Secureworks Taegis XDR Release Notes

March 5, 2026

Thu, 05 Mar 2026 00:00:00

Fixes

Error Opening Entity from Detection: Fixed an issue where opening an endpoint entity from a detection in a new tab could fail with an error.
IDR Identity Insights: Fixed an issue where the Insights tab in Identity details did not show any detections despite there being detection counts for the user shown on the Identity Risk Posture Overview.
Data Source Details Issues: Fixed misaligned Sensor Type values in the Data Source Details drawer and an issue where the drawer unexpectedly closed after clicking a link in the drawer when opened from Log Collector details.. ---

February 26, 2026

Thu, 26 Feb 2026 00:00:00

Features

Detector Explorer: Detector Explorer has left Preview mode and is now generally available to all users. It also includes expanded filtering to help you review detector coverage and identify coverage gaps.
MITRE ATT&CK Detection Table Filter: The Detections table now includes an expanded MITRE ATT&CK filter that uses the full, up-to-date MITRE ATT&CK Enterprise Matrix, allowing you to filter detections in your tenant by tactic and technique.
New Advanced Search Functions: Advanced Search Query Language now supports `tolower` and `toupper` to normalize string field values to lowercase or uppercase when grouping data. This enables case-insensitive aggregations and consistent grouping regardless of the original case of the data. For more information, see Advanced Search.
Threat Score Threat Intelligence Factors: Threat Score now factors threat intelligence from VirusTotal and APIVoid into its calculations. For more information, see Threat Score.

Fixes

Endpoint Agents Summary: The table now sorts correctly by creation date when you sort by the Created At column. ---

February 19, 2026

Thu, 19 Feb 2026 00:00:00

Features

Sophos Linux Sensor: Sophos Linux Sensor is now available for all XDR tenants.
Host Entity Information: Structured Host entities in detections now show the unique Host ID instead of the Sensor ID.

Fixes

Structured Entities: A bug causing Target Entities to be categorized as Source Entities in Identity Authorization events has been fixed. ---

February 12, 2026

Thu, 12 Feb 2026 00:00:00

Features

IDR Credential Compromise Now Named Dark Web Intelligence: The Credential Compromise page of IDR is now named Dark Web Intelligence.
Threat Lineage: The Lineage view in event details has been enhanced with Key Activities and Related Events sub-tabs.

Fixes

Accessing Sophos Central: Fixed an issue where clicking the Sophos Central button on the Endpoint Agents Summary page could fail to open Sophos Central in some environments.

Docs

IDR Integration Guide: The documentation for integrating IDR now includes details on how to complete setup if initial admin consent fails. For more information, see the IDR Integration Guide.
Taegis MDR Proactive Response and Automation Playbooks: The Proactive Response and Automations Playbooks documentation now includes guidance on playbook action pre-authorization for Proactive Response. When using Playbooks with Proactive Response, you can pre-authorize only one response action per action type. For details, see Proactive Response Actions Overview, and Configured Playbooks. ---

February 5, 2026

Thu, 05 Feb 2026 00:00:00

Fixes

Advanced Search History: A bug causing Advanced Search History results not to load when using Safari has been fixed.
Timeline of Related Detections & Events: Events weren't loading in the Timeline of Related Detections & Events if the default timeframe was adjusted. This has been fixed. ---

January 29, 2026

Thu, 29 Jan 2026 00:00:00

Features

Sophos Endpoint Agent for macOS: Sophos Agent for macOS is now available for all XDR tenants, following a period in Early Access. For more information, see the Sophos Agent Introduction.
Threat Intelligence Explorer:
You can now search through all malware, threat reports, and threat groups in the Threat Intelligence Explorer using the search field at the top of the page.
You can now link directly to malware details, threat reports, and threat groups by opening the details in a new tab and copying the URL.
When using the Japanese language UI, threat report titles are now returned in Japanese.

Fixes

Case Filters: Fixed an issue where toggling Show Archived could cause Case table filters such as Priority and Type to stay stuck in a loading state until the page was refreshed.
Cases PDF Exports: Fixed an issue that truncated tables in exported case PDFs when the case’s key findings included a table.

Docs

Carbon Black Response Cloud Integration: Documentation related to Carbon Black Response Cloud integration has been removed as it is no longer supported. ---

January 22, 2026

Thu, 22 Jan 2026 00:00:00

Features

IDR My Environment Now Named Directory: The My Environment page of IDR is now named Directory.

Fixes

eStreamer Configuration: Modifying an eStreamer configuration now works as expected. ---

January 15, 2026

Thu, 15 Jan 2026 00:00:00

Docs

January 8, 2026

Thu, 08 Jan 2026 00:00:00

Features

Check Point Harmony Email Security Integration: Users opted into Preview mode can now access the Check Point Harmony Email integration. For more information, see the Check Point Harmony Email Security Integration Guide.

Docs

Zscaler Integration: The Zscaler Integration Guide now includes details for Cloud NSS integration via HTTP Ingest. ---

December 18, 2025

Thu, 18 Dec 2025 00:00:00

Features

Fixes

Cloud API Integrations: Fixed an issue preventing users with appropriate permissions from editing Cloud API integrations.
Custom Dashboards: Fixed an issue in Custom Dashboards where Detection Volume Trend widgets appeared blank in generated reports. Charts now display correctly and match the dashboard view.

Docs

Microsoft Graph Security API v2 Integration: Documentation for integrating Microsoft Graph Security API v2 is now available. Microsoft Graph Security API v2 supersedes the v1 integration. The v1 integration will be discontinued by April 2026. ---

December 11, 2025

Thu, 11 Dec 2025 00:00:00

Features

December 5, 2025

Fri, 05 Dec 2025 00:00:00

Features

AlienVault OTX Integration Now Legacy: The AlienVault OTX integration is now legacy. New AlienVault OTX integrations can no longer be configured, but existing integrations will continue to function.

Docs

IDR Integration Guide: The integration instructions for initial Taegis™ IDR setup have been updated. ---

December 4, 2025

Thu, 04 Dec 2025 00:00:00

Features

Microsoft Defender Endpoint Agent Health: Microsoft Defender endpoints that report an Inactive asset status now show their Agent Health as Needs Attention instead of Critical in XDR.

Fixes

Executive Summary Report Data Export: The data export for Executive Summary Reports can now be downloaded as designed.
Taegis™ NDR Change Management Report PDF: Taegis™ NDR Change Management Report PDFs now contain the expected contents.
Taegis XDR Trends Report Translation: The translation of the Taegis XDR Trends Report has been improved.
Case Closed Status: Fixed an issue where the case status had to be selected twice when closing a case.
Long Command Line in Detection: Fixed an issue where the page became unresponsive when viewing a detection with a long command line.
Detection Flow Widget: The Tenant and Tenant ID columns in the expanded view of the Detection Flow widget now populate as expected. ---

November 20, 2025

Thu, 20 Nov 2025 00:00:00

Features

Sophos Endpoint Agent: Sophos Agent for macOS is now available for all XDR tenants. For more information, see Sophos Endpoint Agent Introduction.
My Permissions: For users who have opted into Preview mode, press `Ctrl + Alt + P` to open a matrix of your application permissions.

Fixes

My Dashboards Timeframe: An issue with displaying correct detections for a specific timeframe has been resolved.

Docs

Taegis SDK for Python: The documentation for Taegis SDK for Python has been updated with more query examples, information on middlewares and threading, and more.
Identity GraphQL APIs: Documentation for the Identity APIs is now available. ---

November 13, 2025

Thu, 13 Nov 2025 00:00:00

Fixes

Cases Table Date Filters: The dates you select for the Created and Updated filters of the Cases table are now correctly applied in UTC. ---

November 6, 2025

Thu, 06 Nov 2025 00:00:00

Features

Box Integration: Box integration is now available. For more information, see the Box Integration Guide.
IDR VIP Monitoring: For IDR customers opted in to Preview mode, you can now configure VIP users for monitoring in IDR settings. For more information, see VIP Monitoring.

Fixes

Automation Case SMAX Sync Playbook: The case Ticket field now correctly shows the link set by the playbook. ---

October 30, 2025

Thu, 30 Oct 2025 00:00:00

Fixes

Opening Events from Detections: You can once again right-click an event listed on a detection to open it in a new browser tab. ---

October 23, 2025

Thu, 23 Oct 2025 00:00:00

Fixes

Search Results Column Filter: Fixed an issue where filtering search results by the Combined Username column incorrectly limited results to only the Username field, instead of applying the filter across all related fields.
Detection Details Feedback: The feedback buttons for Taegis AI features in detection details now work as expected.

Docs

Sophos Endpoint Agent for Windows Installation: Information to install Sophos Agent for Windows using a Powershell script is now available.
Cisco Secure FTD Integration: The Cisco Secure Firewall Threat Defense Integration Guide has updated instructions for sending logs via syslog to the Taegis™ XDR Collector using Cisco Secure Firewall Device Manager (FDM) or Cisco Secure Firewall Management Center (FMC). ---

October 16, 2025

Thu, 16 Oct 2025 00:00:00

Features

Threat Intelligence Enrichment: The Threat Intelligence (TI) enrichment feature that automatically enriches detections containing file hashes now also uses Sophos Intelix to provide a verdict on the risk level for SHA256 hashes.
Structured Entities and Entity Details: Detection details now show structured entities that are represented as objects that carry rich metadata and properties, rather than traditional string-based entities. Click an entity in detection details to open its Entity Details page with a comprehensive view that helps you understand the significance of the entity and its involvement in security incidents.
Detection Details Threat Intelligence Tab Retired: The former Threat Intelligence tab of detection details has been retired. You can view Threat Intelligence in detections using the Shield icon that shows when information is available, and by opening an Entity Details page.

Fixes

Cases: Fixed an issue where opening a case in a new tab returned an `about:blank#blocked` error. Cases now open correctly from the Cases page.
Proactive Response Actions Playbooks: Fixed an issue that caused playbooks not enabled as Proactive Response Actions to show in the table on the Subscriptions page. Now only playbooks enabled as Proactive Response Actions are listed, with a new Pre-Approved column that indicates the response action is pre-approved to be taken on your behalf.
My Dashboard

Custom Widgets: Fixed an issue where filters were disabled on custom time-series widgets, preventing proper visualization; the filters now work as expected.
Improved Sophos Central link error handling: When opening Sophos Central from the Endpoint Agents Summary an error message now shows if a session cannot be established. ---

October 9, 2025

Thu, 09 Oct 2025 00:00:00

Features

Taegis Terminology Updates: The following terminology changes have been made throughout XDR. For more information, see Taegis Terminology Updates.
Alerts will be renamed Detections
Investigations will be renamed Cases
Automatic Investigations will be renamed Automatic Cases
Threat Intelligence Explorer: The Threat Intelligence Explorer has left Preview mode and is now generally available to all users.
Agent Trends Report Now Available: The Agent Trends Report, which provides an overview of changes to endpoint agent values over time, is now generally available.
Sophos Endpoint Agent Live Response: Live Response is now available, allowing you to connect directly to Sophos Endpoint Agent devices to examine and remediate potential security issues from XDR.
Sophos Endpoint Agent for Linux: Sophos Agent for Linux is now available for all XDR tenants, following a period in Early Access. For more information, see the Sophos Agent Introduction.
Process Lineage Enhancements: The Lineage feature in process event details has been enhanced to integrate contextual detection information directly in the graph. Process nodes are now highlighted if there are associated detections and show the count below the node.
Process Tree Retired: Process trees will be retired on November 13, 2025. You should migrate any workflows from process trees to the enhanced capabilities of process lineage.

Fixes

Custom Widgets: We fixed an issue impacting custom dashboard widgets that use the Sum aggregation function.

Docs

Custom Parser Schema: New supported schemas that can be used with Custom Parsers are now documented: Agent Detection, APIcall, Script Block, Taegis Endpoint Agent Detection, and Windows RPC. ---

September 29, 2025

Mon, 29 Sep 2025 00:00:00

Features

Taegis Terminology Updates: For users opted in to Preview mode, the following terminology changes will be made in XDR with an anticipated date of September 29, 2025. For more information, see Taegis Terminology Updates.
Alerts will be renamed Detections
Investigations will be renamed Cases
Automatic Investigations will be renamed Automatic Cases - Sophos Endpoint Agent

Live Response: Live Response configuration settings in Sophos Central have moved from General Settings to Policies. For more information, see Live Response.
IDR Settings: The IDR settings now include a new Dark Web Monitoring tab, dedicated for selecting credential‑monitoring domains. For more information, see Dark Web Monitoring.

Fixes

Data Sources: When deleting multiple data sources, the delete confirmation dialog for a second data source would close immediately after the first deletion, preventing sequential deletions. This has now been fixed.
Custom Widgets: We fixed an issue where detections displayed an incorrect severity rating in custom widgets. ---

September 18, 2025

Thu, 18 Sep 2025 00:00:00

Features

Fixes

September 11, 2025

Thu, 11 Sep 2025 00:00:00

Features

Threat Intelligence Browser: For users opted in to Preview mode, the new Threat Intelligence Browser gives you direct access to Sophos Counter Threat Unit (CTU) intelligence, including malware analysis, threat group profiles, and daily threat reports.
AWS S3 Server Access Logs Integration: XDR can now ingest and normalize AWS S3 Server Access Logs.

Fixes

Security Posture Dashboard: Fixed an issue where the Confirmed Security Threats widget on the Security Posture Dashboard included cases closed prior to the selected date range.

Docs

Supported Integrations: Our new Supported Integrations page features a table of all third-party sources from which XDR can obtain data. You can filter by category or use the search bar to find the integration guide for your data sources. ---

September 4, 2025

Thu, 04 Sep 2025 00:00:00

Features

Detection Suppression Rules: Query language-based creation of detection suppression rules has moved out of Preview and is now generally available.
Enterprise SSO Domain Verification: Enterprise SSO domain verification has moved out of Preview and is now generally available.
Datasource Assets API: Datasource Assets API v1 queries will be deprecated on February 3, 2026. The v2 API offers improved performance plus filtering and pagination, especially for large datasets. For more information, see the Datasource Assets API documentation.

Fixes

Scheduled Reports: Fixed an issue where selecting the Run Now action on scheduled reports resulted in an error and did not execute the report.
Automations

Endpoint Tagging

Multi Playbook: Fixed an issue for the Endpoint Tagging
Multi playbook that caused scheduled playbook instances to fail. The playbook now runs correctly.

Docs

Secureworks® Taegis™ MDR Plus: The Secureworks® Taegis™ MDR Plus Service Description document has been updated. The changes are summarized as follows:
The Custom Use Case section now includes expanded scope details and newly identified out-of-scope items.
The Named Product Support Engineer section has been removed and replaced with information about the assigned Technical Account Manager (TAM) provided to Secureworks® Taegis™ MDR Plus customers. ---

September 3, 2025

Wed, 03 Sep 2025 00:00:00

Features

Sophos Endpoint Agent: Sophos Agent for Windows and Linux is now available for all XDR tenants. For more information, see Sophos Endpoint Agent Introduction. ---

August 28, 2025

Thu, 28 Aug 2025 00:00:00

Features

Endpoint Agents Archived Status: The Endpoint Agents Summary table now includes an optional Archived Status column, to correspond with the matching filter.
Process Events: The Process Events details page now includes direct links to related script block events, in addition to netflow, thread injection, and persistence events.
Entity Graph: You can now clear all selected entities from an entity graph.
Enterprise SSO Domain Verification: Tenant Admins opted in to Preview mode can now register, verify, and manage email domains to be used in Single Sign-On (SSO) configurations.

Fixes

Advanced Search Performance: After observing decreased performance at certain times of day, advanced search now behaves consistently.
Case Comments: Mentions in a case comment now work even with trailing punctuation (for example, `@secureworks!`).

Docs

AWS Integration Guides: The integration guides for AWS ALB, AWS VPC, AWS WAF, and AWS Cloudtrail have been updated with lambda instructions. ---

August 21, 2025

Thu, 21 Aug 2025 00:00:00

Features

Recent Playbook Executions in Endpoint Details: Endpoint details now include an Execution History section that shows recent playbook executions for the endpoint.

Fixes

Taegis Endpoint Agent Uninstall Tokens: Taegis Endpoint Agent host-specific uninstall tokens now display as intended.
MDR Dashboard Mean Response Times Widget: The Resolution time in the Mean Response Times widget on the MDR dashboard showed an incorrect value for some customers for July. This has been fixed.

Docs

Sophos Endpoint Agent: Documentation for Sophos Endpoint Agent for Linux is now available. Sophos Agent for Linux is currently available by invitation only to select customers as part of an early access program. ---

August 14, 2025

Thu, 14 Aug 2025 00:00:00

Features

Enhancements to Endpoint Agents Summary Table: A new Telemetry Received field has been added to agent details. This changes the Endpoint Agents Summary table in the following ways:
A new Telemetry Received filter replaces the previous Agent Status Options filter.
A new Archived Status filter allows you to filter by archived status.
A new Telemetry Received column replaces the previous Last Active column.
By default, the table now shows only non-archived endpoints that have sent telemetry in the last 30 days.
If you adjust the filters, a Reset to Default filter chip appears above the table to quickly return to the default view.

Fixes

MDR Dashboard: Fixed an issue where values in MDR dashboard widgets were multiplied twice. Values now display correctly.
Auto Cases: Fixed an issue where the Case Template dropdown in the rule builder did not show all available templates; it now displays the full list.
Custom Roles: Fixed an error that prevented the Advanced Search page from loading for users with custom roles lacking specific permissions.
Automations

SentinelOne Connector: Fixed an issue that prevented saving changes after modifying Connection Authentication settings in the SentinelOne connector.
Custom Parsers: The table view now displays all normalized fields.

Docs

Red Cloak™ Endpoint Agent: The Red Cloak Endpoint Agent End of Support document has been updated with a revised timeline. ---

August 7, 2025

Thu, 07 Aug 2025 00:00:00

Fixes

Isolate Host Action: Users no longer receive a save error when adding host isolation activities to a playbook.
Japanese Robocall: The Japanese script used in our robocalls has been rewritten based on customer feedback.

Docs

Remove Service Principals: A new document on Removing Service Principals for Discontinued Integrations is now available. ---

August 1, 2025

Fri, 01 Aug 2025 00:00:00

Docs

Agent Migrator Script Updates: The PowerShell Agent Migrator script that aids in the migration from Red Cloak Endpoint Agent to Taegis Endpoint Agent has been updated to version 2.6.
Event Search Rate Limits: Updated information on rate limiting for event searches is now available. ---

July 31, 2025

Thu, 31 Jul 2025 00:00:00

Features

Process Event Lineage Now Available: Process event details now include a Lineage tab that displays a visual, interactive view of the process tree.

Fixes

IDR Dormant Accounts and Admins Details: The details for Dormant Accounts and Dormant Admins findings in IDR now exclude deleted users, displaying only active accounts that are dormant. ---

July 28, 2025

Mon, 28 Jul 2025 00:00:00

Features

Taegis AI Features Now Available: The following generative AI features have left Preview mode and are generally available.
Taegis AI for Search turns your natural language query into Advanced Search Query Language.
detection Analysis provides easy-to-understand summaries and context for detections.
Detection Logic Explanation summarizes the detection logic behind Taegis Watchlist detections.
Command Line Explanation translates complex command lines and Scriptblocks into clear, readable language.
Manage API Credentials: The ability to create and manage API credentials is now generally available in the XDR UI to all users.

Fixes

Playbook Templates: Resolved an issue where the activity selection was not shown on playbook templates requiring multiple activities and connectors. ---

July 17, 2025

Thu, 17 Jul 2025 00:00:00

Features

Case Timeline: The Case Timeline time range now defaults to 30 days before the case was created, and 30 days after the last case update. This aims to give you adequate case data even for older cases.
Identity Timestamps: Timestamps throughout the Identity section of XDR now include relative times (e.g. 3 hours ago, 7 days ago, etc.) so you can better understand when activity occurred.

Fixes

Playbook Templates Filters: Resolved an issue where filtering playbooks by creation date in list view did not display the latest playbooks on the first page as expected.
Credential Compromise: Several fixes have been made throughout the Credential Compromise page of Identity, including exporting data from the summary table and corrected metrics for active breaches

Docs

AWS Lifecycle Policy Management: Documentation for AWS Lifecycle Policy Management is now available. It includes guidance on S3 object tagging and configuring S3 lifecycle policies to optimize storage costs. ---

July 10, 2025

Thu, 10 Jul 2025 00:00:00

Features

Deprecated Playbooks and Connectors Widget: Automations Overview now contains a new widget that lists all deprecated playbooks and connectors that are still in use in your tenant.
Evaluation Mode Settings: Tenant Admins can now enable Evaluation Mode at the direction of support to activate advanced threat detection rules that are currently being tested and refined.
Install On-Premises Data Collectors on Nutanix Prism: On-Premises Data Collectors and HA On-Premises Data Collectors can now be installed on Nutanix environments.
Manage API Credentials: Users opted in to Preview mode can now create and manage API credentials in the XDR UI.

Docs

Sophos Endpoint Agent: Documentation for Sophos Endpoint Agent is now available. This feature is currently available by invitation only to select customers as part of an early access program. ---

July 3, 2025

Thu, 03 Jul 2025 00:00:00

Features

Mimecast Integration: Mimecast integration now uses the updated API 2.0 method for improved ingestion efficiency.
Automations Connector Library Filters: In the Automations Connector Library, you can apply filters based on various criteria.
Automations Overview: You can now use filters in the Latest Updates widget.

Fixes

Advanced Search: Event queries filtered by schema now return accurate results. ---

June 26, 2025

Thu, 26 Jun 2025 00:00:00

Features

IDR My Environment: On the My Environment page, the section formerly known as Users has been renamed Identities.
Open Findings in a New Tab: Findings Details pages can now be opened in new tabs.
Endpoint Agents Summary Table: Some enhancements have been made to the Endpoint Agents Summary table:
New `Username` filter
New optional table columns, including `Health`, `Sensor Version`, `Users`, and `Created At`.
The Health column replaces the Status column on exported CSV files.

Docs

Oracle Cloud: The Oracle Cloud doc has been updated with additional information for federated users. ---

June 18, 2025

Wed, 18 Jun 2025 00:00:00

Features

Enhanced NDR Device Health and Performance Monitoring: NDR Device details in XDR have been enhanced with the following additional information:
The Health tab provides information on the outcome of health checks performed on the device.
The Charts tab displays visualizations of device performance.
Automations Configured Connections Filters: You can now search for configured connections by name and filter the Description and Tags columns.

Fixes

Notification Configurations: The Notification Configurations page displays only for tenants with relevant services as designed. ---

June 12, 2025

Thu, 12 Jun 2025 00:00:00

Features

Automations Playbook Template Filters: Filters are available for Automations Playbook templates with various criteria.
Add Taegis™ NDR Bypass: A new Bypass tab in NDR Device details allows you to configure firewall rules that instruct the NDR Device to bypass the inspection engine for specified network traffic.

Fixes

Case Summary Report: The Case Overview funnel in the Case Summary Report now presents data correctly.

Docs

Taegis™ NDR Hyper-V Deployment: Documentation for deploying an NDR Device on Hyper-V is now available.
Azure Storage Account: The process in the Microsoft Azure Storage Account Integration Guide has been updated. ---

June 5, 2025

Thu, 05 Jun 2025 00:00:00

Fixes

Export Case Agents: The Export All button on the Case Evidence tab's Agents table now only exports agents related to the case as expected. ---

May 29, 2025

Thu, 29 May 2025 00:00:00

Features

Endpoint Agents Summary Table: The Connection Status filter has been removed from the Endpoint Agents Summary table. Use the Agent Status Options filters instead.
Automations Overview: The Automations Overview dashboard has left Preview mode and is now generally available.
{{ text_variables.shortProdIDR}} My Environment User Tables: A new table filter is available for the My Environment table to quickly find users who leverage selected MFA methods.

Fixes

Space Characters in Passwords: The system now properly supports internal space characters in user passwords as intended.

Docs

Multi-Tenancy: Documentation for multi-tenancy in Secureworks® Taegis™ XDR is now available, detailing its features and usage. ---

May 22, 2025

Thu, 22 May 2025 00:00:00

Fixes

MITRE ATT&CK Charts in Custom Reports: Custom reports that include a pie chart using MITRE ATT&CK data no longer display an Unknown category and include a note explaining that the totals are counts of techniques and not counts of detections.
Download Detection Flow Widget: The Detection Flow widget on Custom Dashboards now successfully downloads as PNG from the expanded view.
Time Frame on Custom Dashboards: Users with Viewer access to a Custom Dashboard can now adjust the time frame used for the widgets.

Docs

Identity Settings: Information on managing Cloud API integrations used by Taegis™ IDR is now available. ---

May 15, 2025

Thu, 15 May 2025 00:00:00

Features

Automations Overview: For users opted in to Preview mode, the new Automations Overview dashboard provides at-a-glance information about your use of Automations in your tenant and a changelog of playbook templates and connectors.
Resize Cases Comments: The Cases comments panel is now resizable; drag the handle to adjust.

Fixes

Identity User Actions: The faulty Actions drop-down menu on the Identity Details page has been fixed. ---

May 8, 2025

Thu, 08 May 2025 00:00:00

Features

Notification Rule for {{ text_variables.shortProdIDR}} Findings: A new notification rule that sends a notification for Critical and High {{ text_variables.shortProdIDR}} findings is now available in Notification Configurations.
Improvements to {{ text_variables.shortProdIDR}} My Environment Tables: The filtering and faceting experience within the My Environment Users, Devices, Groups, and Apps tables has been improved.
Salesforce Real-Time Event Monitoring Integration: XDR can now ingest and normalize logs from Salesforce Real-Time Event Monitoring.

Fixes

Playbooks with Duplicate Activities: When configuring certain playbooks, duplicate activities were present in the Configure Activities section, resulting in an error. This has been fixed.
{{ text_variables.shortProdMXDR}} Dashboard in Japanese Language UI: Several display issues with the dashboard in the Japanese Language UI have been resolved.
{{ text_variables.shortProdIDR}} Findings Display Issue: The New label in finding details now displays correctly in dark mode.
{{ text_variables.shortProdIDR}} Identity Response Actions: Identity action menus were not loading response actions. This has been fixed.

Docs

Top Data Sources by Volume: Additional clarifying information has been added to the documentation for the Top Data Sources by Volume table. ---

May 1, 2025

Thu, 01 May 2025 00:00:00

Features

My Dashboards: Users can now use Quick Links in My Dashboards to select pre-defined time windows beyond 30 days, including Last Month, Last Quarter, and Last Year views.
Automatic Cases: Users can now view Rule Logs to view actions taken on a detection by Automatic Cases, as well as any adjustments to rules and templates.

Fixes

{{ text_variables.shortPlatform}} XDR Trends Report: The Taegis XDR Trends Report now features accurate Japanese localization.

Docs

Playbook Schedules: Documentation for Automation Playbook Schedules is now available. ---

April 24, 2025

Thu, 24 Apr 2025 00:00:00

Docs

The Taegis MDR Service Description now includes the service description for Japan as well. Use the tabs to view the relevant documentation. ---

April 17, 2025

Thu, 17 Apr 2025 00:00:00

Features

Azure Government for Microsoft Defender Integration: For users opted in to Preview mode, Microsoft Defender integrations now support Azure Government tenants.
IDR Identity Details Credential Compromise Tab: Identity Details pages in IDR now have a Credential Compromise tab containing any breach data to which the identity is linked.
Notification Rules Supported Contact Methods: The Notification Rules table has been updated to display the contact methods supported by each rule.

Fixes

Detection Status Options: The correct detection status options now display when closing a case. ---

April 10, 2025

Thu, 10 Apr 2025 00:00:00

Features

IDR My Environment Apps: Applications listed in the Apps view now have a selectable details page containing related findings and more.
Escalation Configurations: Points of Contact have been migrated from their previous tab to Escalation Policies.

Fixes

Custom Dashboards Create Report Error: Users opted in to Preview mode can now create reports from Custom Dashboards as intended.

Docs

Escalation Configurations: Documentation has been updated to reflect changes to Escalation Policies and the removal of the Points of Contact tab. ---

April 3, 2025

Thu, 03 Apr 2025 00:00:00

Features

Data Ingress Chart: The Data Collector details summary now displays a Data Ingress graph within the Health section. This provides a recent history of the collector’s data flow over time.

Fixes

Persistent Detections Filters: The Detections table filters for “Include Options” (Custom Detections, Triaged Detections, OT Detections) now persist even after navigating away from the page.
Identity Risk Posture Findings: Selecting a plot point within the Risk Posture Score Over Time graph produces a full list of findings that were either created, re-opened, dismissed, or resolved on the selected date, as intended.
Escalation Procedures: We have removed the field called Criteria/Attributes from the Escalation Procedures edit panel, as this is a read-only text box.
Completed Reports: The View All Completed Reports table again displays matching reports as intended.
HTML Tags in Comments: Basic HTML tags (such as `
`, ``, `

March 27, 2025

Thu, 27 Mar 2025 00:00:00
Features

Taegis™ IDR Enhancements:

IDR users opted in to Preview mode can now integrate more than one Microsoft Entra ID Tenant from Identity Settings.

The Findings Table has been improved with additional filtering options:

Filter by First Seen and Last Seen time

Filter by the Reference Type of the finding (User, Application, Group, Tenant, or Device) to quickly view which objects have a related finding

You can now view which groups a user is part of from Identity Details pages.

Microsoft Entra Activity Reports Integration: Additional log types are now supported for ingestion and normalization.

Docs

Using the Countermeasures API: Additional information on the types of lists available via the API has been added.

Getting Started with the Endpoint Assets API: Examples for using the Endpoint Assets API are now available.

Taegis MDR Service Name Update: Documentation has been updated to reflect the service name change from Managed XDR to Taegis MDR. ---

March 20, 2025

Thu, 20 Mar 2025 00:00:00
Features

Office 365 Management API Integration Update: The Office 365 Management API Integration Guide has been updated to reflect a change in the setup process{: target="_blank"}.

Fixes

Explore Related Entities: In certain instances, the Explore Related Entities button when viewing detections would not produce the intended results. This has been fixed.

Identity Term Optimizations: Identity is renaming a few fields for clarity:

Breached Sources → Sources

Plaintext breaches → Plaintext Passwords

Hash breaches → Hashed Passwords

Breached Email Accounts → Emails

High Profile Account Leaks → Admin Emails

Unique Passwords Breached → Unique Passwords

Docs

NDR Virtual Device Requirements: NDR Virtual Device requirements have been updated.

Microsoft Defender ATP Integration Guide Update: The integration guide for Microsoft Defender ATP has been updated. ---

March 14, 2025

Fri, 14 Mar 2025 00:00:00
Features

Endpoint Agents Status Labels: We've made some improvements to several columns and filters on the Endpoint Agents Summary table:

The Last Seen column has been replaced by the Last Active column. If data was seen in the last 15 minutes, then it is considered active Now; if it was over 15 minutes ago, this field displays how long ago XDR received data (e.g. 3 days ago).

On the Agent Status Options table filter, instead of filtering by all agents seen in the last 30 days, you can now select Show Active Agents (those seen in the last 15 minutes) and Show Healthy Agents (those seen in the last 15 minutes to 30 days).

The Connection Status column, related to Taegis Endpoint Agents, has been removed from the summary table. It is still available in the summary table filters and the agent details page, however. ---

March 13, 2025

Thu, 13 Mar 2025 00:00:00
Features

Custom Dashboard Widgets: Users opted in to Preview mode can now create custom widgets for My Dashboards. Create visualizations of the data that matters to you, and add to as many of your custom dashboards as you wish.

Share Custom Dashboards: Users opted in to Preview mode can now share their custom dashboards with other tenant users. This includes the custom widgets mentioned above, provided the other user is also opted in to Preview mode.

Fixes

Maintenance Windows: Error messages around overlapping maintenance windows for data collectors have been fixed. ---

March 6, 2025

Thu, 06 Mar 2025 00:00:00
Features

Taegis Detection Browser: Users opted in to Preview mode can now access Detection Browser to view the full list of Taegis detectors and countermeasures and details of each.

EDR OCSF Integration: Users opted in to Preview mode can now configure an integration of an EDR product using the industry-standard OCSF data format.

Enhanced Email Notifications: Data Collector and Data Source Health email notifications were recently enhanced with additional details and troubleshooting information.

Fixes

Endpoint Agent Coverage Widget: The label coloring for the widget on the Security Posture Dashboard in dark mode has been fixed to improve readability.

Identity Details Activity Log: Event data found on the Activity Log tab of Identity Details was not loading in certain circumstances. This has been fixed.

Case Comments Truncated: The use of certain special characters in case comments were causing the comments to be truncated. This has been fixed. ---

February 27, 2025

Thu, 27 Feb 2025 00:00:00
Fixes

Delete Dashboard Menu Option: The Delete Dashboard option in My Dashboards was missing from the Actions menu. This has been fixed.

Advanced Search Aggregate Function: An issue with the aggregate function not displaying results of event searches in Advanced Search has been fixed. ---

February 20, 2025

Thu, 20 Feb 2025 00:00:00
Features

New Custom Dashboard Widgets: For users opted in to Preview mode, there are two new widgets available for use on My Dashboards: Detection Flow and Case Flow.

Fixes

Response Times: The Response Time widget on the MDR Dashboard was incorrectly calculating units as minutes instead of seconds. This has been fixed. ---

February 13, 2025

Thu, 13 Feb 2025 00:00:00
Features

Identity Posture Check Preferences: Identity Settings now features a Posture Check Preferences tab, where you can view and configure posture checks within IDR.

Bulk Uninstall Taegis Endpoint Agents in XDR: The process to bulk uninstall Taegis Endpoint Agents in XDR has been enhanced with an added confirmation step to ensure the action is intentional.

IDR Group Details: Groups in Taegis™ IDR now feature a Details page with group metadata and associated identities.

Fixes

Error Adding User to Scheduled Report: An error displayed when attempting to add a new user to receive a scheduled report. This has been fixed.

Creating Playbook from Older Template Version: Selecting an older version of a playbook template to create a new instance now works without error.

Taegis MDR Dashboard Response Time Values: Response time values on the Taegis MDR Dashboard were displaying incorrect units. This has been fixed.

Docs

Taegis Documentation Site Migration: Please update your bookmarks to https://docs.taegis.secureworks.com for our new Taegis Documentation site.

Taegis Endpoint Agent Known Issues Updated: Information on warning messages regarding AMSI and code integrity for Windows agents has been added to Known Issues. ---

February 6, 2025

Thu, 06 Feb 2025 00:00:00
Features

Export IDR Credential Compromise Data: Exporting data is now available from the Identity Credential Compromise page.

Fixes

Identity Finding Status Update: Altered Finding statuses would not consistently update when changing the Finding status until the page was refreshed. This has been fixed.

Docs

Taegis Documentation Site Migration: The Taegis Documentation site will be migrating to a new site and URL next week. A site-wide redirect will be in place on the original site to avoid any access issues. The new site comes with several enhancements, such as better search, tagging, appearance, usability, and mobile support. Please update your bookmarks to https://docs.taegis.secureworks.com.

Microsoft Defender ATP Integration Guide Update: The Microsoft Defender ATP Integration Guide has been updated.

Self-Service Demo Tenant Documentation: A guide for launching an XDR trial tenant is now available for prospect customers. ---

January 30, 2025

Thu, 30 Jan 2025 00:00:00
Features

IDR Device Details: Devices in Taegis™ IDR now feature a Details page, allowing users to view further information for devices recorded in My Environment.

Taegis Endpoint Agent Group Policy Updates: The Taegis Endpoint Agent Group Policy page now provides a filterable table view of configured group policies.

Fixes

Login Session Timeouts: The MFA login process timeout has been increased to allow a longer period of time before email MFA codes expire before using them.

Scheduled Report Creation in Japanese Language UI: Scheduled Custom Reports created in Japanese Language UI now work as expected.

Custom Automations Connector Builder: Edits to an existing custom Automations Connector can now be published as expected.

Escalation Policy Documentation Link: A broken link to the documentation for Escalation Policies has now been fixed. ---

January 23, 2025

Thu, 23 Jan 2025 00:00:00
Features

Identity Credential Compromise: The new Identity Credential Compromise page lets you explore all historical breach data that we have collected based on your Configured Domains.

Fixes

Group Policy Sorting: Sorting the group summary table by group policy name now works as intended. ---

January 16, 2025

Thu, 16 Jan 2025 00:00:00
Features

New Custom Connector Authentication Option: Azure Client Certificate is now an option for authentication when creating a custom connector.

Fixes

XDR Trends Report Critical Detection Count: The XDR Trends Report now displays the correct count of critical detections in the Critical and High Detection Volume: Period Comparison chart.

Playbook Execution Chart Timestamps: Timestamps on the Playbook Executions chart in configured playbooks did not align with the correct execution count when viewing certain time periods. This has been fixed. ---

January 9, 2025

Thu, 09 Jan 2025 00:00:00
Features

Escalation Policies: More than three contacts can now be defined for Taegis MDR SOC Escalation Calls. Existing Points of Contact have been migrated to the new default escalation policy. Customers can view and compare these policies by navigating to Tenant Settings > Notification Configurations from the Taegis Menu.

Identity Findings History: Findings now show a History tab containing Finding activity such as the new Closed By and Closed At fields tracking when a finding was closed and by whom.

Fixes

Playbook Editing: Under certain conditions, playbook drop-down selections could not be made. This has been fixed.

Detection Triage Dashboard Date Picker: Under certain conditions, the date picker would cause an error on the Detection Triage Dashboard. This has been fixed.

Docs

Agent Migrator Script Updates: The PowerShell Agent Migrator script that aids in the migration from Red Cloak Endpoint Agent to Taegis Endpoint Agent has been updated to version 2.5.

Custom Parser Documentation Refresh: The Custom Parser Documentation has been enhanced with up-to-date instructions, examples, and additional images. ---

December 18, 2024

Wed, 18 Dec 2024 00:00:00
Features

Filter Event Searches by Detections: Both the Advanced Search Query Language and the Advanced Search Builder now allow you to filter event searches based on the presence of detections. Use the syntax `detection.resource_id` to identify events that have triggered detections.

Download PNG of Identity Risk Score: You can now export the Identity Risk Posture Score line graph as a .PNG file.

MITRE ATT&CK Detection Heatmap Widget: For users opted into Preview mode, a new My Dashboard widget is available. The MITRE ATT&CK Detection Heatmap widget helps identify the most commonly observed MITRE ATT&CK techniques across all detections and allows for quick filtering of detections by technique.

Horizontal Stacked Bar Chart: For users opted into Preview mode, you can now create custom reports using the horizontal stacked bar chart, which is appropriate for observing a part-to-whole trend of multiple series of data.

Snowflake Integration: For users opted into Preview mode, XDR can now ingest and normalize logs from Snowflake.

IDR Increases Monitored Primary Domains: The number of primary domains to be monitored with IDR has increased from 5 to 20.

Fixes

Case Summary Funnel Chart: The funnel chart on the Case Summary Report is displaying consistently again. ---

December 12, 2024

Thu, 12 Dec 2024 00:00:00
Features

Identity Risk Posture Score Page Column Preferences: Column preferences made on the Identity Risk Posture Score page now save to your user preferences and persist across sessions.

Export Users from Identity My Environment: You can now export the full or filtered list of users from the Identity My Environment page to CSV.

Automation Actions Design Improvements: The Automation Actions page has been improved with tabs for configured actions and available actions, which can now be filtered by category.

Playbook Execution Task Details: Each detailed view of a task within a Playbook Execution now contains Input and Output tabs that display the JSON values from that specific task.

Fixes

Python SDK Authorization: Authorization to the Python SDK now works as expected.

Missing Horizontal Scrollbar: The horizontal scrollbar now appears as designed in Advanced Search results and the Related Detections and Events Timeline view.

Case Comment Mentions: Case comment @mentions default to the appropriate @secureworks value for customers.

Endpoint Agent Groups Table Sort: The column sort function now works correctly on the Agent Groups Summary page.

Cases Error Message: A _No Cases Found_ error message persisted even when filters were updated and matching cases were found. This has been fixed.

Cloud API Export: The Status column in CSV exports of the Cloud API page now populates with accurate data.

Endpoint Agents Downloads: Intermittent access issues to the Endpoint Agents Downloads page using Firefox have been fixed.

Custom Date Picker Time: The custom date picker throughout XDR now uses the time at which the end date selection is made rather than the time the page was last refreshed in the browser. ---

December 5, 2024

Thu, 05 Dec 2024 00:00:00
Features

Affected Entities Detection Section: Detection details now include an Affected Entities section displaying Threat & At-Risk Entities and Affected Agents.

Detection Details Header: Detections now have a persistent Detection Details Header containing a dropdown to select detection Status and fields that display the Status Reason and any cases the detection is added to.

Filtering and Sorting in Case Events Tab: Events added to a case can now be filtered and sorted within certain columns for detailed triage.

Fixes

Japanese Language Advanced Search Content: The descriptions of Advanced Search terms in the Japanese version of Secureworks® Taegis™ XDR have been edited to align with the detail provided in the English version.

Taegis Endpoint Agent CSV Export: CSV exports of Taegis Endpoint Agent Groups would display incorrect Agent Release Channel details.

Docs

API Device Authorization: API documentation for Device Authorization is now available. ---

November 27, 2024

Wed, 27 Nov 2024 00:00:00
Docs

Oracle Cloud Infrastructure Integration Guide: The Oracle Cloud Infrastructure integration guide is now available.

Vulnerabilities Support for Tenable Ingest: Vulnerabilities has been updated to include information regarding VDR's Tenable ingest capability. ---

November 21, 2024

Thu, 21 Nov 2024 00:00:00
Features

Identity Risk Posture Score Page: A new Identity Risk Posture Score Page is now available for IDR customers to track how the Posture Score is changing over time.

Identity Details Insights Tab: IDR customers can now adjust the period used in the Open Detections section of the Identity Details Insights tab.

Integrate Cisco Umbrella via a Cisco-Managed S3 Bucket: Cisco Umbrella can now be integrated with XDR via a Cisco-managed S3 bucket in addition to the current transport path that leverages a customer-managed S3 bucket.

Fixes

Schema Fields Not Displaying: Schema fields now correctly display in the Advanced Search Schema Browser.

Docs

Log In to XDR: Log In to XDR has been updated to support the authentication provider migration. The legacy content is still available for users who have not yet been invited to migrate their account.

Power BI for XDR: The Power BI template and instructions have been updated to assist users with advanced reporting capabilities.

API Credential Creation Scripts: The API authentication documentation has been updated with new scripts to assist users in API credential creation.

Taegis Endpoint Agent Changelog Presentation: Taegis Endpoint Agent Changelog has been improved by moving any interim pre-Production Stable release versions to a collapsed section at the end of the associated Production Stable note. Click to expand those sections to view the previous versions that were not promoted to Production Stable. ---

November 14, 2024

Thu, 14 Nov 2024 00:00:00
Features

Authentication Provider Migration: A new login screen has been introduced this week in Taegis as part of the upcoming transition to a new authentication provider that affects all tenants. To accommodate this transition, specific actions are required for every tenant depending on the tenant's authentication type. These actions must be completed after November 11th and before the end of December.

If you have Single Sign On (SSO), a Tenant Administrator needs to make a change on behalf of the entire tenant.

If you use a Password paired with Multi-Factor Authentication (MFA), each tenant user will need to re-verify their credentials{: target="_blank"} using the new system.

Identity Findings Table Enhancements: The Identity Findings page can now be filtered by Display Name and Finding Title. Additionally, the Identity Findings table now includes more columns such as Last Seen and Last Modified.

Identity My Environment Sort: A new sort option is available for the My Environment table to quickly find identities with the oldest password age.

Add an Integration Enhancements: The Add an Integration page now displays available integrations as Optimized or Custom.

Fixes

Case Summary Funnel: When new data is retrieved for the Case Summary Funnel, the vertical funnel values did not change. This has been fixed.

Deprecated Playbooks: A warning banner now displays if a user is using a deprecated playbook version.

Case Code Blocks: The code blocks were not rendering properly within Case Summaries. This has been fixed.

Contact Phone Number Extensions: Phone numbers with extensions were not displaying correctly. This has been fixed. ---

November 8, 2024

Fri, 08 Nov 2024 00:00:00
Features

Playbook Template Deprecation: You can now deprecate playbook templates and playbook template versions when there is a newer alternative available. For more information, see Deprecate a Playbook Template and Deprecate a Playbook Template Version.

Event Preview from Identity Details: When viewing the Activity Log on an Identity Details page, you can now preview the events in a side panel before opening them in a new tab. For more information, see Activity Log Tab.

Bring Your Own Threat Intelligence: The Bring Your Own Threat Intelligence (BYOTI) Detector and related integrations have left Preview mode and are now generally available. See the links below for more information:

BYOTI Detector

AlienVault OTX

Anomali

TAXII 2.1

Fixes

Automatic Cases: The per-page count on the Automatic Cases table now persists as expected. ---

October 31, 2024

Thu, 31 Oct 2024 00:00:00
Features

New AI Features in Preview: Secureworks® Taegis™ XDR now features generative AI capabilities in Detections for users opted in to Preview mode. For more information, see Detection Details.

Detection Analysis: AI Detection Analysis provides easy-to-understand summaries and context for detections, helping analysts quickly investigate and respond.

Detection Logic Explanation: The Detection Logic Explainer summarizes the detection logic behind Taegis Watchlist detections.

Command Line and Scriptblock Explanation: This feature translates complex command lines and Scriptblocks into clear, readable language, simplifying analysis.

NDR Device Maintenance Windows: For customers with an NDR Device, the ability to configure a maintenance window that fits your schedule is now generally available. For more information, see NDR Device Maintenance Tab.

Fixes

Taegis Agent File Analysis Settings: Taegis Endpoint Agent File Analysis policy settings now display correctly in the Groups table view. ---

October 24, 2024

Thu, 24 Oct 2024 00:00:00
Features

Customize Taegis Actions Name and Description: You can now customize the name and description when adding or editing Taegis Actions. For more information, see Taegis Actions.

Export Entities from Cases: You can now generate a CSV export of all or selected entities from the Entities sub-tab of a case's Evidence tab. For more information, see Case Evidence.

Export Identity Findings: IDR customers can now generate a CSV export of findings from the Identity Findings table. For more information, see Identity Findings Table.

Update Cloud API Integration Parameters: Additional Cloud API integrations now support certain parameter updates via XDR. For more information, see Cloud API Integration Update Overview.

Fixes

Event Volume by Type Formatting: The Event Volume by Type in the Case Summary Report is now correctly formatted as a distinct count rather than as bytes.

Delete Cloud API Integration: The Cloud API Integrations table now displays the Delete action only for authorized user roles.

Custom Rule Circuit Breaker: The circuit breaker message now displays as intended for Custom Rules that exceed the maximum amount of created detections. ---

October 17, 2024

Thu, 17 Oct 2024 00:00:00
Features

NDR Device Maintenance Windows: For customers with an NDR Device who have opted in to Preview mode, you can now configure a maintenance window that fits your schedule for future maintenance. For more information, see NDR Device Maintenance Tab.

Identity Enhancements: For IDR customers, we’ve made enhancements to several Identity pages, including tooltips around the My Environment page and clearer labels on Identity Details graphs. See Identity documentation for more information.

Taegis Endpoint Agent Group Policies and Tamper Protection: Group Policies and the Tamper Protection setting have left Preview mode and are now generally available. For more information on this enhancement, see the Enhancements to Taegis Endpoint Agent Groups and Settings{: target="_blank"} Knowledge Base article.

Automations Enhancements: The following features and enhancements to Automations are now available:

Use CEL Explorer to test CEL expressions against a specific type of input so that you can see the outcome of the expression for use in your configurations. For more information, see CEL Explorer.

The Playbook Template Steps view was enhanced with a refreshed design that supports drilling into steps to view details and code subsets, tooltips to view conditions, and the ability to expand and collapse a code segment with an iteration or branch. For more information, see Template Steps.

Simplified Automation Actions are now generally available to configure response and enrichment actions with just a few clicks. For more information, see Taegis Actions.

Provider Exclusion for Microsoft Graph Security Integration: The Microsoft Graph Security integration has been enhanced with Provider Exclusion, which allows you to choose Providers you wish to exclude from log collection. For more information, see the Microsoft Graph Security Detections Integration Guide.

Fixes

Tagging Secureworks in Comments: Case comments tagging @secureworks now alert the Secureworks team consistently.

Deleting Cloud APIs: Deleting Cloud API integrations has been restricted to Tenant Admins, as intended.

Docs

Elite Threat Hunting: A renewed Elite Threat Hunting Service Description is now available. ---

October 10, 2024

Thu, 10 Oct 2024 00:00:00
Features

Taegis Endpoint Agent Group Policies: Group Policies, now available in Preview mode, consolidate all Taegis Endpoint Agent settings into policies that are assigned to groups. No action is required, as your configuration has been automatically transitioned to group policies that we recommend you review. At initial launch, your current configuration can only be edited in group policies due to the data migration needed for the enhancements. To review or alter your settings, ensure you are in Preview mode, and see Group Policies. For more information on this enhancement, see the Enhancements to Taegis Endpoint Agent Groups and Settings{: target="_blank"} Knowledge Base article.

View CTU Publications from Detections: For users opted into Preview mode, detection details now display a link to Secureworks Counter Threat Unit™ (CTU) publications if the detection is associated with a CTU-published Malware Family or Threat Group. For more information, see Detection CTU Publications.

Access Entity Graph from Detections: You can now access Entity Graph from detection details to explore the entities and relationships associated with the detection. For more information, see Explore a Detection in Detail with Entity Graph.

Symantec Endpoint Protection Integration: XDR can now ingest and normalize logs from Symantec Endpoint Protection. For more information, see the Symantec Endpoint Protection Integration Guide.

Fixes

Case Summary Report Formatting: The Case Overview funnel chart formatting has been updated to prevent issues with displaying larger values.

Docs

Cloudflare Integration Guide Updated: Additional guidance has been added to the Cloudflare Integration Guide to make configuration easier. ---

October 10, 2024

Thu, 10 Oct 2024 00:00:00
Features

New Navigation Experience: We are pleased to announce a new and improved navigation experience in Secureworks® Taegis™ XDR that simplifies navigation and includes a new section on Taegis Solutions for Secureworks customers. The redesigned experience relocates everything from the top menu bar to the Taegis Menu. Now you can find Quick Search, tenant information, core Taegis platform areas, notifications, help, documentation, your profile, and live chat all on the left side of the application. Notable changes include:

The Tenant Display provides information about your tenant, your user role, and the tenant's subscribed services.

For multi-tenant customers, an optimized Switch Tenant experience is available.

The navigation options remain the same, while Automations move above Endpoint Agents, and Reports and Downloads move above Tools.

Two pages move from Tenant Settings: Rules can now be found under detections, and Auto Cases can be found under Cases.

Introducing the Taegis Solutions section for Secureworks customers, containing IDR, NDR, VDR, and Taegis MDR. For more information, see our Navigation documentation. ---

October 3, 2024

Thu, 03 Oct 2024 00:00:00
Features

IDR Detection Enrichment: For IDR customers, detections with applicable identity information are now correlated and enriched with user information collected with the IDR module. For more information, see IDR Findings.

Fixes

Case Hard Refresh: The Case Detections table would show detections inconsistently upon a hard refresh. This has been fixed.

Report Builder Templates: Under certain conditions, the Report Builder would fail to load a template. This has been fixed.

Draft Case Assignment: A case could not be reassigned while the case was in draft status. This has been fixed.

Docs

IDR Integration Guide Updated: Values in the JSON code block for Azure permissions have been updated to make configuration easier. ---

September 27, 2024

Fri, 27 Sep 2024 00:00:00
Features

Automations Improvements: The following improvements have been made to Automations in XDR:

CEL Syntax Helper: A CEL Syntax Helper displays where applicable to provide common CEL expression examples for automation configurations, making it easier to configure filters for playbooks and actions.

Playbook Configuration: Playbooks now only allow configuration of options that are supported by the playbook template, reducing misconfiguration of more complex playbooks. Unsupported options are greyed out and cannot be configured. For more information, see Automations Overview.

Simplified Automation Actions: Users opted in to Preview mode can now configure response and enrichment actions with just a few clicks. Choose from over a dozen currently available actions, with additional actions scheduled to be released every quarter. For more information, see Taegis Actions.

Docs

Google Cloud Platform Integration Guide: The Google Cloud Platform Integration Guide has been updated with additional configuration guidance. ---

September 26, 2024

Thu, 26 Sep 2024 00:00:00
Features

Assign Cases by Email Address: When assigning cases, you can now search for a user by their email address, in addition to by their name. Start typing their email to narrow down the matching list. For more information, see Hand Off a Case.

Fixes

Playbook Execution History: We have made improvements to address issues with playbook execution caching and pagination. ---

September 19, 2024

Thu, 19 Sep 2024 00:00:00
Features

Set Identity as Landing Page in XDR: You can now select the Identity section of XDR as your landing page in User Profile & Settings. For more information, see Customize Your View.

Data Collector Performance Graphs Improved: The resolution of Data Collector Performance graphs has been increased to more clearly display graph details. For more information, see Manage Data Collectors.

Points of Contact Moved from Tenant Profile: The Points of Contact section used for security escalations has been moved from Tenant Profile to a new Notification Configurations page under Tenant Settings. For more information, see Notification Configurations.

Fixes

Netflow Event Addresses Reversed: Inbound Netflow events from endpoint agents now display the correct local and remote addresses.

Playbook Instance Configuration: When editing a playbook instance, the configuration now consistently displays in the Activity Connections section.

Trends Report Case Overview Values: Values in the Case Overview funnel graph of the Trends Report are now consistent with the values in the same graph of the Case Summary Report.

Docs

Getting Started with Taegis Endpoint Agent: A new Getting Started with Taegis Endpoint Agent guide is now available to help you get started with our latest endpoint security solution.

Red Cloak End of Support Customer Notice: The Red Cloak End of Support customer notice is now available with information on our endpoint protection evolution and resources for migration.

Cloud API Integration Update Overview: The Cloud API Integration Update Overview has been updated with additional Cloud API integrations that support certain parameter updates via XDR. ---

September 12th, 2024

Thu, 12 Sep 2024 00:00:00
Fixes

Adding NDR Device HOME_NET Entries: The Add Row button now works correctly when populating NDR Device HOME_NET entries.

Archiving Multiple Cases from Table: The Actions button now includes an option to archive when selecting multiple cases.

Custom Parser Field Values Not Displaying in Search: Custom Parser field values now display when queried in Advanced Search.

Docs

IDR Configuration Documentation and FAQ Updates: The configuration instructions for Taegis™ IDR have been updated for clarity and additional FAQ details have been added. For more information, see IDR Integration Guide and IDR Overview. ---

September 5, 2024

Thu, 05 Sep 2024 00:00:00
Features

Playbook Execution Inputs, Outputs, and Target Resource: You can now view a JSON of the inputs and outputs of a specific playbook execution when drilling down into its details. On the same view, there is now a link to the Target Resource where applicable. For more information, see View Playbook Executions and Failures.

Cloud API Integration Update: The Cloud API Integration Update feature allows you to update select configuration parameters of supported and existing Cloud API Integrations. For example, this feature can be leveraged for certificate updates, private key updates, or for renaming an existing integration. For more information, see Cloud API Integration Update Overview.

Fixes

Case Comments: Improvements to the commenting system in Cases ensure users are correctly notified of any @ mentions.

Column Resizing: In some tables, when new data loaded during infinite scroll, column width preferences were reverting to default. Resized columns now persist.

Items Per Page: The Items per Page preference that you select on tables (i.e., changing from 25 to 100 items per page) now persists even if you navigate away from the page.

Scriptblock Events: Some scriptblock event details were not loading. This has been fixed.

Docs

Agent Migrator Script Updates: The PowerShell Agent Migrator script that aids in the migration from Red Cloak Endpoint Agent to Taegis Endpoint Agent has been updated. For more information, see Install Taegis Endpoint Agent Using PowerShell Script. ---

September 3, 2024

Tue, 03 Sep 2024 00:00:00
Features

Taegis™ IDR is now available: Taegis™ IDR is a software add-on module that helps improve your security posture by continuously monitoring for identity risks and misconfigurations while providing dark web intelligence on compromised credentials. With IDR, you will receive a list of prioritized findings and an Identity Risk Posture rating based on your current exposures within minutes of setup. For more information, start with our Identity Overview and check out this new feature in app by selecting Identity in the navigation menu. ---

August 29, 2024

Thu, 29 Aug 2024 00:00:00
Features

Request to Fetch File for Analysis: From within Detections and Events, you can now request to fetch file information which will populate in the relevant Detection details. For more information, see File Details.

Fixes

Data Sources Table Filters: In some environments, the Data Sources table filters did not filter according to the user's selection. This has been fixed.

Cases Table Column Size Preference: The Cases table column sizes would reset after a refresh when resized. This has been fixed.

Entity Graph Node Details Empty Upon Collapsing Table Drawer: When collapsing the table drawer for a selected node, the entity details appeared empty even after reselecting the node. This has been fixed.

Hostname Link in Entity: When selecting the hostname hyperlink within a host entity, an error would be returned. This has been fixed.

Advanced Search 'Time Ago' Calculation Incorrect: The 'Time Ago' column in Advanced Search was not properly calculating time. This has been fixed.

Docs

XDR Python SDK Proxy Configuration: Documentation detailing proxy configuration for Secureworks® Taegis™ XDR Python SDK is now available. ---

August 22, 2024

Thu, 22 Aug 2024 00:00:00
Features

Microsoft Azure Flow Logs Integration: XDR can now ingest and normalize flow logs from Microsoft Azure Network Watcher. For more information, see the Flow Logs from Microsoft Azure Network Watcher Integration Guide.

Case Table Filters: Two new filters have been added to the Cases summary table: Created and Updated. Use the date/time pickers to set a specific time or a range for matching cases. For more information, see Filter Cases.

Entity Enrichment: The panel that displays entity enrichment data on a case has been improved to better display larger data sets. For more information, see Entities.

Fixes

Deprecated Fields in Advanced Search Builder: Some saved searches that pre-date the Advanced Search Builder enhancements may contain deprecated fields. The Builder now alerts you if a field needs to be replaced. For more information, see Advanced Search Builder.

Docs

Audit Logs Graph: Documentation for the new Audit Logs stacked bar chart is now available. ---

August 15, 2024

Thu, 15 Aug 2024 00:00:00
Features

Trends Report is Now Available: The Trends Report, which displays trending insights on detections, cases, and data usage on demand, is now generally available. See Trends Report for more information.

Palo Alto Prisma Access Integration: XDR can now ingest and normalize data from Palo Alto Prisma Access. For more information, see the Palo Alto Prisma Access Integration Guide.

Fixes

Audit Log Chart Error: If no results are found in an Audit Log search, the chart would display an error. This has been fixed.

Case Filter Error: Searching for specific assignees on the Cases page would sometimes yield no results. This has been fixed.

Docs

Python SDK Query Updates: Updated sample queries are now available on the Python SDK Queries page.

Cases v2 API Updates: Updates are available for the Cases v2 API documentation and the Cases v1 API has been marked as Legacy. ---

August 8, 2024

Thu, 08 Aug 2024 00:00:00
Features

Abnormal Inbound Email Security Integration Added: XDR can now ingest and normalize data from Abnormal Inbound Email Security. For more information, see the Abnormal Inbound Email Security Integration Guide.

Azure Storage Account Integration Added: XDR can now ingest and normalize data from Azure Storage Account. For more information, see the Microsoft Azure Storage Account Integration Guide.

New Transport Methods Available: Two new transport methods that can be used for custom data source integrations are now available: HTTP Ingest and S3 Ingest

Secureworks-Managed. For more information, see Custom Transport Methods.

Additional Case Type: A new Informational case type is now available to categorize cases used only to communicate information. For more details, see Case Type.

Fixes

Detections Not Updating on Endpoint Details Refresh: The Refresh action on Endpoint details pages was not updating the detections table. This has been fixed.

Cases Filters Not Working in Preview: A bug has been fixed where certain filters on the Cases page were not working in Preview mode.

Red Cloak Endpoint Agent Isolation Status Incorrect: In some instances, the isolation status for Red Cloak Endpoint Agents was stuck in an incorrect state. This has been fixed.

Docs

Using the Notifications API: Documentation has been added that reviews how to update notification preferences of other users via API. For more information, see Using the Notifications API.

Troubleshoot Blocked User Account Issues: Guidance for troubleshooting blocked XDR user accounts is now available.

Professional Services Custom Automation Services: A new document reviewing the Secureworks® Professional Services team's Custom Automation Services is now available. For more information, see Custom Automation Services. ---

August 1, 2024

Thu, 01 Aug 2024 00:00:00
Features

Playbook Executions Graph Enhancements: The Playbook instance details graph is now presented in a bar chart, includes additional execution states ('started,' 'timed out,' 'canceled'), features updated color coding for 'timed out' executions, and displays whole numbers on the y-axis. For more information, see Playbook Executions.

Fixes

Cases Filters Not Working: On the Cases page, the Creator and Assignee filters were not working as expected. This has been fixed.

Incorrect Response Times in XDR Trends Report: In the XDR Trends report, response times were displayed incorrectly. This has been fixed.

Docs

Data Source Integration Enhancements: Integration documentation has been enhanced with better presentation of all available options to integrate your data sources into XDR:

Within the Integrate with XDR folder in the docs side navigation, the Forward Data to XDR folder has been renamed Add Data Sources.

Within Add Data Sources, a new Custom Integrations folder has been added with docs that review available custom transport methods that can be used for custom integrations.

New folders have been added for docs for each main cloud provider: AWS, Azure, and Google Cloud Platform (GCP).

A new section has been added to the Glossary with terms related to integrating data sources. For more information on integrating data sources, see Data Sources in the Integration Overview. ---

July 25, 2024

Thu, 25 Jul 2024 00:00:00
Fixes

Custom Dashboards Export Data: The ability to export data for Custom Dashboards in CSV or JSON was missing. This has been fixed.

Detection Volume by Sensor Type Report Fix: For certain report types, no data would be shown even when data is available. This bug has been fixed.

Docs

PowerBI for XDR Updates: The guide for using PowerBI for XDR has been updated with new features. Further, important fixes are available in the latest version of the Power BI integration for XDR. For more information, see the Power BI for XDR changelog for full change details. ---

July 17, 2024

Wed, 17 Jul 2024 00:00:00
Features

Create Multi-Event Queries with Advanced Search Builder: Advanced Search Builder now supports multi-event queries, enabling more robust data analysis and reporting from Builder. For more information, see Advanced Search Builder.

Secureworks® Taegis™ MDR Plus: Taegis MDR Plus is now available as a new service level option of Taegis MDR. For more information, see Secureworks® Taegis™ MDR Plus.

Bulk Remove Tags from Endpoints: You can now bulk remove tags from one or more endpoints at once from the Endpoint Agents Summary table. For more information, see Bulk Remove Tags from Multiple Endpoints.

Docs

Microsoft Graph Security Detections and Entra Risk Detection Integration Guides: Two new guides have been created for the Microsoft Entra Risk Detection and Microsoft Graph Security Detections integrations.

Enterprise SSO Updated: The Enterprise SSO doc has been updated to account for changes to the testing functionality. ---

July 11, 2024

Thu, 11 Jul 2024 00:00:00
Features

Improved Mobile App Table View: The improved Mobile App table view on the Detections and Cases pages has left Preview mode and is now generally available. For more information, see Optimize the XDR Mobile App View.

Taegis XDR Trends Report Template : For users opted in to Preview mode, you can now create an XDR Trends Report of aggregate data on cases, detections, and data usage from a predefined template. For more information, see XDR Trends Report.

Automated Enrichment via Playbooks: Enrichment Actions can now be configured to connect external tools to pull in additional information into Detections or Cases. Further, custom playbooks can be built and leveraged for data enrichment to perform external analysis such as using ChatGPT to explain elements of a case or detection using customized prompts. See this Knowledge Base article for configuration steps.

Fixes

Entity Graph Detection Selection: Manually selecting Entities and Relationships would automatically select Detections too even if not manually selected. This has been fixed to reflect the expected behavior.

Docs

Integrate Qualys with VDR for Ingest into XDR's Vulnerabilities Feature: VDR can ingest Qualys data that will populate Vulnerability information in XDR when applicable. More information is here and the set up guide is here. ---

June 27, 2024

Thu, 27 Jun 2024 00:00:00
Features

Entity Graph Now Available: Entity Graph is now generally available to all users. This powerful addition to our XDR platform provides enhanced visibility with a live, visual representation of entity relationships. Explore related entity activity and add relevant detections and events to cases to simplify investigative and decision-making processes. For more information, see Explore a Case in Detail with Entity Graph.

Microsoft Azure Data Sources Added: XDR can now ingest and normalize data from Azure Firewall, Azure Front Door, and Azure Application Gateway via Azure Event Hubs.

Taegis Endpoint Agent Maintenance Windows: Maintenance windows, now generally available, allow you to limit when automatic updates for the Taegis Endpoint Agents assigned to a group could occur. For more information, see Maintenance Windows.

Fixes

Custom Detections on Endpoint Agents: The detections table of an endpoint agent details page did not display custom detections in the list as expected. This has been fixed.

Roles & Permissions Exports: Exported CSV and XLS files from the Roles & Permissions page were not formatted clearly. This has been fixed.

Unknown Hostnames in Reports: There was a discrepancy in the Detection Summary Report between the count of detections generated from an unknown hostname and the count of the detections whose hostname is NULL. This has been fixed. ---

June 20, 2024

Thu, 20 Jun 2024 00:00:00
Features

Improved Mobile App Table View: For users opted in to Preview mode using the Mobile App, a new option has been added to tables on the Detections and Cases pages to better present this data on mobile device screens. For more information, see Optimize the XDR Mobile App View.

Fixes

UserID Detection Entity Enhancements:

`Thirdparty` Detections containing a `UserID` field will now populate a `UserID` Detection entity instead of the `userName` entity.

Username event fields will no longer populate multiple username Detection entities, and instead populate only the corresponding Source or Target type.

@user Logical Type Improvements: The `@user` logical type will now cover `sourceUsername` and `targetUsername` fields across relevant schemas.

Case Comments via API: Case comments pulled via API displayed random characters. This has been fixed.

User Admin Summary Report Fixes: The User Admin Summary report now displays the roles of active users, and correctly displays deactivated users as inactive.

Taegis MDR Dashboard Initial Access Vectors Value: The Taegis MDR Dashboard Initial Access Vectors widget displayed odd results and values. This has been fixed. ---

Docs

Professional Services API Reporting: The Secureworks® Professional Services team have released a new offering to support unique reporting needs via the XDR API's. For more information, see API Reporting.

June 13, 2024

Thu, 13 Jun 2024 00:00:00
Features

Taegis Endpoint Agent Maintenance Windows: For users opted in to Preview mode, you can now create maintenance windows to limit when automatic updates for the agents assigned to a group could occur. For more information, see Maintenance Windows.

Taegis Endpoint Agent Tamper Protection: For users opted in to Preview mode and with a supported agent version, Tamper Protection adds a layer of security around the manual removal of agents from user systems. For more information, see Tamper Protection.

Fixes

Automated Calls for High-Severity Cases: Some high-severity cases did not trigger automated call detections as expected. This has been fixed.

Closed Case Detection Labels: After closing a case, some related detections were not accurately labeled according to the documentation. This has been fixed.

Report Creator Name: The creator's name wasn’t appearing on some reports. This has been fixed.

Microsoft Graph API Connection: The "Test" button was missing from the Microsoft Graph API connection Config section. This has been fixed. ---

Docs

Amazon AWS Lambda Update Guide: A new guide provides instructions for updating the XDR Lambda function used in integrations such as Amazon AWS. For more information, see Amazon AWS Lambda Update.

June 6, 2024

Thu, 06 Jun 2024 00:00:00
Features

VDR Integration with XDR: We are excited to announce the integration of Secureworks® Taegis™ VDR into XDR. This feature enables the integration of vulnerability data from VDR through the VDR scanner, or other supported tools such as Qualys, in the following areas of XDR. Select the link to view more details.

Vulnerability Management Page

Detection Details Vulnerabilities Tab

Endpoint Agents Summary Table

Endpoint Agents Detailed View

Fixes

Incorrect Data Source Link: Selecting a data source from the Health section of Data Collector details would sometimes lead to an incorrect source. This has been fixed. ---

May 30, 2024

Thu, 30 May 2024 00:00:00
Features

Stolen User Credentials and Impossible Travel Detectors: The Stolen User Credentials and Impossible Travel Detectors are now available in XDR and supersede the previous Stolen Credentials Detector. For more information, see Stolen User Credentials and Impossible Travel.

Fixes

Bar Chart Report Errors: Certain reports with stacked bar charts sometimes showed an "Unknown" error. This has been fixed.

Entity Graph Improvements: Several fixes and enhancements are now available for Entity Graph, which is in the Preview release ring.

A slight delay would occur when adding items to a case that affected Entity Graph's display. This has been fixed.

Overlapping labels have been optimized in the Entity Graph display.

Entity node name truncation displays have been optimized.

Entity node tabs would sometimes show the previously selected node's information. This has been fixed.

Taegis Endpoint Agent File Analysis Status: The File Analysis feature would show as enabled even when disabled. This has been fixed.

NDR Devices List View: NDR Devices would show in card view but not in list view. This has been fixed. ---

May 23, 2024

Thu, 23 May 2024 00:00:00
Features

Affected Agents Date Range: On the Detection Details page, the Affected Agents section now only shows agents that have seen activity within 90 days of the detection's creation. For more information, see Detection Details Summary Tab.

Vulnerability Management: For XDR tenants that also subscribe to Secureworks® Taegis™ VDR, a new Vulnerability Management page presents vulnerabilities observed by VDR on endpoints in XDR. For more information, see Vulnerability Management.

Docs

Virtual NDR Integration Guide: A new guide for installing and registering virtual NDR Devices is now available. For more information, see the Virtual NDR Integration Guide. ---

May 16, 2024

Thu, 16 May 2024 00:00:00
Fixes

Domain Filtering on Detections: The Detections page was not displaying detections filtered by domain. This has been fixed.

Suppression Rules Missing Criteria: When creating Suppression Rules, specific criteria was missing. This has been fixed.

Suppressing Taegis Watchlist Detection Errors in Japanese UI: Using Taegis Watchlist detector as Suppression Rule criteria in the Japanese UI would present an error. This has been fixed.

Data Export from My Dashboards with no Data: Exporting data from a My Dashboards custom dashboard with no widget will now issue a warning.

Docs

Revamped Getting Started Section: Getting Started documentation has been revamped with improvements. Get Started with XDR has been renamed to Getting Started and updated with new details. New Navigation and Taegis Help Resources pages now feature in the Getting Started section. ---

May 9, 2024

Thu, 09 May 2024 00:00:00
Features

Automation Actions Friendly Names: Automation and APIs play a crucial role in the Taegis platform by streamlining processes and eliminating repetitive tasks. When records are modified within the Taegis platform by configured Automation playbooks rather than a logged-in user, the change details are now captured as friendly identity names in the Created By and Updated By fields to represent Automation actions. These changes will be rolled out incrementally across the platform over the next two months. For more information, see Friendly History Field Names.

Include Disabled Playbooks Toggle: The Playbooks table now excludes disabled playbooks from view by default. To return them to view, select the Include Disabled toggle above the table. For more information, see Configured Playbooks.

Fixes

Missing Actions on Detection Details Events Tab: The options to add events to a new or existing case were missing from the actions menu in the Events tab of Detection Details. This has been fixed.

Docs

Common Expression Language Macros: The documentation for Common Expression Language (CEL) macros used in Automations has been updated with additional macros. ---

May 8, 2024

Wed, 08 May 2024 00:00:00
Features

iSensor Is Now Taegis NDR: Taegis™ NDR is a network detection and response solution that represents an evolution of iSensor and seamlessly integrates with XDR to provide a comprehensive approach to threat prevention and response. With this change:

You will start to see the name Taegis™ NDR in place of iSensor starting on May 8.

While we have new features and will continue to add more, there are no changes to your current contract or pricing.

Your current network-based protection will not be disrupted and there are no steps that you need to take. Be sure to keep an eye out for more exciting news as we add even more capabilities to Taegis™ NDR. For more information, see Taegis™ NDR Overview.

Edit NDR Device Variables: You can now edit the HOME_NET, EXTERNAL_NET, and HTTP_PORTS variables on your NDR Devices. For more information, see Manage NDR Devices Customization Tab. ---