July 2025

Sprint 10

New Enhancements

The following are new enhancements made to existing functionalities in this release:

Resolutions

Multi-selection support for 'Last Updated By' filter in Streams

Users can now select multiple options in the Last Updated By filter to refine their ActOns more effectively. Previously, only a single selection was allowed.

UI enhancements in Streams

In sub-streams, all filter values across categories are now displayed. Values inherited from the parent stream are enabled for selection, while non-inherited values are shown in a disabled state. This ensures users can select at least one valid, inherited filter value in each category.

Renamed 'ActOn Type' to 'Ops Domain'

The field previously known as ActOn Type has been renamed to Ops Domain across various interfaces, including Streams, Create ActOn, and Applied Filters.

Entities

Enhanced widget clarity with descriptive tooltips across entity groups

To enhance usability and provide contextual guidance, tooltips have been added to key widgets—Signals, Situations vs ActOns, Behaviors Overview, and User Activity Insights—within each entity group. Additionally, hovering over a data point on the graph or relevant data within the widget reveals insights specific to that point.

Configurations

New Fields in Add Feed Page

Two new fields have been introduced on the Add Feed page to enhance feed management:

• File Age: Allows users to define how long the feed data should be retained in Chronicle. The retention period can range from a minimum of 1 day to a maximum of 180 days.
• Source Deletion: Provides two options for handling source files after ingestion:
  • Never delete files from the source
  • Delete transferred files and empty directories (files are deleted only after successful ingestion)

Notifications

Introducing New Notification Channels
Support for three new notification channels has been introduced:

• Google Workspace
• Webex
• Pub/Sub

These can now be created in Channels and can be configured within System Notifications to receive alerts when specific events are triggered by ActOns or Situations. Messages follow a defined format to ensure clarity.

Integrations

Checkbox added for Project ID Mapping in Chronicle BYOC Flow

A new checkbox, “The Google Project ID is the same as the BigQuery Project ID,” has been added to the Chronicle Instance Setup page in the Bring Your Own Chronicle (BYOC) flow at the tenant level.

Selecting this checkbox simplifies configuration by allowing the same Google Cloud project ID to be used for both Chronicle and BigQuery. If left unchecked, users must manually provide both the Chronicle Project ID and the corresponding BigQuery Project ID for configuration and data export.

Accounts

Business Hours Configuration in Account Settings

A new Operational Controls section has been added to the Account Settings tab in Accounts Overview. This section allows users to:

• Set Operational Status to Live
  • Change the operational status of an account to Live to enable monitoring and activate Operations.
• Configure Business Hours for Notifications and Escalations
  • Business hours can be defined to control when system notifications and escalations are sent. Once configured, users can choose to receive system notifications:
    • During business hours
    • Outside business hours
    • Anytime
• Users can further personalize their preferences in the System Notifications settings.

Behavior Analytics

View Details Link for Agent-Generated Insights

A View details link has been introduced to expand and collapse insights generated by agents. Previously, clicking the insight title expanded the section to reveal the summary, hypothesis, attack flow, and recommendations. This functionality is now available via the new link, offering more explicit control over content visibility.

Aggregated Activity Count in Observed Behaviors

A new Aggregated Activity Count column has been added for the Rare Occurrence model type in the Observed Behaviors section. When a user clicks on a data point in the graph, the associated table displays the aggregated activity count — showing the total number of activities performed during that day and the frequency of a specific behavior. This comparison against historical data helps determine whether a behavior is rare.

Sprint 09

Enhancements 

These are the enhancements made to existing functionalities on Resolution Intelligence Cloud. 

Entities 

Explore Entities with Interactive Entity Group Widgets

Entity group widgets for different entity types—Users, Hosts, and Generic—are now fully interactive, offering a more intuitive and exploratory experience. Previously, only the Security Activities widget supported hyperlinks. With this enhancement, key entity group widgets now support clickable drill-downs that navigate to the Entities page, filtered by the selected attribute. Additionally, the Entities list tab has been removed, and drill-down functionality has been implemented into the Total Users, Total Hosts, and Total entities widget for direct access to entity details.

For example, in the Users by Organizational Unit widget, selecting a specific count displays the users grouped under that organizational unit. From there, users can select an individual entity to access detailed information and perform deeper analysis.

Interactive widgets include:

User Entity Groups

• Total Users
• Users by Organizational Unit
• Users by Office Location
• Users by Role
• Users by Employment Type

Host Entity Groups

• Total Hosts
• Hosts by Location
• Ingested Sources
• Hosts by Environment & POD
• Hosts by Platform
• Hosts by State

Generic Entity Groups

• Total Entities
• Entities by Organizational Unit
• Entities by Office Location

Preview Option Added to Enrichment Policies

A Preview option is now available in enrichment policies. Once conditions are applied, a preview of matching entities is generated based on the total available entities in the account. 

Edit and Delete Options for Enrichment Policies

Users can now edit or delete enrichment policies directly, offering greater control and flexibility in managing enriched entity data.

• Edit: When a policy's conditions or attributes are modified, previously enriched entities are re-evaluated.
  • If an entity no longer matches the updated conditions, the associated enriched attributes will be removed.
  • If the entity still matches, the old attributes are replaced with the new ones.
• Delete: When deleting an enrichment policy, users are prompted to choose how to handle previously enriched entities:
  • Retain the attributes already added to the entities.
  • Remove the enriched attributes associated with the deleted policy.

These options help ensure that enrichment data remains consistent and aligned with current policies.

Tags Filter in Entity Overview and Inventory

A new Tags filter has been added to both the Entity Overview and Entity Inventory pages. Unlike other filters, tag values are not listed by default—users must manually type the tag to filter entities.

Advanced Search Enhanced with Extended User Attribute Filters

The Advanced Search feature on the Entities Overview page now supports additional user-related attributes, allowing users to build more precise and targeted queries. These enhancements make it easier to refine entity search results based on specific user attributes.

The newly supported user attributes include:

• entity.user.company.name:
• entity.user.manager.displayname
• entity.user.manager.company.designation 
• entity.user.manager.company.department 
• entity.user.username:
• entity.user.manager.displayname : 
• entity.user.company.department:
• entity.user.emailaddress 
• entity.user.company.designation
• entity.user.company.group.name 
• entity.user.userid 
• entity.user.manager.displayname 

Resolutions

Enhancements to Edit Streams Functionality

When filters in a parent stream are modified, the results in associated sub-streams are impacted accordingly. To keep users informed, a message is now displayed in the affected sub-streams, indicating that the number of ActOn results may have increased, decreased, or dropped to zero due to changes in the parent stream filters.

This enhancement helps users understand the impact of filter changes and encourages them to review and adjust sub-stream filters as needed for better visibility and more accurate results.

Updated Signal Drop-down Design

The drop-down design for filtering Signals has been improved:

• Users can now select multiple filters using checkboxes without applying each one individually.
• Filters are applied in a single click after selection, reducing the number of interactions. The multi-select and searchable dropdowns have been added for:
  • State
  • Source
  • Ingested Source
  • Priority
  • Category
  • Sub-category
  • Organization
  • Tenant
  • Function Name
  • Entities
  • Entity Groups
  • Organizational Unit

Refined and Responsive Layout for ActOn Page

The ActOn page layout has been enhanced to provide a cleaner, more user-friendly experience:

• More Details Panel: Clicking More Details now collapses the Streams panel, offering an expanded view of ActOn details.
• Improved Context Visibility:
  • At the domain level, both organization and tenant names are now visible. Hovering over them displays a copy icon for easy copying.
  • At the organization level, the tenant’s name is now shown.
• ActOn ID Hover Details: Hovering over the ActOn ID now shows the ID, the policy that generated the ActOn, and the creation time. A copy option is available next to the ID for convenience.
• Tags and Additional Details Grouped Under More Details: Tags and key information—such as Sync ActOn Link, Created Time, Last Updated, and First Signal Time—are now grouped under the More Details panel to streamline the layout and reduce visual clutter.

Configurations 

Rule Active Time Frame Enhancements Across Multiple Functionalities

The Rule Active Timeframe now includes improved time zone handling for scheduled rule activation. When a user selects the "Only at a scheduled time" option—whether by specifying a custom date and time range or selecting specific days of the week—a Time Zone field is displayed. By default, this field reflects the user’s profile time zone, but users can change it as needed to define when the rule or policy should be active.

This enhancement applies across multiple functionalities, including:

• Processing Rules
• ActOn Policies
• Scoring Templatization
• Functions
• Correlation Policies

Additionally, when a recurring time window is selected, the "On" field is removed for clarity, and a concise summary message now indicates the exact timeframe during which the rule will be active.

Generic Entity Page Introduced for Non-User and Non-Host Entity Types in Entity Groups

Entity groups now support additional entity types beyond users and hosts. For these, a generic entity page is displayed with the following common widgets:

• Total Entities
• Entities by Organizational Unit
• Entities by Office Location
• Behaviors
• Activity Insights
• ActOn Closure Reason
• Security Activities
• Signals
• Situations vs. ActOns

Insights and Modules

Tag-Based Filtering Now Available for ActOn and Signal Widgets

When ActOns or Signals are selected as the source and Tags as a dimension while creating a widget, the filter option now includes the Tags attribute. This enhancement allows users to define filter conditions based on specific tag values, enabling more precise control and customization of widget data.

Users can now easily display only those ActOns or Signals that match the selected tag criteria, improving the relevance and focus of visualized insights.

New Sources and Metrics Added to Dashboards

Two key updates have been made to enhance dashboard data visibility:

• Data Validation Source: 5 new dimensions and 2 metrics have been introduced under the Data Validation source, enabling more detailed analysis and validation workflows.
• Entities – ManageEngine Source: 6 metrics and 7 dimensions are added to Entities-ManageEngine to support deeper insight into ManageEngine-related data.

Create a New Module During Dashboard Import

Users can now create a new module directly during the dashboard import process. If the desired module is not available in the Module & Category drop-down list, a Create Module option is now provided. This allows users to define a new module on the fly and assign the imported dashboard to it, streamlining organization and reducing the need to navigate away from the import flow.

Assign Dashboards to Modules While Cloning

While cloning a dashboard, users can now assign it to either an existing module or create a new module directly from the Modules drop-down—enhancing flexibility and organization when managing dashboards.

Signal Analytics

ActOn ID and Situation ID Filters in Signal Analytics

New filters for ActOn ID and Situation ID have been added to the Signal Analytics page, allowing users to filter signals based on a specific ActOn or Situation ID.

Count Added for Emerging Trends (48H) and Sustained Trends (7-Day)

Users can now view the count on the pills for Emerging Trends and Sustained Trends, making it easier to see how many trends fall under each category.

Deprecated features

Deprecated Tabs in ActOns

The Tasks and Analysis Logs tabs have been deprecated from both Security and Digital ActOns pages.