Platform Update v2.6.50

A milestone release. EventWatch now runs under the job manager, which extends exactly-once processing through rule evaluation and lets the processing pipeline scale past 1 TB per day. The release also adds KQL search history, a send_email MCP tool, and SentinelOne, CrowdStrike Falcon, LDAP, Duo and Abnormal Security applications.

Changes

Processing

• EventWatch job manager. EventWatch runs under the job manager, so every event is evaluated exactly once, and the pipeline scales to more than 1 TB per day.
• Fixed an out-of-memory failure when the data lake merges large indexes.
• Fixed a syslog reader bug.

KQL search history

• Every KQL search is saved for the whole account, and its results can be reopened from Data Lake → KQL Search History without running the query again. See KQL Search History.

MCP

• New tool send_email sends email through the instance's notification endpoints. See MCP Server.

New applications

• SentinelOne
• CrowdStrike Falcon
• LDAP
• Duo
• Abnormal Security