Changelog

One dated note per event, newest first. Each carries its source and says what it changes for a buyer. The RSS feed carries the same notes. Changes to scores are logged on the corrections page.

• 2026-11-03 SOC Prime's news page lists five posts under one date
  Nothing in the workflow changes. The page is content marketing, and the library size and the daily cadence on the marketplace page remain vendor claims with no dates.
• 2026-11-02 Elastic Stack 9.5.6 appears on the Elastic blog
  A team on 9.4 or earlier does not get the History view. Patch level does not change that, so the upgrade target is the 9.5 line.
• 2026-10-28 Newest detection on research.splunk.com is dated 2026-10-28
  A Splunk team can treat the library as live, but should match a new detection to an ESCU release before assuming it is in its own instance.
• 2026-10-12 Google SecOps curated rules move to the GTI_IOC feed
  Search your rule repository for legacy feed references and update them, and add that search to the pipeline so the next feed change is caught in review.
• 2026-10-05 Elastic scores 1,781 prebuilt rules every month
  Elastic buyers get a published noise signal for prebuilt rules, which the other docs read do not match. Replay the Recommended set on your own data before you rely on the tags.
• 2026-09-15 Google SecOps grok filter gains a match_all option
  If you edit a parser, replay the rules that read its fields before and after. The release note adds a capability and carries no warning for existing rules.
• 2026-09-10 Splunk ESCU 6.6.0 adds 12 behavioral analytics and updates 18
  A Splunk team should review the 18 updated analytics against the rules it has tuned, because an update can overwrite a local change.
• 2026-08-27 Splunk ESCU 6.5.0 adds 13 behavioral analytics and two stories
  If your pipeline builds content with contentctl, the 6.5.0 and 6.6.0 releases are the next two diffs to review.
• 2026-08-26 Mandiant Frontline Threats rule packs added to Google SecOps
  Teams with Linux, macOS or Google Cloud log sources have new curated content to enable. Replay it on your data first, since no rule count or tuning guidance is given.
• 2026-08-24 Google SecOps adds an Unroll processor to data pipelines
  If you adopt Unroll, check threshold and match-window rules on the affected log types, because event counts can change.
• 2026-08-12 Sentinel's MITRE coverage doc updated, still in preview
  Use the matrix as a planning view and keep the preview label in any report. A filled cell shows a rule mapped to a technique, not a technique tested.
• 2026-08-08 Sentinel repositories doc: custom detection rules as code in preview
  Plan the repository around the Defender portal's custom detection rules, and treat the preview as subject to change before you move rules over.