November 02, 2026 - Application Update

Threat Intelligence Enrichment on Signal Details

You can now see exactly what threat intelligence existed when a signal fired. The new Threat Intelligence Enrichment tab in the entity panel on the signal Details page shows a point-in-time snapshot of the matched indicators, including the matching sources, confidence, threat type, and feed-specific details such as actors and kill chain phases.

Because the snapshot is captured when the signal is created, it doesn't change if an indicator is later updated or expires. You can investigate older signals with the same context that triggered them. Learn more.

More ways to filter with the hasThreatMatch function

Write more precise threat detection rules. The hasThreatMatch function now supports:

• The actors and kill_chain attributes, to match on threat actor names and kill chain phases.
• Any Cloud SIEM rules syntax function in the filter expression, such as contains() and toString().
• _threatlookup_fields, to filter on custom fields from your own threat intelligence feeds.

For example, hasThreatMatch([srcDevice_ip], contains(actors, 'HELIXKITTEN')) matches only indicators associated with a specific actor. Learn more.