A detection release for password-spray account takeover in Microsoft 365, published October 23, 2026. A new high-severity behavior rule, EntraID_SignIn_After_Block, alerts when an attacker who holds a user's password gets into the account after Conditional Access blocked their earlier attempts. It catches the Azure CLI password spraying that Huntress has reported since June 2026, when a risk policy stops the sprayer once and they come back from another address. A precision fix to EntraID_Valid_Password_Blocked ships with it.

No action is needed: the rules sync to every instance automatically.

A detection release for Microsoft Entra ID, published October 23, 2026. Four new behavior rules alert when an app (a service principal acting with no user signed in) assigns directory roles or adds credentials to other apps. An attacker does exactly this with a stolen app certificate or secret, as in the Storm-0940 compromise of ConnectWise's multi-tenant apps that Microsoft reported on October 21. Until now, role assignments and credential changes made by an app were only context, or one step of the EntraID_App_Takeover correlation.

No action is needed: the rules sync to every instance automatically. These notes also correct how the October 18–20 notes described EntraID_DeviceCode_UserApp.

A reports release, published October 23, 2026. A scheduled report can now keep every day's result for 12 months. With the new fluency-report-rollup skill, Claude builds a month, a quarter or a trend from those daily results. It runs no long query, is not held to a report's 60-day limit, and states on the page which days it covers.

Report Archive is available on every instance. For analysts who build reports in Claude Co-Work or Claude Code, it needs two things: the archive turned on for the report, and the fluency-report-rollup skill.

A detection release for the help desk impersonation campaign that Microsoft Threat Intelligence reported on September 2, 2026, published October 23, 2026. The attacker poses as IT support or a colleague in a Teams chat, calls seconds later, and walks the user into a remote-support session or an installer. Two new high-confidence behavior rules cover the first two steps. O365_Teams_OnMicrosoft_Tenant_Chat alerts on the chat, when it comes from a throwaway *.onmicrosoft.com tenant. O365_Endpoint_Download_From_Azure_CloudApp alerts when a browser downloads an installer from the kind of throwaway Azure host these crews use to deliver it.

No action is needed: the rules sync to every instance automatically.

A detection release for Microsoft Entra ID and Microsoft 365, rolled out October 18–20, 2026. It adds 19 alerting behavior rules and 12 context rules covering three campaigns reported by Microsoft Threat Intelligence (Storm-2755's adversary-in-the-middle (AiTM) session theft, Storm-2372's device-code phishing, and Storm-3119's takeover of whole tenants through a registered app) plus detections for persistence, privilege and sign-in abuse. Five older rules are retired or removed.

No action is needed: the rules sync to every instance automatically.

The v2 interface is available on every instance, and every escalated case now carries an AI investigation report. Detections gain parser rules, and Entra ID audit and sign-in logs, including non-interactive sign-ins, can be collected through Azure Event Hubs.

A milestone release. EventWatch now runs under the job manager, which extends exactly-once processing through rule evaluation and lets the processing pipeline scale past 1 TB per day. The release also adds KQL search history, a send_email MCP tool, and SentinelOne, CrowdStrike Falcon, LDAP, Duo and Abnormal Security applications.

Five more data sources can be queried with KQL as typed tables: Zscaler, Cisco Meraki, F5 BIG-IP LTM, Palo Alto Networks Cortex alerts and incidents, and Qualys, each released with sample queries. Windows audit events, whose schema shipped in v2.6.16, gain sample queries too.

The Microsoft 365 applications can be set up with an app registration you create yourself, instead of through admin consent. Workday, Abnormal Security, Azure Event Hubs and Qualys move to the new platform, and resource polling for Office 365 and SentinelOne runs as a separate job.

The first versioned release of Ingext Skills adds two skills that turn natural-language questions into validated, ready-to-run queries, with no query language required: ingext-kql for events in the data lake, and ingext-promql for platform health. Ten skills ship in this release, and all of them are open source.