April 2026 Product Releases

Chat - Discover Data in Chat

Customers with Discover can ask natural-language questions about their asset inventory in Chat, such as outdated operating systems, highest-risk assets, public-facing servers, EDR coverage gaps and missing controls. With Teammates as well, findings arrive prioritized with remediation steps, and Teammates can work across capabilities, such as generating hunts from the highest exposures.

Discover - External Scanning

Discover now scans customer-defined IP ranges and netblocks daily via Shodan to identify open ports, running services and known vulnerabilities from an attacker's perspective. Results are ingested, normalized, deduplicated against inventory, enriched with risk context, and shown in new widgets on Discover Asset pages.

Discover - OpCo Asset Routing

Parent companies can share integrations with child operating entities and automatically route assets, identities, software and misconfiguration data to the right OpCo.

Discover - SaaS Inventory

Discover now inventories the SaaS applications in use, pulling initially from Okta, Microsoft Defender for Cloud Apps and Netskope CASB, and surfaces exposures tied to threat intelligence. Applications can be marked unauthorized to generate an exposure and follow-up tasks, and matching advisories automatically create Impacted exposures.

Agentic Teammates - Autonomous Teammates

When a threat advisory is published and matched to a customer's environment profile, four Teammates spring into action in parallel: Threat Intel Analyst generates a tailored advisory report, Threat Hunter runs a custom hunt package against telemetry, Incident Response recommends IOCs to block, and Detection Engineer identifies coverage gaps and recommends new rules. Three manually triggered weekly workflows add reports on risky users, rule performance, and alert trends.

Platform - IP Allow Lists for API Keys

GreyMatter API keys can be restricted to customer-defined trusted IPs or CIDR ranges, adding protection if a key is ever exposed. Setup details are in the Configuring API IP Allow Lists article in the Resource Center.

New Direct Sources

Chat - Resource Center Search

Chat can now search, discover and navigate Resource Center documentation through natural language, without leaving the conversation.

Intel - Run Hunt from Intel Updates

Every Intel Update article now has a Run Hunt button that builds a hunt query from the update's indicator list in one click. Users can still hunt from the Actor page to cover all IOCs from the past 30 days.

Enhanced Direct Sources