Agentic Teammates - IT Engineer Teammate
The IT Engineer Teammate is a new Agentic Teammate for infrastructure health, building on the Agentic AI capabilities for GreyMatter Health Alerts. For Teammates customers it coordinates with the other Teammates, flagging infrastructure issues that affect detection, hunting or threat intel operations and answering cross-Teammate questions in Chat, and on request it analyzes an uploaded firewall configuration and returns prioritized recommendations with an updated file.
Respond - Automated Response Tab and Activity History
A new Automated Response tab shows each playbook's available and configured signatures and its active workflows. The Respond Activity tab adds a full run history across web and mobile with new filters, a details side panel, and full-screen playbook outputs.
Hunt - Targeted Search
Targeted Search is a priority execution mode in Hunt that runs a single query against integrated technologies over the last 30 days and returns up to 1,000 records in minutes, without affecting queued hunts. Full Native Query hunts, ReliaQuest-initiated hunts in the activity listing, and case creation from hunt results also arrive.
Cases - Attachments and Task Export
Files can be added, downloaded and deleted on Cases and Tasks, with attachment activity recorded in the Activity Log. Tasks can be exported from the bulk actions toolbar.
Platform - Ticket Sync for Splunk SOAR, ConnectWise and Freshservice
Bidirectional ticket sync now extends to Splunk SOAR, ConnectWise Manage and Freshservice, joining Google SecOps SOAR and ServiceNow. Customers configure each integration themselves with standard platform credentials.
Workflows - Redesigned Workflow Builder
The Workflow Builder now offers drag-and-drop editing on the canvas, a top-to-bottom layout for longer workflows, and trigger swaps on live workflows. Five new triggers arrive: Incident Closure, Intel Subscription, Respond Play, Post-Digital Risk Alert Analysis, and Discover Refresh.
New Direct Sources - Corelight Investigator, Salesforce, WatchGuard Firebox
Source | Supported GreyMatter Capabilities |
|---|---|
Corelight Investigator | Detect at Source |
Salesforce | Investigate/Hunt, Respond |
WatchGuard Firebox | Respond |
Enhanced Direct Sources
Source | Updated GreyMatter Capabilities |
|---|---|
Google Security Operations | Intel Push: data tables now supported |
Microsoft Entra ID | Respond: Add User To Group, Remove User From Group |
Microsoft Defender for Office 365 | Respond: Unquarantine Email, Enrich Quarantine Email |
New Direct Sources - Cribl Search, FortiAnalyzer, Workday, Azure Firewall, Tanium Asset, Lacework FortiCNAPP
Source | Supported GreyMatter Capabilities |
|---|---|
Cribl Search | Detect, Investigate/Hunt, Intel |
FortiAnalyzer | Detect at Source, Detection State Syncing, Investigate/Hunt, Respond |
Workday | Respond |
Azure Firewall | Respond |
Tanium Asset | Asset Inventory |
Lacework FortiCNAPP | Detect at Source, Detection State Syncing, Investigate/Hunt, Respond |
