Transit - GreyMatter SIEM-Less
GreyMatter SIEM-Less lets you detect, search, investigate, hunt and report in GreyMatter without a SIEM. Transit normalizes and runs detections on your data as it arrives, then writes it to your own Amazon S3 storage, where a new Search area queries it directly and streams results as they are found. You can save and share searches, turn them into dashboards, run the same search inside Investigate and Hunt, and take response actions straight from the results.
Mobile App - AI-Suggested Playbooks and One-Tap Reversals
In the Mobile App, incident detail now shows AI-suggested playbooks chosen for that specific incident, and playbooks that can be reversed are marked in Playbook Activity with a linked reversal that runs in one tap. The playbook run form can also be minimized so you can keep working in the app while it runs.
Respond - AI-Suggested Playbooks on Incidents
Suggested Playbooks on an incident are now selected by AI based on that incident's context, with an explanation of why each one is recommended. Executed playbooks can also be reversed directly from Response Activity, as they can in the Mobile App.
Enhanced Direct Sources - Microsoft Exchange Online
Source | Supported GreyMatter Capabilities |
|---|---|
Microsoft Exchange Online | Respond: sender and domain blocks can now apply tenant-wide via the Tenant Allow/Block List |
Chat - Manage Cases from Chat
You can now work with GreyMatter Cases directly in Chat: ask for a summary of a case and its tasks, report across your caseload, or assign, close and create Cases and Tasks without leaving the conversation. Case work no longer requires opening the Cases page.
New Direct Sources - Grokability Snipe-IT
Source | Supported GreyMatter Capabilities |
|---|---|
Grokability Snipe-IT | Asset Inventory, Respond |
Chat - Build Workflows from Chat
GreyMatter Chat can now build a workflow from a plain-language description, returning the trigger, nodes, branching and node settings already configured, or recommending an existing template when one fits. Chat can also edit workflows you already have and explain what a workflow does and how its recent runs behaved, and every result arrives as an unsaved draft so nothing takes effect until you save it.
