Prospector Studio Release 2026.09.30 — New Plugins & Automated StrikeKit Workflows

New MCPs

• FortiSIEM: 25 tools across incidents, watchlists, lookup tables, CMDB device inventory, and instance health. Self-hosted, so you point it at your own appliance's IP or hostname rather than a fixed domain.
• Qualys VM/PC: 25 tools across VM scans, PC scans, SCAP scans, scan schedules, and scanner appliances.

Updated MCPs

• Okta: Every tool was broken due to the wrong auth scheme and a placeholder base URL. Fully fixed and live-verified.
• Microsoft Graph: Fixed request body shape, enum values, and pagination across all mutation tools.
• Google Sheets: Switched to OAuth2 with refresh tokens, replacing the old expiring-token-only setup, plus a full body-shape and wiring fix pass.
• Tavily: Maturity bumped from alpha to beta.
• Zoho Desk: Refactored to a generic, data-driven OAuth2 extension pattern instead of hardcoded Zoho-specific fields, and added multi-portal support with per-portal token cache isolation.
• PagerDuty: Fixed an authentication bug — the connector was sending Authorization: Bearer, but PagerDuty's API-key auth requires Token token=.
• Devo SIEM: Documentation now spells out each tool's default scan window, since it was easy to silently hit a 1-hour default on most calls without realizing it.

Studio Reliability

Fixed: some Studio panels went blank or got stuck on login after a session expired. When your session expired while viewing certain embedded panels (System Administration, Connector Permissions, Organizations, Webhooks, Workflows, Dashboards, and more), the panel could go completely blank, or the login screen could get stuck failing to load. Both are now fixed — an expired session correctly prompts you to log back in, in every panel.

Fixed: toggling tools for one instance of an integration could affect other instances of the same integration. If you had more than one instance of the same integration (for example, two Devo connections), enabling or disabling tools on one could accidentally change or wipe out the tool settings on the other, and in some cases caused chat requests to fail silently. Each instance's tool settings are now tracked independently.

Automations & Triggers

Fixed: editing an advanced-schedule automation trigger could silently reset it to a default daily schedule. Triggers using a custom (cron) schedule that didn't match one of the simple frequency options would open for editing showing the wrong "Daily at midnight" schedule — and saving would overwrite your actual schedule with that default. Advanced schedules now open correctly in Advanced mode and save exactly as configured.

ASOC

Fixed: some automated case-response workflows could fail to find the case they were working on. Certain multi-step tier-response automations (ASOC L1/L2) could fail partway through with a "case not found" error, even though the case existed, due to an internal handoff issue between workflow steps. This is now fixed.

Improved: ASOC ingest and triage are now more configurable and more resilient per tenant. ASOC's data ingestion and first/second-line triage can now run as per-tenant customizable pipelines instead of one-size-fits-all logic, so triage behavior can be tuned to how each organization actually works. Ingest is also more resilient to messy source data — a missing or malformed severity or timestamp no longer stalls the pipeline — and any credentials or secrets that happen to be embedded in incoming alert data are automatically redacted before they're ever stored.

StrikeKit

New: StrikeKit can now run automated, multi-step engagement workflows. An engagement plan can now be turned into an automated workflow you run directly, with live step-by-step progress, the ability to cancel or resume a run, and approve/reject gates at key steps. Workflows can be built visually and started from a library of starter templates. This is an initial release of the capability — refinements are already planned based on internal review.

Access & Permissions

Fixed: chat and Discord automations were blocked for users with custom permission roles. If your organization uses custom role names in your identity provider (rather than the default admin/member roles), chat-based automations could be denied for those users even after an admin granted the correct permissions. Permissions are now checked against your identity provider's roles directly, so custom role names work correctly.

Improved reliability of how your permissions are tracked during a session. Previously, the system recalculated your effective permissions on every action with no record of what had actually been granted, which could occasionally let permission state drift out of sync. Your session now keeps a consistent record of your granted and applied permissions, and automatically repairs itself if anything looks inconsistent.

AI Agents

Fixed: AI agents could call integration tools with missing or incorrect parameters. In Code Mode, the agent could only see full parameter details for built-in tools — for connected integrations (like Devo) it only saw the tool's name, so it sometimes guessed at required parameters like time ranges. This caused some queries to silently return incomplete results (for example, an alert search defaulting to only the last hour of data) with no error shown. The agent now sees full parameter details for every connected integration's tools.

Dashboards

New: AI personas can now build and manage dashboards for you from chat. You can now ask a persona (like the Dashboards Agent) to create, update, or delete tenant dashboards directly from a conversation, instead of building them by hand in Studio. Every action still respects your existing dashboard permissions — this doesn't grant any new access, just a faster way to use the access you already have.