Prospector Studio Release for 2026.10.16 — Bug Fixes

Sign-In & Tenant Access

Fixed: new tenants can be used right away. A newly created tenant could reject sign-ins with an "Authentication service unavailable" error for 15 minutes or more after it was created, which looked like a DNS or certificate problem. Sign-in is now ready as soon as the tenant is created.

Fixed: pages stuck loading after signing back in. If your session expired while you were working and you signed in again, some pages (Organizations and other embedded views) could show a loading state that never finished. Your session now renews smoothly in the background, and those pages load normally.

Fixed: actions recorded as "Unknown user". In some sessions, work such as completing a case task was saved under an unrecognized identity, so the history showed "Unknown user" instead of your name. Actions are now always attributed to the right person.

Roles, Permissions & Import/Export

Fixed: cloned and imported roles keep their feature access. Cloning a role, or exporting it and importing it again, used to silently drop the features that role was granted, so the copy couldn't reach what the original could. Feature access now carries over in both cases.

Improved: import/export now includes identity provider mappings. Moving your organization's configuration between environments now carries your SSO group and attribute mappings too. You no longer have to recreate them by hand in each environment.

Fixed: imported personas keep all their tools. A persona imported from another environment could arrive missing some of its code tools, with no warning. Every attached tool now comes across. If one can't be re-attached, the import tells you which one.

Improved: readable names on permission grants. Permission grants used to show only a raw ID, so you had to look up which persona each one referred to. The persona's name now appears next to the ID on the Permission Sets and Act-as Grants pages.

Fixed: Token Usage Monitor access works when granted through a role. Granting the Token Usage Monitor feature through a role didn't actually show the Tokens page to that role's users. It now does.

Improved: imported roles follow the same naming as roles created in Studio. Roles brought in through import now get the same customer naming prefix as roles you create directly, so the two sets are named consistently.

ASOC

Improved: smarter case grouping.

• A new alert about a file you're already investigating now joins the open case for that file for up to 7 days, instead of starting a new case.
• Website addresses in threat indicators are now matched by their domain, so a common site no longer joins unrelated cases into one.
• Indicators with an unknown type are still shown on the alert, but they no longer join cases together.

Improved: clearer case summaries. Case summaries now list detections first, show full file hashes, and include the names of MITRE ATT&CK techniques and tactics, not just their IDs.

Improved: more reliable case updates under load. When several updates hit the same case at once, you now get a clear "Case is busy" message instead of a confusing failure.

Fixed: concurrent runs of the same workflow could interfere. When one automation workflow ran on overlapping schedules, a run could occasionally fail because another run cleared the data it was using. Each run now keeps its own data.

Improved: the Workflow Engineer can now build case-handling workflows. Ask the Workflow Engineer in plain English for a case-housekeeping automation, such as "close resolved cases nobody has touched in 3 days." It now builds the workflow with the standard Cases steps instead of failing to find a way to change a case.

New: case task checklists. Cases gain a Tasks tab with grouped tasks. Tasks can run snippets, with inputs filled from the case's fields, and include safety checks: a confirmation step before any change, a dry-run mode and version pinning. (Rolling out gradually, tenant by tenant.)

New: dismissed cases reopen when new evidence arrives. If the automated first-pass review dismissed a case and a new matching alert comes in, the alert now joins that case, reopens it and sends it back for review. Cases an analyst dismissed stay closed. (Rolling out gradually, tenant by tenant.)

New: alert counts in case titles. Case titles can show how many hosts, alerts and detections the case covers, updated as new alerts join. (Rolling out gradually, tenant by tenant.)

New: cross-tenant case management for managed service providers. Provider tenants can see and work client cases from one unified list. Each client controls this from its own Access console. Updates are recorded in the client's audit trail, and a new dashboard panel shows case volume per client. (Rolling out gradually, tenant by tenant.)

Workflows & Snippets

Fixed: secrets no longer appear in workflow run details. Passwords, API keys and other secrets used by a workflow could appear in plain text when viewing its run history. They are now masked before they reach your browser, so they don't show up on screen, in screenshots or in exported network logs.

Improved: more trustworthy snippet editing.

• "Saved" and "Deploy succeeded" now appear only when the save or deploy actually happened.
• Usage counts now show the full number of workflows using a snippet, and you're asked to confirm before changing a snippet that live workflows rely on.
• You can pin a workflow step to an exact version of a snippet, and each run's details show the version that actually ran.
• Editing a .js snippet no longer saves a duplicate .ts copy.

Agents, Chat & Connectors

New: agents can send real file attachments. Agents sometimes said they couldn't create files, and fell back to a text document in the side panel. They now attach the file (for example an HTML report) directly in the chat thread.

Fixed: scheduled jobs now deliver their file attachments. Scheduled agent jobs that post to a chat channel delivered only their text reply, and any report file they produced was lost. Those files are now posted along with the message.

Fixed: connector approvals survive restarts. Connectors waiting for admin approval could disappear from the Gateways page after a service restart, leaving them stuck. Pending approvals are now kept across restarts, and a failed approval reports an error instead of failing silently.

Fixed: connectors registered through Fleet are now fully usable. A connector registered through Construct Fleet could show as healthy but couldn't be chosen when adding an MCP server, or reached from personas and workflows. It now appears as a provider choice and works everywhere, and re-registering it after removal no longer fails.

StrikeKit

Improved: redesigned engagement settings, plans and execution dashboards.

• Settings: Save and Commit only turn on when there are real changes, and Commit opens a review step before anything is committed. Checklist "Fix" links take you straight to the right section.
• Plan generation: missing requirements are clearly highlighted.
• Plans: saving and regenerating ask for confirmation. Repeated saves no longer create duplicate plan versions.
• Dashboards: the engagement and execution dashboards are reorganized around recent runs, so it's clear which plan version is active and which one will run.