Prospector Studio Release for 2026.10.21 — New Feature and Bug Fixes

ASOC

New: case tasks in ASOCv2. ASOCv2 cases now have a Tasks tab, so the response steps for a case live with the case itself. Tasks are organized into groups and can do real work. A task can run a snippet or call an MCP tool, with its inputs filled straight from the case's fields, and the tool's results show as readable text on the task. Built-in safety checks include a confirmation step before anything changes, a dry-run mode, and pinning a task to an exact snippet version. (Rolling out gradually, tenant by tenant.)

Improved: smarter case grouping.

• Website addresses in threat indicators are now matched by their domain, so a link to a common site no longer pulls unrelated alerts into one case.
• The 7-day look-back that joins a new alert to an older open case now uses only domains taken from threat indicators, not every domain seen in an alert.
• Indicators with an unknown type are still shown on the alert, but they no longer join cases together.
• A file hash that already appears in many open cases (more than 10 by default) is treated as too common to group on, so one widely seen file no longer chains unrelated cases together.

Improved: longer case titles are readable. Case titles now stay on one line and use much more of the available width, both on the case page and in the cases list. A title that still doesn't fit shows in full when you hover over it.

New: alert counts in case titles. Case titles can show how many hosts, alerts and detections the case covers, and update as new alerts join. Tenants that don't turn it on keep exactly today's titles. (Rolling out gradually, tenant by tenant.)

Sign-In & Sessions

Fixed: pages stuck loading after signing back in. If your session expired while you were working and you signed in again, some pages (Organizations and other embedded views) could show a loading spinner that never finished. This mostly affected users signing in directly to a client tenant. Your session now renews smoothly in the background, and those pages load normally.

Fixed: dark mode switching to light on refresh. With dark mode on, refreshing Studio could sometimes repaint it in light mode. Your theme choice now holds across refreshes.

Automation & Scheduled Jobs

Fixed: scheduled jobs run again. Since the 2026-10-09 release, scheduled, triggered and "run now" jobs could fail before they started. Nothing appeared in the Jobs page, so they looked like they had never fired. Jobs now start and record their runs normally.

Improved: the Workflow Engineer can build workflows that change cases. Asked to automate case upkeep (for example, "close resolved cases untouched for 3 days"), the Workflow Engineer agent didn't know about the built-in Cases workflow nodes and couldn't find a way to change a case's status. It now uses the Cases nodes to search, update, comment on and bulk-update cases.

Agents & Import/Export

Fixed: imported personas keep all their tools. A persona imported from another environment could arrive missing the Code Mode snippet tools attached to it, with no warning. Those tools now come across with the persona.