Prospector Studio Release for 2026.10.28 — New Features and Bug Fixes

ASOC

Fixed: scheduled pipelines create cases reliably. Scheduled ingestion pipelines could stop creating cases whenever the person who set up the schedule wasn't signed in. Alerts were left without cases while runs still reported success, and matching cases weren't assigned to L1 overnight. Scheduled runs now find their case project, dispatch alert groups and assign cases whether or not that person is signed in.

Improved: resolve cases straight from New or Triaging. The standard ASOC Operations workflow now allows Resolve on cases in New or Triaging, as well as Enriched and Escalated. This also lets a linked ticketing system close a case automatically when its ticket closes.

Improved: clearer detection summaries.

• Microsoft alerts show the real alert name (for example, "Suspicious PowerShell command line") in the Alert Distribution and Detections tables, instead of the internal rule name.
• CrowdStrike detections show Falcon's full description in the Detections table, plus a new Action taken column (for example, "Process killed", or a note when the kill failed).
• Command lines move out of the MITRE ATT&CK block into their own Process block. It shows the process, parent and grandparent with their command lines, even when the case has no MITRE technique.

Fixed: fewer unrelated similar-case links. A value seen on almost every alert, such as your own company domain, could link dozens of unrelated cases as "similar". Similar-case linking now uses the same value exclusions as case grouping, so those links stop.

Improved: Create Case and CSV export match your permissions. Users who can't create cases, or can't read any case, no longer see the Create Case and Download as CSV buttons. The New Case dialog only offers projects you can write to.

Fixed: case columns you choose always show. A column you explicitly turned on in the Columns picker (for example, Created) disappeared on screens narrower than about 1400 pixels. Columns you choose now always show. Only the default extras still hide on small screens.

Improved: case task improvements. For tenants with case tasks turned on:

• Tasks can be dragged into order.
• The Action Library pane shows one tidy line per task.
• A snippet task's completion comment shows a summary with the raw output collapsed.
• Each task shows who ran and completed it.
• Tenants without case tasks no longer get hidden task rows on new cases.

(Rolling out gradually, tenant by tenant.)

New: re-run snippet tasks, keeping history. A done or failed snippet task can be run again with "Run again". Earlier runs stay listed under "Previous runs". Retrying a failed task whose snippet changed now opens the run dialog, so you can accept the change instead of hitting the same error. Cases also record the external tickets their tasks created. (Rolling out gradually, tenant by tenant.)

Sign-In, Permissions & Organizations

New: see and rotate your SAML signing certificate. The SAML identity provider settings now show the signing certificate Studio has on file, so you can check it against your identity provider. To rotate it, paste the new certificate. Leave the field blank to keep the current one. Previously the certificate could only be set when the connection was first created, and an outdated one blocked every SAML sign-in.

New: sign in from an Okta dashboard tile. The SAML connection details now include a ready-made "IdP-initiated login URL", with a short note on where it goes in Okta. Pointing an Okta tile at it signs users straight into Studio. Before, admins had to build that address by hand.

Improved: import and export carry identity provider mappers. Organization import/export now includes your SAML and OIDC group and attribute mappers, so you no longer re-create them by hand in each environment. Mappers that hard-code roles are left out on purpose. Roles still come only through group bindings.

Fixed: imported roles keep their permissions. Roles brought in through import could appear correctly but grant nothing, so users with those roles had no permissions. Imported roles now come with their permissions attached.

Improved: clearer persona imports.

• If a persona's attached snippet was deleted before the export, the import now names the snippet as unusable. Before, it silently re-attached a tool that could never run.
• An imported persona keeps its original name when that name is free.

Improved: delete a permission set that's still in use, in one step. When a permission set can't be deleted because roles, groups, connectors or other sets still use it, the dialog now offers "Unbind and delete…". It lists everything that will be detached and asks you to confirm. Before, you had to unbind each one by hand and try again. If any step fails, you see exactly what was detached.

Improved: grants show persona names. The Act-as Grants page and the Permission Sets grants table now show the persona's name above its ID, so you can tell what each grant covers without looking it up.

Improved: faster Studio under heavy permission load. On busy tenants with large permission sets, every permission check did expensive work that slowed the whole UI and could sign users out. Those checks are now much cheaper, so Studio stays responsive and sessions stay signed in.

StrikeKit

New: blockers appear as they happen. The Blockers page now fills in automatically during an engagement. It shows when a target is blocked by scope, when a consent prompt is declined, and when a run stalls or a phase fails. Before, it only showed blockers added by hand.

Improved: cleaner findings.

• Repeat scans, retries and re-run phases no longer create duplicate findings. The same issue on the same host and port is one finding.
• Placeholder "Unknown Vulnerability" findings are no longer created, and CVE IDs from more scanners are saved on the findings.
• Findings can be deleted, and evidence can carry file attachments, with a confirmation before anything is deleted. The full finding page is now reachable from the UI.
• The findings side panel shows which status you picked (Resolved, False Positive, Accept Risk) and lets you un-select it. Status badges show their colors.

Fixed: scope rules always apply.

• Targets added on the Targets page after an engagement was created are now enforced as in scope. The "In-scope targets defined" check ticks for them.
• Deleting targets can no longer empty the in-scope list by accident, even with the engagement open in more than one tab.

Fixed: engagement runs stop hanging.

• Generate Plan now shows a clear error with a Retry button when the AI backend doesn't answer. Before, the spinner just stopped with no output.
• A run waiting on an unanswered consent prompt now pauses as interrupted after the stall window, and you can resume it. Before, it stayed "running" forever.

Workflows & Dashboards

Fixed: secrets stay hidden in workflow runs. Workflow execution details (inputs, outputs, logs and events) now hide secret values before they reach your browser. This covers vault secrets, fields that look like credentials, and tokens. Secrets no longer appear on screen, in the browser's network tools or in exported files.

Fixed: snippet task timeouts take effect. The "Timeout (seconds)" setting on snippet workflow nodes was being ignored, so long-running snippets were cut off at 60 seconds. The value you set now applies.

New: "Latest versions only" on the Workflows list. A new switch, on by default, shows only the newest version of each workflow. Turn it off to see every version.

New: dashboard dropdowns drive your panels. Dashboard variables now appear as dropdowns, and a choice in one can narrow the next (for example, pick a Workflow, then one of its Versions). Panels backed by snippets refresh with your choice.

Improved: readable durations on dashboard panels. Millisecond values now read as durations: "800 ms", "2.500 s", "45.3 s", or "02:58" for anything over a minute. On the ASOC overview, the MTTR card shows "02:58" instead of "178,526.603".

Agents, Code Mode & Chat

New: personas can send real file attachments. Personas using Code Mode now know they can write a file, such as an HTML report, and send it to the chat as an attachment. Before, some told users they couldn't create files.

Fixed: workflow reports are full HTML again. In workflows with Code Mode turned on, AI report steps (such as the ASOC L1 and L2 HTML reports) could return a one-line summary instead of the report. They now return the full HTML.

Fixed: standalone MCP servers work in Code Mode. A persona with a standalone MCP server from the catalog (for example, Devo) couldn't call that server's tools from Code Mode. Those calls now work.

Fixed: Easy Mode keeps its tools. Users without permission to create personas could get a basic assistant with no tools in Easy Mode. Easy Mode now sets up its assistant with full tools for everyone.

Fixed: no more scrambled Slack replies. A Slack reply could sometimes mix pieces of two different assistant messages. Each message now streams on its own.

Improved: file upload errors say why. When a file couldn't be uploaded to chat, the notice now says why (for example, the file no longer exists, or the host couldn't be reached), instead of just "Couldn't upload".

Fixed: the New Connection wizard fits your screen. With many personas, the connection wizard grew taller than the window and its Back, Cancel and Next buttons couldn't be reached. The wizard now fits the window, and its content scrolls.

Studio

Fixed: "Reload" recovers after an update screen. After a laptop sleep, some users got stuck on the "Studio has been updated" screen, where Reload didn't help but a new window did. Reload now clears the cached files that caused this, so one click recovers.

Fixed: the theme switch applies everywhere. Switching between light and dark from the launcher now updates all of Studio right away, including diagrams.

Integrations

Fixed: Amazon S3 works. The Amazon S3 integration now signs its requests correctly, so it works with access keys or a cross-account role. It's now the only S3 integration, with 34 tools. The same fix enables signing for the other AWS integrations.

Security

• Certificate trust update. Studio no longer trusts certificate authorities affected by the October 2026 eMudhra key compromise, following Chrome, Mozilla, Apple and Microsoft.
• Plugin sandbox update. The plugin sandbox engine was updated to fix a critical vulnerability (CVE-2026-115893) that affected ARM servers.
• ServiceNow ITSM. Filter values can no longer change the meaning of a ServiceNow query.