announcements release-notes prospector-studio

Prospector Studio Release for 2026.11.04 — Bug Fixes

Strike48 Strike48
· · 3 min read
Prospector Studio Release for 2026.11.04 — Bug Fixes

The final checks are in progress, this list may change before the release window at 3pm EST on Friday.

ASOC

Fixed: MCP tool errors now show as failed tasks. When an MCP tool reported an error, its case task still showed a green "Done", with the error hidden in the output. Those tasks are now marked Failed and show the tool's error message, so a broken step is easy to spot.

Fixed: Alert Sources lists every pipeline. The Alert Sources admin page, and its sidebar count, could say "No alert sources yet" on tenants whose sources feed the Default or Code Mode ingestion pipelines. The page now lists the sources for every pipeline, including custom ones.

Improved: the Entity Map shows hashes and users.

  • A file-hash row on the case summary's Entity Map now shows the full hash next to the file name. Before, the map showed only the file name, so you had to look in other sections for the hash.
  • The user named in an alert now appears on the Entity Map even when the case's alerts share a host or hash. Before, only the shared values were listed. Generic accounts such as administrator, system or machine accounts are left out.

Fixed: case list and Timeline fixes.

  • On a fresh load of the case list, the first click on a case did nothing, and you had to click again. One click now opens the case.
  • The Timeline's actor list always showed 0 events for each person. It now shows the real counts.

Fixed: case activity shows real names. Some case actions taken in Studio were recorded under "Unknown user" instead of the person who took them. They now show the person's name.

Workflows

Fixed: missing workflow inputs now fail the task. When a workflow step referred to the output of a step that didn't run, or to an output that step didn't produce, it ran anyway with the value missing and could give wrong results without warning. The step now fails, with a message naming the missing input, so the problem shows up where it starts.

Fixed: Code Mode settings survive Studio saves. Saving a workflow in the Studio canvas could silently wipe the Code Mode settings of steps built by the Workflow Engineer persona. Those settings are now kept.

Fixed: failed runs show their error message. A failed workflow run could sometimes show as Failed with no error message. Failed runs now always show the reason.

Fixed: event history for scheduled runs. On tenants with workflow access policies turned on, scheduled runs didn't record their event history. They now record it the same way manual runs do.

Agents & Personas

Improved: the Workflow Engineer knows the ingestion pipelines. The Workflow Engineer persona now understands how ASOC alert ingestion works. It knows the shipped ingestion pipelines and how to clone them, so it builds working ingestion workflows rather than trying variations that can never receive alerts.

Fixed: conversations no longer hang with some models. A conversation could hang at the start when its model didn't report a context window size. Those models now fall back to standard limits and work normally.

Fixed: the New Persona form is more reliable.

  • The form no longer shows a "Role list unavailable" warning on tenants that don't use service accounts. The Run-as role picker is hidden there, because it doesn't apply.
  • If the snippet library can't be loaded for a moment, you can still create and edit personas. The Code Snippets section is just empty until it loads.

Studio

Improved: no Terms of Service pop-up at sign-in. Studio no longer shows the "Devo AI Assist Terms of Service" dialog after every sign-in. You go straight to the app.

New: search snippets. The Snippets manager has a search box, so you can find a snippet without scrolling the whole list.

Improved: "Chat Ops" in permission names. When adding a grant to a permission set, the Chat Ops permissions were listed under an old internal name ("Mero connections", "Mero memory" and so on). They now say "Chat Ops".

Fixed: trigger and role picker fixes.

  • On tenants that enforce service accounts, the trigger identity preview showed an error. It now explains why the identity isn't allowed.
  • The role suggestion list no longer covers the form's submit button.

New: support link in the sidebar. The sidebar can show a Support link that opens your deployment's support desk inside Studio, matching Studio's light or dark theme. (Rolling out gradually, tenant by tenant.)

Strike48
Strike48

Building next-gen infrastructure tooling for security teams.