What's new

This release expands visibility into SD-WAN control-plane activity, enabling security teams to detect unauthorized peers, anomalous control connections, and topology drift earlier. By baselining peer relationships and highlighting rare or unexpected control-plane combinations, defenders can more quickly surface misconfigurations, rogue devices, and potential exploitation attempts targeting SD-WAN infrastructure. The result is improved oversight of network edge components, reduced time to validate suspicious peering events, and stronger assurance that control-plane trust relationships have not been silently altered.

On the endpoint side, new process-level detection strengthens coverage for obfuscated payload retrieval, helping SOC teams identify evasive download behavior before secondary tooling is deployed. Threshold-based logic and tunable parameters across analytics support environment-specific noise reduction while preserving high-signal findings. Additional detection refinements and YAML validation improvements enhance rule accuracy, consistency, and maintainability—reducing operational friction, improving signal quality, and supporting faster investigations across both network and endpoint layers.