Software Release Date: September 15, 2026
Release Note Updated: September 29, 2026
The Stellar Cyber 7.0.0 release delivers the following updates to the Stellar Cyber Open XDR platform.
Highlights - The following features are the highlights of this release:
Alert and Case Auto-Triage with Case Queues – Enable AI case summary and auto-triage for each case queue, with a new default AI Analyst queue for critical cases.
Case Metrics – Define case metrics from quick-start templates or custom timer conditions, then track them as case queue columns and on the Case Detail page.
Detailed Sandbox Evidence in Malware Alerts – View the detailed Sophos sandbox report, including process, file, registry, and network artifacts, directly in the alert so analysts can validate a verdict without leaving it.
Parser Studio Enhancements – Use Parser Studio to enable and disable parsers in bulk with the Disable Inactive Parsers workflow, monitor parser activity with a 7-day ingestion column, create parsers from scratch, and download parsers for use across tenants.
System Action Center Public APIs – Use System Action Center APIs to create and manage actions across all trigger categories programmatically.
New Context-Driven Detections – Detect Active Directory pass-the-ticket attacks, Microsoft 365 sign-ins from never-before-seen ASNs, and SSH brute-force attempts that include aborted sessions.
Printable Payload on IDS Alerts – View the triggering packet content directly in the alert details panel.
Expanded Response Actions – Respond to threats with FortiGate URL and domain blocking, Microsoft Defender for Endpoint responder actions, and Cybereason Malop-level containment.
New Alert Integrations – Integrate alerts from Cisco AMP, Ironscales, and Memcyco.
New Connector – Connect to ThreatDown Nebula to ingest detections, endpoints, endpoint scans, events, and suspicious activity.
Actions Required - There are no actions required in this release.
Behavior Changes - Changes that affect the way users interact with the product or interpret results are as listed:
AELDEV-67525: API error responses return the request identifier under a new name – The API error responses to return the
request_idfield in place ofrequestIdwere updated. After upgrading to 7.0.0, integrations and scripts that parse therequestIdfield in server error responses no longer find it and might fail or lose log correlation. Update any integration that reads the error identifier to use therequest_idfield.AELDEV-67820: Public API endpoints for sensors now require RBAC privileges – Role-based access control (RBAC) privilege enforcement was added to the public sensor endpoints under
/data_sensors, which were previously reachable by any authenticated API user regardless of privilege profile. After upgrading to 7.0.0, an API user whose privilege profile does not grant the privilege that governs the equivalent action in the user interface receives a 403 response where the request previously succeeded. Review the privilege profiles assigned to API users and automation that call these endpoints before upgrading. Enforcement on the pre-existing endpoints can be disabled for an organization as a transition measure; the privilege check on the new uninstall endpoint is always enforced.AELDEV-28743: The tenant group list API no longer returns logo image data – The
tgrp_logofield was removed from tenant group list API responses. After upgrading to 7.0.0, integrations that read the logo image from the list response no longer receive the image data. Update these integrations to retrieve logo images on demand through the/tenant_group/{id}/logoendpoint.
Deprecated Features - The following features are deprecated:
Upcoming Deprecation: SentinelOne Deep Visibility API – The Deep Visibility content type in the SentinelOne connector will be migrated to the Deep Visibility (SDL) content type in 7.0.0 due to a SentinelOne API being deprecated. Refer to the following dates:
Standard SaaS: Feb 15, 2027
GovCloud: April 26, 2027
Make sure to migrate content types from Deep Visibility to Deep Visibility (SDL) before the API is deprecated.
Upcoming Deprecation: Trend Micro Cloud One v2.0 API – The Trend Micro Cloud One v2.0 API is being deprecated. If you previously used the Trend Micro Cloud One connector, you should now use the Trend Micro Vision One connector in 7.0.0 and the Endpoint Inventory content type, which is only supported in the v3.0 API. The Trend Micro Vision One v3.0 API covers what previously required two separate connectors: Trend Micro Vision One and Trend Micro Cloud One. The Endpoint Inventory content type replaces the Computers content type previously collected through the Trend Micro Cloud One connector.
Autonomous SOC - New Features
ClosedASOC-152: Added per-queue AI case summary and auto-triage settings for case queues.
Detection/ML - New Features
ClosedAELDEV-69344: Added Cisco AMP alert integration.
ClosedAELDEV-68929: Added Ironscales alert integration.
ClosedAELDEV-68306: Added an alert type for MS365 Login From New ASN.
ClosedAELDEV-67555: Added case correlation for alerts generated by correlation rules.
ClosedAELDEV-61066: Added Memcyco alert integration.
ClosedAELDEV-59279: Added an alert type for Possible Pass-the-Ticket Attack.
Detection/ML - Improvements
ClosedAELDEV-72528: Improved processing of Sophos protection-disabled and outbreak events into alerts.
ClosedAELDEV-71314: Improved Successful Login After Brute Force fidelity scoring for internal IP addresses.
ClosedAELDEV-70538: Improved suppression for ESET Inspect alert integration.
ClosedAELDEV-68309: Improved three alert types to add subtypes for aborted SSH sessions.
Stellar Cyber Platform - New Features
ClosedAELDEV-73312: Added support for the new credential management workflow.
ClosedAELDEV-72895: Added an HTTPS endpoint option for data sinks without SSL validation.
Stellar Cyber Platform - Improvements
ClosedAELDEV-73532: Updated the query_window_start field to use a consistent datetime format across indexes.
ClosedAELDEV-67557: Improved the Office 365 Multiple Users Deleted alert with user count and username list.
ClosedAELDEV-67064: Improved the time required to load user interface settings when signing in.
Sensors - New Features
ClosedAELDEV-72713: Added a printable payload field on IDS alerts with inline display in alert details.
ClosedAELDEV-71616: Added sensor CLI commands showing heartbeat and phone-home status.
ClosedAELDEV-71317: Added a sensor CLI option to upgrade via ACPS or the Data Processor.
Sensors - Improvements
ClosedAELDEV-73711: Added support for Intel E810 series network adapters on sensors.
ClosedAELDEV-70934: Added Intel E610 NIC driver support to the sensor VM image.
ClosedAELDEV-72518: Added official Linux Server Sensor support for OpenSUSE Leap 15.6 and 16.0.
ClosedAELDEV-71143: Added Linux Server Sensor support for Ubuntu 26.04.
ClosedAELDEV-71294: Added a minimum image guardrail for sensor ISO installation.
Connectors - New Features
ClosedAELDEV-72209: Updated the Trend Micro Vision One connector to v3.0 API.
ClosedAELDEV-71574: Introduced the ThreatDown Nebula connector.
ClosedAELDEV-67465, AELDEV-63463, AELDEV-66973: Added blocking and unblocking of domains and URLs on FortiGate firewalls.
ClosedAELDEV-54698: Enhanced the XDR Connector to add full normalization and enrichment.
Connectors - Improvements
ClosedAELDEV-73636: Improved XDR Connector preview to execute normalization and enrichment steps.
ClosedAELDEV-73627: Updated Trend Micro Vision One response actions to the v3 API.
ClosedAELDEV-73611: Improved data normalization for Idira Privilege Cloud audit events.
ClosedAELDEV-71556: Enhanced the Idira (formerly CyberArk) Privilege Cloud connector.
ClosedAELDEV-72419: Improved Office 365 audit normalization with canonical file and user fields.
ClosedAELDEV-72417: Improved Microsoft Entra ID risky user normalization with canonical user fields.
ClosedAELDEV-72416: Improved Azure Event Hub normalization of source and destination IP fields.
ClosedAELDEV-72415: Improved SentinelOne alert normalization with canonical host and process fields.
ClosedAELDEV-72290: Added proxy support for the Cisco FMC connector running on DP.
ClosedAELDEV-71267: Extended the query_window_start timestamp to other connectors.
ClosedAELDEV-71048 and AELDEV-71052: Added content types to Memcyco connector.
ClosedAELDEV-70599: Updated the SentinelOne connector to migrate Deep Visibility.
ClosedAELDEV-68290: Added ESET endpoint UUID resolution from Cato Networks events for ATH actions.
ClosedAELDEV-43676: Enhanced Cloudflare to collect WAF events using the Generic S3 connector.
Parsers - New Features
ClosedDATA-3604: Introduced a parser for ingesting Apache APISIX logs.
ClosedDATA-3577: Introduced a parser for ingesting Cisco Secure Workload logs.
ClosedDATA-3560: Introduced a parser for ingesting Extreme Networks ExtremeCloud IQ logs.
ClosedDATA-3556: Introduced a parser for ingesting BeyondTrust Privileged Remote Access logs.
ClosedDATA-3538: Introduced a parser for ingesting Check Point CloudGuard WAF logs.
ClosedDATA-3532: Introduced a parser for ingesting IBM TS4500 logs.
ClosedDATA-3531: Introduced a parser for ingesting Dell PowerMax storage logs.
ClosedDATA-3502: Introduced a parser for ingesting Claude Code OpenTelemetry telemetry.
Parsers - Improvements
ClosedAELDEV-71125: Added bulk enable/disable of parsers with 7-day ingestion visibility in Parser Studio.
ClosedAELDEV-70581: Added legacy built-in parser activity information to the Parser Studio list.
ClosedAELDEV-70204: Added download of modular parser configurations for cross-tenant reuse.
ClosedAELDEV-70203: Added the option to create a parser from scratch in Parser Studio.
ClosedAELDEV-69093: Improved Parser Studio Ignore Values to support adding multiple values at once.
ClosedAELDEV-68915: Added custom legacy and modular parsers to the Add Log Source Configuration dialog box.
ClosedAELDEV-67031: Added Root Tenant support for modular custom parsers in on-premises deployments.
ClosedDATA-3578: Added support for ManageEngine PAM360 resource-audit session logs.
ClosedDATA-3576: Expanded the Barracuda firewall parser to support web filter logs from Barracuda CloudGen Firewall.
ClosedDATA-3567: Updated the Citrix ADC parser to map the client IP to the source IP field.
ClosedDATA-3565: Improved modular parser error visibility with searchable error records.
ClosedDATA-3557: Improved the Barracuda firewall parser.
ClosedDATA-3548: Improved the ColorTokens parser to normalize IP addresses and other common fields.
ClosedDATA-3547: Updated the Linux Audit parser.
ClosedDATA-3533: Extended the Imperva parsers to extract additional fields.
ClosedDATA-3528: Improved the Penta Security WAPPLES WAF parser to normalize the destination IP address and port.
ClosedDATA-3512: Added Ubiquiti EdgeSwitch key-value pair log format support.
ClosedDATA-3511: Added Raw Log Capture support for Parser Studio v2 parsers.
ClosedDATA-3506: Added Apache HTTP Server (HTTPD) parser support for forwarded access-log messages.
ClosedDATA-3499: Added alert integration for Palo Alto Networks logs in LEEF format.
ClosedDATA-3486: Improved SonicWall IPS severity mapping to match SonicWall documentation.
ClosedDATA-3467: Improved the Citrix NetScaler parser with expanded event coverage.
ClosedDATA-3462: Improved the F5 - ASM (CEF) parser to parse events consistently.
ClosedDATA-3442: Improved the Check Point - SmartConsole (CEF) parser to extract additional fields.
ClosedDATA-2637: Improved the WatchGuard firewall parser to extract event description fields.
Usability - New Features
ClosedAELDEV-73672: Added a Metadata Dictionary link in the Parser Studio normalization step.
ClosedAELDEV-70028: Added a timezone preference to Automated Threat Hunting (ATH) email recipients.
ClosedAELDEV-68354: Added API support for creating System Action Center (SAC) actions.
ClosedAELDEV-67820: Added a public API endpoint to initiate Server Sensor uninstall from the Stellar Cyber Platform.
ClosedAELDEV-67002: Added Microsoft Defender for Endpoint response actions to Threat Hunting and Action History.
ClosedAELDEV-66747: Added case metrics for measuring case operation times.
ClosedAELDEV-66489: Disabled the Add as excluding filter option on the parser page.
ClosedAELDEV-62025: Added a public API endpoint to generate sensor installation tokens.
Usability - Improvements
ClosedAELDEV-73161: Updated the log filter Log Source field label to indicate Log Forwarder scope.
ClosedAELDEV-71377: Improved original record queries for ML correlation detection alerts.
ClosedAELDEV-70114: Improved API error messages to identify the failing downstream service.
ClosedAELDEV-69501: Added tenant mapping validation of the Stellar Cyber Tenant ID against the tenant name.
ClosedAELDEV-68264: Added Cybereason support for alerts that span multiple machines.
ClosedAELDEV-67803: Added yearly and past-month views to the Asset License Usage Data page.
ClosedAELDEV-67525: Updated API error responses to rename the request identifier field.
ClosedAELDEV-28743: Updated the tenant group list API endpoint to exclude logo image data.
Resolved Issues - The following issues were resolved in this release.
ClosedAELDEV-74798: Fixed SentinelOne Alerts and Deep Visibility (SDL) content types.
ClosedAELDEV-73835: Fixed Linux Server Sensor disconnects on Ubuntu 26.04 that were caused by a removed system library.
ClosedAELDEV-72281: Fixed repeated re-triggering of Automated Threat Hunting rules on query timeouts.
ClosedAELDEV-72117: Fixed Azure VTAP port mirroring producing no traffic records.
ClosedAELDEV-71954: Fixed Acronis connector handling of HTTP 400 responses.
ClosedAELDEV-71502: Corrected the MITRE ATT&CK mapping of the RDP Suspicious Logon alert type.
ClosedAELDEV-70760: Fixed FortiGate administrative session exhaustion during automated response actions.
ClosedAELDEV-70235: Fixed Palo Alto Networks respond actions failing with timeouts.
ClosedAELDEV-69890: Fixed sensor log rotation to prevent unbounded log file growth.
ClosedAELDEV-62383: Fixed a Linux Server Sensor failure on Debian 12 caused by a library version mismatch.
ClosedAELDEV-46633: Fixed false positives in process_creation_commandline_15 rule.
ClosedDATA-3634: Fixed log filter rules that never matched when the rule used a numeric equality or inequality operator.
Early Access Program
If you're interested in testing out new features ahead of general availability, consider joining the Early Access Program (EAP) by contacting us at support@cspglobal.com as your Stellar Cyber Customer Success representative and tell us which EAP feature you want to test. Once you've agreed to the EAP terms and signed up, the EAP feature is unlocked for you.
The purpose of this program is to boost performance and reliability through real-world customer insights, giving you a hands-on role in shaping a Stellar Cyber feature. In return, you'll receive early access to upcoming releases and the chance to guide product development.
The following EAP features are in this release:
Alert Auto Triage and AI Assistance
Alert Auto Triage automatically investigates the alerts in a case, runs Verdict Signal Checks against them, and assigns each alert a verdict with the reasoning behind it. AI Assistance is a natural-language investigation workbench built into every triaged case, converting your plain-language questions into answers grounded in the case data, alert details, and Verdict Signal Check (VSC) context that Auto Triage has gathered. Where the verdict tells you what Stellar Cyber concluded, AI Assistance explains why, and it supports follow-up questions in your own words with no query syntax to learn. AI Assistance is included with every Auto Triage license at no additional cost.
Case Summary and Analysis
Case Summary and Analysis uses AI to turn the evidence in a case into a readable account of what happened: an overview of the activity, its potential impact, the key insights drawn from the alerts, and recommended next steps. You can grasp the shape of a case without reading every alert first, and the summary gives a consistent starting point for triage, escalation, and handoff between shifts.
Exportable Dashboards — Report Integration
Exportable Dashboards lets you schedule dashboards created with the Dashboard Builder as recurring PDF reports. The schedule form includes a new Default PDF type that renders the dashboard as it appears in the Dashboard Builder, along with options to control table row counts, chart color palettes, and optional CSV exports. This capability lets you generate consistent, configurable reports from new dashboards while preserving the settings and PDF types used by existing scheduled reports.
XDR Connector Webhook Ingestion
This is a webhook framework that lets you post JSON data directly from any external system into Stellar Cyber, accelerating custom integrations and expanding your visibility across the entire security stack.
Customizable Case Correlation Strategies
This EAP feature introduces support for multiple case correlation strategies, allowing teams to evaluate and experiment with different approaches to grouping alerts into cases. Each strategy provides a distinct investigative perspective:
Attacker-Centric Correlation groups alerts by the source (attacker) host, making it easier to track adversary behavior across multiple targets.
Victim-Centric Correlation organizes alerts by the destination (victim) host, enabling focused protection and visibility on high-value assets.
Multi-Entity Correlation links alerts across interconnected hosts and actions to form a single case, offering a holistic view of extended or lateral attack campaigns.
This flexibility enables security teams to tailor investigations based on their operational priorities—whether that’s identifying persistently targeted endpoints, tracing threat actor movements, or capturing full-scale intrusion campaigns.
Alert for Suspicious OCI Tenant-to-Tenant Communication
This EAP feature introduces a new alert type that detects cross-tenancy communications in the Oracle Cloud Infrastructure (OCI). By analyzing tenantId fields in audit logs, the feature identifies requests that target resources in a different tenancy. This provides accurate visibility into potentially unauthorized cross-tenancy activity and strengthens oversight in OCI environments.
To join the Early Access Program and begin testing these features, contact us at support@cspglobal,com as your Stellar Cyber Customer Success representative.