For more information, see Agent release notes.

Added the option to include risks from low signal assets. By default, this is disabled if you are an existing customer.

For more information, see Enable or disable risks for low signal assets.

Added access control as a data source to the Aurora Security Assistant.

For more information, see Aurora Security Assistant.

Introduced Aurora Agentic SOC transparency in the Arctic Wolf® Portal preview. You can now view the reasoning and confidence level of each specialized AI agent (Swarm of Experts) that investigated a security event directly in the case timeline. Expand any AI triage entry under Action Center > Cases to see individual agent names (for example, Observation Agent or Identity Agent), verdicts (Close, Alert, or Unable), qualitative confidence scores, and per-agent reasoning. The Swarm View tab in the Home group, or the Swarm View option in the Investigation Timeline, shows the Agentic SOC steps, sequences, and detailed reasoning and findings. New Mean-Time-to-Verdict (MTT) KPIs are now available on the Operational Health dashboard. To enable this feature, a user with administrator access must turn on the Agentic SOC toggle under Administration > Organization > Admin Settings.

For more information, see View ticket details.

Enhanced Data Explorer with AI Mode and search summarization. After running a search or entering a natural language query in AI Mode, click Summarize to generate a plain-language summary of your results, automatic visual widgets (including pie and line charts), and Summary Cards highlighting key domains, IP addresses, and timeframes.

For more information, see Summarize search results with Aurora Security Assistant.

Introduced the Arctic Wolf Query Language (AQL), a pipe-based syntax for building advanced telemetry queries in Data Explorer. With AQL, you can define output columns using project, aggregate data using summarize, and perform case-insensitive or regular expression searches. AQL is available to all customers with a Data Explorer license. For more information, see Arctic Wolf Query Language (AQL).

Added new response actions for the Idira Identity Security Platform (formerly CyberArk Identity Security Platform) integration for Active Response: Close user sessions, Add/Remove a user from a security group or role, and Add/Remove a user from a restricted role.

To enable these actions for existing sensors, edit the service user permissions to include both User Management and Role Management, and configure a restricted access role. For instructions, see Configure Idira Identity Security Platform for Arctic Wolf Active Response.

Added support for French and Japanese. The app language updates automatically based on your device's system language setting. On Android, you can also set the language per-app in App Info. For more information, see Arctic Wolf mobile app.

Customers with an Aurora Vulnerability Management (Aurora VM) subscription and the Arctic Wolf Resolve add-on can now apply patches for top risks directly from the mobile app. Look for the Patch Available indicator on the Risk tab and tap Apply Patch to schedule a deployment. For more information, see Managed risk.

Added cloud sensors and cloud scanners to the Monitoring tab. These views are read-only; to decommission or edit cloud telemetry sources, use the Unified Portal.

Removed decommission and delete actions from the mobile app. These actions are now available only in the Unified Portal.

For more information, see Arctic Wolf mobile app.

Action required by November 23, 2026: Arctic Wolf is moving phishing simulations to a new email delivery platform to support enhanced phishing simulation detection capabilities. To ensure continued delivery of phishing simulation emails, customers must add the new IP address range 3.42.155.128 – 3.42.155.135 to their email allowlists before November 23, 2026.

There may be temporary interruptions to phishing simulation email delivery during the migration on November 23. Customers using Aurora Security Awareness and Training Plus should avoid scheduling custom phishing simulations on that date.

For more information about this change, visit the ASAT portal. For more information about email allowlist setup, see Add ASAT to email allowlists and Add ASAT to email gateway and spam filtering.

Added support for the Palo Alto Networks Cortex XDR® integration for Active Response.

For more information, see Configure Cortex XDR for Arctic Wolf Active Response.

Added a multi-tenant Tasks view that consolidates tasks across all customer organizations in a single page. MSP users can search, filter, sort, and export tasks, and navigate directly to task details or customer organization portals.

For more information, see Tasks and View and manage MSP Portal tasks.

Added the Vulnerability Management Viewer role to MSP User Management. MSP admins can assign this read-only role to customer users and third-party contacts to provide scoped access to Aurora Vulnerability Management (Aurora VM) pages in the Unified Portal.

For more information, see Vulnerability Management Viewer role.

Added the MDR Portal Viewer role to MSP User Management. MSP admins can assign this read-only role to customer users and third-party contacts to provide limited access to MDR subscription-related menus in the Unified Portal.

For more information, see MDR Portal Viewer role.

For more information, see Aurora Security Assistant.

For more information, see Assets table.

For more information, see Aurora Security Assistant.

For more information, see Aurora Security Assistant.

For more information, see Review security investigations.

• 1Password
• Claroty xDome for Healthcare and Industrial Environments
• Cloudflare WAF
• Datadog
• Epic
• ExtraHop RevealX 360
• Imprivata ITDR
• Proofpoint Essentials
• Veeam Data Platform

• Cloudflare WAF
• Imperva Cloud WAF
• Proofpoint Essentials
• TrendAI Vision One Endpoint Security

Added support for Gmail, Google Meet, Google Calendar, SAML Audit Activities, and Alert Center events to the Google Workspace security monitoring integration.

To enable the collection of Alert Center events for existing Google Workspace sensors, you must update the sensor configuration to enable the Google Workspace Alert Center API. For more information, see Step 2: Enable APIs in Configure Google Workspace cloud for Arctic Wolf monitoring.

Added a natural language query engine to Data Explorer. You can now type plain language queries instead of using the dropdown Query Builder. The Query Builder remains available as an alternative.

For more information, see Create and run a query.

Updated Data Explorer with log source filtering. You can now filter log data by selecting log sources directly from the query interface, making it easier to target specific data without having to build complex search queries manually. When you select log sources, associated fields are highlighted in the Query Builder to help you identify relevant fields quickly.

For more information, see Create and run a query.

Added a new Risk Evidence Data field that you can include when you export risk data. You can also still use the existing Risk Evidence URL field.

For more information, see Export risk data.

Added the Data Exploration role for MSP-managed users. MSPs can assign this role to give users read and write access to all menus and submenus within Data Exploration in the Unified Portal, without requiring a Customer Directory account.

For more information, see Data Explorer, Analyze traffic flow data, and Raw Log Search.

Improved Aurora Security Assistant to answer questions about Threat Intelligence bulletins.

For more information, see Aurora Security Assistant.

Launched Aurora MDR Connect. Built on the Aurora Superintelligence Platform, MDR Connect gives MSP customers immediate access to Arctic Wolf security operations and integrations.

For more information, see Aurora MDR Connect.

Improved Aurora Security Assistant to answer questions about tickets from anywhere in the Unified Portal.

For more information, see Aurora Security Assistant.

For more information, see Arctic Wolf Ticket API.

The Arctic Wolf mobile app is now available for iOS. The app is available for both Android and iOS, allowing you to access core Unified Portal features from your mobile device.

The app supports secure sign-in with SSO and MFA, and is available for devices running Android 12 or later, or iOS 17.4 or later.

For more information, see Arctic Wolf mobile app.

For more information, see Arctic Wolf Portal beta.

Introduced the Arctic Wolf mobile app for Android. You can now access core Unified Portal features from your mobile device.

The app supports secure sign-in with SSO and MFA, and is available for devices running Android 12 or later.

For more information, see Arctic Wolf mobile app.