Product Updates

Wildcard support in the EDR Library Item provides greater flexibility when managing allow and block lists.

This update introduces recursive wildcarding. Administrators can establish dynamic, broad-matching rules rather than specifying exact paths or filenames individually, streamlining configuration within the interface.

Endpoint Detection and Response for Windows is now generally available.

Endpoint Detection and Response (EDR) for Windows brings file-based threat detection and automated response to your Windows endpoints. Malicious files, PUPs, and unknowns are automatically categorized and acted on, keeping your fleet protected from the moment devices enroll.

Deploy via...

Microsoft Teams notifications give administrators the ability to receive alerts about detections directly within their communication platform.

This feature allows the configuration of Microsoft Teams notifications in the same manner as existing Slack integrations. Administrators can manage alert routing for the Detections section to ensure visibility into...

File and Behavioral Detections are combined into a single view. This update includes a filter to isolate either file detections or behavioral detections. The Threat Status column is normalized to align consistently across both detection types.

Note, this update modifies solely the interface and does not alter underlying data.

Device Isolation gives you the ability to immediately sever a network connection for any macOS device suspected of compromise. This feature, accessible directly within the Detections section, allows for rapid containment of active threats like malware or unauthorized lateral movement.

This feature was released in preview mode on March 5, 2026. Today, this...

The Threats tab in left navigation panel has been renamed Detections.

Additionally, "Threats by severity" and "Threats over time" have been renamed to "Detections by severity" and "Detections over time" on the Home page, Devices page, and in Iru AI.

For more information, see our support article.

Device Isolation gives you the ability to immediately sever a network connection for any macOS device suspected of compromise. This feature, accessible directly within the Threats section, allows for rapid containment of active threats like malware or unauthorized lateral movement.

Administrators can choose between two levels of isolation based on the...

The Avert Library Item has been renamed the EDR Library Item. This update ensures the Library Item name within the Library section aligns with the product name.

Note, this change affects only newly created Library Items; existing items remain unchanged.

For more information, see our support article.

Threats now includes severity level to help InfoSec teams quickly assess the criticality of detected threats. Each threat event is assigned one of five severity levels: Critical, High, Medium, Low, and Informational.

The threats table now includes a Severity column that displays the corresponding severity level for each threat. You can sort and filter...

The Threats section now includes a tags column, providing visibility into which tags are associated with each threat. Threat tags can be created, edited, and deleted within the threats section.

Tags for threats let you flexibly categorize detections with custom labels, streamlining management and enhancing team collaboration by aligning organization and...