Ingext Logo Ingext

What’s new

Better every week, without an upgrade.

New detections and improvements reach every customer automatically. Here’s what changed lately, and what it means for you.

  1. Oct 23, 2026

    Detection

    Password spraying that gets through, caught.

    When an attacker with the right password finally gets in after earlier attempts were blocked, you get a high-severity case, aimed at the Azure CLI spraying seen since June.

    New rule EntraID_SignIn_After_Block; precision fix to EntraID_Valid_Password_Blocked.

  2. Oct 23, 2026

    Detection

    Vendor apps that grant themselves power, caught.

    After Microsoft reported the Storm-0940 compromise of ConnectWise’s apps, you’re alerted when an app assigns admin roles or adds credentials to other apps.

    Four service-principal behavior rules.

  3. Oct 23, 2026

    Reporting

    Monthly and quarterly reports from what was actually recorded.

    Daily report results are kept for 12 months, so a month, a quarter or a trend is assembled from real daily evidence, without a long query or the 60-day limit.

    Report archive and the fluency-report-rollup skill.

  4. Oct 23, 2026

    Detection

    Fake helpdesk calls on Teams, caught.

    You’re alerted when “IT support” reaches out from a throwaway outside tenant, and when a browser pulls an installer from a throwaway Azure host.

    O365_Teams_OnMicrosoft_Tenant_Chat and O365_Endpoint_Download_From_Azure_CloudApp.

  5. Oct 20, 2026

    Detection

    Three active Microsoft 365 campaigns, covered.

    Session theft, device-code phishing and app-based tenant takeover are now detected end to end, plus persistence and privilege abuse.

    19 alerting and 12 context rules for Storm-2755, Storm-2372 and Storm-3119; five older rules retired.

  6. Oct 13, 2026

    Platform

    Every escalated case now explains itself.

    Each case that reaches your team arrives with an AI investigation report. Entra ID sign-ins, including non-interactive ones, can now be collected through Azure Event Hubs.

    October 2026 Platform Update; v2 interface on every instance.

  7. Jul 24, 2026

    Platform

    Scales past a terabyte a day, every event processed once.

    Detection keeps up at high volume without duplicates or gaps, with new SentinelOne, CrowdStrike Falcon, Duo, LDAP and Abnormal Security integrations.

    Platform Update v2.6.50: EventWatch under the job manager; KQL search history; send_email MCP tool.

  8. Jun 18, 2026

    AI

    Ask your data in plain English.

    Open-source skills let an AI assistant query your events and platform health directly, without learning a query language.

    Ingext Skills v1: ten skills including ingext-kql and ingext-promql.

Full release notes in the manual →See the attacks we cover →