August 18, 2025

© 2025 SOC Prime Inc.

All rights reserved. This product and documentation related are protected by copyright and distributed under licenses restricting their use, copying, distribution, and decompilation. No part of this product or documentation related may be reproduced in any form or by any means without the prior written authorization of SOC Prime. While every precaution has been taken in the preparation of this book, SOC Prime assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.

SOC Prime’s release 6.0.0 focuses on delivering smarter, faster AI-native workflows for threat detection. Key enhancements include the following:

With this release, we’ve added support for Model Context Protocol (MCP) tools that transform AI into a contextually aware cybersecurity co-pilot. MCP provides a framework for AI to understand instrumentation and make decisions grounded in the organization’s environment and threat landscape. MCP is an open standard that connects LLMs to diverse data sources and tools, similar to how USB-C links devices. This standard enables easier integration, vendor flexibility, pre-built connections, and secure data handling, supporting agents and complex LLM workflows.

With the MCP standard, Uncoder AI performs content-based searches by converting requests into keywords for metadata lookup. MCP ensures that AI functionality works intelligently, understanding user inputs and applying the right AI feature for the task.

With this latest SOC Prime Platform release, we’ve introduced MISP integration, an open-source threat intelligence platform formerly known as Malware Information Sharing Platform, which allows organizations to share, store and correlate IOCs, malware samples, and other cybersecurity information.

To set up the MISP integration, SOC Prime users need to take the following steps:

Note: The SSL verification toggle switch is enabled by default.

Once created, the Check Connection option is available for the newly created integration profile under the Status column on the Integrations page, similarly to other integrations. When editing the integration profile, users can see the latest update details and launch this update manually.

With the SOC Prime Platform release 6.0.0, we’ve added the SOC Prime Attack Detective App for Microsoft Graph API to SOC Prime Platform. The SOC Prime Attack Detective App for Microsoft Graph API provides a secure bridge between Microsoft Defender for Endpoint and the SOC Prime Attack Detective platform, enabling automated threat hunting and security analysis.

As part of the latest release, we’ve implemented UX improvements to the SOC Prime website, more specifically:

The SOC Prime Platform 6.0.0 release introduces significant enhancements to the Platform’s AI-native capabilities, designed to accelerate and simplify the way security teams explore, analyze, and respond to threats. This update leverages integrated intelligence, actionable insights, and advanced detection tools through the AI Chat Bot interface and Model Context Protocol (MCP), enabling streamlined, end-to-end detection pipelines.

A smarter AI-driven process now connects Active Threats and Uncoder AI, providing a fully integrated workflow for discovery, analysis, and response. With these improvements, security teams can make faster, more accurate operational decisions.

Continue reading to learn about the latest updates in Active Threats, or jump directly to the Uncoder AI section for details on new enhancements.

Active Threats now processes and aggregates a larger volume of threat intelligence streams, providing broader coverage and more actionable insights. Users can easily prioritize the most critical threats, quickly filter relevant events, operationalize the CTI, and detect attacks more efficiently.

With this release, Active Threats highlights Threat of the Month, selected by SOC Prime experts for its criticality and relevance. The item includes AI-generated summaries, related CTI, Attack Flow visuals, and detection rules. All this is available to SOC Prime Platform users for free, supporting faster prioritization and industry-wide expertise sharing.

The upgraded Active Threats search lets users explore the latest threats in 200+ languages with AI-powered precision. It transforms natural language prompts into accurate filters for CTI, IOCs, and detection rules, delivering a summarized view of results, fusing threat intelligence from multiple sources.

To use the new AI-powered search across Active Threats:

With the latest Active Threats update we have introduced a set of UI improvements to ensure the most smooth and streamlined experience for the SOC Prime Platform users:

This release enhances the Platform’s AI-native capabilities, delivering a fully integrated AI-driven workflow for threat detection. Explore the latest updates in Uncoder AI by reading further or go directly to Active Threats for new enhancements.

The latest Uncoder AI update introduces a New AI Chat Bot mode, a dialog-based, user-friendly interface that lets users interact with Uncoder AI in plain language and perform detection engineering tasks end-to-end. The New mode is backed by MCP tools supporting complex LLM workflows and enabling AI to stay grounded in the user’s environment and threat landscape. The Classic mode also remains available, preserving the traditional Uncoder UI for users who prefer the original experience.

Note: The New AI Chat Bot mode is currently in Early Access, meaning that new features are being continuously added. Certain capabilities, like working with specific MCP tools and modifying AI-generated objects, e.g,. Attack Flows, have only basic functionality that is regularly expanded.

The new AI Chat Bot interface allows users to enter prompts in natural language and perform a full range of detection engineering tasks end-to-end.

To execute the detection engineering task using a custom prompt, follow the steps below:

Alternatively, users can choose from pre-built AI tasks if they prefer a guided approach instead of interacting with the AI Chat Bot via custom prompts. In this release, the available AI tasks include:

To initiate the AI task, users should follow the routine below:

The latest update brings detection rule code editing directly into the New mode of Uncoder AI. The left-hand panel now serves as a built-in editor where users can create rules from scratch or modify existing code. Detection logic can be tuned using AI tasks or custom prompts, with AI-generated suggestions displayed above the dialog box on the left. The adjustments can be instantly applied to the editor section on the right via the Replace or Copy buttons. Once finalized, rules can be saved to a custom repository or copied directly from the Uncoder UI.

With the latest release, we have introduced support for Elastic ES|QL Query and Elastic ES|QL Rule formats to Uncoder AI, ensuring proper aggregation.