March 20, 2026

© 2026 SOC Prime Inc.

All rights reserved. This product and documentation related are protected by copyright and distributed under licenses restricting their use, copying, distribution, and decompilation. No part of this product or documentation related may be reproduced in any form or by any means without the prior written authorization of SOC Prime. While every precaution has been taken in the preparation of this book, SOC Prime assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.

With the latest release, we’ve added support for the Crowdstrike NextGen SIEM and Trend Vision One platforms, that are currently available for Threat Detection Marketplace and Uncoder AI functionality. The Crowdstrike NextGen SIEM and Trend Vision One platforms can now be selected:

Detection content in the Trend Vision One format can be stored in a custom repository. For Crowdstrike NextGen SIEM format, detection content can also be stored in a custom repository, with additional support for Custom Field Mapping, Filters, and Presets.

We have also restructured how Falcon LogScale is represented in the platform. Previously available as a standalone content type, Falcon LogScale is now included as part of CrowdStrike NextGen SIEM. As part of this update, the following content types have been renamed to align with the updated structure:

As part of the latest release, we’ve improved email notifications to provide better visibility into system events and more flexibility in how notifications are received.

On the Accounts Settings > Email Notifications tab, users can now enable the Notify me on Data Plane disconnection toggle. When enabled, users are notified if a Data Plane loses connection. This helps ensure immediate visibility into issues affecting scheduled scans and reduces the need for manual investigation.

Notifications include:

On the Accounts Settings > Email Notifications tab, users can now add an alternative email address to receive operational system notifications and technical events. All notifications are also sent to the user’s primary email address.

With the latest release, we’ve added the ability for the users setting up the Splunk platform with the on-prem environment type to select Quick Hunt and Automation options. SOC Prime users can now choose where the on-prem Splunk Data Plane will be used:

With the latest SOC Prime release, we’ve made several improvements related to the Active Threats module.

When users enter a query in the search bar, threat-related suggestions now appear with a dedicated threat icon. Selecting a suggested threat opens it in a new browser tab. This improvement helps users visually distinguish threat content from other content types and easily switch between tabs to view threat details alongside related content.

A visual indicator has been added on the rule row on the Active Threat details page to show deployment status. Users can now quickly identify which detection rules from Active Threats are deployed and which are not without opening each detection rule individually.

With the latest release, we’ve improved the Advanced Search performance. As part of this enhancement, we’ve improved Data Planes and Tenants loading when selecting them while marking detection content as deployed. Users can now continue interacting with the page during loading, resulting in a smoother experience.

This release introduces several changes to support DetectFlow.

We have introduced a new External Access section on the Create New Repository page, allowing custom repositories to connect and synchronize with external services. The section is available only for the organizations that have access to DetectFlow. Users can now enable the Make available for DetectFlow toggle, which allows synchronization with their organization’s DetectFlow instance. With this toggle enabled, content updates made in DetectFlow are reflected on the TDM platform, and updates on the TDM platform are synchronized to DetectFlow.

Additionally, for improved visibility across the platform, repositories with this option enabled will follow a standardized naming convention: {repository name} (in DetectFlow).

Users now have the possibility to export all Sigma rules from the custom repository to Detect Flow if access to DetectFlow is enabled for the organization. To export the rules, users must perform the following steps:

Note: It is possible to run only one export operation at a time.

With the latest Platform release, we’ve published a new customer success story with AlpenShield, showcasing how the company leverages the SOC Prime Platform to accelerate detection engineering and reduce the effort required to build and maintain high-quality detection intelligence. By using the Platform as a core foundation, AlpenShield streamlines rule development and deployment, keeps detections current as threats evolve, and scales SOC enablement with minimal operational overhead.

With the latest SOC Prime release, we’ve restructured the Blog and News sections on the website, including updated URLs, refreshed article designs, and redirects to ensure seamless navigation. From now on, news articles will be published at a new URL structure: /blog/{name-of-the-news}.

As part of this update, we’ve improved navigation and usability by moving the News section from the main header menu to Resources > Blog, where it is now available under the News tab.

Additional improvements have been made to optimize website functionality and user experience:

With this release, we’ve made the following enhancements to improve the quality of content translations across multiple SIEM, EDR, and Data Lake language formats: