July 17, 2026
© 2026 SOC Prime Inc.
All rights reserved. This product and documentation related are protected by copyright and distributed under licenses restricting their use, copying, distribution, and decompilation. No part of this product or documentation related may be reproduced in any form or by any means without the prior written authorization of SOC Prime. While every precaution has been taken in the preparation of this book, SOC Prime assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.
Level Blue USM Query (PPL) Support
We're constantly expanding support for SIEM, EDR/XDR, and Data Lake platforms, along with various query and rule formats. With the latest SOC Prime Platform release, we've extended Level Blue USM support by adding the Query PPL format. Query PPL format is now available in Threat Detection Marketplace and Uncoder AI in the following locations:
In Expert Filters > Platform on the Search page
On the Detection Code tab of the Detection Rule page
As a target language format for content translation in Uncoder AI
Action Menu Updates Across the Platform
To provide a more consistent user experience, we've replaced the action icons with a three-dot menu on the pages in Platform Settings. To edit or delete an item, users should click the three-dot menu next to it and select the desired action.
Discontinued Freemium
We are ending the Freemium offering for the SOC Prime Platform at the end of July. Organizations interested in exploring the SOC Prime Platform can request a demo or start a trial (pilot).
Enhanced Restricted Access Pages
With this release, we've updated the messaging on the Restricted Access pages shown to users who don't have access to certain modules in the SOC Prime Platform. These pages now include descriptive, benefit-oriented headlines that provide a clearer overview of each module's capabilities.
Additionally, we’ve improved visual consistency of the pages by aligning section titles, font sizes, and image sizes. The updated pages include Custom Field Mapping, Integrations, Data Planes, Tenants, Presets, Search Profiles, and API.
Content Quality Improvements
Splunk
Added additional condition grouping with parentheses to improve translation accuracy to Splunk.
CrowdStrike Next-Gen SIEM
Removed field index in translation to CrowdStrike Next-Gen SIEM Query.
Key Bug Fixes and Improvements
Fixed several UI issues in Threat Detection Marketplace, including:
Fixed an issue in the Repositories selector where clicking the result count in Light Search sometimes failed to expand the dropdown list.
Fixed an issue in Threat of the Month where the eye icon on the tile sometimes was cut off in Safari.
Updated the loading skeleton size in Active Threats to better match the actual size of list elements.
Fixed an issue where the icon in the Related Threats section header on the Active Threat News Item page was sometimes cut off in Safari.
Fixed an issue where the search icon in the Active Threats search bar was sometimes cut off in Safari.
Fixed an issue where Data Plane and platform icons sometimes were cut off in Safari on the following pages: Tenants, Data Planes, Integrations, Custom Field Mapping, Filters, and Presets.
Fixed an issue where sometimes the confirm icon was not displayed correctly when creating a Custom Field Mapping profile.
Fixed an issue where search suggestions were sometimes not displayed in the dropdown on the Search page.
Fixed an issue where granting users access to GitLab sometimes resulted in an error message.
Resolved an issue where the count on the Detections, Simulations, and Attack Flow tabs of the Active Threat News Item page was sometimes displayed incorrectly.
Fixed an issue where certain names, including detection names, Data Plane names, Filter names, and other entities, were not displayed in Google Chrome across the platform.
Fixed an issue where navigating to another page in tables with pagination did not reset the scroll position to the top of the table.
Fixed an issue that caused an error message to appear when translating from Roota if the mitre-attack field was empty.