August 21, 2026
© 2026 SOC Prime Inc.
All rights reserved. This product and documentation related are protected by copyright and distributed under licenses restricting their use, copying, distribution, and decompilation. No part of this product or documentation related may be reproduced in any form or by any means without the prior written authorization of SOC Prime. While every precaution has been taken in the preparation of this book, SOC Prime assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.
Pipeline Runtime Parameters
Pipeline Runtime parameters can now be changed also after creation of a pipeline.
Pipeline Duplication
Added the ability to duplicate pipelines. On the Pipelines page, users can click the three-dot menu next to a pipeline and select Duplicate to create a copy. A complete copy of the original pipeline is created, but it always has the disabled stated by default.
Additional Object in Added Metadata
We've extended the detectflow object by primary_match object that includes the information on the matched rule with the highest severity (if there are multiple rules with the same severity, the most recently updated one is used), e.g.:
"detectflow": {
"processed_at": "2026-06-18T14:32:01.600Z",
"matchnode_version": "2.2.0",
"severity": "critical",
"primary_match": {
"sigma_rule_uuid": "111114f7a-1c3b-4e8d-9a2f-3c7b61111111",
"_rule_id": "1111111-941e-46ca-b9d4-a14268b350c0",
"rule_name": "Suspicious Behavior",
"severity": "critical",
"mitre_techniques": ["T1059.002", "T1017"]
}
Improved Pipeline Page Navigation
Improved navigation by making the header on the Create/Edit Pipeline page fixed at the top, keeping the Create/Update Pipeline button accessible without scrolling back to the top.
Search Rules by ID
Users can now search for rules by ID on both the Repositories page and the Pipeline Details page. On the Repositories page, select By ID from the search dropdown and type the rule ID. On the Pipeline Details page, simply type the rule ID in the search field.
Technique Ordering in Attack Chains
Improved Attack Chain Details page by updating the Techniques list to display techniques in the same order as they appear on the Chain timeline.
Rule Severity Display
Rules are now shown with severity indicator across the following pages in Prime Detect:
Attack Chain Details
Active Threat Details
Pipeline Details
Repositories
Key Bug Fixes and Improvements
Improved matching algorithm to boost performance.
Added _detect_flow_hostname_fields and _detect_flow_timestamp_fields to the YAML Mapping on the Log Source creation/editing page.
Fixed local LLM connection issues.
Fixed an issue that caused incorrect mapping by adding quotation marks around @ in YAML.
Fixed an issue where Active Threat items couldn't be put on monitoring in Attack Chains even though it included Higher Order Sigma rule.