Documentation Updates
| Date | Description |
|---|---|
| Sep 17, 2026 | Updated the Geo Map visualization information for location clustering, which renders queries that return large numbers of results, and for the zoom and drag behavior of clustered maps. Also added the coordinate limit that applies to split-by fields, and removed the legacy aggregate by country control. |
| Jul 23, 2026 | Updated information about the OCSF Field Summary Panel that it now shows all OCSF fields for the relevant event categories when querying OCSF-normalized data. |
| Jul 8, 2026 | Updated documentation for streamstats operator with new support for dc aggregation, and support for isnull and isnotnull in the Basic Mode for Search. |
| Jun 24, 2026 | Added OCSF Field Panel information that becomes visible when Exploring Search Results and Refining Queries. |
| Jun 10, 2026 | Added support for OCSF schema views that allow access to data fields across OCSF-compliant data sources, regardless of vendor. |
| May 28, 2026 | Added information for OCSF support for Copilot-based searches, correlation tables, full-text indexing, turbosearch, and nested objects in lookup tables, and updates to the rex, transaction, and iplocation operators. |
| Apr 29, 2026 | Updated information for the whois operator, OCSF support in Search Tabs, OCSF Schema update for Version 3 fields, and custom suffixes in Report filenames. |
| Apr 15, 2026 | Added information about Resource Tags, OCSF updates for operators, GeoMap visualization updates, DecisionTreeRegressor and RandomForestClassifier updates, calc shannon_entropy function, and timechart operator update. |
| Mar 31, 2026 | Added information about the OCSF Schema Overview, asset and investigation_elements lookup tables, and updates to the MITRE ATT&CK Heatmap visualization. |
| Mar 4, 2026 | Added information about the Google Threat Intel (gti) operator and updates to fit ARIMA. |
| Feb 19, 2026 | Added Reports. |
| Feb 19, 2026 | Updated the CrowdStrike Operators section. |
| Feb 18, 2026 | Added fit OrdinalEncoder, ml_model_summary, fit StandardScaler, and fit DensityFunction. |
| Dec 10, 2025 |
Added information about role-based access control information for Using Lookup Tables and Using Macros. Also added information about the fit IsolationForest machine learning operator. |
| Dec 9, 2025 | Updated kmeans and fit DecisionTreeRegressor. |
| Dec 3, 2025 |
Added information about the new Added information about extracted fields. See Extracted Fields for more information. |
| Nov 17, 2025 | Added information about the bubble chart visualization type. |
| Nov 5, 2025 | Enhanced an example in the mvexpand operator document. |
| Nov 4, 2025 | Added the best practice about the timeline widget to ensure efficient performance. |
| Oct 30, 2025 | Reinstated the Learn More links for 4 different operators after an internal UI fix. |
| Oct 28, 2025 | Added the CrowdStrike operator uber page that acts as the homepage for all CrowdStrike operators. |
| Oct 22, 2025 | Added information about data refresh in observables and threat_models. |
| Oct 17, 2025 | Added information about the CrowdStrike operators. |
| Oct 15, 2025 | Added information about the MITRE ATT&CK Heatmap widget. |
| Oct 9, 2025 | Updated information about recommended practices for full-text indexing search. |
| Oct 8, 2025 | Added information about full-text indexing search. |
| Oct 6, 2025 | Added information about the actor_associations lookup table. See actor_associations for more information. |
| Oct 3, 2025 | Updated information about the subsearch functionality. |
| Sep 24, 2025 | Updated information about saved search. |
| Sep 12, 2025 |
Added information about federated search and the MSS feature. |
| Sep 11, 2025 | Added information about updates to the markdown text widget. |
| Sep 16, 2025 | Added information about structured search. |
| Aug 20, 2025 | Added information about threat models in the AQL threat_models lookup table. |
| July 29, 2025 | Updated information about context-aware message-based throttling. |
| July 17, 2025 | Updated information in the AQL lookup tables to make them more descriptive for readers. |
| July 16, 2025 | Updated URLs to point correctly to the Job Tracking page. |
| July 15, 2025 | Added information about the Search Data Retention Policy. |
| July 7, 2025 | Updated information about the Copilot dashboard widget. |
| July 2, 2025 | Added information about the Copilot dashboard widget. |
| Jun 24, 2025 | Deprecated information about forensic and retrospective search UI elements. |
| Jun 24, 2025 | Updated information about makecontinuous function in the calc operator. |
| Jun 16, 2025 | Added information about subsearch and updates to turbosearch throttling. |
| Jun 13, 2025 | Added information about Bulk IOC. |
| Jun 6, 2025 | Added information about turboserach throttling. |
| Jun 4, 2025 | Updated information related to AQL lookup tables that describe them in greater detail. |
| May 28, 2025 | Updated information about turbosearch best practices. |
| Apr 29, 2025 | Updated information related to the search guidelines. |
| Mar 26, 2025 | Updated information in the calc operator for json_extract, regex_split, and regex_replace functions. |
| Mar 25, 2025 | Added information about boolean keywords and threshold-based color strings in widgets. |
| Mar 17, 2025 | Added information about views. |
| Mar 13, 2025 | Updated information in the lookup tables. |
| Mar 10, 2025 | Added information about the transaction operator. |
| Mar 7, 2025 | Added information about the rex operator |
| Feb 20, 2025 | Added information about new fields in turbosearch |
| Feb 12, 2025 | Added information about the strftime operator. |
| Feb 11, 2025 | Added information about the bug regarding case-sensitive and case-insensitive fields. |
| Feb 6, 2025 | Added information about the boolean conditions in the where operator. |
| Feb 3, 2025 | Added information about the riskiq_ssl operator. |
| Jan 29, 2025 | Added information about the appendtable operator. |
| Jan 28, 2025 | Added information about the history operator. |
| Jan 24, 2025 | Added information about Anomali Virtual Compute. |
| Jan 23, 2025 | Added information about the yieldtable and array_agg operators. |
| Jan 17, 2025 | Added information about the transport operator. |
| Jan 15, 2025 | Added information about aggregated queries. |
| Jan 9, 2025 | Updated information about date formats in the What's New. |
| Jan 8, 2025 | Added information about using cron scheduling for alerts. |
| Jan 8, 2025 | Added information about search drilldown when using aggregation. |
| Jan 3, 2025 | Updated the documentation of the join operator with information about joining eventlog data with system lookup tables. See the join operator for more information. |
| Jan 3, 2025 | Updated the documentation of the field operator with the plus (+) and minus (-) signs for adding/removing additional fields to the search results. See the fields operator for more information. |
| Jan 3, 2025 | Updated the Search Best Practices with information on staggering scheduled tasks. See Stagger Scheduled Tasks for more information. |
| Jan 2, 2025 | Added documentation for the fromjson and lstinv operators. See fromjson and lstinv for more information. |
| Dec 19, 2024 | Added information about the Dotted Notation operator for easily handling JSON fields. See Dotted Notation for more information. |
| Dec 9, 2024 | Updated the Limited Availability flag on the history operator. |
| Dec 6, 2024 | Added documentation for the loadjob, lstintdest, streamstats operators. See loadjob, lstintdest, and streamstats for more detail. |
| Dec 5, 2024 | Added documentation for the inlist operator. See inlist for more detail. |
| Dec 4, 2024 | Updated the procedure to use custom macros in Search. See Use Custom Macros in Search for more detail. |
| Nov 27, 2024 | Added information about the snap-to specifier for the where operator. See the where operator for more details. |
| Nov 25, 2024 | Updated the usage and code examples for the dedup operator. See Guidelines for Search and dedup operator for more details. |
| Nov 22, 2024 | Added information related to the dedup operator in the the Search guidelines and dedup operator documents. See Guidelines for Search and dedup operator for more details. |
| Nov 20, 2024 | Updated the Search guidelines document with more clarification about role-based search. See Guidelines for Search for details. |
| Nov 19, 2024 | Added Search guidelines recommended by Anomali. See Guidelines for Search for details. |
| Nov 18, 2024 |
Added the information about the time-limited search. See Getting started with Search for more information. |
| Nov 18, 2024 | Updated the Search docs with information about the top and bottom left search stats. See Refining Event Search Expressions for details. |
| Nov 5, 2024 | Added the document for the Text visualization type. See the Text visualization for details. |
| Oct 30, 2024 | Updated all visualization documentation for dashboard drilldown. As an example, see Bar Chart for more details. |
| Oct 29, 2024 | Added the document for the Gantt Time Series visualization type. See the Gantt Time Series visualization for details. |
| Oct 25, 2024 | Added the turbosearch operator documentation. See turbosearch for details. |