AI Discovery (Code)
- Smoother GitHub integration updates: You can now update an existing GitHub integration without a new authorization code, and your existing credentials are kept. Pending approvals show an informational message, incomplete or invalid setups show specific errors, and new integrations appear in listings immediately.
AI Discovery (Workforce)
- Device and employee identities: You can now list and manage device and employee identities from a combined device drawer, with pagination, platform details and search. Placeholder and masked email addresses, including masked addresses from DeepSeek, are now handled consistently and resolve to a single identity per device, platform and domain.
- Device 'Last Seen' activity: Devices now show both 'Last Seen' and 'Last Updated' timestamps, and device lists sort by 'Last Seen'. The platform records each device's activity at most once every 15 minutes.
- No more duplicate devices: Duplicate device records are no longer created when several requests for the same device arrive at the same time.
- Outdated agent detection: Devices running an agent older than the minimum supported version (1.0.17 by default) are now flagged as outdated, and the distributor portal shows 'Update agent' for them. Device events sent to these agents, or to agents with an unknown version, now finish as 'unsupported'. Earlier event results stay readable.
- Device control and endpoint commands: If you have the required permissions, you can now send events to devices from the device page. These include diagnostics, health, mode, supported-events and proxy status commands. The available evidence for the device page feature mainly covers documentation and configuration.
- Browser extension connections: Browser extensions can now securely connect to the FireTail WebSocket API, allow it to receive policy updates as they happen
AI Logging (Cloud)
- Safer Bedrock log uploads: The Bedrock LLM logs endpoint now rejects gzipped uploads larger than 10 MiB once decompressed (413 error) and requests with more than 1,000 log entries (429 error).
- Clearer errors for unreadable Bedrock uploads: Bedrock log uploads with an unreadable or malformed body now return a clear 400 'invalid body passed' error instead of a generic server error.
- Bedrock integration setup fixes: Bedrock Logging token creation now works for both current and older integration setups, and the form shows a clear error when no project is selected. Setup instructions now point you to the correct FTPROJECTKEY field, and the S3 and CloudWatch template links are labelled correctly.
- Azure OpenAI Logging integration retired: The Azure OpenAI Logging integration has been removed. You can no longer find it in the integration catalogue or create and update it. This is due to Azure retiring this feature
- Cloud Log links: The browser Back button now works as expected after you open a Cloud Log from a direct link.
AI Logging (Workforce)
- Identity policy evaluations in browser logs: Browser logs can now record identity-policy evaluations, such as a sign-in blocked because the email domain is not on the allowed list, and you see a related identity policy notice. Account emails and credentials are excluded by design, and logs that contain raw identity information are rejected.
- 'Blocked (Domain)' log action: Logs now show blocked-domain actions with their own label and colour, and employee chart filters include this action.
AI Governance
- Sensitive flag for Customer Topics: You can now mark a Customer Topic as sensitive when you create or edit it.
- Guardrail usage reporting for MSPs and distributors: The MSP and distributor portals now include guardrail usage reporting, with filters and access controls. The available evidence for this feature mainly covers documentation and configuration.
- Clearer policy management: Policy management now shows guardrails based on whether your organisation has custom guardrails available. Policy scope labels show readable device names, and the policy listing tab is now called 'Existing'.
General Improvements
- Unified navigation: All organisations now share one consistent navigation layout, tailored to your enabled products and permissions. Organisations with both Workforce and Workload use sidebar menus, and single-product organisations use tabs labelled Employee or Inventory.
- Settings and page reorganisation: Administration pages are grouped under Settings and show only the options relevant to your products. Members is renamed to User Management. Employee Logs are under Workforce and Cloud Logs are under Workload. Workforce-only organisations find Policies and Topics under Posture Management.
- Saved links keep working: Older supported links redirect to their new locations and keep your filters. Organisation switching and default page selection are also improved.
- License usage reporting for MSPs and distributors: MSPs and distributors can now see billable license usage, including active users, active devices and a per-client or per-MSP breakdown. The figures use the same calculation as the portal's License Usage card. The evidence conflicts on whether reports cover only the current month or also the previous month, and on which permission controls access: billing:get, which only the Admin role has by default, or dashboard:get.
- Distributor client list and NFR filter: Distributors can now list clients across the MSPs they manage, with filters for MSP, name and NFR status. The list shows client metadata only and does not include admin contact details or email addresses. MSP client lists also add an optional NFR filter.
- Multiple distributors per MSP: An MSP can now work with more than one distributor, with options to manage distributor access and roles.
- PagerDuty Issue submission fix: The Submit button in the PagerDuty Issue modal now enables as soon as you complete all required fields.
