This month's Nebulog is full of new features and improvements from this past month. We released an updated navigation, an investigations tool, better insider risk management features, and more.
In addition, we made improvements to the agent’s context and memory to produce tighter findings and more grounded conclusions in threat reports.
Streamlined Navigation New collapsable menu There is a new Nebulock navigation experience based on actions you need to perform or a specific use case. The updated organization brings additional clarity and fewer clicks to reach critical workflows.
The left panel is now grouped in collapsable headings:
Hunt Investigate Insider Risk Detections Monitor Intel AI Usage Settings Manage AI app usage with a single toggle A critical component of insider risk management is having clear visibility and control over AI tools found in your environment. The new AI Usage settings helps teams quickly approve or disallow AI applications with a single toggle. It also displays the number of endpoints the tools appear on to help you assess impact.
Actors + Watchlist Use Actors and Watchlist for added controls in insider risk To further strengthen your insider risk tools, we now unify scattered pieces of identity into a single object called an Actor. This correlates a user, their accounts, identities, and hosts across applications, and log files into a single unified view.
Actor works best with an IAM integration (such as Okta or Entra). When integrated, we auto-populate users from your identity events and auto-correlate hosts and accounts, so Actors stay current without manual upkeep. Additionally, you can also add actors manually or via API .
If an Actor warrants extra attention (departing employees, contractors wrapping up, anyone sitting in a sensitive role), you can flag their status by adding them to the Watchlist, where their activity becomes additional context in Hunts and Findings.
Hunt Report Feedback Leave feedback on the Findings of Hunt Reports You can now leave feedback on Hunt Reports to better inform hunts. Use the text box or API to confirm or dispute the findings and leave additional comments. This information will be added into your context graph to inform future hunts and help make them more accurate for your organization.
Investigate Run natural language investigations and see detailed results We've launched Investigate, so you can now execute operational searches and lookups directly in Nebulock. Use natural language ("show me all Okta activity for this user in the last 30 days" ) in your queries and get an answer researched and summarized for easy analysis. This is another step in reducing investigation time and tool usage, without pivoting to your SIEM, EDR, or IdP console.
Hunt API Start programming hunts with our Hunt API documentation Hunts are now a programmable primitive with the release of our Hunt API . Anything you can do in the Hunt interface (Vibe Hunt, ask a follow-up, save a rule, run a retrohunt, generate a report) can be triggered from your SOAR, ticketing system, or internal tooling. Get faster hunting cycles by embedding Nebulock into your existing workflows. To get started, navigate to the API Keys section of your dashboard.
What’s Next If you want to learn more about managing insider risk, running investigations, or any other new features, reach out to your account manager or request a demo to see how Nebulock can work in your own environment.
Come see us at Black Hat USA 2026 where we’ll be hosting a number of events to meet the team and get a personalized demo. If you can’t make it, visit our events page to see where we’re heading to next.
.webp)
.webp)
