CardinalOps
CardinalOps website now redirects to Cribl
cardinalops.com now redirects to cribl.io; on 14 Jul 2026 Cribl announced it is acquiring CardinalOps.
Source: Cribl press release
News
Threat hunting news
Summaries of public announcements, with links to the original source. Updated monthly.
Vega
Vega brings Wiz cloud risk data into its detections
Vega now pulls Wiz attributes on exposure, privileges and sensitive data into detection and investigation, so an alert on a cloud resource arrives with its risk context.
Source: Vega blog
Mars Security
Mars Security adds hypothesis playbooks
A Mars blog post introduced MARS playbooks for hypothesis-driven hunting, built around attacks that show up as a failed hypothesis rather than a fired alert.
Source: Mars Security blog
Mars Security
Mars Security turns threat advisories into backtested detections
Mars announced Real-Time Intel-Based Detection, which converts published advisories into ATT&CK-mapped rules and backtests each one on 30 days of the customer's data. It is included for existing customers at no added cost.
Source: Security Boulevard
Field
ATT&CK v19.2 is the first release in MITRE's agile format
MITRE's updates page dates v19.2 to 6 August 2026. The narrower release adds groups including ShinyHunters and TeamPCP, along with related supply chain software.
Source: MITRE ATT&CK
Vega
Vega publishes Detection Skills as an open specification
Detection Skills builds on the Agent Skills format and ships with a library of more than 50 skills that describe detection tasks for agents.
Source: Vega blog
Anvilogic
Anvilogic 8.0 extends federated search and adds case management
Version 8.0 spans onboarding, search, detection and investigation, and adds Elastic, CrowdStrike LogScale and Dynatrace as federated search sources.
Source: Anvilogic
Nebulock
Nebulock launches Helix for on-demand enrichment
Helix lets Nebulock's agents query vulnerability management and other security tools when a hunt needs the data, instead of loading it in advance.
Source: Nebulock blog
Cotool
Cotool Router adds model fallback for security agents
Router gives Cotool agents fallback across model providers, access to open-weight models, and model selection based on evaluations.
Source: Cotool blog
Anvilogic
Anvilogic Blueprints and Federated Search reach general availability
Anvilogic made its Blueprints workflow automation generally available, along with a Federated Search experience that runs on Anvilogic Compute.
Source: Anvilogic
CardinalOps
Cribl announces it is acquiring CardinalOps
Cribl announced it is acquiring CardinalOps to add detection engineering to its AI platform for security operations; no deal amount was disclosed.
Source: CardinalOps newsroom
Field
Sigma release r2026-07-01 adds 20 rules
The SigmaHQ July release adds 20 detection rules and updates more than 80 existing ones, including rules for supply-chain attacks.
Source: GitHub SigmaHQ
Nebulock
Nebulock raises a $25M Series A
The FirstMark-led round was announced with new insider risk features, correlation rules and a Command Center view.
Source: Nebulock blog
Artemis Security
Artemis ingests Anthropic Compliance API events
Artemis added Claude Enterprise Compliance API events, normalized to OCSF, next to the cloud, identity and SaaS telemetry it already correlates.
Source: Artemis Security blog
Field
ATT&CK v19 splits Defense Evasion in two
MITRE's April release divides Defense Evasion into Stealth and Defense Impairment, bringing Enterprise to 15 tactics and 222 techniques.
Source: MITRE ATT&CK
Artemis Security
Artemis Security leaves stealth with $70 million
Artemis launched with $70 million in combined seed and Series A funding, with the Series A led by Felicis.
Source: Artemis Security blog