Product Changelog
A running log of notable features, improvements, and fixes across the Sentry platform.
Recent updates
Third-party risk: continuous collection, a portfolio dashboard, reports and an audit trail Feature
A new supplier now gets its own collection feed automatically, so it is scored from its first day instead of waiting for stories you happened to collect. The supplier dashboard shows coverage first (suppliers with no score or stale scoring are counted before the figures that exclude them), a 30-day history of risk bands, and a needs-attention list. A Third-Party Risk Summary report is available in the report builder and as a PDF, Word or Excel download. Every change made to a supplier is recorded in an audit trail on the supplier page, and each domain rating on a supplier shows a 90-day trend.
The AI governance policy names every provider Feature
The policy now lists all three providers the platform can use when external AI is on: Azure OpenAI hosted in Canada, Anthropic and OpenAI. The second and third are hosted in the United States and are unavailable when an account or the platform is restricted to Canadian processing. Each account can still turn external AI off entirely.
Profile scores now show a 30-day trend projection Feature
Where a profile has at least six recorded scores over three weeks or more, the Predictive Analyses panel shows where each domain score is heading over the next 30 days, with an 80 percent range and the chance it crosses the next severity boundary. A flat or noisy history gets no projection, and the panel never uses external AI. It was tested against simulated data only, so read the chance as an upper estimate until it has been checked against real outcomes.
Unusual feed activity is now recorded and shown as trending anomalies Feature
Each collection batch is compared with that feed's own recent history, never with other feeds or other accounts, and what is unusual is now stored and appears under trending anomalies on the global dashboard. A feed needs about ten batches before it can be judged, so a new feed or a restarted service stays quiet at first. Anomaly records are kept for 90 days.
French content is analysed on the platform's own models Feature
When an account has external AI turned off, French items are now scored with French keyword lists, a multilingual threat classifier, French sentiment and French entity extraction, instead of being run through English models. Nothing is sent to an external provider. French sentiment is positive or negative only, with no emotion profile, and organisations are sometimes labelled as places. We have not measured French accuracy yet, so treat French scores as a first pass for an analyst to review. Content in other languages is handled as before. An administrator can switch French off with the local_languages setting.
A one-page ServiceNow setup Feature
One page now covers sending alerts to ServiceNow, creating the pull key and the ServiceNow script, and profiles can be paused, resumed or removed through the API with the right scope.
Intelligence requirements link to monitors, evidence and findings Feature
A requirement can be linked to the monitors, evidence and findings that serve it, from the item page, and shows what is actually collecting. A requirement is marked answered only by a person reviewing it, never by the system.
IOC findings show campaign context and CVE exposure, with their limits stated Feature
A new findings page lists your IOC findings. Campaign context appears only through a recorded association and says how the link was made: imported from a STIX bundle, made by an analyst, or inferred from text. It always notes that a shared indicator is not proven attribution, and no recorded context is not a finding that none exists. CVE findings show whether the CVE reaches the estate you have declared, and a CVE nobody has assessed reads as not assessed, never as safe.
A delivery record for every notification channel Feature
Email, SMS, push, in-app and webhook notifications now each leave a delivery record, including one per webhook endpoint with sent, failed or suppressed and the reason. Retries share a group so a resend can be told from a duplicate. A sent webhook means the receiver answered successfully, not that anyone read it.
IOC findings: one alert per finding, with no duplicates Feature
An IOC match is now a finding with its own evidence and state, and a finding alerts once even when an item matches several indicators or two workers see it at once. Scanning uses a durable queue with retries instead of the newest 500 items. New or changed indicators are checked back over 30 days by default, history is seeded as a baseline on first run so nothing floods in, and shared hosts and CDNs carry a context unverified label that discloses without muting. A URL or IPv6 address is recognised in any spelling. An account can suppress an indicator for itself, which is reversible, audited and off by default.
Sensitive account changes need your strongest factor Security
Turning off TOTP or changing a password now needs your strongest available factor, and a password change signs your other sessions out. Changing an address invalidates links sent to the old one, signing up from an invitation no longer joins the team before the address is verified, and suspended accounts are refused on every entry point. Sessions are now tracked individually, so an administrator or a reset can end them. Sessions that existed before the update end by timeout or logout.
When someone leaves an account, their access ends everywhere Security
Removing, suspending, deactivating or deleting a member now goes through one process. Their sessions and credentials end, assignments are cleared with a note on the record, shares and group memberships are cleared, and collaborator rows are removed from dossiers whose owner shares no active team with them. Nothing is reassigned and nothing is deleted automatically. Account deletion now shows what it would remove before you confirm.
Dossier items follow the access of what they point to Security
Being able to open a dossier no longer means being able to read everything filed in it. Each item is checked against the viewer's own access to its source search, profile, feed or alert. A viewer without access sees a Restricted item placeholder with no title or link, and reports and summaries leave restricted items out. Removals are audited, and stored reports that cite a dossier re-check dossier access when retrieved.
AI opt-out and Canada-only now apply on every analysis path Security
An account that turns external AI off, or sets Canada-only, is now honoured on every path that could send content to an AI provider: search, background feed analysis, embeddings, profile analysis, report summaries and deep analysis. A request with no known account sends nothing, a batch that mixes accounts is split by account, and cached analysis is kept apart by whether an external model contributed. With Canada-only on, features that have no Canadian provider route are unavailable rather than falling back to another region.
Identifiers found during investigations go to analyst review Feature
Identifiers a recon scan finds are staged for an analyst ruling, watchlist hits name their source, an alias or identifier lead can be ruled on from the profile, and a promotion records who made it. A ruling that cannot be read is reported as a fault, not as not ruled on.
Want to know when something ships? Watch this page, or talk to us about release notifications for your team.