Action required by November 23, 2026: Arctic Wolf is moving phishing simulations to a new email delivery platform to support enhanced phishing simulation detection capabilities. To ensure continued delivery of phishing simulation emails, customers must add the new IP address range 3.42.155.128 – 3.42.155.135 to their email allowlists before November 23, 2026.

There may be temporary interruptions to phishing simulation email delivery during the migration on November 23. Customers using Aurora Security Awareness and Training Plus should avoid scheduling custom phishing simulations on that date.

For more information about this change, visit the ASAT portal. For more information about email allowlist setup, see Add ASAT to email allowlists and Add ASAT to email gateway and spam filtering.

Added support for the Palo Alto Networks Cortex XDR® integration for Active Response.

For more information, see Configure Cortex XDR for Arctic Wolf Active Response.

Added a multi-tenant Tasks view that consolidates tasks across all customer organizations in a single page. MSP users can search, filter, sort, and export tasks, and navigate directly to task details or customer organization portals.

For more information, see Tasks and View and manage MSP Portal tasks.

Added the Vulnerability Management Viewer role to MSP User Management. MSP admins can assign this read-only role to customer users and third-party contacts to provide scoped access to Aurora Vulnerability Management（Aurora VM） pages in the Unified Portal.

For more information, see Vulnerability Management Viewer role.

Added the MDR Portal Viewer role to MSP User Management. MSP admins can assign this read-only role to customer users and third-party contacts to provide limited access to MDR subscription-related menus in the Unified Portal.

For more information, see MDR Portal Viewer role.

For more information, see Aurora Security Assistant.

For more information, see Assets table.

For more information, see Aurora Security Assistant.

For more information, see Aurora Security Assistant.

For more information, see Review security investigations.

• 1Password
• Claroty xDome for Healthcare and Industrial Environments
• Cloudflare WAF
• Datadog
• Epic
• ExtraHop RevealX 360
• Imprivata ITDR
• Proofpoint Essentials
• Veeam Data Platform

• Cloudflare WAF
• Imperva Cloud WAF
• Proofpoint Essentials
• TrendAI Vision One Endpoint Security

Added support for Gmail, Google Meet, Google Calendar, SAML Audit Activities, and Alert Center events to the Google Workspace security monitoring integration.

To enable the collection of Alert Center events for existing Google Workspace sensors, you must update the sensor configuration to enable the Google Workspace Alert Center API. For more information, see Step 2: Enable APIs in Configure Google Workspace cloud for Arctic Wolf monitoring.

Added a natural language query engine to データエクスプローラ. You can now type plain language queries instead of using the dropdown Query Builder. The Query Builder remains available as an alternative.

For more information, see Create and run a query.

Updated データエクスプローラ with log source filtering. You can now filter log data by selecting log sources directly from the query interface, making it easier to target specific data without having to build complex search queries manually. When you select log sources, associated fields are highlighted in the Query Builder to help you identify relevant fields quickly.

For more information, see Create and run a query.

Added a new Risk Evidence Data field that you can include when you export risk data. You can also still use the existing Risk Evidence URL field.

For more information, see Export risk data.

For more information, see Risks table.

Added the データ探索 role for MSP-managed users. MSP can assign this role to give users read and write access to all menus and submenus within データ探索 in the Unified Portal, without requiring a Customer Directory account.

For more information, see Data Explorer, Analyze traffic flow data, and Raw Log Search.

Improved Aurora Security Assistant to answer questions about Threat Intelligence bulletins.

For more information, see Aurora Security Assistant.

Launched Aurora MDR Connect. Built on the Aurora Superintelligence Platform, MDR Connect gives MSP customers immediate access to Arctic Wolf security operations and integrations.

For more information, see Aurora MDR Connect.

Improved Aurora Security Assistant to answer questions about tickets from anywhere in the Unified Portal.

For more information, see Aurora Security Assistant.

For more information, see Arctic Wolf Ticket API.

The Arctic Wolf mobile app is now available for iOS. The app is available for both Android and iOS, allowing you to access core Unified Portal features from your mobile device.

The app supports secure sign-in with SSO and MFA, and is available for devices running Android 12 or later, or iOS 17.4 or later.

For more information, see Arctic Wolf mobile app.

For more information, see Arctic Wolf Portal beta.

Introduced the Arctic Wolf mobile app for Android. You can now access core Unified Portal features from your mobile device.

The app supports secure sign-in with SSO and MFA, and is available for devices running Android 12 or later.

For more information, see Arctic Wolf mobile app.