October 22 2026
New Features and Capabilities- Added automated license expiration notification emails sent to all enabled Manager users and the license contact at 30, 15, 7, 3, and 1 day intervals before the USM Anywhere license expires.
- Added automatic label synchronization across USM Anywhere and USM Central so that renaming or deleting a label updates or removes that label on all associated alarms and vulnerabilities for the tenant.
- Implemented infinite scroll navigation on pages within the User Behavior Analytics section.
- Updated the asset identification priority order used during event asset enrichment to determine which asset sent an event.
- Updated the Orchestration Rules page to display an Error status and a Syntax error reason for orchestration rules affected by plugin naming mismatches.
- Updated asset monitoring queries to evaluate hourly asset reporting status in batches rather than running individual queries per asset.
- Updated Open Threat Exchange (OTX) lookup behavior to exclude private (RFC 1918) IP addresses from indicator requests.
- Removed authenticated vulnerability scan credentials from API responses for users without the required permissions, such as Analysts.
- Updated download links for saved and scheduled reports to require an authenticated session for the owning tenant, enforced a 24-hour expiration period for links in report emails, and updated the report email text to state the expiration period.
- Updated third-party libraries across the platform to minor and patch versions to address known vulnerabilities.
- Resolved an issue that prevented saved vulnerability scan reports from running and returned a “Your report failed to run” error.
- Resolved an issue that caused sensors to stop generating events displayed in the Events view.
- Resolved an issue that caused OpenSearch connections to fail with an “Untrusted certificate” error when the hostname was present only in the certificate’s Subject Alternative Names.
- Resolved an issue that caused CSV exports of the NIST CSF Control ID.AM-1 compliance report to fail.
- Resolved an issue that caused CSV reports to fail when using the updated sorting and pagination behavior.
- Resolved an issue that prevented custom rule Occurrences and Length thresholds from retaining their saved values, causing them to reset to defaults after approximately one day.
- Resolved an issue that prevented Check Point Harmony Response Action Rules from being evaluated.
- Resolved an issue that prevented orchestration rules from being exported after selecting the rules and clicking Export.
- Resolved an issue that prevented customers from adding or updating an OTX subscription key and returned a “Cannot connect to OTX” error.
July 27 2026
Platform and UI Improvements- Added a banner that informs users when scheduled CSV reports must be edited and saved before they can run correctly
- Added links to the USM Anywhere Status Page in the Help menu, login and application footers, and maintenance page
- Resolved an issue where events could be displayed more than once after minimizing or expanding the Filter or Graph panel
- Resolved an issue where the Events page footer was misaligned or displayed an incorrect record count when fewer than 50 events were available
- Resolved an issue where CSV reports generated from Vulnerabilities, Configuration Issues, Assets, and Asset Groups failed to run
- Resolved an issue where the Asset Groups details modal did not display asset group counters correctly
- Resolved an issue where orchestration rules that used user correlation lists could not be saved
July 21 2026 - Hotfix
Fixes- Resolved an issue where the Investigations column disappeared from the Events page after users changed the visible column selection
- Resolved an issue where investigation IDs were not displayed on the Investigations page
- Resolved an issue that caused user sessions to terminate prematurely
- Resolved an issue where the plugin was not preselected when creating filtering rules from the My Subscription page
- Resolved an issue where scheduled and on-demand CSV reports failed to run
July 16 2026
New Features and Capabilities- Added a system action to automated playbooks for creating investigations from alarm triggers, with links between the playbook execution and the resulting investigation
- Replaced pagination with infinite scrolling on the Events, Alarms, System Events, and Console User Events pages
- Updated licensed hot-storage event visibility limits to use the event occurrence time instead of the event arrival time
- Upgraded the AWS SDK to version 2.0
- Applied the HeroDevs update that patched CVE-2026-11998 in AngularJS
- Resolved an issue where selecting Linux Events from the Views dropdown on My Subscription > Consumption Analysis caused a page error
- Resolved an issue where event counts on the Asset and Asset Group details pages could return an error or time out, preventing available page information from loading promptly
- Resolved an issue where Check User Actions replaced the + character in user email addresses with a space when filtering Console User Events
- Resolved an issue where processing large vulnerability data sets caused high resource usage, database connection exhaustion, severe performance degradation, or instance freezes
- Resolved an issue where the Custom time filter on the Alarms and Events pages displayed weekdays and dates one day out of alignment
- Resolved an issue that prevented users from editing FQDN values for asset network interfaces
- Resolved an issue where the Sensor dropdown was missing when creating an asset in quick mode
- Resolved an issue on USM Anywhere Government instances where the required new-password flow returned an unauthorized error after successful MFA
- Resolved an issue where users were repeatedly prompted to change their password after completing an expired-password reset
- Resolved an issue where CSV asset reports generated with Windows Server operating system filters contained headers but no asset data
April 22 2026
New Features and Capabilities- Added support for enhanced investigation workflows in the USM Anywhere user interface.
- Added new user interface controls to improve navigation and management of investigations.
- Added expanded filtering and search options across supported UI workflows.
- Improved page load performance across core USM Anywhere interface screens.
- Improved responsiveness and usability of investigation management workflows.
- Improved consistency of labels, buttons, and status messaging across the user interface.
- Improved backend processing efficiency for platform tasks related to investigations and alerts.
- Improved system reliability for scheduled background jobs and platform services.
- Improved visibility of actionable information within supported dashboards and detail views.
- Updated internal platform dependencies to supported versions.
- Completed routine platform maintenance updates to improve service stability.
- Applied backend component updates to maintain ongoing platform supportability.
- Resolved an issue where investigation pages could display inconsistent status information.
- Resolved an issue where certain UI screens did not refresh correctly after user actions.
- Resolved an issue where filtering results could return incomplete data in specific workflows.
- Resolved an issue where alert and investigation actions could require multiple attempts to complete.
- Resolved an issue where page navigation could redirect users to unintended screens.
- Resolved an issue where selected values in forms were not consistently retained after saving.
- Resolved an issue where background jobs could fail to complete under specific conditions.
- Resolved an issue where user interface elements could overlap or render incorrectly on certain pages.
- Resolved an issue where system notifications were not consistently displayed to users.
- Resolved an issue where exported data could contain incomplete results in supported workflows.
March 25 2026
Features and Capabilities- Removed the ability to configure Jump Box and SU or SUDO privilege options in the vulnerability scanning workflow
- Enabled all available time range options in the report generation modal
- Updated the Terms of Service link in USM Central to match the USM Anywhere Terms of Service
- Added the ability to hide the onboarding mode banner from the user interface
- Improved validation behavior by ensuring form inputs display error messages when invalid data is entered
- Improved layout behavior for medium screen sizes in the user interface
- None
- Resolved an issue where OTX loopback values were not handled correctly in the user interface
- Resolved a JavaScript error when generating reports from the Hunting Library page
- Resolved an issue where incorrect sensor counts were displayed in the My Subscription page
- Resolved an issue where a sensor could not be selected when creating a scheduled job by sensor
- Resolved an issue where the Orchestration Rules Triggered counter did not display values
- Resolved a JavaScript error when cloning executive dashboards
- Resolved an issue where the investigation flyout panel did not render correctly
- Resolved a JavaScript error in the Generate Report modal for Compliance Template and Event Type Template
- Resolved an issue where event data exceeded licensed hot storage retention limits in the Essentials tier
- Resolved an issue where event name titles could not be modified in the user interface
- Resolved issues affecting sensor eligibility and asset custom fields in the Configure Asset screen
- Resolved an issue where machine learning widgets for user and source events did not display expected results
- Resolved an issue where only eight graphs were displayed in reports
- Resolved multiple issues in the Configure Asset modal affecting Name, Description, Operating System, and Asset Type fields
- Resolved a regression where SentinelOne properties in alarms did not display as a link
- Resolved an issue where the vulnerability scanning action was not available when running actions on an asset
- Resolved an issue where the scan details download button was displayed for failed scans in scan history
- Resolved a regression where the Cortex XDR application icon displayed at an incorrect size