Release Notes

Version 6.5.0 (October 2026)

• Removed Alerts

  • O365 - Rejected/Quarantined Emails
  • Windows - Lateral Movement to Multiple Hosts via NTLM
  • AD - Login Failure Due To Password Expired

• Enhancements

  • Renamed DNS - Suspicious DNS Server Outbound Connections to Windows - DNS Server Suspicious Outbound Connections and moved it from the DNS product to the Windows product. Its filter macro is renamed from cs_dns_suspicious_outbound_connections_filter to cs_windows_dns_server_suspicious_outbound_connections_filter; existing filter customizations are migrated during upgrade.

  • SOAR forwarding: severity-based filtering
    • Added Send to SOAR Severities option to the Cyences Action - Notable Event alert action to forward only selected cyences_severity values to SOAR. Defaults to critical.
    • Added Default Severities to Forward on the SOAR Configuration page, and Send to SOAR with severity selection on the Custom Alerts page.
    • Events with non-selected severities are still written to the cyences index, but are not forwarded or retried.
  • Alert result aggregation to reduce noise
    • The following alerts now aggregate results (by host/user etc.) instead of producing one row per event:
      • Sophos - EDR Security Event
      • O365 - Suspicious Email Detected
      • O365 - PST File Downloads
      • Fortigate - High Severity Admin Action
      • Windows - PowerShell Encoded Command Detected
      • Windows - Suspicious Script Host Execution Detected
      • Windows - Ransomware Behaviour Detected
      • Windows - New Service Installation
      • Windows - Suspicious Process Execution from Temp
      • Windows - System Startup and Shutdown
      • AD - User Locked Out
      • Authentication - VPN Login Attempts Outside Working Hours
      • Linux - User Access and Privilege Activity Monitor
      • Oracle - Privilege Activities
      • Oracle - Table DDL Changes
      • Windows - DNS Server Suspicious Outbound Connections
  • Alert tuning updates
    • O365 - External URL was Accessed: now triggers only when the user overrode a Safe Links block/detonation page (UrlClickAction 4, 5) and added a description field.
    • O365 - Suspicious Email Detected: excluded campaign detections and emails from internal domains (cs_email_user_domain).
    • O365 - Spoofing Attempts Detected: excluded blocked emails along with quarantined emails.
    • O365 - PST File Downloads: added FileSyncUploadedFull operation.
    • Web - Unusual or Suspicious User Agents Detected: excluded known benign user agents (Apple, Samsung Pass, WordPress, Imperva, etc.).
    • Windows - Suspicious Script Host Execution Detected: excluded Microsoft Monitoring Agent activity.
    • Windows - Ransomware Behaviour Detected: excluded Splunk --ps2 executions.
    • Windows - Suspicious Process Execution from Temp: excluded known benign processes (Splunk, DismHost, Defender ATP, Veeam, Monitoring Host, etc.).
    • Windows - New Service Installation: excluded services installed by known vendors (Google, Edge, Adobe, CrowdStrike, Forcepoint, Kaspersky, ManageEngine, Splunk, VMware, Websense, NetBackup, Microsoft, Defender, Trend Micro, Picus) and fixed the Service_File_Name field used for severity calculation.
    • Windows - Multiple Failed Logins from One Source IP: excluded network logons (Logon_Type=3) on domain controllers (ComputerName="DC*").
    • Windows - Multiple Modifications on File Servers: monitored event codes are now 4663, 4660, 4658, 4659, 4670 and 4656 (with DELETE access). Computer accounts are excluded and the threshold is configurable via cs_windows_multiple_modifications_file_servers_threshold (default: 20).
  • Custom Alerts page: Severities to include/exclude fields are now multi-select dropdowns.
  • Cyences Alert Setup page: the immediate/digest alert severity macros (cs_soc_immediate_alert_severities, cs_soc_digest_alert_severities, cs_compliance_immediate_alert_severities, cs_compliance_digest_alert_severities) now use a multi-select dropdown.
  • Added rule field for sophos:xg:firewall sourcetype for CIM compliance.
  • Added computerDnsName to deviceHostName mapping for SOAR (CEF) forwarding.

• Bug fixes

  • Fixed app upgrade failure when upgrading across multiple versions at once.
  • Fixed the delete button on the Custom Alerts page being enabled/disabled based on severity instead of whether the alert is removable.
  • Fixed internal _ScheduledView* searches showing up on the Cyences Alerts page.

---

Table of contents

• Previous Release Notes