June 2026
Entity graph: tenant-wide relationship view
RAIDEN now builds a tenant-wide entity graph — a single connected map of your environment’s users, devices, IP addresses, subnets, ASNs, and the relationships between them. Where the per-case Live Graph shows one investigation, the entity graph shows the whole tenant: shared egress points, VPN fleets, and devices used by multiple users. Two clustering passes make structure visible at a glance:- Shared-infrastructure clusters — an IP used by many users, a VPN provider serving a group, or a device signed into by more than one account are surfaced as clusters rather than buried in a list
- Subnet grouping — sign-in IPs are grouped into their subnets, so users who connect from the same network neighbourhood connect through a shared subnet node instead of appearing as thousands of disconnected points
New case verdict: True Positive — Remediated
When you close a case, you can now record True Positive — Remediated as a distinct verdict — a real threat that has already been contained. Previously a contained attack had to be shoehorned into another status, which risked a genuine incident being mislabelled as a false positive. The new verdict keeps your case history accurate and feeds the right signal into suppression and (for MSSP fleets) cross-tenant threat-intel sharing.Reliable monitoring-window auto-close
RAIDEN keeps a verdicted threat case open until it is remediated or its monitoring window expires — it never silently closes a real attack. This sprint we fixed the background sweep that closes cases once their monitoring window passes with no further suspicious activity, so timed-out cases now resolve cleanly as Monitoring Timeout instead of lingering open. Confirmed false-positive and benign cases continue to auto-close immediately.May 2026
AskRaiden: Live Graph API queries
AskRaiden can now query the Microsoft Graph API in real time — bypassing the audit log delivery window entirely for two high-value question types:- OAuth consents — ask “what apps have consent right now?” and get a live list of granted application permissions across your tenant, not a 30-minute-old snapshot from the audit log
- Sign-in risk & location — ask “show me live risk for [email protected]” and get the user’s current sign-in risk state, last sign-in location, and device compliance status directly from Graph
Live Graph: Entity relationship graph
Every case now includes a Live Graph view — an interactive entity relationship graph showing how the case’s actors, assets, and indicators connect to each other in real time. Reading the graph:- Nodes represent identity entities: users, devices, applications, IP addresses, ASNs, and sessions. Node size reflects involvement weight — the more events tied to an entity, the larger the node.
- Edges represent observed relationships: sign-ins, token grants, OAuth consents, session reuse, and lateral movement paths. Edge thickness reflects event frequency.
- Colour coding maps to severity: red = confirmed compromise, amber = suspicious, grey = benign context.
Live Graph: Real-time session mapping
When a user is under investigation, RAIDEN now shows their live session state pulled directly from Microsoft Graph — not a 30-minute-old audit log snapshot. From any case’s User Context tab, you get a real-time read on:- Active sessions — which sessions are still live and which tokens have been invalidated
- Password change status — confirmed via Graph, not just logged; self-service resets through the portal now show up immediately
- Session revocation — whether a Conditional Access revoke completed successfully or the session is still alive
AskRaiden: Sortable analytics results
Analytics query results in AskRaiden now render as sortable, paginated tables instead of raw text. Click any column header to re-sort. Supports subnet, session, OAuth, country, and all other query types introduced this sprint.Findings lifecycle management
RAIDEN now manages the full findings lifecycle automatically:- When a case is closed as a false positive, all open signals and sub-findings associated with that case are cascade-closed — no stale orphan signals left in the queue
- Orphan signals (signals with no parent case) are now auto-triaged on a schedule, either promoted to a new case or expired, depending on whether the triggering activity has aged out
Detection monitoring dashboard
The dashboard now includes a Detection Monitoring strip showing:- Poll cycle health and last-seen times per tenant
- Finding volume by severity over the last 24 hours
- Suppression rule hit rates — immediately visible when a suppression is over-matching
April 2026
Live Graph remediation verification
RAIDEN now queries Microsoft Graph directly forlastPasswordChangeDateTime and signInSessionsValidFromDateTime to confirm whether a user has actually been remediated — in real time, at case review time.
UAL-only platforms miss self-service portal password resets and Conditional Access session revokes because those events do not always appear in the audit log. RAIDEN reads the state directly from Graph. The result appears as the via Graph pill on every case’s User Context tab — green when remediated, amber when the window is still open.
For MDR partners, this closes the gap between what endpoint tools report and what actually happened at the identity layer — catching false remediations before a case is incorrectly closed.
Per-case Blast Radius tab
Every case now includes a Blast Radius tab giving an immediate, quantified picture of campaign scope — both within your tenant and across the MSSP fleet. Headline stats show four numbers at the top of the tab:- Users targeted — how many users in this tenant received the campaign payload
- Clicked — how many users interacted with the malicious content
- Popped — how many users were confirmed compromised
- Tenants affected — how many other MSSP-managed customers have seen the same campaign indicators (shown as a fraction of the total fleet)
MSSP: Automatic cross-tenant threat intelligence
When RAIDEN detects a bad actor in one customer tenant, the attacker’s indicators are automatically recorded in the MSSP-wide threat intelligence pool. On the next poll cycle — within 2 minutes for identity events — every other tenant is checked against those indicators. What this means in practice: if an attacker’s session fingerprint, IP address, or ASN is confirmed in Customer A’s environment, Customer B’s next poll will match against that indicator and raise a finding automatically — with no manual intel sharing, no analyst intervention, and no configuration required. This creates a compounding network effect: the more MSSP customers on RAIDEN, the faster the platform detects campaign reuse. An attacker who succeeded against one customer is actively hunted across the entire portfolio within minutes of detection. The Blast Radius tab shows the current reach of any active campaign across your fleet. The cross-tenant threat intelligence loop is what drives those fleet counts in near-real time.Per-content-type poll cadence
RAIDEN now polls each Microsoft 365 content type at a rate tuned for its risk profile. Identity events (Audit.AzureActiveDirectory) poll every 2 minutes — down from 5 — cutting detection latency for AiTM, token theft, and MFA fatigue attacks from 13 minutes to 8–10 minutes. Other content types poll at cadences optimised for their volume and threat velocity.
No configuration required — poll intervals are managed automatically per content type.
Shadow visibility for platform admins
New detection rules ship under a three-state promotion ladder: OFF → SHADOW → LIVE.- OFF — rule is inactive; no findings generated
- SHADOW — rule fires and generates findings in the admin-only Shadow Cases page; customer dashboards are unaffected
- LIVE — rule is promoted; findings surface to customer dashboards as normal
Identity Threat Detection & Response (ITDR)
RAIDEN now automatically ingests risky user signals from Microsoft Entra ID Identity Protection and Microsoft Defender and creates investigation cases from them — without any manual setup.- Entra ID Identity Protection risk events (leaked credentials, risky sign-ins, suspicious IPs) now generate RAIDEN cases automatically
- Microsoft Defender identity alerts are ingested and merged with RAIDEN’s own detection findings for the same user
- New ITDR view in the main navigation shows all identity-sourced cases in one place
- RAIDEN can dismiss Entra ID risk flags on confirmed false positives, keeping your tenant risk state clean
- E5 and Entra ID P1/P2 licences unlock additional signal coverage — RAIDEN works at all licence tiers
MSSP: Bulk customer onboarding via CSV
MSSP partners can now onboard multiple customer tenants in a single batch import using a CSV file in the onboarding wizard. Up to 50 customers per batch.MSSP: Portfolio dashboard improvements
The MSSP portfolio dashboard now shows aggregated finding counts by severity across your entire customer base, with direct links to any customer’s environment.Activity Explorer
New Activity Explorer view showing detection rule activity, MITRE tactic distribution, and finding volume trends over time. Available in the main navigation.Required Actions dashboard panel
The dashboard now includes a Required Actions panel — a prioritised list of open cases that need attention, derived from active High and Critical findings, with direct links to each investigation.Microsoft Defender: Vulnerability Management
RAIDEN now surfaces Microsoft Defender Vulnerability Management data in the case investigation view, giving analysts additional endpoint context when reviewing identity-related cases.Detection improvements
- AITM_PHISHING: improved compound detection logic reduces false positives on legitimate conditional access redirects
- BASELINE_ANOMALY: statistical comparison now uses datetime-safe comparisons — no more missed anomalies from timestamp type mismatches
- DEVICE_CODE_PHISHING: detection logic updated to handle pandas-based enrichment loaded at import time, preventing first-poll latency
Security hardening
- Added authentication guards (
require_auth) to all API routes as defence-in-depth — no more unauthenticated access to admin and hunt endpoints, even if middleware is bypassed - Session token validation tightened across the investigation API
March 2026
MSSP: One-click impersonation
MSSP partners can now enter any customer’s RAIDEN environment with one click from the portfolio dashboard. Impersonation sessions are 4 hours, rate-limited to 60/hour, and fully audit-logged.AI investigation engine
RAIDEN now runs an automated AI investigation on every new High or Critical case. The investigation report includes a plain-language verdict, confidence level, recommended actions, and a summary of all supporting evidence.Multi-tenant polling (parallel)
Tenant polling is now parallelised using a thread pool. Previously, tenants were polled sequentially — a slow or unhealthy tenant could delay polling for all others. Each tenant now polls independently.Response Actions: Re-enable account
The Disable Account action now has a paired Re-enable Account action, so you can restore access from RAIDEN after a compromise is resolved without going to the Entra ID portal.Cases: Chain detection
Related cases involving the same user across multiple attack phases are now linked into a Chain Case — a single investigation covering the full attack sequence from initial access to persistence.February 2026
Initial release
RAIDEN launched into early access with:- Continuous Microsoft 365 audit log monitoring (5-minute poll cycles)
- 15+ detection rules covering device code phishing, token theft, AiTM phishing, impossible travel, OAuth abuse, mailbox manipulation, and SharePoint exfiltration
- AI-generated investigation cases with plain-language reports
- Response actions: revoke sessions, disable account, Conditional Access block, inbox rule deletion
- Role-based team access: Owner, Admin, Analyst, Viewer
- Multi-tenant architecture with full schema isolation
- Microsoft Defender alert ingestion
- Email notifications for High and Critical cases
For questions about any update or to report unexpected behaviour, email [email protected]. For active security incidents, include URGENT in the subject line.