Sensor Update
Late May 2026
Sensor Name | Category | Details of Update |
|---|---|---|
Global Protect VPN Disconnected | System | Changed - Added a configurable blacklist variable that lets customers exclude specific IP ranges (e.g., LAN subnets) to prevent false triggers when devices are on-site. The variable is empty by default. |
Outlook – Excessive OST Space | Disk | Changed - The sensor has been renamed from Excessive OST Space to Outlook – Excessive OST Space. |
Slow Login Time | Boot | Fixed - The sensor was not triggering. Updated expression, payload, and resolution. The variable description now specifies "seconds" with a default value of 180. (16421) |
Early May 2026
Sensor Name | Category | Details of Update |
|---|---|---|
Software Change | Applications | |
Desktop - Session Reliability Issues | Citrix | Fixed - The sensor properly triggers when System Event IDs 1005, 1006, or 1007 from source TdIca are reported 3 or more times within 60 seconds. (16073) |
SMS Agent Host Service Disabled | Management | Changed - The sensor has been renamed to SCCM Agent Disabled. |
Low Wifi Signal Strength | Network | Fixed - Updated expressions to properly handle Mac Wi‑Fi adapters. (16456) |
AI Tool Usage Detected | Security | |
BitLocker Protection Status | Security | Changed - The sensor checks that the system has been running for a minimum uptime before triggering. Uptime is now defined by a configurable variable, with a default value of 30 minutes, helping prevent false triggers during startup. |
Defender for Endpoint Service Stopped | Security |