> ## Documentation Index > Fetch the complete documentation index at: https://docs.rilevera.com/llms.txt > Use this file to discover all available pages before exploring further. # Changelog > New releases and changes to Rilevera. **November 14, 2026** ## New * **Learned inactivity thresholds**: Rilevera now learns how often each log source usually sends logs, and marks a source inactive only when it stays silent longer than that. When you open an inactive source from `Logs`, its banner tells you how often it usually reports. * **Learning period**: A new log source is in a learning period for its first 14 days, or until Rilevera learns its reporting pattern. During that time it shows a `Learning` status and isn't flagged for issues. On `Logs`, hover the brain icon to see which sources are still learning. ## Improved * **Inactive log sources in Slack**: The weekly *Rilevera Rollup Summary* Slack message now counts log sources that have stopped sending logs based on each source's learned pattern, instead of a fixed number of days. ## Fixed * **Horizontal scrollbar on MITRE technique list**: Horizontal scrollbar on Mitre Alignment page now appears without scrolling to the bottom of the page. * **Rule ID column styling**: Fixed overlap styling issues on the rule ID column in the rules grid. * **Rules table field ordering**: Corrected the column field order in the rules table based on the view, so important fields show up first. * **Broken Log Entity Names**: Rilevera now rejects more broken log entity names, created by incomplete and broken logs from providers. **November 10, 2026** ## New * **Splunk rule management**: Changes you make to a Splunk rule in Rilevera now sync to Splunk. When you `Accept` a review of the rule, or click `Enable Rule` or `Disable Rule`, Rilevera updates the rule in Splunk. ## Fixed * Accepting a review of a Sumo Logic rule with a schedule no longer fails because of the schedule's time range. * Text filters on table columns now match regardless of letter case. Before this fix, a filter with capital letters could miss matching rows. * Rule repository page now loads \~5x faster. **November 5, 2026** ## Improved * **MITRE classification reviews**: Rilevera no longer opens a review when it reclassifies a rule and the proposed MITRE tactics and techniques match the rule's current ones. ## Fixed * In an automated MITRE classification review, turning on `Diff` on the rule's `Docs` tab now compares the proposed tactics and techniques with the rule's current ones in the *Mitre Attack Coverage* section. Before this fix, every proposed tactic and technique showed as added. **November 2, 2026** ## New * **New vendors**: Rilevera now recognizes log sources from Akamai, Cohesity, Docker, Forescout, Fortinet, IBM, Imperva, Infoblox, Informatica, Kong, NetApp, Netskope, Omnissa, SAP, Thales, Torq, and VMware, and shows the vendor and product for each. ## Improved * **Resolved fields in notifications**: In a *Source Field Missing* or *Field Never Seen on a Mapped Source* notification, rules whose fields are no longer failing now show a `Resolved` pill. When every affected rule is resolved, the notification tells you so. * **Sumo Logic Data Sources**: Rules no longer show false "missing data source" alerts. Data source matching now ignores behavioral fields in log searches, monitors, and SIEM queries, so more of them are correctly linked. ## Fixed * Splunk rules that set only an index-time search window, such as key indicators, now sync with their time range. Before this fix, these rules synced without one. **October 29, 2026** ## Fixed * Log sources discovered in Sumo Logic Cloud SIEM are now recognized as SIEM sources, so Cloud SIEM rules map to them on the `Data Sources` tab. Before this fix, those sources weren't treated as SIEM sources, so Cloud SIEM rules didn't map to them. **October 28, 2026** ## New * **Splunk macro expansion**: In a Splunk rule's query view, click a macro to expand its definition inline. Click the expanded lines to collapse them again. Nested macros expand the same way. ## Improved * **Highlighted diffs**: Turn on `Diff` on the `Versions` or `Overlapping Rules` tab of a rule to compare queries with syntax highlighting. Switch between `Split` and `Unified` views. * **Detections state**: Filters, sort order, page, and page size on the `Detections` page are now saved in the URL, so they're kept when you go back from a rule. ## Fixed * Sumo Logic rules with multiple notifications now load their rule details and schedule settings without errors. * Sumo Logic alerts now ingest correctly when their *Detected At* time is slightly earlier than their *First Observed At* time. Before this fix, those alerts failed to ingest. * Data Sync now captures every Sumo Logic source category. Before this fix, some categories could be missed. **October 26, 2026** ## New * **New vendors**: Rilevera now recognizes log sources from Cato Networks, Finxact, GitLab, Orca Security, and Teleport, and shows the vendor and product for each. ## Improved * **Log source classification**: Rilevera now recognizes more log types, including Google Cloud Load Balancing, Chrome Enterprise Browser, Temporal Cloud, and AWS Elastic Load Balancer (ELB), Security Lake, Site-to-Site VPN, and RDS logs. Coverage also expands for many existing vendors, including Google Cloud, Atlassian, Cloudflare, and Kubernetes. * **Google Cloud Pub/Sub**: Google Cloud logs delivered through a Pub/Sub push subscription are now classified the same way as logs delivered directly. ## Fixed * Sumo Logic monitors with notifications set up in Sumo Logic now sync and save changes without errors. * Fields that are present in a log with a `null` value now count as existing when Rilevera classifies the log. **October 23, 2026** ## New * **Test connection for Slack**: In the `Add Slack Integration` or `Edit Slack Integration` dialog on `Integrations`, click `Test connection` to send a test message to your webhook without saving. * **Field names in notifications**: *Source Field Missing* and *Field Never Seen on a Mapped Source* notifications on the `Notifications` page now list the fields that caused each rule to fail. **October 21, 2026** ## New * **Show deactivated**: Deactivated users are now hidden from the *Organization members* table by default. Turn on `Show deactivated` to see them. ## Improved * **Query editing**: When you edit a detection rule's query on the `Query` tab, the editor now highlights query syntax as you type. This works for Sumo Logic, Datadog, Splunk, and Panther rules. * **Splunk severity**: Splunk rules whose finding severity is set to `unknown` now sync with *Critical* severity. **October 20, 2026** ## Fixed * Sumo Logic monitors now show their status from Sumo Logic, such as `Normal`, instead of `Unknown`. **October 13, 2026** ## Improved * **Tab links**: The tab you open on a detection rule's details page or a log source's page is now saved in the URL. You can bookmark or share a link that opens a specific tab. * **No Mapped Sources notifications**: Clicking **Review Rule** in a notification about rules with no mapped sources now opens the rule's **Data Sources** tab. ## Fixed * The same error message no longer stacks as multiple toasts when it occurs more than once. * Log sources whose logs can't be parsed are no longer mapped to detection rules. **October 6, 2026** ## New * **Alert metrics**: The `Overview` tab on a detection rule's details page now has a `Metrics` section with *Mean Daily Alerts*, *Precision*, *Mean Time to Detect*, *Mean Time to Acknowledge*, *Mean Time to Respond*, and *Acknowledgement Rate*. Use `Compare with` to see how each metric changed against another date range or version. * **Weekly Log Volume**: A log source's page now shows a *Weekly Log Volume* card with the total logs from the last 7 days. Click the card to open a daily chart. * **Splunk queries**: The `Query` tab on a Splunk rule's details page now highlights Splunk query syntax. * **Required Field Missing From Dependency**: A new validation status flags a detection rule when a rule it depends on doesn't output a field it needs. You can subscribe a Slack channel to this event. ## Fixed * If you don't have permission to view reviews, a detection rule's details page no longer shows errors. **September 23, 2026** ## Fixed * Removing an integration now asks you to confirm first. Click `Remove Integration` on the integration's card, then click `Remove` in the *Remove integration?* dialog, or click `Cancel` to keep it. **September 21, 2026** ## New * **Connected Rules**: When a detection rule uses other rules or is used by them, a `Connected Rules` tab appears on the rule's details page. Click a connected rule to open it in a new tab. * **Splunk integration**: You can now connect Splunk as a source platform from `Integrations` with an *Auth Token* and *Site URL*. Turn on *Trust self-signed certificate* only for on-premises Splunk Enterprise deployments that use a self-signed certificate. * **Datadog OAuth**: You can now connect Datadog with OAuth. Select your site, choose the *OAuth (Recommended)* tab, and click `Connect with Datadog (OAuth)`. API key and app key authentication is still available. * **Bulk notification actions**: On the `Notifications` page, select notifications with their checkboxes or `Select all`, then use `Mark as` to mark them *Read* or *Unread* or to **Archive** them. ## Improved * **Panther queries**: The **Query** tab on a Panther rule's details page now highlights Python and SQL syntax. * **Notifications**: The notification list loads in pages. Click **Load more** to see older notifications. * **Resizable columns**: You can drag column edges to resize columns in the detection rules table and the **Alerts** table. * **Tags column**: The **Tags** column in the detection rules table shows tags as pills. When a rule has more than one tag, click the **+N items** pill to see all of them. ## Fixed * Opening the **Tags** column filter in the detection rules table no longer causes an error. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.