Name: October Product Launch Announcement: LogRhythm SIEM
Uploaded: 2026-10-06T16:31:29.764Z
Duration: 52 min 12 s
Description: October Product Launch Announcement: LogRhythm SIEM

Transcript for "October Product Launch Announcement: LogRhythm SIEM": Hello, and welcome. My name is Brook Shummel, and I am here to talk about what is new with Logarithm. This is one of the most exciting release you're going to see. This is, such a powerful release. We could have call... Called this 8.o if we wanted to, but there's some legal reasons why we didn't do that. So there is an impressive amount that's coming here. Ryan Gamboa here, he is my fellow speaker on the call. He is gonna be walking us through all the different aspects that we've put into this, this release. So, Ryan, it's super exciting. Can you tell us a little... I mean, so let me get through the start of the agenda here, and we'll get into this. I'm so excited. It's... It... I I just wanna get going right now. We're talking a little bit about the customer challenge. We're gonna get into our portfolio. There's really big no no big change there, but we want to at least inform you of how the portfolio looks. What are those LRSM or, you know, logarithm SIM development goals? What's doing the release? A demo from Ryan followed by q and a. So at the end of the day, we're all having similar challenges. It doesn't matter where we are in the world, we all have the same challenge. And when it comes to artificial intelligence being used to help us as well as to hurt us, it's the same story around the world. For the most part, we're seeing everything from, everything speeding up from vulnerabilities being weaponized to malware being generated to the amount of attacks, the noise that our SOCs are looking at. So long story short, without getting into all the details, you can take a screenshot of that that... Of these stats here, but the problem is real. And our CSOs and our security leaders around the world, they're always looking for a new edge against the latest threat. In terms of our portfolio, it's the same as before. Yeah. It's, you know, logarithm SIM. New scale analytics is shared between them. So new scale analytics in logarithm is called logarithm intelligence. This allows for you to enrich the the alerts that you're seeing. It's gonna provide a lot of value in terms of reducing false positives on any tech stack. You know, we're white labeling this into many other different technologies out there today. This is why we're the the number one partner of the year for Google, Google SecOps, because of our capability to bring in something that no one else can really do. So LogRhythm Intelligence, again, a very powerful tool. And within, new scale, combined together, they call that fusion. And then another technology shared between them is, you know, the network analysis called NetMon to look at what's going on. And my experience at a large networking company, not gonna say the name right now, we would find... We try to sell something like this to people. This would always fall off the map because it just became something that everyone wanted, but not everyone could get. And so having network traffic analysis adds a lot of value. So I'm not gonna do a NetMon, webcast today, but, again, a great, addition to that. So, when it comes down to our strategic goals this year, we wanna continuously improve the platform. This is why you're seeing these kind of step by step incremental changes to the platform in seven dot twenty four, 07/25, now seven dot twenty six. We really wanna improve that user experience, and we're really gonna deliver on that one today as well. And then, ultimately, to deliver that foundation for human and agent, teaming for behavioral analytics. So, again, big powerful step forward. So with that said, Ryan, if you could take the wheel and talk to us about what's new, that'd be great. Yeah. Yeah. So as as Brooke mentioned, you know, AI is is making attackers faster. Right? It it makes it easier. And so it... It's important for us to make sure that, LogRhythm helps helps you, defend against that. We we know that, those attacks are just gonna keep coming. There's gonna be more and more data. You know, how do we help you sift through that data, be more efficient, and use, AI tools to also, you know, help you in, in defending against those attacks? So, we we see the, the system needing, you know, a human, in the loop type of approach where we have some AI systems that help you maybe, triage an alert, raise that alert up, and, give you all the evidence, you know, do kind of the grunt work for you, that tier one work, and, allow you to to take that in, quickly and make quick decisions. Eventually, moving towards, more of a a full autonomy where we have AI agents maybe doing, some of that, work for you, when we're a little more comfortable with, maybe tuning and and getting those those systems and and agents to, a better spot. But, this is where we're heading. And as as we, head in that direction, we've introduced this quarter, a MCP server that that helps you do some of these tasks. So this MCP server, is available on community. It, is a, community driven project currently. So, a little bit of of use your, at your own risk as we test this out. We get feedback, understand where, we need to make improvements. But, this tool is is super powerful, and I'll I'll walk through demos, but but it really does, allow you to ask it, and, have it triage alerts, raise evidence, maybe, once it decides that this is not a false positive, you know, elevate that to a case, maybe run, a playbook for you. And then we've also added tools to it. I'm gonna pause because I think we... I see some loading here. Are we... Brooke, can you give me a thumbs up? Make sure Let's take a look. you can hear me okay? Yeah. Yeah. I can hear you perfectly. fine. I. saw I saw some spinning. So, Okay. but, yeah, I forwarded. We... the slides. also. baked in, tons of skills into the m... This MCP server. I think we're up to about 85 different skills, from regex building, AIE, rule building, closing alarms for you. It it will do quite a bit. So, again, I'll I'll walk through this, but but super, super helpful in, making you more efficient and, getting getting through your day to day tasks. More on the agentic side, this is, I guess, more, kind of on the the the front end of, the SIEM of getting logs into the SIEM so that you can, build alerts and detections off of, agentic behavior. So, we know that, you know, everyone's out there using these tools. How do we monitor those, and how do we look for, behaviors that, of misuse where where users are maybe using these tools in ways that they shouldn't be that are outside of your, company's policies? So, we've released a chat GPT, a GitHub Copilot, and a Gemini beat that allows you to pull those logs into the SIM, and get that data in there so that you can build alerts on them. We have some, out of the box content for our LogRhythm intelligence customers that will, give you some detections around these. But we'll continue to build that out for on prem customers as well, things that we can deliver through the the knowledge base. Right? So getting data in is is the first step. Next step is is let's build on top of that. But, yeah, this will this will let you get that data into the SIEM and and start monitoring some of these tools. We'll continue to build out, available beats as well for for other tools, as as we go along. Alright. This has been coming for a long, long time. We've been on, Elasticsearch for forever, and we've been stuck on an old version, because Elastic changed their licensing model. We didn't want to, update to a newer version of Elastic because that would have mean... That would have meant that we were no longer, on an open source version, and that cost would have been passed to our customers. So we we really wanted to stay, on open source, products to to prevent that, cost getting passed down. And so we've made the jump over to OpenSearch. This is this is huge because, like I said, we were on a very old version. So we're gonna get, some performance gains here. You'll see, better, better search performance. You'll also see, that, the upgrade is very, very, straightforward. You run an upgrade just like you normally would. We, leave your data alone, and, we just pull out the, Elastic version, and we we place in OpenSearch, and we point OpenSearch at your existing indices. So there's no data moving around, which means your upgrade is is actually fairly fast as well. And, you'll have all your data. One caveat here is if you are on a old version, 07/17 or older, those indices aren't, compatible with this version. So, really recommend getting up to seven 18 or newer, and then you can sit there for a little bit while, your indices, roll roll over into the the new ones, before you make that jump. But, yeah, this really lays the foundation for us to go after, a lot of other features that that, have been held back, just due to, some of the the foundational, back end stuff here. So, really, really looking forward to this one. No. We're we're not taking advantage of any of the new OpenSearch features just yet. So, just wanna call that out. You're not gonna see, frozen search for for example. We do want to take advantage of that in the future, but, this is, mainly about just making the jump. So, just the the migration piece. We'll we'll come back to adding in, future functionality in in future releases. Alright. Another one near and dear to my heart, is an update to our reporting engine. You all know crystal reports and how inflexible it is. Really, today, we we need that flexibility. We we want, these reports to to allow me to drag and drop the columns that I want, to create a bar chart or a tree chart. Right? And schedule these things and send them out to to whoever. So Crystal has been a a pretty big, form in our in our foot. So, we are we are starting to replace that. This new reporting engine is based on Apache Superset. Very modern. It gives us, I think, 80 different charts out of the box that you can go take advantage of. Some of them, are are kinda silly. I I don't know if you'd ever use some of them, but but they're there if you wanna take advantage of them. And, this is this is being launched in, a a beta form. So just just a heads up that not everything is there. We have we have so much out of the box content for, reports that are built on, you know, HIPAA, PCI, other compliance packages, and, migrating all that over is going to take time. Getting all the different datasets into Apache, superset is going to take us a little bit of time. So this first launch really focused on, getting the tool out there, with the alarm dataset. So you can build reports on, all of all of the alarm, bits and pieces and and columns that are available in in SQL. We will build that out to include other datasets in in the next release, and continue to progress this. But we've also focused on, making sure that the data you can query is in line with your, your RBAC controls. Right? We don't want to allow users to query data that they're they're not supposed to query, so a lot of work went into that. And, there's there's some RBAC controls here that actually provide you access to the reporting engine, that you can turn off or on if, if you, you know, don't wanna give, access to to customers or to, your your analysts. So I'll I'll walk through that as well. But, this is this is huge news, and is, just amazing to see in the product. Okay. This one, is is a little more around, our our, accessing, you know, data, programmatically. Right? We... We've been building out APIs available to you to to go build, scripts or, for our MCP server. Right? We wanna be able to go grab, all the data from the SIM, or make changes, within the SIEM. And one of the key areas that we were... We, have really been focusing on over the last quarter is, AIE. We've built out the ability to go fetch AIE, rule information. You could make modifications to existing rules, but you could not create a brand new rule. So this brings the ability to, to do that. You can create a a rule from scratch, and and you can actually get, stats from the AIE server as well. So, things like, you know, if you pull up the AIE page in the client console, we have things like, CPU cost, and, processing rates. So all that's available through the stats now as well. And then the the other area of AIE that we've been focused on is, improving the drill down mechanism. Today, we use this caching mechanism that that, is something we can't rely on, all the time. It's it's tough to, you know, go in there and and find an old alarm and try and drill down on it, and and the data is no longer there because it's fell out of the the cache. Right? And, we we wanted to improve that, so we've slowly been building out these IDs. We track every log that comes into the SIM. It gets a GUID, and, we store that in Elastic, what... Or now OpenSearch. And we've actually updated the AIE pipeline over the last couple quarters to track those IDs, so that when an AIE alert is triggered, we know the IDs of the, the logs that trigger that alert, and we store those now, inside of OpenSearch. So the the next step was to take those IDs and throw them into a search and recall them, in a drill down. So going around the cache, and, calling these IDs directly. So I'll I'll show you this in in the web console as well, but but this is, a a much better workflow, much better pipeline, and, we'll we'll keep improving this, to extend this functionality throughout the web console. The last slide where... That I wanna go through before we really dig into the the fun bit of demoing and, showing you, things actually, you know, in in a real demo environment, and and getting into questions and things is, logarithm intelligence. We introduced the sync service last quarter, and, that syncs cases from the, new scale, cloud down into, logging them on prem, right, to to help you keep just one, one console that you're working with and you're not doing the swivel chair. But when we launched, we didn't support proxies. So this, adds that capability. If you use the proxy, you can now take advantage of that, for the LogRhythm, sync service... LogRhythm intelligence sync service. Lot of other things that I don't have slides for, we've improved, some of the the JSON policy management. We're we're starting to centralize that. So check out the release notes on that, and we've also spent some time, you know, with obviously lots of lots of different defects and things, that I would I would point you at. And, finally, the last thing I wanna call out, is... Are are some extra tools, that you... I think a lot of you take advantage of, things like echo or the, threat intelligence service. Those have seen some updates as well. Obviously, some bug improvements, some performance improvements, but, some new features there too. But I'm gonna skip those for today, just to to really focus on some of these these bigger ones and spend a lot more time there. So let me share my screen, and we'll go through some of these. Brooke, if you wouldn't mind keeping an eye on, questions for me, that would be helpful. Will do. Yeah. No questions right now, but, again, feel free to fill in, your questions here in the q and a, option. And if we don't get to them now, we will get to them at the end of this webcast. Thank you, sir. Alright. So I'm I'm here in the web console. The the first thing I wanna show off is that drill down functionality. So, if I have an AIE rule, there's there's been this function here in, the the mega grid to, select this, event from AIE and to drill down on it. And, again, this this, used to go through the cache. But today, as I mentioned, those IDs, if I head over to the log tab, this log that was, created by the AI engine has its own ID. So this is... These are those log IDs I I mentioned. And every single log coming into the system gets these whether or not it's an AIE event or not. It... Anything coming into the SIM gets a, a GUID. And as I mentioned, AIE is going to track these now. As as logs trigger rules, we are going to track these source events that trigger these rules. So this, AIE event was triggered by this log. And you... If I scroll down here, we might find one that has multiple. No. I don't have an example of it. But, if there are multiple, it'll be comma separated, and we'll we'll track all of those there. So you can you can simply take this log ID, and copy it and come up to search and look for the log ID field, and you can search for this. If you have multiple, again, you can do a comma separated and add more in there. But I'll just search for the one, and I can go I can go pull that back. Pretty, pretty handy. Very useful if you're looking for... And and being very targeted about the logs that you're pulling back. You know, you can search either a source ID or, if you're maybe sharing with a user, you could give them, a specific log ID of of something, you know, and say, hey. Check out this log. But the the real benefit here is is this drill down button now just does that for you. Right? I don't have to copy this myself and throw it into search. If I click this AIE drill down, it's going to take that GUID automatically for you and and run a search for it. So you can see log ID is that same GUID that I copied, and it'll go back to, the the DX and pull back that log that triggered this rule. So very, very handy. I do want to call out that right now, it's it's only available from, this DX dashboard workflow. It is not yet updated within threat center. So if I head over to, an alarm here and I try and drill down on this alarm, it's going to, it's gonna use that old cache workflow still. This is, the next area that we we plan to improve so that it uses the new pipeline. But, starting to make its its way there, and is available on those DX dashboards today. So, that's the new pipeline. Let's jump over to, reports now, and we'll go through that. So I mentioned, that the, reporting is in beta. So you'll still find, your normal Crystal reports here in the web console if you have them scheduled and being, added here into the web console. I don't have any in in my example environment here, but Crystal remains the main primary reporting engine for, logarithm today until we can fully, again, replace some of those out of the box reports and, make sure that we can do everything that we can do in Crystal with with the new reporting engine. So you'll find beta over here. This this new button, will take you to the new beta area. And and before I go there, I just wanna call out... I I mentioned some RBAC controls. So if I go into the client console, and check out my, user profile manager, the Loggerland global admin is the only user prof... Profile that gets this by default. There's a new reporting, option here to allow or disallow access to the the beta area in the web console. So this will show or hide that button in the web console. If you wanna give anyone access, you'll you'll have to come in here and just check that box for whichever profile you you wanna give access to. So, just a quick note on that. But let's go jump back into the fun here, and we'll go to the new reporting engine. I've got a couple reports that I was playing around with, but you will find a out of the box, alarm executive summary here that that you can, use. So before I jump into that, though, just just a quick overview of how this works. There are datasets, which, think of like a a database, right, where we're pulling in alarm data into, into here. Eventually, you'll find, some additional datasets as we add them in, in in the next versions. Things like cases or log volume or or the DX. Right? Those those are, next on our list to go after. So you'll you'll find those. Today is just, some alarm information. Some of these are more, robust than others. Right? Alarms with the actual events versus just maybe a a summary of of the alarm and has, less information there. So just depending on what you want to do. But I can select the dataset to make a chart from. And then once I have a bunch of charts, I can make a report. So let's let's, look at a report here, this executive summary. As I mentioned, I've I've already got some out of the box stuff. So if I hit edit, on the right, I'll find all of the charts that I've I've previously created, and I can drop them into my report, or I can move these other ones around. I can resize them very easily. The the tool is is very intuitive and, easy to use. So, there... There's even some, layout elements. I can create multiple tabs inside of, a widget. So if I add this here, I can, add a bunch of different tabs at the top. Rather than having to click through different reports, I I can just go through those tabs instead. So I'm gonna discard that. But, the the executive report will give you some nice information about the alarms. I've got, alarms over time, just how many have been created. This is an overall number of how many alarms have been created over the last thirty days as well as, the difference between the prior thirty days. So, you know, am I up? Am I down? How am I trending versus last, last month? Same thing with a a closure rate. So how many of how many of those alarms are getting closed? And give me a, a comparison to last month. Then I've got alarms by status, open alarms by status. I I, don't have closed alarms here. Just I... You know, as a as a manager, maybe I wanna know, how many alarms are open and where they're sitting. Right? Same thing with, maybe risk. I wanna see, of the open alarms, how how many of them are, critical and how many are not. We also have alarms by owner. So, you know, maybe we have an analyst that that is overloaded. You can quickly see that there. And then finally, down at the bottom, we've got top alarms by, in the last seven days and oldest alarms that are that are still open. So you can quickly see into all that. A lot of these datasets are are connected. So as you click on something, the other charts will update based on what I selected. So now I've got a a filter for alarms that are in the working, status. All my other charts updated by, by that. If you don't have any, you can see, some of these are are blank. But I can I can quickly change and go check out, any any one of those statuses and and have those charts updated? Creating a chart is also very, very simple. You can either do that through, again, from from the dataset, I can click on, the dataset I want to create a chart from, and that will bring me to the chart area. Or from, the the chart, I can I can click new chart? So, I'm gonna create one just as as an example here, but I've got a dataset, or a couple different datasets, so I'll select one. I just... I'm gonna make a tree chart based on the log, the volume of alarms coming from from AIE and, grouped by the alarm rule. Right? So I can see which alarm rules are most chatty. So I'm just gonna do from our summary dataset. If you're not, if you don't know what's in these, there there is a little bit of, information as you as you hover over these. It'll give you a little bit of of detail about it. But but the easiest way to to really see is is to create your chart. I'm gonna do a tree chart. Where did that go? Let's just do a quick search. You you can see here I mentioned there's there's 80 different chart options in here. I don't know what a handlebar chart is, but it's there. Sounds fun. Some of these, you know, we might not have the right data available to to make some of these, like a a Gantt chart, or a waterfall chart, but, have at it. Alright. So let's do a treat chart, create new, and then I'm brought to a a section where on the left, I've got all the columns that I can add. Then I've got all the settings for my chart. And then on the right, I'll I'll have a display of, an example of what that chart will look like. So, again, click and drag. I'm just gonna do, alarm rule name. I'm going to add that to my dimensions, and then I just want it to count. Right? Count the alarm rule name, group by alarm rule name. I'm gonna save that. And, I could add in filters if I want. So, maybe by alarm date, the the time range filters are, very, very customizable. I can do it by, sort of like a previous or a last option. I can do an advanced where I'm doing an in between. But maybe I wanna do, like, last week or last seven days. Right, I can be very specific about that, and then, it'll give you an example of of what that date range looks like. So, I'm not gonna do this quite yet. Let's just see what this chart looks like. There we go. We've got, quite a bit of these abnormal off behavior rules coming into the system. I can see an example of of the data that that this, chart is based on. And then if I want, I can I can give it a name, and I can save it? And then, from there, I can even, I can even add it to a a report. So very, very simple, very quick. And, I've had really good experience and and feedback on this. Would love to hear from you guys as as you get in here and start playing around with it, what what your experience is like. There is not a scheduling option, yet that... That's, due for our January release, but there are options to, export manually. So you'll find, up here in the dot dot dot menu, the ability to download the report. So you can do it as a PDF or just as an image. And, we don't have a way to share reports yet, but, eventually, you'll be able to export a a a YAML, maybe share that with someone and have them be able to upload it, maybe put it on the community for others to enjoy. So, yeah, coming along. Go out there. Happy reporting, and and let us know your experience. Brooke, how we doing on questions? Questions. Yeah. I got two of them here. So, Devonte wants to know and also relate... Let me ask Lisa's question. Is all this available for 726 on prem? Yes. Yes. All the reporting is available for for, any customer. Yeah. Okay. Yeah. The... Devonte asked, are there any plans to update the UI for the desktop console? There are not. We, we plan to move away from the desktop, in the works right now. We... Now that, 07:26 is out, work has started to refresh the web console. So, you will see, refresh web console here, in the next couple releases. I won't spoil anything there, but, we're we're gonna bring that to look more modern. And then we'll also start to bring some of the, functions that are in the client console to to the web and and consolidate into a single interface. Mhmm. Okay. Thank you. Great. Alright. Keep them coming. If there are questions, let's jump over to, our MCP. So I'll just jump into threat center real quick. I've got an alarm here, that maybe I want to investigate, and, my MCP has the skill to, triage alarms for me. And I found that the easiest way to do that is to, select your alarm. You can grab the alarm ID and copy it and then go over to your MCP. And, actually, I'm I'm getting ahead of myself. Let's let's, let's talk about setup really quick and and what this thing is, before we, get into, how it functions. So let me switch screen share. Alright. So this, this is out on community, and, there's there's tons of information here about the, MCP itself. But think about it like a very, very good dictionary that we're providing, your, either quad or whatever AI... Or generative AI tool you're you're using. So this provides it, the skills to interact with, logarithm. Your your, environment based on, it's going to use, an API token to, hit all the APIs and pull back data and do the work that you're asking it to do. So, you need to, get an API token. Access to the data, will be based on whatever that API token has access to. Right? So if you are a global admin, Claude is gonna have global admin access. Right? So just just a heads up on that. Be be careful. Make sure, you know, we're not handing out global admin tokens to, to anyone that that you don't want to have them. You can go, give them, you know, a token that has more restricted access. But the setup to do this is fairly easy. You you download, a download at the very end of this very long write up, and you install this locally on your, on your own laptop or system. So, you know, you're running cloud desktop. I run it in, the terminal, and, I've I've installed this, so that cloud can, access all of these tools that are available in the MCP. But that will allow, Claude from my desktop to access all the APIs, pull back data, synthesize it, and and, again, take the actions or or do whatever it is that I've asked Claude to do. So all this is happening on your local workstation, and it's just hitting the logarithm APIs. Capabilities, it it can triage alarms. I I mentioned case management, playbooks. We have, like I said, almost 85 tools now, I think. We built in things like Sigma conversion, ability to to manage content lists, provide you, some topology, lot... Lots and lots of different things. So, really, really, really helpful and, some some cool tools in here. As I mentioned, the install's, pretty simple. Download this, this Python wheel, this package, install it, provide it your API token. And then, as we've been adding updates, we've actually released an updated version in the last week with, some additional tools and some fixes. So, as you need to update, you can just redownload and, run the installer again. It'll just install over what you already have. But, yeah. So the the, let me see here. So there's a tool summary for you, and then we also are listing way down at the bottom. One more thing I wanna call out is the release history. So, you can see we we had, an additional release last week, with some additional tools and some fixes. So, if you grabbed version o four one, maybe maybe go grab the the latest o six zero. But let's show what we've got here. Let me switch screens one more time. Maybe. To find the right screen. Okay. Hopefully, you guys can see this okay. We're we're working in the terminal today, but, I asked Claude to triage an alarm. I ran this earlier just to make sure we didn't have to sit here and wait for it to be done. But I gave that that alarm that I was mentioning at the beginning. I gave it the ID, and I said, hey. Go triage this alarm for me. I also told it, you know, this may look like synthetic data, as I've been doing some testing. You know, I have echo and, a log generator. It it usually catches that and says, hey. This this looks like synthetic data, so I recommend you just close the alarm. So I was I was telling it, ignore that. And you can see it it starts to go grab the alarm, and it it actually says, hey. I I found that this was synthetic data, and I recommend that you close it. So I I told cloud one more time, hey. Treat this like an alarm, that's real. So it says, okay. Great. Let me go out and do all the work for you. And, actually, I didn't finish running this, so we'll we'll have it go. And and I guess you guys can see it in real time. But what what it does is, it's it's gonna go grab the alarm detail, maybe things like hosts and users. It will run searches, in the background for the... You know, effectively running the drill down to to go grab the, the evidence for, for this alarm. It will try and do some contextual lookups for the host or the user. A lot of different tools going into this to help gather all of that, information and triage the alarm again for you so that you don't have to go do these things. So you can see it. It spits out, hey. I I found, that this looks like privileged escalation. It gave me, some information about the primary event, any related events, some, key indicators, and then it finally ends up with this recommended action. It will say, hey. I I recommend, you know, this this looks like a true incident. You should probably, escalate this to a case, and and here are the reasons why. But it also has the axe... Access to do that. So I can say, let's let's create a case. And, it it will go, create that. I'm I'm not gonna switch screens again, but, that alarm will get added as evidence to the case. It's going to add any of the search results, if found relevant as well as evidence. And then I can I can tell it, you know, assign it to a certain queue or or whatever it is we? We'd like it to do. So really, really useful and helpful, and, nice for triaging alarms. But there are, like I said, tons of skills. So if I do l r c... Sim here, you can see that, triage alarm is is the first one that came up, but I I even have, like, tune AIE rule. So, here's the rule that I want to tune. Why don't you go grab, all the all the logs that have, triggered this rule and help me understand, how to make this, more relevant to me. Right? How do we decrease the amount of times that this rule triggers and provides false positives? So the... That's another tool that's in there. I've used it to, mass close alarms. I've mentioned, regex. Right? I can I can have it go grab some logs from a very specific log source and help me build the regex? It it is aware of our schema, and understands that. Other use cases that I've seen people use this for is, reporting. Since it can go run searches and can access the search API, I can say, hey. Go go grab, you know, logs to, around this specific thing and build a report for me. Maybe export it to an HTML style report or throw it into Excel, etcetera. Right? As as long as Claude has access to those things on on your desktop, it can it can do that. I'll pause there. Brooke, any any, questions from the field? Yes. Just, one more here. It is l r, seven twenty six support custom JSON policies. Custom JSON policies. Yes. We we have supported custom JSON policies for, a while now, In the system monitor, directory, on the agent, you'll find a, a folder for custom policies, and you you drop them in there. And the the system monitor will use those policies first before trying any of the the system ones. Was that the only one? That was... Oh, sweet. Oh, hold on. Yeah. You know, Devonte, he says I missed... I think I missed my question being answered. That was about, the plans to update the UI for the desktop console, but, except for one and see that one to update. Sorry. Say that again. I I don't think I followed. No. That was the question you answered a while back is, Oh, are. there any plans to update UI for the desktop console? Yep. Gotcha. Yep. Yeah. Yep. Okay. Great. Okay. We can pull forward. Well, Yeah. yeah, sounds like, sounds like I crushed it on the demo since we don't have a whole lot of questions. But, yeah. So similar with the MCP, please... You know, as you guys use it, you can use, the community to to provide some, feedback on, you know, how it's going, if you're running into issues. We've, like I mentioned, already, updated the tools to to fix a few things that that folks have run into. So if you if you have ideas for additional skills, or you run into problems where, you know, it doesn't understand the the schema or or whatever it might be, yeah, let us know, and and we'll we'll continue to to work on that. Future plans for the MCP is to productize it, and and actually make it part of the web console, installer so that when you, when you come from, your desktop, you don't you don't have to have the skills sort of, installed locally. You can hit the MCP server that is hosted, as part of the web console, and, you know, all the updates would come come from there, and you don't have to individually manage, workstations. But, we wanted to get this out there since, it's got a lot of goodness in it and, get some early feedback. So let us know. Okay. Alright. Oh, I have to stop sharing. Sorry. So I'm trying to switch back over to our slides here. Brooke mentioned the, logarithm intelligence offering. You know, this is a hybrid model of of being able to send data from, your on prem system into, our, UEBA engine in in the cloud, and and then you get data back into your on prem SIM. So if you're interested in that, we've got, you know, a white paper or a data sheet on that. You can find that here, through the QR code. And you... Of course, you can always ask your your sales team about it as well. Okay. One more question for you here, from. James. How can I see the whole list of MCP skills? Yeah. Go go check out that community page. Everything is listed there. And, that... Yeah. That's the best place. Okay. So we do, have an action we'd love for folks to take, and that is to come and take a look at the NuScale fusion release webcast that's coming up in two more days. So, we're, you know, again, super excited for us to be here and present this material. Ryan, do you have any other closing thoughts before we wrap up today's webcast? I don't think so. Did we post, any of the links? I think that might be be helpful for everyone. Just links to the the MCP, posting on community, maybe release notes. We'll we'll get that into into the chat here for for anyone that wants it. But, yeah, I didn't I didn't have anything else unless there's any other questions. Okay. Okay. I don't see any right now. So... Oh, sorry. There is one more. James came back in and says, tell us a bit more about what you said at the beginning that Exabeam is... I'll read more. A top Google partner. Okay. That's... I'll take that one. So... Yes. We are one of seven GUS partners with Google. New scale analytics is integrated into directly, Google SecOps for those who are, you know, SecOps customers. Google, again, you know, they're provide... They're able to provide SIM like functionality in SecOps, but they can't do what we do, and that's providing behavioral analytics. So we've been named the the the number one partner of the year for security analytics because of integrating new scale analytics into SecOps. Yes. Technically, that's a competitor. But we've learned, through all the, you know, the wars of past that if we don't integrate together and work together, we're all going to lose together. So that being said, yes. We integrate directly into Google with Google sec... Sorry. Google sec ops with new skill analytics so you can have that UEBA capability, the paper intelligence and analytics inside all that security data without having to replicate the data lake. And, again, we will talk about this again on the webcast in two more days if you'd like more information. Okay. Well, that being said is, my name is Brooke Chemo. I'm here with Ryan Gamboa. Again, we are very pleased, to have this release and share this with you, to the point where I had a major life event, family life event. I got in at 03:30 in the morning last night, went to bed. I got four hours of sleep. I'm so excited. There's no way I was gonna miss this webcast to be here with Ryan. So, this is by far the most exciting release that we have had, and, so excited to be here. Again, this is all the result of customer feedback and input. So, again, talk to your sales reps, talk to your partners, talk to folks like Ryan when you get a chance to be interviewed by them so that we can keep developing for the future. Again, my name is Brooke Cholmond here with Ryan Gamboa, and we wish you the best. Thank you very much. Thank you, everyone.