What's New?

Build dashboards around additional dimensions and case fields for more focused, nuanced data.

P95 and P99 for calculated-time widgets for a sharper view of SLA compliance that matches your SOC reporting.

Sort tables by Case ID, Creation time, or Closure time.

Group or filter by workspace for cross-workspace visibility.

YTD and Past 1 year filters now work per widget, not only as global filters.

Learn more here.

Download your widget data as CSV, to save the numbers behind any custom or built-in dashboard widget locally.

Learn more here.

You can now create Guidance and Rules for Auto Triage with Socrates Builder. Attach a playbook or procedure, or describe what you need in plain English. Socrates Builder drafts the entries, and you can review each one before enabling it.
​
Learn more about Guidance and Rules.

Context Graph gives you a visual map of the identities, assets, and relationships in your environment. Start from any entity to see its direct connections, expand the graph step by step, and filter for critical, privileged, or weak-posture entities to scope an incident's potential blast radius. Auto Triage also adds graph context directly to alerts.
Additional information is available in the Knowledge Base.

Cases Dashboards widgets can now be grouped and filtered by Actor Type, so you can see whether an action came from an analyst, a workflow, Socrates, Agents or Auto Triage.
​
Compare who closed your cases, or how many cases were created by each actor type.

Learn more here.

Add a separator to your dashboard to group related widgets under titled sections, for dashboards and reports that are easier to read.

Learn more here.

We've introduced new steps and improvements for new and existing integrations. For full details, check out the complete digest.

Cases has enhanced its search experience, with matching keywords highlighted wherever they appear: case title, description, notes, attachment name, and resolution reason.

• Snippets show match context inline under each result.
• Click a highlight to open the match location directly.
• Expand results to walk through every match in a case across tabs, and use the Next/Previous arrows to navigate between matches without losing your place.

Learn more here.

Cases Dashboard widgets can now filter by numeric values: Less Than, More Than, and Range. Letting you focus any widget on cases that meet a specific threshold or event count. ​

Learn more here.
​

​

Cross-workspace reporting, escalation workflows, and centralized SOC operations are now simpler to build and more efficient to run.

Use the new Query cases across workspaces step to return cases from all workspaces in your org in one call, supported by the cross-workspace API key.

• Scope results to specific workspaces using the Workspace IDs parameter.
• Control which fields are returned using Output Fields.
• Focus your results using case filters.
• Scope a service account key to some or all workspaces automatically, by creating a new cross-workspace API key in Org Admin settings

We've introduced new steps and improvements for new and existing integrations, as well as a new template. For full details, check out the complete digest.

You can now build Cases Dashboards around five more case fields, giving you sharper control over what your dashboard surfaces:

• Case Reviewer + Review Conclusion — see who reviewed what, and how often cases got overturned
• Resolution Status — set a whole dashboard to a particular status only, in one click
• Case Title — see which case types come up most often
• Restricted Status — keep restricted cases off shared dashboards

Introducing scheduled reports — automatically deliver case metric snapshots to any recipient on a recurring cadence, with optional filters for case state, assignee, severity, and more. Reports arrive in your inbox with a link to the snapshot in your dashboard and an optional PDF attachment.

Each scheduled report execution also fires a system trigger for use in downstream workflows.

Stay on top of critical events across Torq without leaving the product. The Notification Inbox gives you a persistent, centralized view of workflow failures, approval requests, AI credit alerts, case activity, and more. Notifications are grouped by time, badged by type, and link directly to the relevant resource so you can act immediately.

Innovation at Torq never stands still — and the Product Spotlight keeps you up to speed. This Q2 2026 edition covers the latest in how you build and investigate, with scannable summaries of what's new and why it matters.
The full edition is available in the Knowledge Base.

AI agents in Torq now have a dedicated hub where they live independently of any workflow. Build an agent with Socrates for a fully guided experience: it works through the configuration with you, step by step, and publishes the agent when done. You can also configure one manually from the AI Agents page. Publish once and reuse across workflows, Socrates sessions, Case Management, and more.
Additional information is available in the Knowledge Base.

We've introduced new steps and improvements for new and existing integrations. For full details, check out the complete digest.

Socrates can now build as well as investigate.

Here is what Builder can do:

• Build, modify, and troubleshoot: Ask Socrates to build or change workflows, or anything else in the workspace, right from the chat.
• Plan before it builds: In Plan mode, Socrates reviews the request, asks clarifying questions, and suggests a solution. Switch to Build mode to apply the changes.
• Test, refine, and approve: Socrates tests and validates as it builds. Refine through chat, then publish when ready. Nothing goes live without explicit approval.

Get started faster with suggested prompts, or attach files for additional context.

Builder lives alongside Investigator, the new name for the existing Investigate > Socrates experience, now unified with Builder. Socrates now opens as the Torq homepage; both are there as soon as you log in.

Learn more in our knowledge base.

The list of observable types has been extended to fully align with OCSF 1.8.0, supporting more thorough and granular investigations.

See the full list in the Observables page.

Cases Dashboards now supports new dimensions for custom widgets and filtering:

• MITRE ATT&CK mapping. Visualize threat coverage and analyze cases, filtered by Tactic and Technique.
• Security context. Build widgets using a consistent, standardized set of case fields, such as mitigation actions and event sources.
• Group assignment. Break down case workloads by the assigned team, alongside any other dimension.

More ways to surface the metrics that matter — without leaving the dashboards you already use.