What's New?

We've introduced new steps and improvements for new and existing integrations. For full details, check out the complete digest.

Cases has enhanced its search experience, with matching keywords highlighted wherever they appear: case title, description, notes, attachment name, and resolution reason.

• Snippets show match context inline under each result.
• Click a highlight to open the match location directly.
• Expand results to walk through every match in a case across tabs, and use the Next/Previous arrows to navigate between matches without losing your place.

Learn more here.

Cross-workspace reporting, escalation workflows, and centralized SOC operations are now simpler to build and more efficient to run.

Use the new Query cases across workspaces step to return cases from all workspaces in your org in one call, supported by the cross-workspace API key.

• Scope results to specific workspaces using the Workspace IDs parameter.
• Control which fields are returned using Output Fields.
• Focus your results using case filters.
• Scope a service account key to some or all workspaces automatically, by creating a new cross-workspace API key in Org Admin settings

We've introduced new steps and improvements for new and existing integrations, as well as a new template. For full details, check out the complete digest.

You can now build Cases Dashboards around five more case fields, giving you sharper control over what your dashboard surfaces:

• Case Reviewer + Review Conclusion — see who reviewed what, and how often cases got overturned
• Resolution Status — set a whole dashboard to a particular status only, in one click
• Case Title — see which case types come up most often
• Restricted Status — keep restricted cases off shared dashboards

Introducing scheduled reports — automatically deliver case metric snapshots to any recipient on a recurring cadence, with optional filters for case state, assignee, severity, and more. Reports arrive in your inbox with a link to the snapshot in your dashboard and an optional PDF attachment.

Each scheduled report execution also fires a system trigger for use in downstream workflows.

Stay on top of critical events across Torq without leaving the product. The Notification Inbox gives you a persistent, centralized view of workflow failures, approval requests, AI credit alerts, case activity, and more. Notifications are grouped by time, badged by type, and link directly to the relevant resource so you can act immediately.

Innovation at Torq never stands still — and the Product Spotlight keeps you up to speed. This Q2 2026 edition covers the latest in how you build and investigate, with scannable summaries of what's new and why it matters.
The full edition is available in the Knowledge Base.

AI agents in Torq now have a dedicated hub where they live independently of any workflow. Build an agent with Socrates for a fully guided experience: it works through the configuration with you, step by step, and publishes the agent when done. You can also configure one manually from the AI Agents page. Publish once and reuse across workflows, Socrates sessions, Case Management, and more.
Additional information is available in the Knowledge Base.

We've introduced new steps and improvements for new and existing integrations. For full details, check out the complete digest.

Socrates can now build as well as investigate.

Here is what Builder can do:

• Build, modify, and troubleshoot: Ask Socrates to build or change workflows, or anything else in the workspace, right from the chat.
• Plan before it builds: In Plan mode, Socrates reviews the request, asks clarifying questions, and suggests a solution. Switch to Build mode to apply the changes.
• Test, refine, and approve: Socrates tests and validates as it builds. Refine through chat, then publish when ready. Nothing goes live without explicit approval.

Get started faster with suggested prompts, or attach files for additional context.

Builder lives alongside Investigator, the new name for the existing Investigate > Socrates experience, now unified with Builder. Socrates now opens as the Torq homepage; both are there as soon as you log in.

Learn more in our knowledge base.

The list of observable types has been extended to fully align with OCSF 1.8.0, supporting more thorough and granular investigations.

See the full list in the Observables page.

Cases Dashboards now supports new dimensions for custom widgets and filtering:

• MITRE ATT&CK mapping. Visualize threat coverage and analyze cases, filtered by Tactic and Technique.
• Security context. Build widgets using a consistent, standardized set of case fields, such as mitigation actions and event sources.
• Group assignment. Break down case workloads by the assigned team, alongside any other dimension.

More ways to surface the metrics that matter — without leaving the dashboards you already use.

We've introduced new steps and improvements for new and existing integrations, as well as new templates. For full details, check out the complete digest.

Cases can now be assigned to analyst groups—giving teams greater flexibility and control over how they manage their workload.

Filter cases by Group assignee to quickly surface the cases relevant to your team, keeping investigations on track at a team level.

We've introduced new steps and improvements for new and existing integrations. For full details, check out the complete digest.

Two new native data connectors are now available for endpoint security: SentinelOne and Microsoft Defender. Each connector provides continuous ingestion, filtering, backfill, and reliability out of the box, no custom integrations required, and routes alerts, threats, and security events directly to Auto Triage and workflows. This enables faster operationalization of security signals and scalable automated triage and response.

You can now create and manage custom roles at the organization level and apply them consistently across all your Torq workspaces. Org-managed roles ensure that permissions, role IDs, and access definitions remain uniform everywhere, eliminating the need to recreate roles per workspace and preventing inconsistencies that can lead to integration gaps or unauthorized access.

Cases now ship with a built-in set of security fields for immediate, investigation-ready context schema.

MITRE ATT&CK Tactics and Techniques are now structured fields on every case, with dedicated filter categories to instantly surface cases by threat context.

Workspace groups brings scalable team-based access control to restricted cases, dashboards, and Interact — making it easier to protect sensitive data and focus teams on what's relevant to them.

Groups can be provisioned statically by manually adding members, or dynamically with automatic syncing from your IdP.