--- title: "Workshop Release Notes" description: "Workshop release notes. What was added, changed, and fixed in the ten most recent releases of North Pole Security's endpoint protection console." doc_version: "1" last_updated: "2026-10-16" canonical: "https://northpole.security/releases/workshop" --- ![](https://northpole.security/images/workshop/figma/hero-bg.png) [Release notes](https://northpole.security/releases) # Workshop release notes What was added, changed, and fixed in the ten most recent releases of the Workshop console. ## 2026.8.2 September 22, 2026 ### Announcements - 📣 This is a hotfix release. It contains performance fixes for approval workflows and clean syncs. ### Fixed - ❗ Approval workflows are much faster, especially for users with several hosts, or tenants with a large number of binaries and rules. - ❗ Clean syncs are much faster on tenants with large rule sets, and no longer put heavy IO load on the database while a host downloads its rules. ## 2026.8.1 September 21, 2026 ### Announcements - 📣 This is a hotfix release. It contains one performance fix for clean syncs. ### Fixed - ❗ Clean syncs are much faster on tenants with large rule sets, and no longer put heavy IO load on the database while a host downloads its rules. ## 2026.8 September 10, 2026 ### Announcements - 📣 This release promotes Tags as a first-class concept. There is now a top-level Tags section with per-tag settings, priority ordering, and per-tag process overrides. - 📣 Time-based rules in CEL allow you to control when something is allowed to run - 📣 Cross-event sequences in Signals, full-process tree uploads, and an improved process tree viewer ### Fixed - ❗ Rule sync no longer drops rules when a pagination boundary lands on a `created_at` tie. - ❗ Clean sync no longer serves stale cached data for deleted rules. - ❗ Approval workflows no longer fail forever for OS platform binaries. - ❗ AI chat no longer stalls when Claude models exhaust the token budget by thinking. - ❗ Table filters in URLs now properly handle CJK text and emoji. - ❗ Fixed the Team ID row on the event details page for platform-ish binaries. - ❗ Fixed ordering by tag on the hosts and directory groups tables. - ❗ Package rules only delete materialized rules that have a valid ID. - ❗ Rule pack teardown no longer deletes rules from other rule packs. - ❗ Fixed issues with the Dangerous Entitlements report. - ❗ Preflight now fails loudly when a host record update fails, instead of continuing silently. - ❗ Last seen client mode is now stored correctly. - ❗ Usernames are now stored and matched case-insensitively throughout, resolving occasional issues with approval workflows. - ❗ Package rules no longer adopt or re-policy rules that already exist. - ❗ Package rules with a very large number of identifiers can now be properly ingested. - ❗ A batch of smaller UI fixes across the console. ### Changed - ↔️ Redesigned the dashboard, which prioritizes actionable information higher in the page - ↔️ The nav bar is now sticky with a layered shadow and refreshed header, search, and chat buttons. - ↔️ Revamped “Create Network Rule” modal. - ↔️ Updated process tree visualization in signal matches. - ↔️ Host details are now split into separate tabs. - ↔️ Package rule details always show the binary and version selection expressions. - ↔️ Tag names can now contain spaces. - ↔️ Reports now read from aggregates, and recent apps no longer read raw events. - ↔️ Documentation and API errors now list every valid MCP toolset slug. ### Added - ➕ Top-level Tags section with a tags list, tag detail pages, rename and delete actions, priority ordering, and managed settings counts. - ➕ Edit tagged settings from each tag page, and edit host settings with the same editor. - ➕ Per-tag process overrides. - ➕ Bulk package import for Homebrew packages. - ➕ Nix package scanning and Nix package rules. - ➕ Time-based rules in CEL: `policy_for_range()`, `now()`, `weekdays()`, `today(tz)`, and `kill_on_expiry()`. - ➕ Signals support `sequence()`, a full process tree flag, and an OS column. - ➕ Telemetry query history. - ➕ Export network flow events and host metrics to cloud storage. - ➕ File access authorization now supports per-process options. - ➕ Approve for Tag on designated approver requests. - ➕ Directory groups list page, group membership filtering on directory users, and cost center and department sync from directory events. - ➕ Vote counts on blockable details, with a reset button. - ➕ The latest available Santa release is now shown in the console with a direct download link - ➕ Tag selector on the fleet metrics report. - ➕ WorkspaceONE in the MDM dropdown. - ➕ An unsaved-changes guard on the telemetry query page. ## 2026.7 August 4, 2026 ### Announcements - 📣 This release mainlines the Ready for Lockdown report - bulk rule creation, CSV export, and app links - replacing the legacy report. - 📣 Rule Packs can now contain all rule types and combine multiple rule types in a single pack - 📣 Signals can now trigger on repeated events across a time window and upload a process tree slice from the trigger event - 📣 We’ve added a package inventory command to upload telemetry data about all the packages on your machines across a variety of ecosystems. Along with this we’ve re-designed the commands interface to handle queuing and display of attempt history ### Fixed - ❗ Push notification values are no longer written into audit events. - ❗ SETTINGS\_AUTO\_UPDATE audit events now record the correct details. - ❗ The workshop-audit-user role now has all the expected read permissions. - ❗ Spurious update-failure messages no longer appear on AWS deployments. - ❗ Package rule sync errors are correctly reported as errors instead of successes. - ❗ Slack block notifications now resolve the rule by the rule ID Santa reports to better handle replacements. - ❗ Auto-update settings no longer flash the Disabled option while loading. - ❗ Table filters correctly escape apostrophes, allowing querying for fields containing them. - ❗ Telemetry results reset to the first page when a new query is run, avoiding misleading “no results found” errors. - ❗ Scrolling inside a CEL editor no longer gets swallowed by the page. - ❗ Rule pack catalog no longer shows “All rules edited” on every subscription, and empty subscriptions warn correctly. - ❗ Multi-party approval on rule pack changes shows a proper prompt, and closing the approval modal no longer raises an error toast. - ❗ The lockdown report labels the app hash as SHA-256 rather than CDHash. - ❗ Voting emails are normalized to lowercase. - ❗ Command palette and docs search include previously missing entries. - ❗ Fixed a very rare rule sync issue that could cause a rule to be skipped if it was added during a period of high contention. - ❗ Fixed Slack bot not alerting users that an approval cannot be requested due to a block rule or a binary being flagged. ### Changed - ↔️ Navigation replaced in-page tabs with a megamenu and sub-nav; tabs are now real URLs (?tab= query params are gone) and each page sets its own document title. - ↔️ Audit moved from a top-level page into Settings. - ↔️ Signal state colors were swapped and severity colors removed. - ↔️ The FAA rule creation modal was redesigned with a live preview, and FAA rules auto-inject noisy system processes. - ↔️ Rule packs are gated by release channel and minimum Workshop version; packs above your version show a version notice instead of an Add button, and unsubscribed pack titles link to their preview. - ↔️ App icons are now shown in many places throughout the UI. - ↔️ Telemetry queries run through DuckDB are restricted to SELECT-only. - ↔️ Tag ordering scales to 5000 tags with a warning in the UI past 250. ### Added - ➕ Ready for Lockdown report: bulk rule creation, CSV export, shift-click range selection, and links from app names to app pages. - ➕ Santa commands service with package inventory, binary upload, and kill commands, plus a commands UI and results view. - ➕ AI chat shows tool calls and results on both live and historical conversations. - ➕ QueryTelemetry is exposed as a streaming tool on MCP and AI chat. - ➕ Per-connection MCP tool selection via X-MCP-\* headers. - ➕ Advanced CEL filters on package rules, with function autocompletion in the CEL editor. - ➕ Signal rules support process trees and responsible process attribution. - ➕ Signal and network flow rules can be delivered through rule packs. - ➕ Risk engine setting to evaluate only unknown blocked executions. - ➕ Local groups can now coexist with directory-synced groups. - ➕ Auto-updates support per-day scheduling and display GMT times alongside local. - ➕ Overwrite warnings when creating a rule that already exists. - ➕ Support for customizing the “Open” button on a per-rule basis. - ➕ Docs: the Complete Guide to CEL in Santa Rules, webhook documentation, sandbox profile documentation, and per-version badges. ## 2026.6.1 July 23, 2026 ### Fixed - ❗ Updated Next.js to 16.2.11 to fix [several vulnerabilities](https://nextjs.org/blog/july-2026-security-release) ## 2026.6 July 10, 2026 ### Announcements - 📣 This release introduces several large new features: **Signals**, customizable detection rules with reports and labels, **Network rules** for controlling network flows, **Rule Packs** subscribe, preview, and safely apply curated rule sets, **Temporary Admin Mode** (beta) to remove latent admin access, a new **Lockdown readiness** report to guide your path to Lockdown, and a new **Webhooks API** lets you receive audit, approval, and signal events. ### Fixed - ❗ Number inputs that couldn’t be cleared can now be emptied - ❗ Fixed high latency when voting to approve applications - ❗ Scope regexes no longer stick across tags in the UI - ❗ Approvals now return an audit failure when a user has zero eligible hosts - ❗ Designated-approver emails are compared case-insensitively in approval workflows - ❗ Numerous smaller UI/UX and correctness fixes across the app ### Changed - ↔️ Santa auth tabs are unified and sync tokens are now copyable - ↔️ The telemetry filter bar now applies AND/OR per gap instead of globally - ↔️ Seatbelt policies now use the BINARY\_PATH placeholder - ↔️ Block reason is now a checkbox, and policy names were clarified - ↔️ Donut chart values are centered on the pie - ↔️ Hosts not synced in over 30 days are now hidden in more places - ↔️ FAA signing IDs are now sourced from the binary catalog and composed for platform binaries ### Added - ➕ **Network rules**: define network-flow rules, ingest network flow events, view them on a details page, with MPA gating - ➕ **Temporary Admin Mode** (beta): grant time-boxed admin access, gated behind the EPM tenant feature - ➕ **Signals**: detection rules with santasync download, report upload, labels, host-tag scoping, and a dedicated UI - ➕ **Lockdown readiness**: new LockdownProgress reporting with projected per-mode host counts, rule-coverage attribution, and a Ready-for-Lockdown report UI. - ➕ **Rule Packs**: subscribe to curated rule sets provided by North Pole Security with preview-before-apply and overwrite warnings - ➕ **Webhooks**: receive webhooks for audit events, first-time software approvals, and signals - ➕ AI Chat and MCP now benefit from an internal tool dispatcher, significantly reducing token usage and improving performance - ➕ AI chat can now render Mermaid diagrams - ➕ Telemetry query storage, save your queries for replay later, with descriptions and versioning - ➕ Added autocompletion in the telemetry filter expression editor - ➕ CEL rules now support `today()` and `days()` functions - ➕ Added split silence modes for block policies - block just the GUI, just the TTY, or both - ➕ A “Copy Event Details” button to most events - ➕ Approval workflows in Slack can now be explicitly rejected - ➕ Automatically upload bundle information for apps that are not yet known by Workshop and for which an allow event occurs - ➕ Tables in the UI now show total counts up to 10k rows - ➕ Improved API validation of requests and more consistent error responses ## 2026.5.1 June 17, 2026 - 📣 **Hotfix release.** This is an out-of-band hotfix for v2026.5 addressing approval-workflow latency and raising the tag limit. ### Added - ➕ Increased the tag limit to 250. (Hosts remain capped at 25 active tags.) ### Fixed - ❗ Resolved latency issues in the approval workflow voting path. ## 2026.5 June 8, 2026 ### Announcements - 📣 Seatbelt Policies Initial support for Seatbelt rules, including a built-in editor for authoring and syncing rules and a simple builder to help build initial policies. The minimum required Santa version for Seatbelt rules is 2026.4. - 📣 MPA Everywhere Multi-Party Approval can now be attached to any mutating API method via a generic interceptor, rather than a fixed set of endpoints. CEL expressions can be used to further decide whether a given method should be protected. ### Added - ➕ API key CIDR restrictions — optionally restrict API keys to specific source IP ranges - ➕ Break-glass passkey support for emergency access - ➕ Rule blast radius — new CreateRuleBlastRadius RPC and an `affected_host_threshold` guardrail when creating rules. Affected hosts shown in the UI when creating a block rule. - ➕ Justifications for self-service and social voting workflows - ➕ CEL policy additions — AUDIT return value, plus ALLOW\_PLATFORM and BLOCK\_BINARY\_MISMATCH support - ➕ Added by attribution added to rules - ➕ Filter bar — filters consolidated into a single search bar; press / to focus, driveable by keyboard alone - ➕ API Explorer added to the docs site - ➕ Telemetry filter expression documentation - ➕ “Test Bucket” button on all bucket configuration fields to make it easier to verify whether permission policies are correct at configuration time. - ➕ Processed time now exposed on events - ➕ Added extra indexes to events for faster per-host event queries - ➕ Added “App Inventory” command to request Santa upload an inventory of all applications/binaries found under a path. This can be sent to any tag, or individual host. - ➕ Added “Binary Upload” command to request Santa upload a copy of a binary from a host. Requires a “Binary Upload” bucket to be configured in advance. Added buttons to trigger these uploads from the Host Details page and from an Event Details page ### Changed - ↔️ Callout clarifying that automatic updates apply to Workshop only - ↔️ Sync is now triggered when tag↔group mappings change - ↔️ Toned down CheckBlockableForSession error noise and dropped plugin-disabled logging from Warn to Debug - ↔️ Updated CEL fallback-rule commentary to note Santa version requirements - ↔️ Settings pages are now alphabetized and each sub-page is a full part of the URL - ↔️ Events from Santa 2026.5+ for platform binaries are now categorized as “Platform” instead of “Certificate” - ↔️ “Online Status” field on Host Details renamed to “Push Notifications” to better reflect what the field is showing ### Fixed - ❗ AI Settings enabled/disabled state could desync between toggle and backend - ❗ AI Chat now filters out non-chat models from provider listings and excludes admin/settings methods to stay within the OpenAI 128-tool limit - ❗ AI Chat settings wiped the provider/key on initial load - ❗ Renaming a tag could break approval workflows referencing it - ❗ Filtering by sync status in package rules didn’t work - ❗ Telemetry query URL state caused a feedback loop and overly large queries are no longer pushed to the URL - ❗ publishmetrics no longer fails when called before the host record exists - ❗ Hosts now handle ERROR\_COMMAND\_DISABLED correctly - ❗ Some mutations made using MCP bypassed audit record logging - ❗ When updating rules in-place, redirect to the new rule instead of showing an error - ❗ Fleet CPU/RAM statistics now drops stale entries to avoid drag ## 2026.4.1 May 8, 2026 ### Fixed - ❗ Updated Next.js to 16.2.6 to to fix [several vulnerabilities](https://vercel.com/changelog/next-js-may-2026-security-release) ## 2026.4 April 16, 2026 ### Fixed - ❗ Resolves an issue where event exports (execution, file access, USB mount, and network mount) could skip exporting events when a host’s clock was skewed into the future. The export cursor would advance past legitimate events that hadn’t been exported yet. ## Sitemap - [Home](https://northpole.security/index.md) - [Workshop](https://northpole.security/workshop.md) - [Santa](https://northpole.security/santa.md) - [Features](https://northpole.security/features.md) - [Cookbook](https://northpole.security/cookbook.md) - [Docs](https://northpole.security/docs.md) - [Blog](https://northpole.security/blog.md) - [Glossary](https://northpole.security/glossary.md) - [About](https://northpole.security/about.md) - [Contact](https://northpole.security/contact.md)