Atlas 4.1: graph-native threat intelligence
Fan-out investigation paths, provenance receipts, and a reworked enrichment engine that completes in under a minute.
Atlas 4.1 is the largest release since we shipped the graph in January. This note summarizes the operator-facing changes and the reasoning behind them.
Why fan-out paths
Analysts kept telling us the same thing: the investigation window is shaped like a tree, not a timeline. Pivot out, collapse the dead ends, promote the live ones, repeat. 4.1 makes that first-class.
Provenance receipts
Every artifact in the graph now carries a signed receipt: source, fetch time, confidence, and any transformations applied. Exports include the receipt chain by default.
Enrichment under a minute
We rewrote the enrichment pipeline around a work-stealing scheduler. Median enrichment time dropped from 4m12s to 51s across our reference dataset.