> ## Documentation Index
> Fetch the complete documentation index at: https://docs.petrasecurity.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Changelog
**November 6, 2026**
## Cross-Tenant Phish Removal Member Permission
You can now allow Members to run cross-tenant phish retraction in Petra, so more technicians can remove phishing emails across clients without needing an Admin role.
Read-only Members still can't run retractions, and sensitive tenants remain excluded from search results.
To enable this, go to Settings → Access → Actions (on a member row) → Edit member and access this feature under Tenant → Admin → Emails → Cross-Tenant Phish Removal.
Cross-Tenant Phish Removal Member Permission
**October 30, 2026**
## Additional Device and MFA Registration Forensics
Petra already detects and flags malicious MFA methods and device registrations. This week, we added more forensic detail to these incidents, including when each one was added and the relevant metadata (IP address, location, etc.).
You can find these details in the Attack Timeline and Incident Report.
Additional Device and MFA Registration Forensics Incident Page
Additional Device and MFA Registration Forensics Incident Report
**October 23, 2026**
## Service Principal Logins and SkyKick Incident Report
Petra now ingests and analyzes all available service principal sign-ins, which allows us to detect when a trusted app is compromised.
We also launched a white-labeled ConnectWise/SkyKick incident report. In addition to surfacing the affected ConnectWise apps in any tenant, the report shows malicious service principal activity for tenants with at least one P1 license.
Use this with existing clients to show them a clean bill of health, and in prospecting conversations following a Petra Scan.
Service Principal Logins
SkyKick Incident Report
**October 16, 2026**
## Activity Logs Viewer Improvements
This week we shipped many improvements to the Activity Viewer, including new fields, right click filtering, more metadata for SharePoint file rows, and much more.
Our detection engine is built on extremely fast search over trillions of logs, and the Activity Viewer makes that searching capability available to you to answer any questions you have about user behavior.
You can find the Activity Viewer at the bottom of the tenant page.
Login Activity Improvements
SharePoint Activity Improvements
**October 9, 2026**
## Overlay Real User Activity
Our Incident Timeline already shows every action an attacker took during a compromise. Now, you can also see the real user's activity in the same view to get the full context.
Open any incident, scroll down to Activity, and select **Overlay Real User Activity.**
Use this when walking a client or prospect through a compromise to point out subtle differences between the attacker's behavior and the real user's.
Overlay Real User Activity
**October 2, 2026**
## Email Folder Synced Tag
In [Petra Scan](https://docs.petrasecurity.com/docs/scan.md) results, we sometimes see that an attacker synced an entire email folder. The new **Email Folder Synced** tag now highlights this in the portal and the Incident Report.
Use this when reviewing detailed forensics with a prospective customer after a Petra Scan.
Email Folder Synced Tag
Email Folder Synced in Attack Timeline
**September 25, 2026**
## View All Devices
Petra already flags malicious registered devices during a compromise. Now, you can also view a tenant's registered devices in Petra anytime. Go to the tenant's page, scroll down to Admin, and select Devices. Use this when you're looking to review registered devices in a tenant.
As a reminder, if you have Petra Response enabled, all malicious registered devices are remediated automatically by our SOC during a compromise.
View All Devices
**September 18, 2026**
## Conditional Access Policy Report
This week we shipped a whitelabled [Conditional Access Policy Report](https://docs.petrasecurity.com/docs/reporting/policy-report.md). Use this to demonstrate the value of an active policy or the potential protection of a new policy.
You can find this on Policies -> select a policy -> Generate Policy Report.
Conditional Access Policy Report
**September 11, 2026**
## Get Posture Reports Data in the API
This week we shipped a new [API endpoint](https://docs.petrasecurity.com/docs/api-reference/endpoints/get-posture-reports.md) to get your tenants' Posture Reports data.
If you haven't run a [Posture Report](https://docs.petrasecurity.com/docs/reporting/posture-report.md) yet, you can do so by going to Reporting -> Run a Report -> Posture, or by [clicking here](https://app.petrasecurity.com/reporting/posture).
You can grab an API key in [Settings -> API](https://app.petrasecurity.com/settings/api-keys).
**September 4, 2026**
## Phishing Email in the API
Our [incidents API](https://docs.petrasecurity.com/docs/api-reference/endpoints/get-incidents.md#response-incidents-phishing-email) now includes the phishing email's metadata such as its subject, sender, and Internet Message ID. You can use this data in your internal tooling and data visualizations.
You can grab an API key in [Settings -> API](https://app.petrasecurity.com/settings/api-keys).
**August 28, 2026**
## Proactive Phishing Email Removal
Now when you use the Cross-tenant Phish Removal feature in Petra, you can generate a whitelabeled PDF report of the threat you handled for your clients.
Use this to demonstrate expertise and value to your customers of the proactive measures you took to protect them from bad actors.
You can find this on a tenant page > Remove Phishing Emails > Export.
Proactive Phishing Email Removal
**August 21, 2026**
## Remediate Inbound Connectors
You can now remediate malicious inbound connectors directly from Petra when surfaced by a Scan. Attackers can use malicious inbound connectors to send emails and inject phishing emails directly into users’ mailboxes even after they've been locked out of the account.
If Petra Response is enabled, our SOC takes this action on your behalf.
Remediate Inbound Connectors
**August 14, 2026**
## Review MFA Methods Registered During an Incident
You can now review the MFA methods registered during an incident and remove them from Petra.
We've noticed that some of our partners clear all MFA methods following an incident, which is unnecessary. Now you can know which ones were added during the compromise and remove only those.
Note that Scans of past compromises cannot distinguish which MFA methods were present before the compromise (because Petra wasn't monitoring), so we recommend confirming with the user before removing them.
Review MFA Methods Registered During an Incident
**August 7, 2026**
## Recover Attacker-Deleted Emails
You can now recover attacker-deleted emails from the incident page. The emails return back to the folder they were deleted from.
If Petra Response is enabled, our SOC takes this action on your behalf.
Recover Attacker-Deleted Emails
**July 31, 2026**
## Restore a Conditional Access Policy
You can now manually restore a previous version of a Conditional Access Policy through Petra. Use this to remediate policy drift or to roll back to a prior configuration.
You can find this by navigating to [Policies](https://docs.petrasecurity.com/docs/policies/conditional-access-policies.md) in the nav bar -> open a specific Policy -> History -> "Review & restore" next to each stored version. This opens a preview of the changes and gives options to roll out the Policy as Report-only or Enabled.
Restore a Conditional Access Policy - Open the Panel
Restore a Conditional Access Policy - Apply the Change
**July 24, 2026**
## Petra Posture Report
This week we shipped a new [Posture Report](https://docs.petrasecurity.com/docs/reporting/posture-report.md). This report compares a tenant's configuration to best practices and highlights opportunities to improve the tenant's security. After running the report, you can make any necessary configuration changes directly in Petra and generate a new report which compares the state before and after your improvements.
We hope this is useful for prospecting and for driving new project work with existing clients.
You can generate a Posture Report by going to [Reporting](https://app.petrasecurity.com/reporting) -> Run a Report -> Posture.
Petra Posture Report - Where your M365 stands today
Petra Posture Report - Accounts & identities
Petra Posture Report - Login Conditional Access Policies
**July 17, 2026**
## Petra Policies: Conditional Access Policy Recommendations
Petra Policies are Conditional Access Policy recommendations for your tenants based on threat intelligence from vast amounts of data across industries, locations, and attacker toolkits.
You'll find these recommendations at the top of the [Policies page](https://app.petrasecurity.com/policies). Petra's new Policy Simulator highlights the potential impact of the recommended policy before enabling it.
Petra Policies: Conditional Access Policy Recommendations - Open Panel
Petra Policies: Conditional Access Policy Recommendations - View Panel
**July 10, 2026**
## Simulate and Backtest Conditional Access Policies
You can now Simulate and Backtest Conditional Access Policies (CAPs) directly from Petra.
It's built so you can:
* Instantly know the impact of a policy (without waiting weeks in “report-only” mode).
* Edit policies and test changes immediately.
* Test on 6 months of historical data in less than a minute (for most policies).
To see it in action, click [Policies](https://app.petrasecurity.com/policies) -> Policy Simulator. Here you can filter the users, time range, and sign-ins, and more properties of the policy to test.
Simulate and Backtest Conditional Access Policies
**July 3, 2026**
## Version History for Conditional Access Policies
You can now see the version history of your Conditional Access Policies in Petra. Use this when analyzing how the policy's scope has changed over time regarding users, locations, or apps in scope.
You can find this on a Policy's page, under the “History” tab where you can see each time a policy has changed and the exact difference between two versions.
Version History for Conditional Access Policies - View Details
Version History for Conditional Access Policies - Copy Details
**June 26, 2026**
## Analyze Report-only Conditional Access Policies and User Groups
You can now analyze Report-only Conditional Access Policies and User Groups in Petra. Use this to evaluate the potential impact of new Policies and handle exceptions for certain users.
The Policy page now shows which logins “would be blocked” and allows you to click into a User Group to view or edit its members.
Analyze Report-only Conditional Access Policies and User Groups
**June 19, 2026**
## View Conditional Access Policies
You can now view your Conditional Access Policies (CAPs) across all your tenants in Petra. Use this to get a view of the status, configuration, and impact of each policy.
This is available on the Policies page. Each policy can be clicked into to dive deeper into its scope and sign-ins blocked by the policy.
View Conditional Access Policies
**June 12, 2026**
## View Which Conditional Access Policy Blocked Sign-In
You can now see which Conditional Access Policy (CAP) caused a sign-in to be blocked. Use this to see exactly which CAPs were evaluated for a sign-in and what triggered the blocking policy.
This is available in the Petra Activity viewer, by clicking the Information icon which will open a drawer of the CAPs on the tenant and the corresponding results.
View Which Conditional Access Policy Blocked Sign-In
**June 5, 2026**
## Ad Hoc Cross-Tenant Phish Removal
We've seen a big rise in sophisticated phishing campaigns, so we've expanded Cross-Tenant Phish Revocation and made it accessible even outside of an incident.
You can now look for a malicious Subject or Sender, and remove all emails from them, before an incident occurs and across all tenants with one click.
To see it in action, go to the Admin pane, click Emails, and click Cross-Tenant Phish Removal.
Ad Hoc Cross-Tenant Phish Removal
**May 29, 2026**
## Domain Spoofing Scan
Given the recent uptick in Direct Send attacks, this week we shipped a new [Domain Spoofing Scan](https://docs.petrasecurity.com/docs/investigating/domain-spoofing.md). Use this when a client asks about an email they received from "themself."
This scan includes suggested steps to harden the environment and a new client-ready [Domain Spoofing Report](https://docs.petrasecurity.com/docs/reporting/domain-spoofing-report.md) to reinforce the value you're providing.
You can run a Domain Spoofing Scan by going to the tenant page and selecting "Domain Spoofing" at the top.
Domain Spoofing Scan
Domain Spoofing Report
**May 22, 2026**
## User Activity Report
We shipped a new [User Activity Report](https://docs.petrasecurity.com/docs/reporting/user-activity-report.md). This report highlights a user's sensitive M365 activity, such as accessing financial documents or sending emails to external contacts.
This report is helpful for ad hoc investigations into a specific user - for example, summarizing the activity of an employee who recently quit.
You can generate these reports by going to a tenant, scrolling down to the Activity logs section, and clicking the "User Activity" button.
User Activity Report (Cover)
User Activity Report (Exchange)
User Activity Report (SharePoint)
**May 15, 2026**
## Sales Role
We added a new [Sales](https://docs.petrasecurity.com/docs/settings/member-roles-and-permissions.md#sales) role for your team. This lets your sales team sell Petra to your customers and prospects without giving them total access to your other tenants.
Sales Role
**May 8, 2026**
## Attack Method in Incident Report
We now show how a user's credentials were stolen leading to the account compromise in the Incident Report's summary section.
This helps you tell a clear story of what happened to your clients as their trusted security advisor, especially when showcasing retrospective compromises to sell Petra monitoring.
Attack Method in Incident Report
**May 1, 2026**
## Get onboarded tenants in the API
We added a new [API endpoint](https://docs.petrasecurity.com/docs/api-reference/endpoints/get-tenants.md) to get your tenants on Petra.
> **Note:** You can get an API key by going to [Settings -> API](https://app.petrasecurity.com/settings/api-keys).
Get onboarded tenants in the API
**April 24, 2026**
## Get failed attacks in the API
We added a new [API endpoint](https://docs.petrasecurity.com/docs/api-reference/endpoints/get-failed-attacks.md) to get failed attack data. This allows you to build your own custom reports with the same data that powers our white-labeled monthly [Tenant Security Reports](https://docs.petrasecurity.com/docs/reporting/tenant-report.md).
> **Note:** You can get an API key by going to [Settings -> API](https://app.petrasecurity.com/settings/api-keys).
Get failed attacks in the API
**April 17, 2026**
## Cross-Tenant Phish Revocation
Petra now searches across all of your tenants to find and revoke the phish before more users fall for it. We often see the same phishing campaign hit multiple tenants. Now when the first compromise is detected, it's kicked out of everyone's mailbox.
This means every one of your clients benefits from the threat intel you get from any compromise.
You'll find this below the tagged phish in an incident's Remediation Actions panel.
Cross-Tenant Phish Revocation
**April 10, 2026**
## Get incidents in the API
We added a new [API endpoint](https://docs.petrasecurity.com/docs/api-reference/endpoints/get-incidents.md) to get Petra incidents. This allows you to build workflows and automations.
> **Note:** You can get an API key by going to [Settings -> API](https://app.petrasecurity.com/settings/api-keys).
Get incidents in the API
**April 3, 2026**
## White Labeled Example Reports
The Marketing Hub now offers these white-labeled example reports:
* Incident Report
* Tenant Report
* Scan Report
These white-labeled example reports are built to help you sell M365 monitoring to your customer base and prospective customers.
> **Note:** You can set your logo in Branding settings [here](https://app.petrasecurity.com/settings/branding).
White Labeled Example Reports
**March 27, 2026**
## Attacker Retains Password
Petra now surfaces past compromises in which the attacker's session was revoked, but the account password was not reset. Even if an attacker was locked out of an account, they can get back in if the password was last set prior to the compromise.
Attacker Retains Password
**March 20, 2026**
## View Tenant Apps
You can now view a tenant's installed applications. Go to the tenant's page, scroll down to Admin, and select Apps.
View Tenant Apps
**March 13, 2026**
## Dwell Time Tag
The new "Dwell Time" gives you digestible info at a glance after onboarding new clients who have past compromises before Petra was installed.
Dwell Time Tag
**March 6, 2026**
## Update GDAP Relationships from Partner Center
You can now push new GDAP relationships to your tenants from our Partner Center portal. This allows you to more easily onboard tenants to Petra without manually setting up relationships in Microsoft Partner Center.
Update GDAP Relationships from Partner Center
**February 27, 2026**
## Partner Center
Now you can connect Microsoft Partner Center to save time by one-click adding new tenants and bulk-updating permissions to take advantage of new Petra features.
Link it by clicking “Add Tenants” button in the nav bar or by [clicking here](https://app.petrasecurity.com/portal).
Partner Center
**February 20, 2026**
## Billing Role & Granular Member Permissions
We've given you more control around who can do what in Petra:
* Invite your finance team under the new **Billing Only** role to give them access limited to viewing the billing page and editing payment methods.
* Members can now be configured with these new permissions:
* **Can onboard and modify tenants**
* **Can view sensitive tenants**
Billing Role & Granular Member Permissions
Billing Only Portal
**February 13, 2026**
## PSA Billing Integrations
Petra now syncs billing data directly to your PSA. Billing integrations are available for **ConnectWise**, **Autotask**, and **Halo PSA**. Configure billing sync in [Settings](https://app.petrasecurity.com/settings) and follow the updated setup guides:
* [ConnectWise PSA](https://docs.petrasecurity.com/docs/integrations/connectwise.md)
* [Autotask PSA](https://docs.petrasecurity.com/docs/integrations/autotask.md)
* [Halo PSA](https://docs.petrasecurity.com/docs/integrations/halo.md)
Each integration guide now includes a dedicated **Billing** section with the additional permissions and configuration required for billing sync.
**February 6, 2026**
## Itemized Billing Report
The Billing Excel sheet now includes per-tenant tabs that break down each billable user and their prorated cost based on when they were added to Petra. You can download this sheet in [billing settings](https://app.petrasecurity.com/settings/usage).
> **Note:** Itemized billing data is only available since January 2026. Prior reports only include the Summary page.
Itemized Billing Report
**January 30, 2026**
## Custom Webhooks
**Custom Webhooks** let you automatically send Petra incident alerts to any external service, like Zapier or other automation tools, whenever we detect a compromise. You can customize the HTTP method, headers, and JSON payload to fit your workflow. Find it in [Settings](https://app.petrasecurity.com/settings).
Custom Webhooks
**January 23, 2026**
## The Autopsy Report
A **Petra Autopsy** investigates the last 6 months of a tenant's activity to uncover attacks and compile forensics. Our new white-labeled **Autopsy Report** transforms 6 months of tenant forensics into a sales-ready document for your client meetings. We hope you use it to demonstrate real security gaps your clients didn't know existed and make deploying Petra a no-brainer for your client.
What it reveals:
- Previously remediated compromises with deeper analysis
- Active attackers still in the account
- Gaps in existing ITDR solutions
> **Note:** New MSPs receive an Autopsy with their Petra trial.
Cover Page
Confirmed Compromises
Attacker Found Late
**January 16, 2026**
## Redacted Incident PDF
**Redacted Incident PDFs** help you demonstrate real compromises in sales pitches while protecting client data. To download this report, navigate to an incident in the Petra dashboard, click **"Download Report"**, and select **"Redacted PDF Report"** in the dropdown.
> **Reminder:** When sharing your screen to showcase incidents to other clients, you can redact PII by clicking the **Anonymize** button on the top right of the Incident page.
Redacted Incident PDFs
Redacted Incident PDF
## Analyst Summary in the Incidents List
The list of previous incidents now includes a detailed **Analyst Summary** section, making it easier to distinguish between incidents. This helps you select a more compelling and diverse set of previous compromises when engaging prospective clients.
Analyst Summary in the Incidents List
**January 9, 2026**
## Incident Summary
Now the incident page has an “Incident Summary” section which succinctly highlights the most important details of the attack. This enables account managers and salespeople to tell a clear story of the attack, rather than overwhelm the client or prospect with information.
Incident Summary
## Tenant Onboarding Tracker
When adding new tenants, you'll now see a streamlined onboarding tracker that displays real-time status updates. This gives you clearer visibility into each tenant's onboarding progress and lets you anticipate exactly when they'll be fully set up.
Tenant Onboarding Tracker
**December 19, 2025**
## Tenant Report Redesign
The Tenant Report has been redesigned! We've listened to your feedback and added the most requested features and improvements. Go check out the new [Report Generator](https://app.petrasecurity.com/report-generator).
> **Reminder:** You can configure automatic sending of Tenant Reports at the end of every month by going to [Settings](https://app.petrasecurity.com/settings) and adding your organization's emails in the **"Automated Monthly Reports (Internal emails only)"** section.
Tenant Report Redesign
**December 12, 2025**
## Anonymize Incidents
You can now anonymize an incident to help you show any quickly caught incident as a victory lap, and any Autopsy as a cautionary tale. Go to an incident page, click the Anonymize button on the top right, and select which information should be hidden.
Anonymize Incidents
**December 5, 2025**
## The Marketing Hub
The Marketing Hub offers a collection of documents, slides, and waivers that are meant to help you share the value of Petra ITDR with your clients. Navigate here by clicking the "Marketing" tab in the navbar or by [clicking here](https://app.petrasecurity.com/marketing).
Today, the Marketing Hub offers the following resources:
- **Autopsy One-Pager:** One-page overview of Petra autopsy capabilities and incident investigation workflow
- **Example Report (with ITDR):** Sample security report showcasing enhanced detection capabilities with Petra ITDR
- **Forensic Analysis One-Pager:** One-page overview of Petra forensic analysis capabilities and threat detection
- **Threat Intel - ITDR (white labeled):** White-label ready threat intelligence presentation on ITDR capabilities and insights
- **Opt-Out Campaign Toolkit:** Documentation and guide for the Petra opt-out campaign toolkit and resources
- **Waiver - ITDR Opt-Out:** Opt-out waiver document for ITDR services and related terms
- **Two-Pager - Why ITDR + Why Petra:** Two-page overview document highlighting Petra ITDR capabilities
- **Two-Pager - Why M365 Monitoring (white labeled):** Two-page overview document highlighting general M365 ITDR capabilities
- **How To Categorize Your Risk:** Presentation slide providing guidance on categorizing and assessing security risks
- **Why M365 Protection Matters:** Presentation slide explaining the importance of Microsoft 365 security protection
The Marketing Hub
**November 28, 2025**
## View Tenant-Wide MFA Enforcement
You can now see whether MFA is enforced for every user in a tenant directly from the tenant homepage. Both legacy MFA methods and enforcement through Conditional Access Policies are shown.
View Tenant-Wide MFA Enforcement
**November 21, 2025**
## SOC Incident Highlighting
Our SOC highlights especially relevant or noteworthy incidents for your clients with a star. This helps you quickly spot the most important incidents to showcase, even when Petra detects many incidents.
SOC Incident Highlighting
**November 14, 2025**
## Read-Only Members
You can now assign read-only status to members within your organization. Read-only members are restricted to viewing content and cannot perform any actions in the app. By default, all existing users are not set to read-only, and this setting is also not set for new members unless specified. You can designate a member as read-only either when inviting them or by updating their permissions at any time in the Settings -> Access page.
Read-Only Members
**November 7, 2025**
## Delete Malicious Inbox Rules
You can now delete inbox rules from the Threat Remediation Actions panel.
Delete Inbox Rules
**October 31, 2025**
## New Remediation Actions Panel
The Threat Remediation Actions panel has been updated with a clearer layout, making it easier to find and perform the actions you need.
New Remediation Actions Panel
**October 24, 2025**
## International Text Alerts
International text alerts are now supported for UK (+44) numbers. When an incident occurs, we can send SMS notifications to members of your organization in the US and the UK. To use this feature, go to "Settings" > "Notifications" > "Texts" and choose the appropriate country code for each recipient.
International Text Alerts
**October 17, 2025**
## Threat Remediation Report Includes Phish
Improved the Threat Remediation Report to include the phish that led to the compromise.
Phish in Threat Remediation Report
**October 10, 2025**
## Rogue Apps & Remnant Inbox Rule Incident Redesign
We redesigned the Rogue Apps and Remnant Inbox Rule incidents to show all available context and remediation options.
**October 3, 2025**
## Historical Usage Data
You can now select a past month to see historical usage data.
Historical Usage Data
**September 26, 2025**
## Full Incidents in Tenant Report Appendix
When a Tenant Report includes an Incident, the complete Incident Report will now be added to the Appendix.
Full Incident in Tenant Report
## Tenant Report Bug Fixes
Thanks to some helpful feedback from customers, we've fixed a few bugs in the Tenant Report.
* Improved readability of the Executive Summary page
* Fixed bug for particularly long usernames in the failed attacks section
**September 19, 2025**
## Tenant Report Redesign
The Tenant Report has been redesigned! Go check out the new [Report Generator](https://app.petrasecurity.com/report-generator).
Tenant Report Redesign
## Tenant Report Configuration
Tenant Report Configuration
* **High Value Accounts**: tag accounts like CEO, CFO, billing manager to see greater detail on who is targeting them.
* **Hidden Accounts**: hide accounts that you want to be excluded from the report, like your own admin account or testing accounts.
* **Hidden Incidents**: hide incidents that you want to be excluded from the report, like those that you've already surfaced to the client.
* **Other Options**: customize which sections are included in the report.
**September 12, 2025**
## Automate Sending Monthly Tenant Reports
Now you can schedule sending security reports to your tenants and your organization at the end of every month.
**Directly to tenants:** Go to a tenant's page, click the gear icon on the top right, and add their emails in the "Tenant-Specific Monthly Reports" section. These emails will receive a tenant-specific security report at the end of every month.
Tenant-Specific Automated Security Reports
**To your organization:** Go to settings and add internal emails in the "Automated Monthly Reports" section. These emails will receive a security report for every tenant at the end of every month.
*Note: These emails will receive security reports for all of your tenants. We recommend that you only add emails within your organization.*
Organization Automated Monthly Reports
**September 5, 2025**
## Include User Licenses in Admin Panel and Excel Export
Now you can see what licenses each user has in the admin panel and when you export user lists to Excel. This is useful for right-sizing spend for your clients.
User Licenses
## Edit Tenant Name
Now you can edit the name of a tenant.
Edit Tenant Name
**August 29, 2025**
## Petra Automatically Enables Audit Logs
Now when you onboard a tenant, Petra automatically enables audit logs if they were not already enabled.
We all know the pain of trying to enable audit logs in Purview--it lags by hours and often takes several attempts. Now onboarding in Petra is the last step in setting up monitoring.
Like everything else in Petra, this is available regardless of Microsoft license level.
## Improved Threat Remediation Report Timeline
We updated the summary timeline at the bottom of the Threat Remediation Report to focus on the most important events in the incident--especially how you stopped it.
Improved Threat Remediation Report Timeline
**August 22, 2025**
## SharePoint Malicious File Removal
Attackers often upload new files to SharePoint to use as a phishing lure.
Petra commonly uncovers these files in baselining when latent attackers are discovered. Now you can remove them from SharePoint from within Petra without opening Microsoft.
SharePoint Malicious File Removal
**August 15, 2025**
## Tenant Logs Excel Export
You can now export tenant logs to Excel. The export includes fully enriched metadata for Exchange, including email subjects, sender, recipients, and more.
The export respects any filters you have applied in the viewer, so you can get, for example:
* A specific user's activity across logins, Exchange, SharePoint, Teams, etc.
* All activity across a tenant for a specific time period.
* All sent emails across a tenant for a specific time period.
Export button opens the Excel export dialog
Excel export modal
**August 8, 2025**
## Halo PSA Integration
You can now link your Halo PSA account to Petra. Go to [Settings](https://app.petrasecurity.com/settings) to link your Halo PSA account.
Follow this guide to integrate with Halo PSA: [Halo PSA Integration](https://docs.petrasecurity.com/docs/integrations/halo.md).
**August 1, 2025**
## Phish Search & Retraction
Phish search and retraction now catches replies and forwards. It's surprisingly common for the recipient of a phish to forward it to coworkers. Now Petra finds all of those replies and forwards so we can retract those too.
Asha, the initial recipient, forwarded the phish to Holly.
## Excel Export for Usage by Tenant
The usage page in settings now includes an option to export usage data by tenant to Excel.
Excel Export for Usage by Tenant
## Beta of API Endpoint for Tenant Usage
We launched a beta of an API endpoint for tenant usage. Contact us if you want to try it. Read more about it in the [API documentation](https://docs.petrasecurity.com/docs/api-reference/endpoints/get-usage.md).
**July 25, 2025**
## Email Search and Removal
The admin panel now includes the ability to search for emails by subject, sender, and recipient, as well as the option to remove emails.
Find and Remove Emails
## Sensitive Tenants
Sensitive Tenants are tenants that only admins have access to within Petra. This is useful for safeguarding access to certain tenants, such as the MSP's own tenant.
Sensitive Tenants
**July 18, 2025**
## Better Phish Deletion
Phish Deletion
Phish deletion now includes both **soft delete** and **hard delete**.
* **Soft delete** moves the email to the recoverable folder within deleted items (which users are much less likely to find than just the deleted folder).
* **Hard delete** deletes the email from the mailbox.
We aim for the remediation actions taken by Petra Response to be 1) effective and 2) reversible, so we will soft delete and leave the hard delete as an option for your analyst when they review the incident. If it turns out we were wrong, your analyst would instead click "Recover" to move the emails back to the inbox.
## Delegated Activity in the Activity Viewer
Delegated Activity
Now when one user acts on behalf of another, the activity viewer will display both the actor and the delegated mailbox.
This is critical for understanding compromises involving delegated mailboxes and administrators who have permission to act on behalf of other users.
**July 11, 2025**
## Deep Links & Streamlined Sign In
* **Deep Links**: Now if you open a link to a specific page (e.g. an incident link in a ticket), you'll be taken to that same page after you sign in.
* **Streamlined Sign In**: We removed the organization selection step during sign in, reducing sign-in flow by 1 click in 99% of cases.
## Incident Forensics Countdown
Microsoft logs are often delayed by a few minutes, which could cause the forensics in the Threat Remediation Report to change in the minutes after the incident.
You can now see an estimated time for all of the forensics to be published by Microsoft and included in the Threat Remediation Report.
Incident Forensics Countdown
**July 4, 2025**
## Improvements to Self-serve Tenant Management
Self-serve Tenant Management
You can now remove tenants at any time without talking to anyone.
Go to [Settings > Usage](https://app.petrasecurity.com/settings/usage) to manage your tenants.
**June 27, 2025**
## Similar Phish Retraction
Stop others from falling for the same phish
Now you can quickly see who else received a similar phish and remove it from their inbox.
This stops other employees from falling for the same phish.
Highlights:
* The 'Current Folder' column updates in realtime as you or the employee moves the email.
* The 'Interactions' column opens the Email Interactions Panel which displays all read/moved/deleted/etc. interactions with the email.
**June 20, 2025**
## Edit Analyst Note for Reports
Edit Analyst Note for Reports
This week's release gives you the ability to edit the analyst note that appears in the Threat Remediation Report PDF.
We also added formatting to the notes to accommodate timelines, highlighting critical info, etc.
**June 13, 2025**
## Added DKIM & Mailbox Permissions to Remediation Actions Panel
DKIM & Mailbox Permissions
The Remediation Actions panel now includes attacker activity in DKIM configuration and mailbox permissions.
This is important for understanding what the attacker did and how to undo it.
**June 6, 2025**
## White-label Portal & PDF Reports
White-label Portal & PDF Reports
You now have the ability to use your own branding in the Petra portal and reports.
Now your logo is used in the nav bar and every report, which gives your external guests a consistent experience with your brand.
**May 30, 2025**
## Petra Autopsy: Incident Response for BECs
Petra Autopsy analyzes the 6 months prior to onboarding
Introducing **Petra Autopsy**.
We now have the capability to do **find and compile forensics for compromises up to 6 months before onboarding**.
Now when a prospect or client needs incident response for a BEC, you can offer them a full forensic incident report and Excel export **delivered within 24 hours**.
**May 23, 2025**
## Improved White-label Threat Remediation Report
Improved White-label Threat Remediation Report
We redesigned the PDF export.
Highlights:
1. New executive summary for quick read-through.
2. Attack duration and impact (crowd favorites in the portal) are now in the PDF.
3. More compact timeline of events table on the second page.
**May 16, 2025**
## Tenant-specific Access
Tenant-specific access
You can now invite members to a subset of your tenants in Petra.
This is helpful for two use-cases:
1. Giving access to a client who needs to see the portal themselves.
2. Least-privilege access to a subset of tenants for an AE or technical team member.
**May 12, 2025**
## Revamped Attack Timeline
Attack Timeline
The new attack timeline shows all of the attacker’s activity over the course of an account compromise: from the initial phish -> successful logins -> sharepoint/exchange activity.
Then, we can see Petra flagging that attacker’s activity, killing current sessions, and locking the account.
Afterwards, we often see failed logins as the attacker bangs on the door.
The new attack timeline sits at the bottom of the incident view, just beneath the Attack Impact panel.
**May 9, 2025**
## Attack Impact
Attack Impact in continuous monitoring
Attack Impact in an incident response case
What files/emails did the attacker touch?
Usually, defenders have to dig through logs and powershell scripts to find the answer.
Instead, we make it easy to see what an attacker did with *Attack Impact*.
You can see exactly which emails and files the attacker read, modified, sent, or deleted.
This is particularly helpful for identifying things like:
1. What emails did the attacker send? To whom? (Likely to laterally phish).
2. What files did the attacker modify?
3. What did the attacker delete?
Just as importantly, Attack Impact helps you identify what the attacker did NOT read or interact with. For GDPR and HIPAA clients with disclosure requirements, this is a huge time and money saver.
**May 2, 2025**
## Tenant-wide Email Subject Search
Filter emails by subject
Super fast tenant-wide search.
This is useful for a variety of forensics tasks, like tracking down an email that a user vaguely remembers or getting to the root of an email thread.
When you want all of the emails in a thread, use "contains" without case sensitivity to include the "Re:" and "Fwd:" messages. When you want the root, use "equals."
**April 25, 2025**
## Phish Similarity Search
Two emails are similar to the known phish
We see this all the time: after a successful phish, sometimes attackers will send similar emails to other users in the organization, hoping to phish them as well. If the first one worked, there's a pretty high chance others will too.
After a user has been phished, and the phishing email has been identified by Petra, Petra shows you similar emails to the phish email.
In a future update, you'll be able to one-click remove these emails from mailboxes in your tenant.
## Email Interactions Panel
Asha received and opened the phish
Via the Email Interactions Panel, you can see who has read/forwarded/replied/etc. an email.
This is helpful after a user has gotten phished to see who all is in the blast radius––i.e. who all has read/clicked/replied to the phish email.
In a future update, you'll be able to one-click remove all identified similar phishing emails from your environment.
### Other updates this week:
- **Incident logs export:** Export all logs from an incident as .xlsx
- **User list export:** Export all users in a tenant as .xlsx
**April 18, 2025**
## Company IP Detection
104.8.38.161 is the Daly City office VPN
IP geolocation can be misleading. Just because a user logs in from a New York IP every day doesn't mean they're actually in New York. It could be the company's shared tunnel or office VPN that everyone uses.
**Petra now tells you when a login is coming from a shared company IP**. Our detection engine already uses this signal to cut down on false impossible travel alerts, and now we're surfacing it in the portal
so you have that context when investigating.
## Logging Received Emails
'Email Received' events are now processed in addition to the traditional operations logged in the Unified Audit Log. Now, you can see who has received an email before they interact with it at all.
**April 11, 2025**
## Disable Inbox Rules & App Registrations
Remediate inbox rules and app registrations
**You can now 1-click disable inbox rules and app registrations that the attacker added** when they had access. You'll also see audit logs that record when each action was taken, and by whom.
The portal constantly syncs with the state from Microsoft, so if for some reason something was disabled or deleted directly in Microsoft, that would be reflected here too.
**April 3, 2025**
## Filter Auth Methods and Devices by username
- Search and filter authentication methods and devices by specific usernames for targeted investigations.
- Username is auto-populated to the compromised account during an incident.
## Export spotlighted investigations as PDF
- Download complete records of spotlight investigations as PDF files for documentation and sharing.
- Reports are company-branded for professional presentation.
**March 27, 2025**
## Phish Identification
- Petra identifies the email that is most likely the phish that led to the user's compromise.
- Phish appears in attack timeline with forensic details showing when the user clicked on the phish and if the user deleted it thereafter.
- Identify if the attacker deleted the phish to cover their tracks.
## Autotask Integration
- Generate tickets in an Autotask queue when there's an incident.
## Redesign tenant report
- White-labeled tenant report includes an executive summary on the first page.
## Include inbox rule content in Attack Timeline
- See the contents of the inbox rules including their title, conditions, exceptions, and actions.
**March 20, 2025**
## Added Acme Corp demo tenant to the portal
- Demo tenant now available in your portal for product exploration.
- Use this tenant to demonstrate the value of M365 monitoring to prospects.
## Data Center tagging in activity viewer
- IP addresses belonging to data centers are tagged in the logs viewer.
- Easily identify traffic originating from cloud providers and hosting services.
## Login stats sidebar
- View login frequency across various cities over time.
- Identify unusual login location patterns at a glance.
## Multi-select filters on logs
- Add filters that match multiple values (e.g., country not equals US or Canada).
- Create complex queries to narrow down specific activity patterns.
## Slack webhook integration
- Send incident notifications to Slack channels through webhooks.
## Mail to UPN auto-resolution
- Searching by email address or UPN includes logs for both automatically.
**March 13, 2025**
## Make the entire app mobile-friendly
- All Petra interfaces now fully support mobile devices.
- Control Microsoft from anywhere, even when away from your desk.
## Add filters to rare activity
- Filter rare activity events by type.
## User page
- View user details with complete metadata, authentication methods, and logs.
**March 6, 2025**
## P1/P2 risk events
- If your tenant has P1/P2 risk events, you can see them in the portal.
- Investigate the activity in the context of surrounding logs.
## Spotlighted investigations
- Review investigations into suspicious but ultimately benign behavior.
- Highlight this investigations to show the value of M365 monitoring.
## Report Generator
- Generate comprehensive reports of tenant activity.
**February 27, 2025**
## Apply filters to log exports
- Export logs with the same filters applied in the viewer.
## Add rare activity to tenant report
- Rare activity events now included in tenant reports.
**February 20, 2025**
## New failed attack types: password spray and known malicious IP
- Detection for password spray attacks against your tenant.
- Identification of connection attempts from known malicious IP addresses.
- Better visibility into failed attack attempts targeting your organization.
**February 13, 2025**
## Apps, devices, auth methods, directory roles tables
- Track application usage, device access, authentication methods, and role assignments.
- Useful for tracking activity around an attack.
**February 6, 2025**
## Filter by not equals
- Create exclusion filters (e.g., country not US, ISP not Comcast).
- Focus on activity from unexpected or non-standard sources.
## Autocomplete some filters
- Autocomplete for username, UPN, browser, OS, etc. filters as you type.
- Faster filter creation with suggested values from your tenant data.
**January 30, 2025**
## Share filter bar across all log sources
- Filters in activity viewer apply across all tables (logins, Exchange, SharePoint, Teams).
- Maintain consistent filtering criteria when switching between different log types.
## Remediation readiness panel
- At-a-glance view of how you'll be notified of incidents.
- Verify your notification channels are correctly configured.
## API for SIEM integration
- API for pulling incidents using a cursor, designed for SIEM integration.
- Incorporate Petra incident data into your existing security workflows.
**January 23, 2025**
## Users export
- Export all users in a tenant to spreadsheet format.
- Analyze user data outside of the Petra platform.
## Failed attacks
- View targeting patterns and attack toolkits used against your organization.
- Identify which users are being targeted, typically executives.
- Use this data as a sales artifact to demonstrate M365 monitoring value.
**January 16, 2025**
## Remediation controls
- Lock down compromised accounts with a single click.
- For hybrid tenants, Petra renews the lock repeatedly to prevent on-prem sync from unlocking the account.
## Teams integration
- Send incident notifications to Microsoft Teams channels.
- Keep your security team informed through their existing communication platforms.
**January 9, 2025**
## Third party app names
- Track third-party apps that users sign into within the activity viewer.
- See friendly application names instead of just application IDs.
## ConnectWise integration
- Automatically generate tickets in ConnectWise when incidents occur.
- Streamline incident response through your established ticketing system.
**January 2, 2025**
## Latent attacker search
- Scan for attackers already present in the tenant before monitoring began.
- Identify and remediate existing compromises during the onboarding process.
- Get immediate security value from day one of Petra implementation.
**2024 Archive**
## An Eventful Year
- Launched initial activity viewer with login logs
- Added Exchange Online activity tracking
- Added SharePoint and OneDrive activity tracking
- Added Teams activity tracking
- Added email notifications for incidents
- Added webhook notifications for incidents
- Built investigation tools to analyze raw logs with very low latency
- Added custom geolocation data enrichment to correct Microsoft's often incorrect IP geolocation
- Added tenant-wide activity search
- Built role-based access control for members in the portal
- Built PDF export reporting capabilities
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.