What’s shipping in Prairie.

Search summary dashboards.

A new summary view rolls up event counts, alerts, and top results across every instance in the current search.

Richer saved queries.

A saved query can now also capture its time range, column selection, and pivot settings — not just the query text.

Full search history.

A new History view covers both your own searches (My History) and everyone's (All Users History).

Gemini Summary.

Pulls the Gemini-generated summary directly from SecOps for the active search.

Pivots.

Group and count results by a chosen field directly from the search results.

Alerts.

Alerts matching the active search now load alongside events.

Aggregations.

A full aggregation panel — grouped fields, UDM fields, counts — sits alongside the event list.

Playbook dependency blocks.

Playbooks cannot yet be deployed together with all of their dependency blocks in a single run.

Full parser-extension lifecycle.

Custom parsers synchronize end-to-end, and Prairie now supports the full cycle of parser extensions and parser updates.

Templated MSSP provisioning.

A BisonCyber-side orchestrator and a templated Terraform environment mean a new MSSP is stood up from a template instead of by hand.

Two-org onboarding gaps closed.

Fixes to initial deployment, teardown, and re-provisioning automation for the cross-org (BisonCyber org + MSSP org) model.

Cross-org deployment, proven.

Successfully ran distributed SaaS deployment tests with the application running in BisonCyber's org while every credential — service-account keys and passwords — lives in the MSSP's own org.

Search permissions, instances, and users.

Find any permission, instance, or user directly instead of scanning a list.

Clearer permission names.

Permissions now follow a consistent prairie.<area>.<action> format.

Near-instant permission changes.

A permission change now reaches the affected user's session within about 30 seconds.

Force logout.

Administrators can force-log-out a user immediately when needed.

Privilege-escalation bug closed.

Fixed a bug that allowed a user to reach the /setup page without the required permission.

Full audit log.

Every action and resource change in Prairie is now recorded in the audit log.

Playbook and parser synchronization, overhauled.

Significant changes to how both playbooks and parsers synchronize between the MSSP's master instance and customer instances.

General stability.

Broad stability fixes across the platform.

No customer data stored in Prairie's database.

Database changes mean Prairie no longer stores any customer data.

Privacy and security documentation.

Published internal documents describing data privacy and retention strategy.

Customer-owned Secret Manager, in testing.

Testing a model where credentials are held in a Secret Manager project the MSSP owns, so Prairie no longer stores any credentials on its own end.

Playbook visualization.

View a playbook's block flow directly in Prairie.

Enable and disable playbooks.

Turn a synchronized playbook on or off from Prairie.

Block-level sync.

Synchronization now covers individual blocks as well as whole playbooks.

Dependencies install automatically.

A playbook sync now also installs any integrations it needs and adds the matching configuration instance.

Custom parser synchronization.

Custom parsers now synchronize between instances (parser extensions are still pending).

Custom log types.

Create custom log types and push playbook updates alongside them.

Full content synchronization.

Detection rules, SOAR playbooks ("hands down the toughest nut to crack"), and SOAR custom integrations all synchronize end-to-end.

MSSP-owned GitHub, by design.

Content is developed and tested in the MSSP's SecOps instance and stored centrally in a GitHub repository the MSSP creates and maintains — BisonCyber has no access or visibility into it, by design. A "Sync Content from Master Instance" action pushes selected content from Prairie to that repository.

Background synchronization.

Pulling and syncing content runs in the background, with a clear "Sync complete" summary of what succeeded.

Deployment tracking and a deployment wizard.

Track which instances a given rule or playbook is deployed on, and deploy new content through a guided wizard.

Version-conflict comparison.

When the MSSP's version of a rule and a customer instance's version differ, see a side-by-side diff before choosing to overwrite, deploy as new, or keep the customer's version.

Sync without touching credentials.

Customers sync and install SOAR integrations and add instance configuration without Prairie ever handling credentials — a pivot link sends them to configure secrets directly in their own instance.

Centralized integration updates.

MSSPs can push integration updates to customer instances centrally.

Licensing enforcement.

License limits are now enforced in the platform.

Light appearance.

Added a Light color theme alongside the default dark theme.

One customer, many instances.

A single customer can now have more than one instance — production and development, for example.

API keys and service accounts.

Manage the essential APIs, keys, and service accounts a customer connection needs.

Connection testing.

Test an API key connection directly to confirm it's correct before relying on it.

Federated search, live.

Run a query across every customer and instance at once, with results shown in individual tabs per customer/instance.

Saved queries and query history.

Save a query for reuse, and review past queries from history.

Targeted instance selection.

Choose exactly which instances a query runs against.

Syntax checked before execution.

A UDM query's syntax is validated before it runs against any instance.

Natural query language.

Describe a search in plain language instead of writing UDM by hand.

Paginated, pivotable results.

Each customer/instance tab paginates results to 50 at a time, with a direct pivot back into the source SecOps instance to continue the investigation.

Every open case, one view.

All open cases and their alerts are pulled together across the fleet, with basic details and a pivot into the individual case or alert.

Case wall activity.

See a case's wall activity at a glance to understand what already happened on it.

Gaps and failures, highlighted.

Cases where alerts have no playbook attached, and alerts whose playbook failed, are called out directly.

SLA status.

Cases and alerts show their SLA status.

All customers, one tab.

Unlike Federated Search, which keeps each instance in its own tab, Case Overview rolls every customer into a single "All Customers" view.