New cross-layer attack simulations available for third-party logs

November 24, 2025—You can now run the cross-layer attack simulation with ingested data from Microsoft Defender for Endpoint, Palo Alto Networks firewalls, and Fortinet FortiGate firewalls. To run a cross-layer simulation, go to Resource Center → Simulations → Cross-layer attack simulations and select the simulation you want to run. To view simulation results, go to Agentic SIEM & XDR → Workbench or Agentic SIEM & XDR → Observed Attack Techniques for correlated alerts and events related to the T1071, T1204, T1518.001, and T1105 technique set, and the T1003 and T1071 technique set.