From 912d2325124333e81fc4ba449410fb424f9b83a6 Mon Sep 17 00:00:00 2001
From: feldmanr <ron.feldman@gmail.com>
Date: Wed, 7 Oct 2026 01:26:25 +0200
Subject: [PATCH 1/2] Add and alphabetize Bits Security Analyst supported
 sources

---
 .../en/bits_ai/bits_security_analyst.md       | 22 +++++++++++--------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/hugo/content/en/bits_ai/bits_security_analyst.md b/hugo/content/en/bits_ai/bits_security_analyst.md
index 39b6ccbb48c..25a8cc7a232 100644
--- a/hugo/content/en/bits_ai/bits_security_analyst.md
+++ b/hugo/content/en/bits_ai/bits_security_analyst.md
@@ -53,6 +53,7 @@ Additionally, when you use Cloud SIEM notifications to send new signal alerts to
 ### Supported sources
 
 Bits AI can run investigations on the following Security log sources:\*
+- 1Password
 - Amazon GuardDuty, where supported [finding types][6] cover:
   - Anomalous and compromised IAM credentials
   - EC2 and resource credential exfiltration and misuse
@@ -62,28 +63,31 @@ Bits AI can run investigations on the following Security log sources:\*
   - S3 anomalous behavior, data exposure, malicious callers, and penetration test activity
   - CloudTrail or S3 defense evasion
   - Attack sequences correlating IAM credential and S3 data compromise
-- AWS CloudTrail
 - Atlassian Event Logs
+- Auth0
+- AWS CloudTrail
 - Azure
+- Claude Compliance Logs
 - Cloudflare
 - Confluence Audit Records
 - CrowdStrike
+- Email phishing
 - GCP
+- GitHub
+- GitLab
+- Google Workspace
+- Jira Audit Records
+- JumpCloud
 - Kubernetes
+- Microsoft 365
 - Microsoft Entra ID
 - Okta
-- Google Workspace
-- Microsoft 365
-- GitLab
-- GitHub
-- JumpCloud
-- Jira Audit Records
 - Salesforce
+- SentinelOne
 - Slack
 - Snowflake
-- SentinelOne
 - Windows
-- Email phishing
+- Zendesk
 
 \*In rare cases, an out-of-the-box rule for a supported source is ineligible for Bits investigations because the investigation requires additional non-SIEM telemetry. To view these rules, go to {{< ui >}}Security{{< /ui >}} > {{< ui >}}Settings{{< /ui >}} > {{< ui >}}Bits Security Analyst{{< /ui >}} > {{< ui >}}Analyst Configuration{{< /ui >}}, then turn on {{< ui >}}Show currently ineligible rules{{< /ui >}}.
 

From 9c775276a7a1697a06ac2c7503742e263327823d Mon Sep 17 00:00:00 2001
From: feldmanr <ron.feldman@gmail.com>
Date: Wed, 7 Oct 2026 01:45:21 +0200
Subject: [PATCH 2/2] Add Microsoft Defender for EDR to Bits supported sources

---
 hugo/content/en/bits_ai/bits_security_analyst.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hugo/content/en/bits_ai/bits_security_analyst.md b/hugo/content/en/bits_ai/bits_security_analyst.md
index 25a8cc7a232..0cd878a0382 100644
--- a/hugo/content/en/bits_ai/bits_security_analyst.md
+++ b/hugo/content/en/bits_ai/bits_security_analyst.md
@@ -80,6 +80,7 @@ Bits AI can run investigations on the following Security log sources:\*
 - JumpCloud
 - Kubernetes
 - Microsoft 365
+- Microsoft Defender for EDR
 - Microsoft Entra ID
 - Okta
 - Salesforce