RL Malware Analysis and Threat Hunting Updates for H1 2026

Three themes run through RL's Malware Analysis and Threat Hunting portfolio updates for the first half of 2026: Infrastructure Modernization, Automated Incident Response, and AI-ready Architecture.

Here are the key highlights:

Spectra Detect v6.1: Kubernetes-Native Deployment for Enterprise Scale

Spectra Detect is engineered for speed, scalability, and extensibility, with the ability to process millions of files per day. With the release of version 6.1, Spectra Detect introduces Kubernetes microservices to simplify infrastructure management and reduce total cost of ownership. This architectural shift enables auto-scaling and decoupling of applications from operating systems.

• Kubernetes Microservices Architecture: Connector, receiver, pre-processor, processor, post-processor and egress functions now run as independently scaling pods rather than fixed hub-and-worker appliances. Each layer scales up under load and back down when idle, which removes the need to provision and pre-size appliances for peak volume.
• Helm Chart-based Deployment: Configuration and rollout are managed through Helm charts, aligning with standard DevOps and Kubernetes tooling rather than a proprietary management layer. RL provides starter templates that teams can adapt to their environment.
• Built-in Resiliency: Deployments inherit Kubernetes-native redundancy and self-healing. Capacity flexes to ingest load per service – no manual VM cloning.
• Connector Support at Launch: Version 6.1 ships with AWS, manual API and ICAP Server connectors, with additional connectors planned to reach parity with the existing appliance model.

[ Join webinar: Less Noise, More Signal: 2026 Product Updates for Modern SOCs ]

Spectra Analyze v9.8–9.9: SOC Workflow Empowerment

Spectra Analyze empowers all levels of the SOC with a private, in-depth, malware analysis workbench. Across versions 9.8.0 through 9.9.0, Spectra Analyze added capabilities that speed up investigation, expand hunting coverage, and prepare the platform for AI-assisted workflows.

• Spectra Analyze MCP Server: The MCP server gives AI assistants a standardized, secure interface into Spectra Analyze for malware reporting, indicator of compromise (IoC) triage, file and network reputation lookups, and natural-language search. It supports multi-modal prompts and includes a pre-built prompt library, providing easy, out of the box functionality.
• Expanded EDR Integrations and Connector Setup Wizard:  Spectra Analyze now has direct integrations with CrowdStrike Falcon, Palo Alto Cortex, SentinelOne and Microsoft Defender for seamless two-way enrichment. Plus, a new step-by-step wizard provides quick and easy set up to ensure connectors are configured correctly, enabling reliable two-way data flow. Suspicious files flagged in the EDR platform are automatically submitted for analysis, with enriched verdicts flowing back to strengthen detection and response.