Stamus Expands Clear NDR for AI-Driven Threat Investigation

Stamus Networks has released Clear NDR U42.2, adding new AI-driven investigation, threat hunting, and analyst workflow capabilities to its network detection and response platform. The update expands the company’s Model Context Protocol toolset from 10 to 14 capabilities, giving AI agents more ways to query network data, validate detection coverage and surface evidence for analysts.

With U42.2, Stamus is trying to make network telemetry easier to use inside AI-assisted workflows. The new MCP tools support access to raw network events, behavioral frequency analysis, detection coverage validation, and higher-confidence threat verdicts. Declarations of Compromise and Declarations of Policy Violations now include direct links into the Analyst Operations Console, so analysts can move from an AI-generated finding into the investigation view without jumping across disconnected steps.

Stamus also redesigned the Analyst Operations Console with faster navigation, updated visualizations, contextual tooltips, and more customization options. The company added 23 advanced protocol analytics dashboards and 32 new threat hunting filter sets, with a focus on OT and IoT environments where protocol diversity and unusual device behavior can make investigations harder. For security teams, the practical value is faster access to the data behind a threat, not just another alert in the queue.

The update also adds new REST API endpoints for third-party integrations, SOAR platforms and custom automation workflows. Stamus says the release includes performance and scalability improvements for large deployments, including environments with more than 500 probes and 500 million tracked hosts. That matters for large enterprises and MSSPs that need network visibility across complex environments while keeping investigations repeatable, explainable and easier to operationalize.