{"id":79427,"date":"2026-02-03T22:14:20","date_gmt":"2026-02-03T22:14:20","guid":{"rendered":"https:\/\/www.n-able.com\/?p=79427"},"modified":"2026-03-30T08:19:24","modified_gmt":"2026-03-30T07:19:24","slug":"whats-new-in-n%e2%80%91able-edr-2025-year-in-review","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/it\/blog\/whats-new-in-n%e2%80%91able-edr-2025-year-in-review","title":{"rendered":"What\u2019s New in N\u2011able EDR \u2014 2025 Year-in-Review"},"content":{"rendered":"

Explore N‑able EDR\u2019s 2025 innovations, including AI-driven threat detection, extended data retention, Cloud Funnel for real-time telemetry streaming, and advanced forensics\u2014designed to deliver stronger, more resilient security.<\/em><\/p>\n

2025 marked a wave of innovation for N\u2011able EDR, powered by SentinelOne, with significant new features and add-ons that enhance how security teams protect endpoints and streamline security operations. From AI-driven threat detection to enhanced data governance, N‑able EDR has advanced on multiple fronts to help partners and customers accelerate threat detection, conduct deeper investigations, and optimize operational efficiency.<\/p>\n

Below, are the key capabilities introduced in 2025<\/strong>, including the updated RemoteOps Forensics, newly launched PurpleAI\u2122 Security Analyst, Extended Data Retention, and Cloud Funnel demonstrating how they empower users to stay ahead of ever-evolving cyber threats.<\/p>\n\n\n\n\n\n\n
Purple AI \u2122<\/sup> Security Analyst<\/strong><\/td>\nGenerative AI-powered SOC and security assistant (SentinelOne’s Purple AI) embedded in the EDR console<\/em><\/strong>. This allows analysts to use natural language to hunt threats, summarize alerts, and get investigative guidance. It also helps to streamline incident responses by delivering actionable insights and guidance in natural language.<\/td>\n<\/tr>\n
Extended Data Retention<\/strong><\/td>\nFlexible log retention add-on allowing storage of EDR telemetry for up to 365 days (beyond the standard 14-day window, which was already offering good advantages)<\/em><\/strong>. This is ideal for compliance and threat hunting, as it supports comprehensive visibility into all security events by keeping up to a full year of historical data.<\/td>\n<\/tr>\n
Cloud Funnel<\/strong><\/td>\nReal-time telemetry streaming to your own cloud storage. <\/em><\/strong>Supports streaming all endpoint events as they occur, enabling long-term data retention, advanced analytics, and seamless integration with SIEM\/SOAR tools, helping reduce manual data exports.<\/td>\n<\/tr>\n
RemoteOps Forensics<\/strong><\/td>\nAdvanced remote incident response feature combining script orchestration with digital forensics<\/em><\/strong>. Security teams can automatically collect in-depth evidence (running processes, memory dumps, etc.) across endpoints in seconds, enabling faster investigations at scale.<\/p>\n

See datasheet<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Purple AI\u2122 Security Analyst<\/strong><\/h2>\n

One of the most exciting additions in 2025 is that Purple AI\u2122, SentinelOne’s AI-powered security analyst <\/strong>is now integrated into N\u2011able EDR. <\/strong>Purple AI transforms how teams detect, investigate, and respond to threats by allowing users to interact with the endpoint data through natural language queries across the network. For example, a technician can ask, \u201cShow me all PowerShell scripts executed in the last 24 hours\u201d.<\/em> Purple AI then analyzes logs and surfaces the answer. By leveraging generative AI, Purple AI streamlines threat hunting and incident analysis, enabling even junior analysts to uncover patterns and insights without writing complex queries. The assistant can summarize alerts, highlight related incidents, and suggest next steps–acting as a digital co-pilot during investigations. Built on the open OCSF schema, PurpleAI can correlate data across the broader security stack providing richer context.<\/p>\n

Early adopters report that natural language threat hunting accelerates identification by approximately 63% i<\/sup> compared to manual methods. For MSPs and IT professionals, this translates to faster resolution times and stronger capabilities without adding headcount.<\/p>\n

365-Day Data Retention: No More Blind Spots<\/strong><\/h2>\n

Context is everything, and sometimes that context resides in an event that happened months ago. To address this, N‑able has introduced an Extended Data Retention option for EDR Complete.<\/p>\n

Organizations can now retain Deep Visibility data for 30, 90, 180, or 365 days. This ensures that whether investigating a slow-moving intrusion or conducting a year-end security review, teams have access to a full year of historical endpoint telemetry. Longer retention significantly enhances proactive threat hunting as attackers often leave traces in logs long before detection allowing hunters to trace activities across several months. It also supports compliance and digital forensics by simplifying audits and breach reconstruction.<\/p>\n

The feature is flexible; you choose the retention tier that fits your needs (and budget). All extended data is stored in the SentinelOne Data Lake and remains seamlessly accessible through the console\u2019s Deep Visibility interface.<\/p>\n

With this feature, N\u2011able EDR moves closer to SIEM-like telemetry depth, eliminating blind spots that can hinder investigations.<\/p>\n

Cloud Funnel: Your Data, Your Cloud <\/strong><\/h2>\n

Another major enhancement this year is Cloud Funnel, which addresses long-term data retention and integration needs. Cloud Funnel lets you stream all your endpoint event data in real time to your own cloud storage \u2013 whether Azure, AWS, or Google Cloud. This means every security event, benign or malicious, can be piped into an S3 bucket or Azure Blob container as it happens, in an open format (compressed JSON).<\/p>\n

This enables organizations to retain months or years of raw EDR data, correlate endpoint activity with other security and SaaS logs, and build a broader XDR view of threats. By maintaining ownership of their data and eliminating manual exports, teams can apply advanced analytics or machine learning to full-fidelity telemetry.<\/p>\n

For example, you could stream EDR logs to Azure, then use Azure Synapse or SentinelOne to run custom anomaly detection across all endpoints. Cloud Funnel is easily enabled via the EDR settings and billed per protected endpoint, with customers managing their own cloud storage costs.<\/p>\n

RemoteOps Forensics: Deep Incident Investigations at Scale<\/strong><\/h2>\n

To complement its prevention and EDR capabilities, N\u2011able introduced RemoteOps Forensics in 2025 to expand the existing Remote Script Orchestration (RemoteOps) module and support faster, more autonomous incident response.<\/p>\n

With RemoteOps Forensics, security teams can trigger a predefined forensic capture across hundreds of endpoints at once, collecting data like running processes, open ports, Master File Table (MFT) entries, registry hives, browser artifacts, and even full memory dumps. Evidence is gathered in a forensically sound manner and centralized in the Singularity Data Lake for analysis, painting a comprehensive picture of an attack.<\/p>\n

All this is achieved within the same EDR console and agent, eliminating the need for separate DFIR tools. RemoteOps Forensics bridges a gap by combining \u201cblue team\u201d automation (remote remediation scripts) with \u201cdigital forensics\u201d rigor. Security teams can define custom forensic profiles and even set automatic triggers (e.g., run a memory capture if a ransomware alert occurs) for consistent, rapid response. RemoteOps Forensics empowers teams to conduct in-depth investigations rapidly, across many endpoints. reducing the mean time to resolution and helping pinpoint root cause without delay.<\/p>\n

Bonus<\/strong>: Existing users of RemoteOps received this forensic upgrade at no additional cost.<\/p>\n

2025 Was a Leap, but the Groundwork Was Already Rock Solid<\/strong><\/h2>\n

These innovations build on an already robust foundation. N\u2011able EDR continues to deliver machine-speed detection and threat prevention with its behavioral AI, static AI, and Storyline\u2122 context) which have been proven in real-world environments.<\/p>\n

By the end of 2025, N\u2011able EDR has evolved into a comprehensive endpoint security platform with autonomous protection, rich forensic insight, open integration, and operational alignment for MSPs and IT professionals. Customers can fine-tune how they use the product, from what data they keep and where, to how they integrate it into business workflows. This year\u2019s advancements underscore N‑able\u2019s commitment to delivering enterprise-grade innovation\u2014such as generative AI and advanced DFIR\u2014to organizations of all sizes.<\/p>\n

As cyber threats grow more sophisticated and IT environments more complex, these enhancements ensure N\u2011able EDR remains ahead of the curve. Whether detecting novel attacks with AI analysis, or investigating an incident with comprehensive data, the 2025 feature set enables teams to respond faster and more efficiently.<\/p>\n

We look forward to seeing how our user community leverages these capabilities in 2026 and beyond.<\/p>\n

Stay secure, and here\u2019s to an even more innovative year ahead.<\/strong><\/p>\n

Discover more: download the <\/strong>N‑able EDR Datasheet<\/strong>,<\/strong><\/a> or <\/strong>speak with a pro<\/strong><\/a>.<\/strong><\/p>\n

Editor\u2019s Note: <\/em><\/strong>Beginning in 2025, with the introduction of Adlumin Warranties, MSPs and IT professionals using N‑able EDR may be eligible for coverage at no additional cost:<\/p>\n