Magnet Axiom 10.5: Investigate more evidence with greater confidence

Technology never stands still. New apps launch, communication habits shift, cloud environments grow, and the evidence investigators depend on keeps changing with them.

For investigative teams, keeping up takes more than collecting more data. They need to know whether evidence can be trusted, see it in the right context, adapt their analysis to the environment in front of them, and find relevant evidence wherever it lives.

Magnet Axiom 10.5 and Magnet Axiom Cyber 10.5 help investigators do exactly that. Whichever product your team uses, 10.5 brings broader support for emerging evidence sources and clearer time context. Axiom Premier adds more flexible media authentication, and Axiom Cyber adds more adaptable threat analysis.

What’s new in both Axiom and Axiom Cyber

Fewer blind spots and fewer missed leads

Any new application, browser, AI service or communication platform can become part of an investigation, often before investigators expect it.

Axiom and Axiom Cyber 10.5 broaden evidence coverage with Signal acquisition and enhancements to Discord live acquisition. They also add new and updated support for sources including Claude, Grok, Yahoo! Japan Browser, Safari IndexedDB, Chromium network cache and Snapchat warrant returns.

The goal is simple: fewer blind spots and fewer missed leads as the evidence landscape changes.

With more supported sources, teams can examine emerging evidence alongside the rest of their case data and build a more complete picture of what happened. Their investigation is no longer limited to traditional device and application evidence.

Turn time-based evidence into clearer investigative timelines that stand up to scrutiny

A single timestamp can change your understanding of what happened, and when. But when investigators work across routes, conversations and exported evidence, inconsistent time context can make an already complex timeline harder to follow.

10.5 improves local-time handling across route views, chat threads and exports, and adds clearer date and time filtering for faster timeline reconstruction that holds up to scrutiny.

Investigators can review time-based evidence consistently from start to finish, with less ambiguity as they analyze events and share them with others.

Whether you’re reconstructing a conversation, tracing movement through route data or preparing evidence for export, clearer time context makes it easier to build a coherent timeline.

For Axiom users: Authenticate media evidence without sending case data outside secure or air-gapped environments

Establishing trust in digital media matters more than ever. But media authentication also has to fit how and where investigators actually work.

In Axiom 10.5, Axiom Premier expands Magnet Verify-powered media authentication and provenance capabilities, enabling offline analysis for supported file types. Investigators can assess the authenticity and provenance of supported media directly within their Axiom workflow, even where internet connectivity is unavailable.

Investigators can reduce tool switching by bringing supported media authentication directly into their existing Axiom workflow. Validation becomes a natural part of the investigative process, not a separate step.

The result? More flexibility to validate the evidence investigators rely on, wherever the investigation takes them.

For Axiom Cyber users: Detect organization-specific threats in macOS and cloud environments that generic detection rules miss

Threat analysis isn’t one-size-fits-all. Every organization faces different threats, works in a different environment, and may need different detection logic.

Axiom Cyber 10.5 gives investigators more control over how that analysis works.

The Indicators of Compromise Dashboard now supports custom SIGMA rules for MITRE ATT&CK analysis, so teams can apply detection logic built for their environment. MITRE ATT&CK analysis also expands to macOS Unified Logs and Google Cloud Platform logs, bringing ATT&CK context to more of the evidence investigators encounter.

For incident response and investigation teams, that means applying MITRE ATT&CK analysis across relevant macOS and cloud evidence instead of relying only on standard analysis, resulting in fewer irrelevant findings, more organization-specific context, and insights.

More evidence. Clearer context. Stronger investigative confidence.

At its core, 10.5 is about helping investigators keep up with changing evidence without losing sight of what matters.

Together, these enhancements help investigative teams:

• Reduce blind spots and missed leads with broader support for emerging evidence sources.
• Reconstruct investigative timelines faster and with greater confidence through clearer, more consistent time context.
• Authenticate supported media without sending case data outside secure or air-gapped environments with Axiom Premier.
• Surface fewer irrelevant findings and gain more organization-specific context and insights with more adaptable threat analysis in Axiom Cyber.

Because as digital evidence continues to evolve, investigators need workflows that evolve with it.

To explore what’s new in Axiom, request a trial or speak to one of our experts for a personalized demo.

Existing customers can upgrade to Axiom 10.5 in the Support Portal and review the Release Notes for full details.