Cytomic EPDR

Agent and protection versions

• Windows protection: 8.00.26.0012
• macOS protection: 3.08.00.0003
• Linux protection: 3.08.01.0000
• Android agent and protection: 3.14.3
• iOS agent and protection: 2.02.06.0001
• Windows agent: 1.25.14.0000
• macOS agent: 1.17.24.0000
• Linux agent: 1.17.01.0000

New features

• The “Workstations and servers” security settings have been reorganized.
  The "Advanced protection" section has been split into separate sections to simplify configuration: Zero-Trust Application Service, Anti‑exploit, Network attack protection, and Advanced security policies. The existing settings profiles are automatically adapted to the new organization.
• The macOS protection can now generate incidents and signals.
• Malicious URLs detected are categorized as Signals in incidents.
• There is a new status for incidents: Automatically closed. This status shows in the Security dashboard, in the Incidents list, and in Executive Reports.
• An alert message appears at the top of the Security dashboard when there are critical incidents that require immediate review.
• Incidents replace the indicators of attack (IOA) feature in the console. Indicators of attack detections are now considered signals in the context of attacks. Consequently, the Indicators of attack dashboard and list, the Indicators of attack setting in My alerts, the Indicators of attack information in executive reports, and the Recent indicators of attack risk are removed from the console. The RDP attacks settings and the Advanced IOA toggle are kept.
• The data retention policy has been updated. This policy defines how long data is retained on our servers and available in the console. For more information about the new data retention periods, click here.
• This release includes counters that show the number of successful installations, download errors, and installation errors for each patch. These counters do not include data prior to this release and show data obtained from the customer network and from the WatchGuard community.
• You can now configure requirements for installing patches from patch installation tasks: the amount of time elapsed since the patch was released, the minimum number of successful installations, the maximum number of failed installations, or the minimum number of days elapsed since the first successful installation. Each computer verifies these conditions before installing the patch.
• Improvements to the Windows protection update process:
  We have extended, to all Windows systems, the update system implemented for Windows Home editions and for computers where the user manually modified the shutdown policy. In Windows Pro editions, updates no longer apply just before computers restart, but when you click the "Update and restart" button or after the countdown in the restart message ends.
• Improvements to the Windows protection update process:
  To minimize disruption, the agent checks whether the requirements for updating the protection are met before showing any update or restart messages. If the conditions are not met, the update does not start and the relevant status is notified in the console.
• With the release of the Android Mobile Security app v3.13.6, protection for Android 6 and Android 7 will become End-of-Life (EOL). After the EOL date, the minimum requirement to install the Android app on new devices will be Android 8.
• Devices that run Android 8 or higher will be automatically updated to the Android Mobile Security app v3.13.6.
• Devices with Android versions lower than Android 8 will not be updated to the Android Mobile Security app v3.13.6. The previous version of the Android app will continue to work.
• This release includes improvements to the protection and detection capabilities.
• This release optimizes the detection of attempts to remotely encrypt decoy files. If the security software detects an attempt to encrypt decoy files from a remote IP address, it generates an incident and blocks communications with that IP address for one hour.
• The security software no longer uses temporary files to identify fileless malware detections. Now, it generates an incident by using real data from the processes involved in the detections.
• The “Report blocking to the computer user” option in the Anti-exploit protection settings is now disabled by default.
• The “Audit” mode of the Zero-Trust Application Service has been renamed to “Learning”.
• The “Advanced protection” settings have been renamed to “Zero-Trust Application Service”.
• In the Patches list, the “Pending” status has been changed to “Available”.
• In the Incident status widget, the “Pending” label has been changed to “Action required” and “Closed” has been changed to “Manually closed”.
• New iOS protection version: 2.02.04. This version includes internal adjustments to improve integration with dependent services.
• New iOS protection v2.02.05. Improved response time when you access the Anti-Theft feature.
• New iOS protection v2.02.05. You no longer need to grant the iOS app the Local Device Access permission when you install it without an MDM solution.
• New iOS protection v2.02.05. Optimized installation of the iOS app when you do not need to grant permissions to the app.
• New Android protection v3.14.3. Improved device information updates. Version 3.14.3 of the Android Mobile Security app checks for relevant changes on Android devices every seven days and reports them automatically to our servers (for example, operating system version changes).
• New Android protection v3.14.3. The Android Mobile Security app no longer includes code associated with operating system versions the app no longer supports. This enhancement reduces the attack surface and minimizes potential vulnerabilities.
• New Android protection v3.14.3. The Android Mobile Security app now collects more information for error analysis. This allows for more efficient identification and resolution of issues.
• There is a new type of alert message on the My alerts settings page. You can now receive an email notification when an incident is detected.
• New option available: Allow anti-exploit technology to send diagnostic information. When you enable it, the system automatically sends diagnostic data for any detection made by the anti-exploit technology. The feature requires Windows protection v8.00.26.0011 or higher.
• Support for short-lived certificates. This feature expands the scope of digital signature technology to eliminate false positives and strengthen the Zero-Trust security model. This feature requires Windows protection v8.00.26.0011 or higher.
• Support for new Linux distributions: Red Hat Enterprise Linux 10.0, 10.1, and 10.2; lmaLinux 10.0, 10.1, and 10.2; Rocky Linux 10.0, 10.1, and 10.2; Oracle Linux 10.0, 10.1, and 10.2; CentOS Stream 10; AlmaLinux Kitten 10; SUSE Linux Enterprise 16; openSUSE Linux Enterprise 16.0; and Amazon Linux 2023. For more information on supported Linux distributions, click here. This feature requires Linux protection v3.08.01.0000 or higher.
• Support for ARM macOS devices natively. The security software no longer requires Rosetta to run on ARM macOS devices. This feature requires macOS protection v3.08.00.0002 or higher.
• Support for macOS 27 (Golden Gate). This feature requires macOS protection v3.08.00.0002 and macOS agent v1.17.21.0000 or higher.
• You can now export and import settings profiles.
• Encryption. From version 1.25.12.000 of the Windows agent, both administrator and non-administrator users can configure encryption (PIN/password).
• From version 1.25.12.000 of the Windows agent, both administrator and non-administrator users can restart a computer from a protection update or patch management alerts.
• From version 1.25.12.000 of the Windows agent, both administrator and non-administrator users can retry actions from the initial installation dialog box.

Bug fixes

• This release resolves an issue that caused unexpected restarts on Linux servers.
• This release resolves an issue that prevented custom branding from being applied when you reinstalled the agent without restarting the computer after you had previously uninstalled the agent with the generic uninstaller.
• This release resolves an issue that caused Windows computers to restart multiple times when you restarted them from the console.
• This release resolves an issue that prevented advanced policies from being disabled on computers after they had been disabled from the console.
• This release resolves an issue in patch management where the restart option you had configured in the maintenance window was not applied.
• This release resolves an issue that caused app ownership to be incorrectly assigned when you installed patches on macOS systems.
• This release resolves an issue on macOS computers that prevented you from configuring encryption passwords that contained the dollar sign ($).
• This release resolves an issue that occurred when the security software showed new third-party patches for macOS.
• This release resolves an issue that prevented you from moving more than 10,000 computers to an Active Directory group at once.
• This release resolves connection issues to knowledge servers.
• This release resolves an issue that caused the security software PSANHost.exe service to crash when the computer recovered from Sleep, Suspension, or Hibernation state.
• This release resolves an issue that caused occasional BSOD errors related to the Firewall module.
• This release resolves an issue that caused the security software to incorrectly handle detection IDs in certain contextual detections.
• This release resolves an issue that affected security software updates because of the ELAM (Early Launch Anti-Malware) technology.
• This release resolves an issue that caused computers with advanced indicators of attack (IOAs) enabled to encounter performance issues.
• This release resolves an issue that caused occasional BSOD errors on VPN servers caused by network interception drivers.
• This release resolves an issue that caused occasional BSOD errors caused by the NNSPRV.sys network interception driver.
• This release resolves an issue that caused occasional BSOD errors caused by the NNSPRV.sys driver.
• This release resolves an issue that caused compatibility issues when you used dock stations with certain laptops.
• This release resolves false positives of malicious or disallowed URLs on DNS servers where there is no browsing activity.
• This release resolves an issue that caused occasional BSOD errors when you configured the Device Control feature for removable drives in Block or Allow read access mode.
• This release resolves an issue that caused the Device Control feature to interfere with the display settings of devices.
• This release resolves vulnerabilities that affected OpenSSL libraries: CVE-2026-22796, CVE-2026-22795, CVE-2025-9232, CVE-2025-9231, CVE-2025-9230, CVE-2025-69421, CVE-2025-69420, CVE-2025-69419, CVE-2025-69418, CVE-2025-68160, CVE-2025-66199, CVE-2025-15468, CVE-2025-15467.
• This release resolves an issue where the installer did not request privilege elevation in certain cases, preventing necessary settings from being applied correctly.
• This release resolves the CVE-2026-41286 vulnerability, which could cause the agent to crash when it received certain invalid communications.
• This release resolves the CVE-2026-41287 vulnerability, which could cause the agent to crash when it processed certain messages.
• This release resolves the CVE-2026-41288 vulnerability, which could enable a local user to gain elevated privileges on the system.
• This release resolves the CVE-2026-6787 vulnerability, which enabled the execution of processes with elevated privileges on the system.
• This release resolves the CVE-2026-6788 vulnerability, which could enable unauthorized users to gain elevated privileges on the system.
• This release resolves an issue where the iOS app obtained the device location when you opened it.
• This release resolves an issue where the “Issues” or “Protections” sections in the main window of the iOS app did not show correctly.
• This release resolves an issue where customer data was incorrectly sent to Support when customers reported an issue with the iOS protection.
• This release resolves BSOD errors caused by the NNSPICC.sys network interception driver.
• This release resolves an issue that caused continuous restarts of the protection service (PSANHost.exe). This caused the device to temporarily appear as unprotected in the management console.
• This release resolves an issue in the Web Access Control feature where the category reported in block notifications was incorrect for pages belonging to the Unknown category.
• This release resolves BSOD errors caused by the PSINReg.sys network interception driver when you connected specific dock stations or USB devices.
• This release resolves BSOD errors caused by a concurrency issue affecting the NNSPRV.sys network interception driver.
• This release resolves an issue that caused Network Attack Protection to reduce the Internet connection upload speed.
• This release resolves several performance issues.
• This release resolves an issue that caused driver update that prevented the MSI cache from being repaired correctly.
• This release resolves BSOD errors caused by the PSINKNC.sys driver on computers where there was a large number of running processes that generated multiple input/output operations.
• We have re-signed Device Control Control drivers to prevent errors on legacy Windows 10 (th1) systems.
• This release resolves BSOD errors caused by the PSINFILE.sys driver.
• This release resolves an issue where Device Control local alerts did not show when the security software blocked USB devices.
• We have updated the SQLite3.dll library to resolve vulnerabilities.
• This release resolves a security software vulnerability that could enable privilege escalation.
• Version 1.25.13.000 of the Windows agent resolves the CVE-2026-57909 vulnerability, which could enable a malicious process to drop an unauthorized executable file on the computer.
• Windows agent v1.25.13.000, macOS agent v1.17.21.0000, and Linux agent v1.17.01.0000 resolve the CVE-2026-57910 vulnerability. This vulnerability could enable a malicious process with access to a compromised computer on the network to establish fraudulent communications with other computers and perform unauthorized operations on them.
• Version 1.17.21.0000 of the macOS agent resolves an issue on ARM systems with dark mode enabled where some communications agent windows (including installation, Panda Full Encryption configuration, or restart request dialog boxes) showed incorrectly.
• Version 1.17.21.0000 of the macOS agent resolves the CVE-2026-57909 vulnerability, which could enable a malicious process to drop an unauthorized executable file on the computer.
• macOS protection v3.08.00.0003 resolves an issue that caused excessive disk space usage.
• Windows protection v8.00.26.0012 resolves the CVE-2026-13043 vulnerability in the PSKMAD.sys driver. This vulnerability could enable an attacker to send specially crafted IOCTL requests to read memory allocated to other processes.
• Windows protection v8.00.26.0012 resolves BSOD errors caused by the NNSPRV.sys driver after the protection was updated to v8.00.26.0011.
• Windows protection v8.00.26.0012 resolves random BSOD errors caused by the NNSPRV.sys driver on Windows 11 ARM64 systems.
• Windows protection v8.00.26.0012 resolves an issue that occasionally caused progressive performance degradation on Windows 11 systems.
• Windows protection v8.00.26.0012 resolves an issue that blocked the installation of large .MSI files on user computers through System Center Configuration Manager (SCCM)/Microsoft Endpoint Configuration Manager.
• Windows protection v8.00.26.0012 resolves an issue that caused performance problems on Windows Server 2022 systems.
• Windows protection v8.00.26.0012 resolves an issue that caused high bandwidth usage when patches were downloaded on computers with Patch Management enabled.
• Windows agent v1.25.13.0001 resolves an issue that caused the full signature file to be downloaded repeatedly after successive failed implementation attempts. The security software cache has been optimized to prevent unnecessary network usage.
• macOS agent v1.17.24.0000 resolves the CVE-2026-96293 vulnerability. This vulnerability could enable the FileVault Personal Recovery Key (PRK) to be written to the agent log directory.
• macOS agent v1.17.24.0000 resolves an issue that caused Patch Management patch installation errors when the target computer entered sleep mode during the patching process.
• Windows agent v1.25.14.0000 resolves an issue that caused unexpected restarts of Windows 11 computers during agent uninstallation.
• Windows agent v1.25.14.0000 resolves an issue that caused computers to restart outside maintenance windows when updates were applied.
• Windows agent v1.25.14.0000 now enables patches larger than 4 GB to be cached.
• Windows agent v1.25.14.0000 resolves the CVE-2026-96293 vulnerability. This vulnerability could enable a local user to write, modify, and run files in the agent log directory, altering the logs.

Agent and protection versions

• Windows protection: 8.00.25.0002
• macOS protection: 3.07.00.0000
• Linux protection: 3.07.00.0001
• Android agent and protection: 3.13.4
• iOS agent and protection: 2.02.03.0006
• Windows agent: 1.24.02.0000
• macOS agent: 1.16.00.0000
• Linux agent: 1.16.01.0000

New features

• When Cytomic Advanced EDR/EPDR detects a potential threat, it converts the Zero-Trust Application Service detected into signals. To make threat identification and resolution easier, related signals are automatically grouped into incidents.
• There are two new widgets in the Security dashboard: Pending incidents and Incident status. These widgets provide direct access to lists of incidents..
• When you select an incident, you can view a list of signals, the incident graph, and high-level details. Additionally, you can see the entities of interest related to the incident.
• Now you can add or remove signals, and decide whether to show or hide them.
• When you select a signal, you can view a tree that shows the processes that generated it, and the MITRE techniques and tactics used. This page also includes details about the signal and other relevant information from MITRE.
• You can select the different events within a signal to see their details.
• New incident and signal monitoring and management features. You can investigate affected computers, view activity graphs, review computer details, and run advanced SQL queries.
• This release adds a new AI-powered virtual assistant to investigations to run SQL queries using natural language.
• New list that shows all incidents detected across the organization. This list provides different filters and the ability to generate scheduled reports.
• New Zero-Trust Application Service Report, which provides you with key metrics to evaluate the service effectiveness.
• New script blocking feature. With this tool, you can create settings profiles with custom rules that enable you to block or allow the execution of scripts based on their characteristics or those of the process that runs them.
• New list (Scripts blocked by the administrator) to view blocked scripts and schedule them to be sent by email.
• Web Access Control: Support for QUIC HTTP3 protocol.
• Web Access Control: Support for pages protected by content delivery networks (CDNs). A CDN (Cloudflare, Akamai, etc.) acts as an intermediary, concealing the true intended destination of a connection. We can now know the domains of the web pages managed by CDNs, so that our web filtering and protection technologies can scan them.
• You can now enable Verbose mode for Linux computers in Audit mode. This feature, which can be enabled for a short time only and for a maximum of 20 computers simultaneously, requires Linux protection v3.06.00.0001 or higher.
• We have updated the security software local console on Windows computers to use .NET libraries.
• New settings to configure maintenance windows and time slots to restart computers automatically after software updates or patch installationssoftware updates or patch installations.
• Improved detection of malicious .MSI filesImproved detection of malicious .MSI files.
• Support for macOS 26 Tahoe. This feature requires macOS protection v3.07.00.0000 or higher.
• We have updated the security software local console on macOS computers to show the number of quarantined files instead of scanned files.
• The Android app improves detection of large-screen devices to prevent constant screen rotation. This feature requires Android protection v3.13.0 or higher.
• The Android app now supports Android 15 natively. This feature requires Android protection v3.13.0 or higher.
• The iOS app improves URL categorization. This feature requires iOS protection v2.02.01.0003 or higher.
• The iOS app now shows a message when there is an error sending log files to Support. This feature requires iOS protection v2.02.01.0003 or higher.
• The iOS app optimizes the sending of the registration message to WatchGuard servers. This feature requires iOS protection v2.02.01.0003 or higher.
• Agent security standardization: This release improves memory management for two agent auxiliary processes. With this, security measures for all of the agent processes are standardized.
• The upgrade process has been modified to back up log files. Log files are no longer lost when a reinstallation is required.
• Support for Rocky Linux 9.7. Click here for detailed information about all supported Linux distributions. This feature requires Linux protection v3.07.00.0001 or higher.
• Linux Agent v1.16.01.0000 enables you to deploy and manage the Open MDR service collector.
• The Mobile Security app for Android devices includes improvements to the progress screen shown when the device to protect is integrated into our systems.
• The Mobile Security app for Android devices shows a message that prompts you to keep the app open while the device to protect is integrated into our systems.
• The Mobile Security app for Android devices shows a message to prevent you from granting the Device Admin permission to the app before changing the Battery Optimizations and App Hibernation settings on the device. This is because those settings cannot be modified while the Device Admin permission is active.
• If required during installation of the Mobile Security app for Android devices, the app shows a message informing you that the Device Admin permission has been automatically disabled so you can change the App Hibernation or Battery Optimizations settings. The Device Admin permission must be re-enabled after you modify these settings.
• Coinciding with the release of iOS Mobile Security app v2.02.03.0006, our protection for iOS 13 and iOS 14 will become End of Life (EOL). After the EOL date, the minimum requirement to install the iOS app on new devices will be iOS 15.

Bug fixes

• This release resolves an issue with the way XDR obtained User/Domain information.
• This release resolves an issue that caused a memory leak in the AMSI detection technology.
• This release resolves an issue that allowed the PSUAService to be stopped, even when the anti-tamper protection was enabled.
• This release resolves a vulnerability that enabled third-party tools such as Revo Uninstaller to bypass the anti-tamper protection and the uninstall password.
• This release resolves an issue that caused the Windows operating system to start slowly. This affected Windows Server systems primarily.
• This release resolves an issue that caused a BSOD error when our security software was updated.
• This release resolves an issue that sometimes caused a network slowdown after an update to macOS protection v3.04.
• This release resolves an issue that caused Network Access Enforcement to stop working on macOS computers after an update to macOS protection v3.06.00.0001.
• This release resolves an issue that sometimes caused connection problems with WatchGuard servers on macOS computers after an update to macOS protection v3.06.00.0001 or lower.
• This release resolves an issue with logouts intercepted by the firewall to improve stability and compatibility with third-party applications.
• This release resolves compatibility issues between the firewall protection and networks detected automatically through WireGuard/Wintun VPN adapters.
• This release resolves issues that affected immediate and scheduled scans.
• This release resolves an issue that prevented notifications from appearing on user computers.
• This release resolves a possible vulnerability in the Android protection when you used the Network Access Enforcement feature.
• Version 2.02.01.0003 of our iOS app resolves an issue that caused an error when you tried to send log files to Support from the welcome screen.
• Version 2.02.01.0003 of our iOS app resolves an issue with MDM enrollment of iOS 26 devices.
• Version 2.02.01.0003 of our iOS app resolves an issue that sometimes caused an error when you disabled phishing or malware detection in the Web Protection feature.
• This release resolves an issue on Windows computers that caused the NDR collector to not install correctly after the latest WSL update.
• This release resolves an issue that caused error 1067 when you reinstalled the security software from the web console.
• This release fixes the CVE-2021-0341 vulnerability that affects Android devices.
• This release resolves an issue that occurred when you scanned malformed QR codes.
• This release resolves an issue that could cause an exception when you closed the Mobile Security app for Android devices before the integration process was complete.
• iOS Mobile Security app v2.02.03.0006 resolves an issue on supervised iOS devices where, when you ran an app that calls external authentication systems, this error occurred: “about:blank – You cannot browse this page because it is restricted”.

Agent and protection versions

• Windows protection: 8.00.24.0001
• macOS protection: 3.06.00.0001
• Linux protection: 3.06.00.0001
• Android agent and protection: 3.11.4
• iOS agent and protection: 2.01.16.0007
• Windows agent: 1.23.01.0000
• macOS agent: 1.15.01.0000
• Linux agent: 1.15.02.0000

New features

• Zero-Trust Application Service improvements. When the security software blocks an unknown program because the endpoint cannot connect to Collective Intelligence, a text appears on the History of Blocked Programs page that indicates the reason for the block.
• Zero-Trust Application Service improvements. When a program blocked as unknown is later classified as goodware, the endpoint where the block occurred shows a pop-up notification that prompts the user to try to run it again.
• Zero-Trust Application Service improvements. Programs initially blocked and then reclassified as goodware show on the History of Blocked Programs page, along with the time taken for reclassification.
• Zero-Trust Application Service improvements. When a blocked program is reclassified, the Blocked Program Details page shows when reclassification occurred, how long it took, and whether it was classified automatically by WatchGuard Collective Intelligence or by WatchGuard lab technicians.
• Device Control. You can disable Autoplay on removable storage devices.
• Changes made to the Filters and Folders trees on the Computers page now persist if you navigate away from the Computers page.
• Support for Fedora Linux 41. Click here for detailed information about all supported Linux distributions. This feature requires Linux protection v3.06.00.0001 or higher.
• Anti-tamper protection on Linux systems. Added anti-tamper protection for Linux systems to prevent attackers from stopping the security software.
• Added the ability to request a password to uninstall the security software on Linux systems, as well as the ability to enable two-factor authentication.
• The proxy server you configure in the management console is used by the Linux protection only to communicate with our repositories. It does not affect interaction with the package manager.
• The Linux protection repository is disabled after you uninstall the security software and is automatically enabled/disabled during the security software update cycles.
• Knowledge server connection status. The Computer Protection Status list now shows the status of the connection to the Collective Intelligence and URL classification servers for Linux and macOS computers.
• Knowledge server connection status. The Details page for Linux and macOS computers now shows the status of the connection to knowledge servers.
• Uninstallation from the management console for Linux and macOS computers. Added the ability to uninstall the agent and the software installed by the agent from the management console for Linux and macOS computers.
• Authorized Software. When an authorized process loads a library, the security software does not block the library even if it is unknown.
• Authorized Software. When an authorized process creates and runs a child process, the security software considers the child process authorized and does not block it.
• Authorized Software. When an authorized installer creates and runs new processes, the security software considers these child processes authorized and does not block them.
• The display time of local alerts is increased.
• The Android app now support Android 14 natively. This feature requires Android protection v3.11.4 or higher. Previous versions of the Android app also work on Android 14, but in compatibility mode.

Bug fixes

• This release resolves an issue where editing Office files shared on a server created temporary files that could not be deleted.
• This release resolves a security software self-diagnosis issue that caused an unchecked exception that could lead to service crashes.
• This release resolves a vulnerability that caused the security software to show multiple blocked page notifications, preventing the computer screen from being locked and leaving the computer exposed to unauthorized access.
• This release resolves a vulnerability found in protection version 8.00.23, which could allow arbitrary file creation, potentially leading to a denial-of-service attack.
• This release resolves a BSOD error that occurred on computers with NeuShield drivers.
• This release resolves an issue that enabled users to occasionally access web domains belonging to Web Access Control blocklisted categories.
• This release resolves an issue with detection of certain PUPs by macOS protection.
• This release resolves an issue with macOS protection that caused the service to hang for about 30 seconds on older computers with limited resources.
• This release resolves an issue with Patch Management where, after the security software patched and restarted a computer, patch traces were left in the Patch Management folder.
• This release resolves an issue where the AppMngPatcher.exe patch installation tool stopped working occasionally.
• This release resolves an issue where incomplete tasks prevented new patches from being downloaded.
• This release resolves an issue where patches included in a later patch did not install, and a message appeared that indicated the patch was no longer necessary.
• This release resolves an issue where, if the Endpoint Access Enforcement feature was enabled, it caused high CPU usage by the AgentSVC process.
• This release resolves an issue where signature file traces were left that could not be applied and took up space.
• This release resolves an issue where, when the security software sent Active Directory data through Directories and Domain Sync, if any Active Directory item was larger than 125 KB, an error occurred and it was not synchronized.
• This release resolves an issue that prevented the security software from installing due to a brand download error.
• This release resolves an issue where you were prompted to restart the computer repeatedly.
• This release resolves an issue where the security software showed incorrect time information in attack graphs.
• This release resolves an issue where users without Total Control permissions could not see applied filters on the Computers page.
• This release resolves an installation issue on computers running SUSE Linux Enterprise Server 12.1.
• This release resolves an issue that caused high CPU usage by the PSANHost process.
• This release resolves an upgrade issue that caused error 1603.
• This release resolves an issue that caused the security software to show local alerts with no text.
• This release resolves an issue that caused the security software to show incorrect local alerts when blocking unknown files due to lack of connectivity with Collective Intelligence servers.
• This release resolves an issue that caused the Network Extension (NEXT) to crash with HTTP communications to very long URLs.
• This release resolves an issue that caused constant screen rotation on devices that had an operating system bug.
• This release resolves an issue that caused a memory leak in the Android protection. This issue occurred when you changed the display size with our app in the foreground.
• This release resolves an issue where, when the protection software was updated on Linux computers, some unused processes remained in memory.

Agent and protection versions

• Windows protection: 8.00.23.0001
• macOS protection: 3.05.00.0001
• Linux protection: 3.05.00.0001
• Android agent and protection: 3.10.0
• iOS agent and protection: 2.01.16.0007
• Windows agent: 1.22.01.0000
• macOS agent: 1.14.01.0000
• Linux agent: 1.14.01.0000

New features

• Verbose mode. In this new mode, computers send much more telemetry to servers (extended telemetry). This mode provides detailed system information for IOA resolution. It is particularly helpful for security operators who want to simulate proof-of-concept attacks under the MITRE standard.
• Verbose mode. You can enable Verbose mode on Windows computers in Audit mode for a limited time. This feature requires Windows protection v8.00.23.0000 or higher.
• Verbose mode. You can enable Verbose mode on up to 20 Windows computers simultaneously.
• New Investigation tab on the computer details page. This tab shows telemetry reported by Windows, macOS, and Linux computers in the last seven days.
• Investigation tab on the Computer Details page. You can run SQL queries on the telemetry collected over the last seven days.
• New Investigation tab for indicators of attack (IOA). This tab shows telemetry reported by Windows, Mac, and Linux computers in the days around the date of the event that triggered the IOA.
• Investigation tab for indicators of attack (IOA). This tab enables you to run SQL queries on the available telemetry for an IOA.
• Endpoint Access Enforcement. This new feature monitors connections to the Windows computers on the network to help reduce potential infections and attacks from unprotected computers (Windows, macOS, or Linux). By default, it monitors inbound connections for SMB and RDP traffic. Connections are allowed only if the configured conditions are met. On Windows computers, this feature requires Windows protection v8.00.23.0000 or higher and communications agent v1.22.01.0000 or higher; on macOS and Linux computers, it requires communications agent v1.14.01.0000 or higher.
• New Endpoint Access Enforcement settings profile. You can specify risk conditions for computers, create new connection rules for protocols other than those monitored by default, and select the action to take on computers at risk (audit or block).
• New Endpoint Access Enforcement dashboard with several graphs: connection map, top 5 computers reporting high-risk outbound or inbound connections, number of connections by condition, and number of connections by monitored protocol.
• New Monitored connections tab on the computer details page. This tab shows connections that meet the conditions specified in the Endpoint Access Enforcement rules.
• Endpoint Access Enforcement. Executive reports now include an Endpoint Access Enforcement section.
• Ability to block vulnerable drivers. New Vulnerable drivers section in the Workstations and servers settings. This section enables you to detect and block vulnerable drivers, preventing attackers from exploiting them to perform malicious actions. This feature requires Windows protection v8.00.23.0000 or higher.
• Ability to block vulnerable drivers. You can exclude detected vulnerable drivers from monitoring, so that they are never detected again.
• Changes to anti-exploit protection settings. Anti-exploit protection is easier to configure. You can now exclude specific processes from anti-exploit protection, without having to completely disable the feature. This feature requires Windows protection v8.00.23.0000 or higher.
• AMSI detection technology. You can now enable advanced scanning with AMSI. You can enable and disable AMSI detection technology and exclude specific processes, without having to completely disable the AMSI feature. This feature requires Windows protection v8.00.23.0000 or higher.
• Ability to manage exclusion impact on risk assessment. One of the aspects that is considered in risk assessment is whether there are folder, file, and extension exclusions. Now, when configuring Risks settings, you can decide which exclusions you want the security software to consider when it calculates a computer risk level.
• Remote control for Linux and macOS computers. You now have the same remote control features for Linux and macOS computers as for Windows computers: remote shell, list of running processes, list of computer services, and bidirectional file transfer. This feature requires v1.14.01.0000 or higher of the Linux or macOS communications agent.
• Ability to isolate Linux computers. You can now isolate Linux computers on your network. Similar to the Windows and macOS feature, isolated Linux computers allow only our processes to communicate. If an attack occurs, you can isolate the computer from the network to prevent the spread of the threat. If required, you can exclude other processes to allow them to communicate on isolated computers. This feature requires Linux protection v3.05.00.0000 or higher.
• You can now enable and disable local alerts on macOS computers and customize malware, firewall, and device control alerts.
• Android protection now supports Network Access Enforcement.
• Support for SHA-256. You can now use MD5 and SHA-256 hashes when configuring these features: Advanced protection, Program blocking, and Authorized software.
• Users with Total Control permissions can export recipient email addresses configured in the My alerts section for all users in an account.
• Task management improvements. You can now cancel or delete all tasks at once instead of having to individually select all tasks that appear on each page.
• Support for Windows Server 2025. This feature requires Windows protection v8.00.23.0000 or higher.
• Support for macOS 15 Sequoia. This feature requires macOS protection v3.05.00.0000 and higher.
• Support for these Linux distributions: OpenSUSE 15.3, 15.4, 15.5, and 15.6; SUSE 15 SP6; Fedora 39 and 40; Red Hat/Oracle/Rocky/Alma 8.9, 8.10, 9.3, and 9.4; Ubuntu 23.10 and 24.04; and Mint 21.2, 21.3, and 22. Click here for detailed information about all supported Linux distributions. This feature requires Linux protection v3.05.00.0000 or higher.
• Exchange Server protection is now end of maintenance (EOM). Although we no longer provide support for issues with Exchange Server protection, it will continue to be available until 1 January 2025 to customers that are currently using it. After that date, Exchange Server protection settings profiles will be removed from all consoles and Exchange Server protection will be disabled on all endpoints. As a result, Exchange Server email will no longer be intercepted and scanned.
• On 30 September 2024, protection for Windows XP, Windows Vista, Windows Server 2003, and Windows Server 2008, as well as macOS Yosemite, El Capitan, Sierra, High Sierra, and Mojave will become End of Sale (EOS). Windows 2008 R2 will continue to be supported. After that date, you will not be able to add to the console or install the protection software on new computers that run these operating systems versions.
• Later, on 30 April 2025, our Windows and macOS protection for these OS versions will become End of Life (EOL). After that date, the product license will be automatically removed from all computers that run these OS versions, and you will not be able allocate licenses to affected computers.

Bug fixes

• Issue that caused the security software to send the same alert email notifications repeatedly over several days.
• Temporary performance issues on Windows Server 2016.
• Issue that caused the security software to classify URLs as “unknown category” and block them on some computers.
• Issue that prevented users from logging in to a corporate website.
• Security software upgrades after computer shutdown took too long because the computer waited for the PSANHost process to close.
• BSOD error that occurred on computers with NeuShield drivers.
• Issue that caused the security software decoy files to create temporary files and folders after backup sessions.
• ATC.exe did not run on Server Core because of a dependency.
• Issue that caused on-demand scans of PDF files to not finish.
• Vulnerability found in the security software decoy files.
• Issue with Linux protection signature file permissions after a security software upgrade.
• Self-diagnosis issue that caused the security software to sometimes report an error despite it worked correctly.
• When you uninstalled the security software from a macOS device, you were prompted to keep the quarantine despite it was empty.

Agent and protection versions

• Windows protection: 8.00.22.0025
• macOS protection: 2.00.10.1000 and 3.04.01.0000 for Catalina, Big Sur, Monterey, Ventura and Sonoma
• Linux protection: 3.03.00.0001
• Android agent and protection: 3.9.6
• iOS agent and protection: 2.01.16.0007
• Windows agent: 1.21.03.0000
• macOS agent: 1.13.10.0000
• Linux agent: 1.13.00.0000

New features

• WatchGuardSecure Wi-Fi connections. When you connect to a Wi-Fi network using WatchGuard Access Points, Access Points can check that connecting devices are secure: the security software is enabled and running. This feature supports Windows and macOS computers and requires the latest version of Wi-Fi Access Points.
• WatchGuardSecure Wi-Fi connections. You can configure this feature on the Network Access Enforcement tab inside the Network Services settings. You must also enable it on the Access Points that you configure in WatchGuard Cloud. The Network Access Enforcement settings also apply when you connect to a VPN network through WatchGuard Fireboxes.
• The new version of Cytomic Patch supports macOS computers. This version adds automatic detection of patches and the ability to patch macOS Catalina, Big Sur, Monterey, and Ventura systems on demand or on a schedule.
• Cytomic Patch on macOS systems enables you to patch both the operating system and third-party applications.
• Operating system patches for macOS with ARM (M1 and M2) require the computer user password and a forced restart.
• macOS operating system patches are not included by default in recurring patch installation tasks. However, you can enable installation of these patches manually.
• You can select to install macOS operating system patches manually from the list of available patches. These patches include the text “Softwareupdate” in the patch name. Search for Softwareupdate to easily identify these patches in your organization.
• macOS devices can install patches from a Windows cache computer to optimize bandwidth use and centralize patch downloads through cache computers. You can specify these cache computers in the Network Services settings.
• The new version of Cytomic Patch supports Linux computers. This version adds automatic detection of patches and the ability to patch Red Hat 7 and 8, CentOS 7, and SUSE 12 and 15 systems on demand or on a schedule. Future releases will support additional distributions.
• Cytomic Patch on Linux systems enables you to patch both the operating system and third-party applications.
• Linux devices install patches by using the caching mechanisms implemented on the system, not the caching mechanisms configured in the product.
• Support for macOS Sonoma. Requires macOS protection version 3.03.00.0002 or higher.
• In the Cytomic Patch dashboard and lists, you can now filter by operating system (Windows, macOS, or Linux).
• In the Available Patches list, you can now filter the list by operating system (Windows, macOS, or Linux. You can also filter by any of the hundreds of applications that can be patched with Cytomic Patch.
• By default, recurring patch installation tasks install only Windows patches. To install macOX or Linux patches, you must select them manually in the section where you specify the software you want to patch.
• You can view the software supported by Cytomic Patch here.
• Cytomic Patch New Programs with Most Available Patches widget that shows programs with most patches that are pending installation.
• Cytomic Patch. New Available Patches by Computers list that shows patches that are pending installation on most computers on the network.
• Vulnerability assessment. New dashboard that shows vulnerabilities detected on computers. It is only available for customers without the Cytomic Patch module.
• Vulnerability assessment. Automatic discovery of vulnerabilities in the operating system and third-party software on Windows, macOS, and Linux workstations and servers.
• Vulnerability assessment. This feature enables you to run searches to check whether vulnerabilities that are being exploited by hackers are present in your organization. You can view a list of vulnerabilities exploited in the wild here.
• Vulnerability assessment. The Available Patches list shows the number of affected computers. For details about affected computers in the organization, you can purchase or take a 30-day free trial of the Cytomic Patch module.
• Vulnerability assessment. To patch vulnerabilities on demand or on a recurring schedule and keep your network free of critical vulnerabilities, you can purchase or take a 30-day free trial of the Cytomic Patch module.
• Audit mode. In a Workstations and Servers settings profile, you can enable Audit mode to detect and report malware, ransomware, and other types of attacks. However, detected threats are not blocked or deleted. Computers in Audit mode are shown as computers at risk because they are not protected. They are simply audited. Audit mode supports Windows, macOS, and Linux workstations and servers.
• On the Audit mode. We recommend you use this mode only if you are evaluating our endpoint security solutions or if you are evaluating the security status of a customer protected with another solution.
• You can filter the Audit mode. In Audit mode, the solution detects the hardware and software installed on each computer, malware, PUPs, exploits, vulnerabilities, etc. To prevent malicious software from running and performing any action, you must disable Audit mode.
• If Audit mode is enabled in the workstations and servers settings profile applied to a computer, the security software does not register as an antivirus with Windows Security Center (WSC) and does not disable the Windows Defender antivirus protection.
• Network attack protection. New protection technology for Windows that scans network traffic in real time to detect and stop threats. It prevents network attacks that attempt to exploit vulnerabilities in services that are open to the Internet and in the internal network. To view the network attacks detected by this protection, click here.
• Network attack protection. You can configure this protection in the Advanced Protection section of a Workstations and Servers settings profile. The default action is Block, although you can also set it to Audit. If this protection is disabled or in Audit mode, the computer appears as at risk.
• Network attack protection. New Network Attack Activity widget that shows the number of incidents and computers with network attack activity.
• Network attack protection. If needed, you can exclude the detection of a specific network attack on all computers in the organization, as well as network attacks that originate from a specific IP address or IP address range.
• Network attack protection. You can send email alerts when network attack protection detects a network attack.
• Network attack protection. Network attack detections are included in executive reports.
• Threat Hunting Service. The Indicators of Attack (IOA) Mapped to the MITRE Matrix widget now includes the MITRE sub-technique, along with the tactic and technique (TTP). This information enables you to identify the phase of an attack and provides you with customized response recommendations to take containment and remediation actions with the required urgency.
• Threat Hunting Service. Advanced IOAs. We have added new advanced IOAs. Advanced IOAs provide in-depth monitoring of the applications on your computers, detect suspicious behavior, and determine if the event is an IOA. Compared to other types of IOAs, the probability that the actions that trigger an advanced IOA are a confirmed attack is lower. Advanced IOAs must be investigated. Advanced IOAs are available only for Windows systems.
• Threat Hunting Service. Advanced IOAs. Just like other types of IOAs, advanced IOAs are included on the various widgets in the “Indicators of attack (IOA)” dashboard.
• Threat Hunting Service. Activity tab. The details page for an advanced IOA includes an “Activity” tab that shows all events that triggered the detection. This shows the sequence of steps taken by the malicious software and enables you to confirm or dismiss the attack.
• Threat Hunting Service. Advanced IOAs settings. We have added the ability to enable and disable advanced IOAs in the “Indicators of Attack (IOA)” settings. You can enable and disable these IOAs globally and individually through the appropriate toggles
• Enriched events sent to the SIEM platform. Provided you have the Cytomic SIEMConnect module, this new release provides you with information about indicators of attack (IOA) as well as the MITRE tactic and technique associated with each IOA.
• Settings profiles set by partners. Partners can define whether the settings profiles assigned to customers from the partner’s multi-customer console can be editable. Editable settings profiles enable you to add exclusions and authorized software to the settings. However, you cannot delete or edit the list of exclusions or authorized software defined by the partner.
• Ability to configure multiple proxies. You can configure multiple proxies so that computers on the network connect to the Internet through the first proxy computer that works. This feature is now supported by macOS workstations and Linux servers as well as on Windows.
• Support for these Linux distributions: Ubuntu 22.10 and 23.04, Linux Mint 21.1, Fedora 36, 37, and 38, Oracle Linux 8 UEK R7, 9.0, 9.1, and 9.2, Red Hat Enterprise 8.8 and 9.2, AlmaLinux 8.8 and 9.2, and Rocky Linux 8.8 and 9.2. Information about all supported Linux distributions. Requires Linux protection version 3.03.00.0001 or higher.
• Performance improvements on macOS computers. Improved boot time. Faster startup speed for applications that require thousands of files be opened to work. Requires macOS protection version 3.03.00.0001 or higher.
• Login Items permission on macOS Ventura. On macOS Ventura 13 systems, you must grant the security software the Login Items permission to run correctly after a reboot.
• Insights and Data Watch. More modern, intuitive, user-friendly user interface. New colors for color-blind users. Reduced visual noise. Some sections have been moved to sub-tabs. Better contrast. Improved spacing. Fewer icons. Horizontal scroll bars always visible. Some items are responsive to fit the screen size. Changes to domain navigation. Redesigned modal dialog boxes for warning and notification messages. More intuitive action buttons.
• We no longer ask users to grant the “Disable App Hibernation” permission when the app is installed on an MDM profile in Device Owner or Work Profile mode. Requires Android protection version 3.8.14 or higher.
• We have fully adapted the Android app to support Android 13 natively. Requires Android protection version 3.9.3 or higher. Previous versions of our Android protection also work on Android 13, but in compatibility mode.
• New permission required (“Show Notifications”) to show notifications to users on Android 13 or higher. Requires Android protection version 3.9.3 or higher.
• We have added a new privacy policy and a new notification describing how we collect, use, and share the data processed by the app, and how to access it. This information appears the first time that you run the Android app. You can also access it from the About screen. This change applies to Android protection version 3.9.3 or higher.
• Removed link in the wizard to add Android protection in the customer account. The link pointed to a website where you could create a customer account. This could affect compliance with the Google account deletion policy.
• Full Encryption. Added support for macOS Catalina or higher. macOS computer encryption leverages FileVault technology included in the operating system. Encryption runs in the background. There is no impact on performance.
• Full Encryption. When you enable macOS computer encryption in the settings, the computer user is prompted to enter administrator credentials for encryption to begin. All hard disks on the computers are encrypted. On computers already encrypted with FileVault, the user is also prompted to enter administrator credentials to generate recovery keys.
• Full Encryption. Recovery keys for macOS computers are managed centrally from the console. These keys are requested after a number of failed login attempts or when the encrypted drive is removed from the computer and an attempt is made to use it on another computer.
• Full Encryption. You can now see the encryption status of Windows as well as macOS computers on dashboards and in lists.
• Full Encryption. Just like Windows computers, macOS computers are not decrypted when Full Encryption licenses expire or the software is uninstalled.
• Full Encryption. This module requires as many licenses as computers are encrypted with Windows BitLocker and macOS FileVault technologies.
• MacOS device isolation. You can now isolate macOS computers as well. Just like Windows computers, isolated macOS computers allow only our processes to communicate. If an attack occurs, you can isolate the computer from the network to prevent the spread of the threat. If required, you can exclude other processes to allow them to communicate on isolated computers. Requires macOS protection version 3.04.00.0000 or higher.
• To improve anti-tamper protection, we have added the ability to enforce two-factor authentication (2FA) when users access the local console installed on their computers or to uninstall the protection software on a computer. 2FA relies on a single QR code you can generate for all computers in a customer account or multiple codes if you want to have different authenticator factors for different areas. Requires Windows protection version 8.00.22.0023 or higher.
• You can enable protection when Windows computers start in Safe Mode with Networking to prevent hackers from taking advantage of this boot mode to spread their attacks across the network. This setting is enabled for default, but you can disable it from the web console and from the local console. Requires Windows protection version 8.00.22.0023 or higher.
• You can now send executable files larger than 50 MB to Collective Intelligence platform for analysis. These files do not contain personal details. This improvement enables our Zero-Trust Application Service to classify large files more accurately.
• Patch Management. Ability to filter the list of available patches by patch release date.
• Patch Management. We have added new columns to the installation history export file to provide more information about the tasks that installed the patches shown in the list.
• Patch Management. New text for the message that appears on user computers when a reboot is required to install a patch. The text indicates that the reboot is requested by the patched software, not by our security solution.
• Ability to select all unprotected computers discovered from the list of computers discovered.
• Ability to download signatures over HTTPS.

Bug fixes

• The solution now shows detections made by the decoy files technology in the local console reports.
• The solution now shows detections made by anti-exploit technology in the blocked items counter in the local console.
• We have fixed vulnerabilities in our security software. Requires Windows protection version 8.00.22.0010 or higher.
• Fixed issue where the solution did not identify the operating system correctly when it was installed on a server in a Virtual Desktop Infrastructure (VDI) environment.
• Fixed issue to avoid BSOD errors in the firewall technology in rare cases where there is a timeout error because there is no network traffic.
• Fixed issue to cancel the installer when there are Windows Update updates in progress.
• Fixed issue where path exclusions that include special characters did not work on macOS computers. Requires macOS protection version 3.03.00.0001 or higher.
• Fixed issue where local alerts were not shown on macOS computers.
• Fixed issue with the Network Extension (NEXT) used on macOS computers. Requires macOS protection version 3.03.00.0001 or higher.
• Fixed issue on macOS Catalina where the Network Extension (NEXT) enabled by a user did not enable for other users of the computer.
• Fixed issue on macOS computers when URL Filtering was enabled. When you connected to a computer using AnyDesk, a warning message appeared that indicated the URL https://AnyDesk was “Uncategorized” and the connection was cut. Requires macOS protection version 3.03.00.0001 or higher.
• Fixed issue loading the scan engine on Linux computers with version 9 of CentOS, Red Hat, Rocky Linux, and AlmaLinux when SELinux is running in Enforcing mode (there were no issues in Permissive mode). Requires Linux protection version 3.03.00.0001 or higher.
• Fixed issue on Linux that prevented access to our collective intelligence when you connected through Blue Coat ProxySG or FortiProxy devices. Requires Linux protection version 3.03.00.0001 or higher.
• Fixed issue to avoid random BSOD errors in the PSINProt.sys driver. Requires Windows protection version 8.00.22.0013 or higher.
• Improved protection upgrades to better keep the settings defined in a previous version.
• Improvements to minimize the possibility that the protection service crashes. Requires Windows protection version 8.00.22.0013 or higher.
• Fixed issue that caused a memory leak in a firewall driver. Requires Windows protection version 8.00.22.0013 or higher.
• Fixed issue to enable the operating system, the backup software, and other applications to create shadow copies on drives other than system drives. Our protection did not allow this to prevent ransomware from deleting shadow copies. Requires Windows protection version 8.00.22.0013 or higher.
• Improved creation of decoy files to prevent Windows Defender from detecting them as malware on servers. Requires Windows protection version 8.00.22.0013 or higher.
• Fixed issue in the RDP protection that detects and contains brute-force attacks on RDP. This issue affects customers with Windows protection version 8.00.22.0012 and is fixed in version 8.00.22.0014 and higher.
• Fixed issue that caused the solution to not show pop-up notifications when malware was detected on macOS computers under very specific circumstances. Requires macOS protection version 3.03.00.0001 or higher.
• Improvements to the communications agent to process corrupt messages. Requires Windows agent version 1.21.02.0000 or higher.
• Fixed issue to correctly get Active Directory paths with computer names longer than 15 characters. Requires Windows agent version 1.21.02.0000 or higher.
• Cytomic Patch. Added a prompt for users to enter their password when installing operating system patches for macOS with ARM (M1 and M2). Requires macOS agent version 1.21.02.0000 or higher.
• Fixed issue where the protection service crashed when the Decoy Files technology was enabled and the computer had directories whose name was in Greek. Requires Windows protection version 8.00.22.0014 or higher.
• Fixed issue that caused a memory leak in the PSINReg.sys driver and could lead to a BSOD error. Requires Windows protection version 8.00.22.0014 or higher.
• Fixed issue where scheduled reports did not include details of available patches.
• Fixed issue where, when you installed certain Windows operating system patches, the solution did not show the result of the installation task.
• Fixed issue where, when you excluded a network attack performed from certain IP addresses, these were lost when you added another exclusion for the same attack performed from other IP addresses.
• Fixed issue where executive reports showed an incorrect date and time in IOA-related information.
• Fixed issue that caused an increase in memory usage by the PSANHost process and led to increased CPU usage by the service.
• Improvements so that our security software registers correctly with Windows Security Center (WSC) after an operating system upgrade.
• Fixed issue to improve loading of some specific web pages. This bug affects version 8.00.22.0010 or higher of the Windows protection and is fixed in version 8.00.22.0022 or higher.
• Correction of Japanese texts in the local console installed on endpoints. Requires Windows protection version 8.00.22.0022 or higher.
• Fixed issue on Android devices so that we prompt users to grant necessary permissions not yet granted to the app every 24 hours.
• Fixed issue that prevented macOS computers from connecting to a VPN when you enabled network access enforcement (VPN enforcement). Requires macOS protection version 3.03.00.0001 or higher.
• Fixed issue that caused network extensions on macOS computers to stop working, and a message indicating that required privileges had not been accepted appeared. Requires macOS protection version 3.03.00.0001 or higher.
• Fixed issue that caused the local console to stop working on macOS computers when the protection software scanned paths and files that contained special characters or emojis. Requires macOS protection version 3.03.00.0001 or higher.
• Performance improvements. Goodware items are now correctly added to the cache to optimize scans at the next program execution. Requires macOS protection version 3.03.00.0001 or higher.
• Fixed issue by which, when you created a list of patches and sorted it by computer, an error occurred if you tried to access a patch details.
• Fixed issue by which, when a patch description contained the + sign, no information appeared when you accessed the patch details.
• Fixed issue by which. if an Exchange server connected to the Internet through a Panda proxy, anti-spam scans did not work.
• Fixed issue by which, when you disabled advanced protection, features that depended on advanced protection, such as Anti-exploit or Network Attack Protection, were not disabled.
• Fixed issue by which, when you searched the network for unprotected computers, the search results returned protected computers whose name did not match the name in the list.
• Fixed issue by which antivirus exclusion were not applied to the Decoy Files technology. Requires Windows protection version 8.00.22.0023 or higher.
• Fixed issue in URL filtering to classify web pages in IPv6 environments. Requires Windows protection version 8.00.22.0023 or higher.
• Fixed issue that caused a BSOD error when the server exceptionally generated malformed network packages. Requires Windows protection version 8.00.22.0023 or higher.
• We have updated the zlib version to fix vulnerabilities in the previous version. Requires Windows protection version 8.00.22.0023 or higher.
• Fixed issue that caused a memory leak with Data Control and customer-defined filters. Requires Windows protection version 8.00.22.0023 or higher.
• Performance improvements on virtual servers. Requires Windows protection version 8.00.22.0023 or higher.
• Fixed a vulnerability in the pskmad_64.sys driver that could enable an attacker with Administrator privileges to run code with SYSTEM privileges on the target computer. For more information, click here. Requires Windows protection version 8.00.22.0023 or higher.
• Fixed issue that affected immediate and scheduled scans in progress when you shut down a laptop by closing the lid and started it by lifting the lid. This fix requires macOS protection version 3.04.00.0000 or higher.
• On Mac computers with low resources, web browsing slowed down and access could be allowed to URLs you had blocked through the URL filtering feature. This fix requires macOS protection version 3.04.00.0000 or higher.
• Fixed issue on iOS devices so that the time slots you configure in the URL filtering feature also apply to the lists of allowed and denied URLs. This fix requires iOS agent version 2.01.17.0006 or higher.
• Fixed issue on iOS devices so that the new URL categories added to the URL filtering feature are handled correctly and are not treated as unknown URLs. This fix requires iOS agent version 2.01.17.0006 or higher.
• Fixed issue on iOS devices to report the threat type correctly when phishing URLs are detected and blocked. This fix requires iOS agent version 2.01.17.0006 or higher.
• Fixed issue in the anti-theft protection for iOS so that the alarm sound is the correct one and calls can be made to the phone number specified in the remote alarm feature. This fix requires iOS agent version 2.01.17.0006 or higher.
• Fixed issue that caused a memory leak with connections over port 8180 of the Java application. This could cause the server to run out of memory. This fix requires Windows protection version 8.00.22.0024 or higher.
• Fixed issue by which the URL filtering feature did not prevent access to URLs configured as denied. For example, Facebook or YouTube pages. This fix requires Windows protection version 8.00.22.0024 or higher.
• Fixed issue that caused a rare BSOD error due to the pskmad.sys driver. This fix requires Windows protection version 8.00.22.0024 or higher.
• Improvements to the protection software upgrade process to prevent rare BSOD errors when a driver cannot be stopped. This fix requires Windows protection version 8.00.22.0024 or higher.
• Fixed issue so that AMSI detection technology respects the path exclusions configured in the protection software settings. This fix requires Windows protection version 8.00.22.0024 or higher.
• Improvements to prevent high CPU usage during computer startup when the Shadow Copies feature is enabled. This fix requires Windows protection version 8.00.22.0024 or higher.
• Fixed issue so that URL filtering local alerts can be disabled. This fix requires Windows protection version 8.00.22.0024 or higher.
• Fixed issue to minimize the cases where the protection appears with an error status. This fix requires Windows protection version 8.00.22.0024 or higher.
• Fixed issue that caused isolated computers to show alert messages despite the option to not show alerts was selected. This fix requires v8.00.0022.0025 or higher.
• Fixed issue for computers that showed a protection software error on the Status tab. This fix requires v8.00.0022.0025 or higher.
• Fixed issue that stopped the service during upgrades. This fix requires v8.00.0022.0025 or higher.
• Fixed issue to prevent the ‘Registry modifications to run when Windows starts’ advanced policy from affecting the protection software system tray icon. This fix requires v8.00.0022.0025 or higher.
• Fixed issue to prevent BSOD errors caused by the protection for POP3/SMTP email over IPv6. This fix requires v8.00.0022.0025 or higher.
• Fixed issue to prevent a rare BSOD error caused by the NNSSTRM.sys driver. This fix requires v8.00.0022.0025 or higher.
• Fixed issues resolving the criteria defined for trusted networks in the Panda Endpoint Security firewall protection settings for networks detected automatically. This fix requires v8.00.0022.0025 or higher.
• Performance improvements for multi-user environments such as RDS environments. This fix requires v8.00.0022.0025 or higher.

Agent and protection versions

• Windows protection: 8.00.21.0005
• macOS protection: 2.00.10.1000 y 3.02.00.0000 para Catalina, Big Sur, Monterey and Ventura
• Linux protection: 3.02.01.0002
• Android agent and protection: 3.8.12
• iOS agent and protection: 2.01.16.0006
• Windows agent: 1.20.00.0000
• macOS agent: 1.11.03.0000
• Linux agent: 1.11.04.0002

New features

• In order to continue with our strategy to differentiate WatchGuard’s strategic products, Cytomic EPDR will now be called Advanced EPDR.
• Risk assessment. New dashboard for monitoring risks on managed computers. It includes four graphs showing the risk level for each computer in the organization, the risk trend, the most detected risks, and the top 10 computers at risk. We recommend that you manage risks to reduce the attack surface.
• Risk assessment. New “Risks” settings which enable you to specify the risk factors you want to detect on computers. You can disable each factor to avoid detection. Also, we recommend a risk level for each factor, which you can change based on your needs.
• Risk assessment. The risk factors that are detected automatically are: computer protection status, inadequate settings, and detection of indicators of attacks (IOA). For customers who have the Cytomic Patch module, the solution also detects whether there are critical patches pending installation.
• Risk assessment. The details page for each laptop, desktop, server, or mobile device now includes risk information, including the overall risk status.
• Risk assessment. New lists detected risks and risks by computer.
• Risk assessment. You can now include risk information in the executive report.
• Remote control (Windows). New “Remote control” settings that enable you to configure the remote control features that are available for the Windows computers the settings are applied to.
• Remote control (Windows). Command terminal (remote shell) and tracking of the commands typed by the administrator using the terminal.
• Remote control (Windows). List of running processes on the computer, with the ability to stop processes.
• Remote control (Windows). List of services on the computer. It enables you to stop and start services.
• Remote control (Windows). Transfer of files to or from the remote computer.
• Remote control (Windows). Sometimes, when you updated the remote control module, an error occurred and the protection generic uninstaller was launched, causing an unnecessary reboot of the computer.
• Remote control (Windows). After you installed the remote control module, the module internal configuration file was backed up before its content was encrypted.
• Discovery of unmanaged computers through Active Directory. Discovery computers can access up to three Active Directory servers to find computers registered in Active Directory. Unprotected computers found in Active Directory appear in the list of unmanaged computers discovered. You can remotely install the protection on those unmanaged computers from the web console.
• Discovery of unmanaged computers using Active Directory. In the list of unmanaged computers discovered, the computers you find using Active Directory show the Active Directory path where they are located.
• As of this version, the Active Directory path appears for macOS and Linux computers.
• The installation page for macOS and Linux computers now includes the "Add computers to their Active Directory path” option.
• The "Move to Active Directory path" option is now available for macOS and Linux computers.
• Automatic deletion of computers. On the ”Computer maintenance” page, you can configure VDI environments and now also automatically delete computers based on a filter. All computers that meet the criteria in the filter are automatically deleted daily. Deleted computers that reconnect to our platform reappear in the web console.
• Automatic deletion of computers. Only users with full visibility of the account and the “Add, discover, and delete computers” permission can modify these settings. Deletions are tracked in the “System events” section.
• Source IP address. The “Malware activity”, “PUP activity”, and “Currently blocked programs being classified” widgets on the “Security” dashboard now show when a computer visible to you is infected after a file was copied from another computer on the network. The information includes the IP address of the computer where the infection originated.
• We have added these categories to the URL filtering feature:
  
  
  1. Collaboration Office – Apps
  
  
  2. Collaboration Office – Documents
  
  
  3. Collaboration Office – Drive
  
  
  4. Collaboration Office – Mail
• On the Cytomic Patch dashboard, an Available patches trend graph shows the number of patches that are available for installation on the computers on the network, over time (seven days, one month, one year). This information also appears for individual computers, on the “Detections” tab of the computer details page.
• You can filter the Available patches trend graph by computer type (laptop, workstation, and server) and patch type (operating system patches and app patches).
• Cytomic Patch. In the Available patches list, you can export trend data about patches pending installation to a file for further analysis.
• Cytomic Patch. The Available patches trend graph is now included in the executive report.
• Cytomic Patch. In the Restart options section of an install patches task, you can now specify the maximum time that the system waits before it forces a restart on the computer to complete the installation of the patch (the default time is 4 hours). You can restart immediately when the task is scheduled or delay the restart up to 7 days.
• You can now export tasks in the account to a file to easily identify tasks in progress, affected computers and groups, etc.
• You can filter the task list by task status (No recipients, In progress, Finished, and Canceled).
• When you copy a task, you can copy its settings with or without the recipients.
• Integration with the VPN enforcement feature of WatchGuard’s Firebox solutions. Secure VPN is now available for computers with macOS. With Secure VPN, all VPN connections must meet specified security requirements before they connect to VPN networks.
• New tool for generating gold images on macOS and Linux systems. For more information, see this FAQ on how to create a gold image.
• Better integration with Windows Security Center (WSC) in Windows 11. The process that communicates with WSC is protected at all times with ELAM to meet a future requirement of Windows 11 22H2.
• Support for macOS Ventura, the newest version of macOS. It requires macOS protection version 3.02.00.0000 or higher.
• Support for the CentOS Stream, Alma Linux and Rocky Linux Linux distributions. Support for new versions of the supported distributions. Details about all supported Linux distributions. It requires Linux protection version 3.02.00.0000 or higher.
• Performance improvements on Linux servers with high workload. It requires Linux protection version 3.02.00.0000 or higher.
• Computers list. You can now export a simplified computer list that does not include configuration details.
• In the filter tree, you can now search filters by name.
• Improved anti-tamper protection for Windows to prevent our files from being deleted through registry modifications that run when the computer starts. It also prevents changes to our process permissions. It requires Windows protection version 8.00.21.0000 or higher.
• Updated third-party libraries to fix vulnerabilities in them. It requires Windows protection version 8.00.21.0000 or higher.
• The Linux agent service now restarts automatically after a crash.
• The core files created by the Linux protection and agent are automatically deleted so that they do not take up all disk space. The oldest files are deleted until there is at least 1 GB of free disk space.
• Ability to use the Snap the Thief feature even for locked devices. Requires version 3.8.10 or higher of our app for Android.
• New permissions required for our app for Android: Ignore Battery Optimizations and Disable App Hibernation.
• To comply with Google’s security policies, we have removed the feature to automatically install Android apps from unknown sources. These apps were installed after being scanned.
• Access to our knowledge base for URL filtering on HTTPS. Requires version 2.01.16.0006 or higher of our app for iOS.
• We have improved log generation to speed up incident resolution. Requires version 3.8.10 or higher of our app for Android.
• Logs are more detailed to speed up incident resolution. Requires version 2.01.16.0006 or higher of our app for iOS.
• Fixed issue to stop requesting users to disable the "App Hibernation" permission on devices running Android 12 or higher when the security app is installed on a managed profile (work profile).

Bug fixes

• Fixed issue where, when a decoy file was opened exclusively, the solution detected it as write. This led to false positives with Office 365 and certain backup programs.
• Fixed issue where decoy files were identified as Office files and were continuously synced with OneDrive. We have made changes to minimize this.
• We have optimized the Decoy Files module to resolve performance issues on servers with many concurrent users. It requires protection version 8.00.21.0004.
• Fixed an issue where there was a protection service outage with paths that exceed the maximum length allowed by the operating system. It requires protection version 8.00.21.0004.
• Fixed an issue with the mv.sig signature file that caused slowdowns on certain servers.
• Fixed a vulnerability that had the ability to modify the behavior of the security software in specific situations to delete files on the affected computer. It requires protection version 8.00.21.0004.
• Fixed an issue to avoid potential BSOD errors on computers with the FSLogix application installed. It requires protection version 8.00.21.0004.
• Fixed an issue that prevented the creation of firewall rules on servers. It requires protection version 8.00.21.0004.
• Fixed an issue with the VMware VMXNET3 adapter, where files copied over the network were modified (SMB). It requires protection version 8.00.21.0004.
• Fixed an issue with the Linux agent, where the protection could not be updated.
• Fixed an issue with the Linux agent, where there were continuous errors when the event queue became full.
• We have optimized the tasks performed by the Linux agent to not affect performance on servers with thousands of active sessions.
• Fixed issue to avoid BSOD errors when you run Sandbox on Windows.
• Fixed issue that caused increased CPU usage on certain computers, mainly Windows servers.
• Fixed issue that caused, in specific situations, the URL Filtering feature not to block URLs belonging to denied categories.
• Fixed issue to avoid BSOD errors in the firewall technology when inconsistent network packets were received.
• Fixed issue to avoid losing the ability to communicate in real time with isolated computers.
• Fixed issue so that, if there is an error in some data in a report, the error is dismissed and all other information in the report is sent.
• Fixed issue with version 3.01 of the macOS protection that caused systems to stop responding when Time Machine Incremental backups were performed in the background.
• Fixed issue with the macOS protection by which when there was an upgrade to Catalina, the EndpointProtection Network driver of the previous version was kept.
• Fixed issue that caused crashes when you scanned macOS Catalina systems on demand.
• When you tried to install the protection on a Red Hat Enterprise Linux 6.7 (Santiago) server, an error occurred and the installation was canceled soon after it started.
• Ability to change the recipients of a recurrent task (scan or patch installation tasks).
• Now you can filter the hardware inventory list by any operating system we support (Windows, macOS, Linux, Android, and iOS). The exported information contains data from all systems.
• If a machine communicated using the IPv6 protocol, the console showed only the first numbers in the IP address, but not the full IP address.
• If you had the “Add, discover, and delete computers” permission only and tried to add a discovery computer, the action was not allowed.
• Fixed issue when updating Windows Defender signatures with Cytomic Patch.
• On Linux systems, we were reporting as malware behaviors that we were monitoring but were not confirmed malware.
• Fixed issue on Linux systems that caused errors in the psanhost process.
• Fixed issue that occurred when you enabled certain categories in the URL filtering feature for iOS devices. We have excluded our processes from URL scans to avoid blocking URLs required for the correct operation of our protection.
• Fixed issue in the iOS protection to always allow URLs belonging to domains ending in “.apple.com” and “.icloud.com”.
• Fixed issue to prevent temporary disruptions of the protection service from affecting other sessions with logged-in users. It requires protection version 8.00.21.0005.
• The Decoy Files technology has been optimized to not regenerate decoy files in closed remote desktop sessions. It requires protection version 8.00.21.0005.
• Fixed issue that occurred on certain devices when you scanned the QR code to install and integrate our app for Android.
• Fixed issue to request geolocation permissions when required. Requires version 2.01.16.0006 or higher of our app for iOS.
• Fixed issue to request permission to send notifications when required. Requires version 2.01.16.0006 or higher of our app for iOS.
• Fixed issue in the installation wizard for iOS devices, so that the Installation Complete screen is always shown.
• Fixed issue in the Web Access Control feature for iOS devices when multiple web pages were blocked. Requires version 2.01.16.0006 or higher of our app for iOS.
• Fixed issue to stop requesting users to disable the "App Hibernation" permission on devices running Android 12 or higher when the security app is installed on a managed profile (work profile).

Agent and protection versions

• Windows protection: 8.00.20.0001
• macOS protection: 2.00.10.0000 y 3.01.00.0000 para Catalina, Big Sur y Monterey
• Linux protection: 3.01.00.0003
• Android agent and protection: 3.7.0
• iOS agent and protection: 2.01.11
• Windows agent: 1.19.01.0000
• macOS agent: 1.10.12.0001
• Linux agent: 1.10.10.0001

New features

• Support for iOS devices. You can centrally manage smartphones and tablets running iOS 13 or higher to work and browse safely. Requirements for installing the solution on iOS devices.
• The protection for iOS mobile devices is called WatchGuard Mobile Security. The iOS app is customized based on the platform where your solution is integrated (Panda, Cytomic, or WatchGuard).
• Anti-theft module for iOS devices with the following features: geolocation, remote wipe, remote lock, snap the thief, and remote alarm in the event of theft or loss of the device.
• URL filtering for iOS devices. Ability to deny access to pages belonging to tens of categories on the selected days at the selected times. Ability to add URLs to the allowlist or blocklist. Requires that the iOS device be in supervised mode. The product guides provide steps for enabling supervised mode.
• Web protection for iOS devices. Ability to filter malicious URLs and phishing. Requires that the iOS device be in supervised mode. The product guides provide steps for enabling supervised mode.
• Hardware and software inventory for iOS devices. This information is available in the web console.
• You can install the iOS protection with the MDM solution incorporated onto our platform. This is the recommended option because it enables all features. You can also install it without an MDM solution, in which case only the following features are available: geolocation, remote alarm, and hardware inventory.
• You can also install the iOS protection with a third-party MDM solution, that is, with the MDM solution already used by your organization. In this case, only the following features are available: geolocation, remote alarm, hardware inventory, web protection, and URL filtering. For more information about how to install our iOS protection using your organization’s MDM solution, see the product guides.
• The protection for Android mobile devices is called WatchGuard Mobile Security from version 3.7.0. The app icon and name always indicate WatchGuard Mobile Security. For Android 11 or higher, the app is customized based on the platform where your solution is integrated (Panda, Cytomic, or WatchGuard).
• If the end user does not grant all permissions required to enable the protection features on iOS and Android mobile devices, an error message appears on the device details page. Information about the permissions that have not been granted is also provided in the protection status section.
• You can centrally manage Shadow Copies from the product web console. Shadow Copies is a technology included in Microsoft Windows that enables you to restore previous versions of files. This feature is particularly useful in the event of a ransomware infection. It is supported on Windows Vista or higher and Windows Server 2003 or higher. Requires Windows protection version 8.00.20.0001 or higher.
• You enable the Shadow Copies feature from the product web console. You can specify the percentage of disk space you want to dedicate to shadow copies (10% by default).
• When the Shadow CopiesCopies feature is enabled, Windows creates a shadow copy every 24 hours. The Panda software retains up to 7 copies at a given time.
• The Shadow Copies feature is protected against ransomware attacks by our anti-tamper protection. Ransomware can delete all backup copies on affected devices before encrypting all files on the system.
• We have incorporated Decoy Files technology to detect attacks based on behavior. This technology detects changes to files stored on computers as bait. Requires Windows protection version 8.00.20.0001 or higher.
• We have added deep learning technologies as an additional machine learning technique in the protection model. Requires Windows protection version 8.00.20.0001 or higher.
• Integration with the VPN enforcement feature of WatchGuard Firebox solutions. Secures VPN access from computers with our protection installed and running.
• New optimized protection for macOS computers with a Catalina operating system or higher. Includes a new local console and uses Network Extension technology to intercept network traffic. This new technology replaces SQUID, which has been removed in our macOS protection (version 3.00.00.0000 or higher).
• The new macOS protection (version 3.00.00.0000 or higher) for computers running Catalina or higher can also intercept traffic when connected via VPN, so web protection and URL filtering are available when using any VPN.
• You must allow the new Network Extension technology included in our protection on all macOS computers. You need to allow it the first time that it is installed, or when we update the macOS protection to version 3.00.00.0000 or higher. For more information about the required permissions, click here.
• You can now select the type of device where you want to run scan tasks: laptop, workstation, server, or mobile device.
• You can now select the type of device where you want to run patch installation tasks: laptop, workstation, server, or mobile device.
• We have added a new column to the list of detections made by the antivirus. This column shows the number of detections of the reported attack.
• If an error occurs installing the Linux and macOS protections, detailed information is shown in the protection status section.
• The protection status section shows information about the status of the advanced protection for Linux systems.
• Ability to export, sort, and filter the list of users with access to the product web console. This feature improves efficiency when you manage accounts with tens or hundreds of users. Relevant information is included, such as user role or 2FA enforcement.
• The computer details page now shows the public IP address of the device (Windows, macOS, Linux), even of mobile devices.
• Cytomic Patch. New tile with information on computers with most vulnerabilities. You can filter the information in the tile by criticality, computer type, and patch type (operating system patches or third-party software patches).
• Cytomic Patch. New tile with information on most available patches for computers in the organization. You can filter the information in the tile by criticality, computer type, and patch type (operating system patches or third-party software patches).
• Cytomic Patch. The number of computers that are pending a restart to finish installing patches is shown in the main tile on the Cytomic Patch dashboard.
• Cytomic Patch. New filter that shows operating system patches and third-party software patches. This filter is available from the available patches and installation history lists.
• Cytomic Encryption. Ability to search for recovery keys by using the encrypted device ID. These searches are particularly useful for USB devices (it is easy to forget on which computer they were encrypted), and computers that are difficult to identify.
• We have improved the process to validate the certificates required to communicate with certain domains safely. Requires Windows protection version 8.00.20.0001 or higher.
• We have improved the anti-tamper protection by leveraging the ELAM (Early Launch Anti-Malware) technology included on Windows 10 and Server 2019 or higher operating systems. Requires Windows protection version 8.00.20.0001 or higher.
• We have limited the list of detections made by the Device Control module to the last seven days to speed up data loading.
• We have optimized the Linux protection performance. Linux protection version 3.01.00.0003 and higher include multiple performance improvements that are particularly noticeable on servers with heavy workloads.
• Support for the latest versions of the supported Linux distributions (Fedora 35, Red Hat 8.6, and Ubuntu 22.04). More information about all supported Linux distributions. Requires Linux protection version 3.01.00.0003 or higher.

Bug fixes

• Fixed a bug in scheduled scans on Android devices so that detections are reported only when the task runs correctly.
• Hardware and detected threats reports were not emailed when they had been modified by users with restricted privileges.
• When exporting the Computers list, if the user had read-only permissions, information for some computers was not exported.
• Cytomic Patch. Improved reporting of patch installation tasks on computers with an incorrect date and computers where the time was changed.
• In silent installations, the First Installation window appeared when there was a temporary error updating signatures.
• When you tried to install the protection with the option to update signature files disabled in the settings, the installation froze.
• Exclusions for the permanent protection now apply to Windows AMSI (AntiMalware Scan Interface) as well.
• Added significant performance improvements when opening Microsoft Access files.
• Fixed BSOD errors with inconsistent network packets.
• Fixed BSOD errors that occurred if you opened Outlook when scanning inconsistent network packets.
• Fixed a bug in the way URLs in blocklists were managed.
• Fixed a POP3 bug that prevented connections from being made when the email protection was active.
• IPv6 public IP addresses were not fully shown in the web console.
• If you installed patches that required a restart and user consent and several days went by without a response, when you tried to install new patches that required a restart, the communications agent crashed.
• If you installed the agent on an ARM-based Windows 11 Education computer, the protection failed to install.
• When you tried to install the protection on extremely slow computers, there was a double installation attempt which uninstalled the installed antivirus and caused an unnecessary restart.
• The new macOS protection (version 3.00.00.0000 or higher) for systems running Catalina or higher includes a new network interceptor that optimizes browsing speed and enables you to open URLs which, in TLS 1.3 connections, could not be opened with the SQUID technology.
• The new macOS protection (version 3.00.00.0000 or higher) for systems running Catalina or higher eliminates problems when you log in to online services such as OneDrive or Google Drive.

Agent and protection versions

• Windows protection: 8.00.19.0010
• macOS protection: 2.00.10.0000 and 2.00.10.1000 for Catalina, Big Sur, and Monterey
• Linux protection: 3.01.00.0001
• Android agent and protection: 3.6.7
• Windows agent: 1.18.02.0000
• macOS agent: 1.10.11.0000
• Linux agent: 1.10.10.0001

New features

• Support for Android 12.
• Support for Windows 11. Requires Windows protection version 8.00.19.0000 or higher.
• Support for Windows 2022. Requires Windows protection version 8.00.19.0000 or higher.
• Support for macOS Monterey. Requires macOS protection version 2.00.10.1000 or higher.
• Threat Hunting Service. New dashboard providing visibility into the indicators of attack (IOA) detected through the Threat Hunting Service included at no extra cost in our EDR products. Indicators of attack (IOA) are anomalous behaviors detected on computers which are very likely to belong to an attack. The continuous monitoring of the actions performed on computers enables us to provide this service. The dashboard contains different tiles with information about the IOAs detected, including a tile mapping the indicators of attack found on the network to the MITRE matrix.
• Threat Hunting Service. Direct access to extended information about an indicator of attack from its Details page. Click the MITRE, tactic and technique links to open the MITRE website with detailed information that helps remediate the attack and reduce the attack surface.
• Threat Hunting Service. Advanced attack investigation. Accessible from the Details page of an indicator of attack. This investigation automatically reports the compromised users and computers, helps determine the root cause of the attack, provides information such as the URLs and IP addresses involved in the attack, and gives a view of the overall impact of the attack on the entire organization.
• Threat Hunting Service. Attack graph. Accessible from the Details page of an indicator of attack. This view is a graphical display of all the items involved in the attack, aiding the investigation of the root cause of the attack, its impact, etc.
• Threat Hunting Service. New “Indicators of attack (IOA)” settings. Configure indicators of attack and select the action to take, set a list of trusted IP addresses, and disable any indicator of attack that is generating false positives on any computer in the organization.
• Threat Hunting Service. Added a new permission to roles to control who can modify indicators of attack settings.
• Threat Hunting Service. Added a new alert type to the “My alerts” settings to send email notifications when indicators of attack are detected.
• Threat Hunting Service. Added information about indicators of attack to executive reports.
• New Detections tab on the Details page of computers. This tab shows all detections, unpatched vulnerabilities, indicators of attack, etc. The information displayed depends on the contracted product and modules.
• Ability to cancel and delete multiple tasks in one step.
• More granular, flexible task scheduling You can schedule scans or patching tasks to run on any day of the week, on the last Friday of the month at the time you select, etc. There are many other options that make the task scheduling process more flexible. Especially suitable for installing patches through Cytomic Patch.
• Ability to delete blocked programs in the process of classification. Administrators can delete blocked programs from the list of blocked items. This option is useful when there are blocked files that could not be sent to the cloud because they are too large or are no longer available. The status of the file is shown in the list of blocked programs. All actions taken are logged in the activity log and in the history of blocked items.
• Ability to perform searches in the computer group tree.
• Ability to schedule the sending of a full or summary version of the lists that allow exporting detailed information (for example, the software inventory list).
• New column in the “Protection status” list. This column shows the status of computer communications with the Collective Intelligence platform servers and the servers used for URL classification. This feature is currently implemented for Windows computers.
• New column in the “Protection status” list export. This column shows the status of the advanced protection (Audit, Hardening, or Lock).
• The anti-exploit protection is now enabled and in Block mode by default. The anti-exploit protection settings created prior to this release are not modified, although it is recommended to enable the protection in all settings profiles.
• The advanced protection for Linux is now in Block mode by default. This way, all malicious actions detected by the behavior scanner are blocked, providing maximum protection.
• The contextual detections of the advanced protection for Linux are updated dynamically when necessary.
• Better integration with the Windows 10 AntiMalware Scan Interface (AMSI). The use of AMSI provides our solutions with telemetry and additional information about script and macro execution, improving protection without negatively impacting computer performance.
• Scanning of programs launched on Windows startup to make sure that all programs loaded in memory are trusted.
• Optimizations on the Web Access Control module cache to reduce cloud queries when classifying URLs.
• IPv6 traffic filtering for all protocols supported by the firewall technology incorporated into all our products.
• Ability to show notifications in the web console. These notifications are informational and are also used to notify customers of the availability of new versions, enabling them to upgrade their account to the latest version. Each user of the web console can disable the notifications they want, without affecting other users.
• Support for the latest versions of the supported Linux distributions (Fedora, Red Hat, CentOS, etc.). More information about all supported Linux distributions.
• Support for SUSE 11 SP2 and above, SUSE 12, and SUSE 15.
• Support for Oracle Linux 6.X, 7.X y 8.X.
• Monitoring of network events on Linux to get more context information for run applications. The final objective is to provide the EDR features included in the Linux protection with more visibility and therefore more detection capabilities.
• Improved process monitoring on Linux to enrich telemetry with more process execution data. This provides the EDR features included in the Linux protection with more visibility and therefore more detection capabilities.
• New parameter in the Linux agent installation to include proxy settings.
• Automatic upgrade of the Linux protection when necessary after an upgrade of the Linux kernel or distribution installed.
• Linux protection performance improvements applicable to very specific distributions where management of multiple threads was not optimal.
• When selecting “Custom range” in “Web access” lists, no data or incorrect data was returned. Now, it is not possible to select more than one month of data.
• The Exchange Server protection has reached its end of life (EOL) and is no longer available for new customer accounts. It will remain available for existing customers until June 2024 (End of Maintenance, EOM).
• Enabled IPv6 traffic scanning in the firewall technology.
• To optimize performance, Windows protection communications now use WinHTTP.
• Scanning of compressed files on macOS systems when you launch an on-demand or scheduled scan .
• “Snap the thief” feature on devices with Android 11 or higher. Because of system constraints, photos can be taken only when the screen is unlocked.
• New permission required (“All files access”) on devices with Android 11 or higher in order to scan external storage devices.
• Ability to select "Last 7 days" and "Last month" in the Cytomic Patch installation history so that partners can inform customers about the patches installed in the last 7 days or in the last month as part of the managed service provided to them.
• In Cytomic Patch, patches shared using cache computers can now be shared across network segments.
• Ability to set an expiration date for downloaded installers so that you can control their use.
• Ability to set exclusions by IP address or IP address ranges in the IDS module of the firewall protection. Requires Windows protection version 8.00.19.0010 or higher.
• On Windows Legacy operating systems (Windows Vista, Windows 7, and Windows Server 2008), only SHA-256 signed drivers are allowed. To install a protection version higher than 8.00.19.0001, the Windows Legacy operating system of the target computer must be up to date and compatible with SHA-256 driver signing. For more information, click here.
• The advanced protection classifies files included in MSI installers signed with a trusted digital signature as trusted files.
• Improved Anti-tamper protection by leveraging the ELAM (Early Launch Anti-Malware) technology included in Windows 10 and Server 2019 or higher operating systems.
• Included the last 4 digits in the protection and agent versions reported in the “About…” section of the local console on Windows devices.
• Cytomic Patch goes into EOL (End of Life) for the following operating systems: Windows XP, Windows Vista, and Windows Server 2003.

Bug fixes

• Fixed a bug to avoid BSOD errors with inconsistent DNS network packets.
• Fixed a bug to avoid BSOD errors under certain circumstances when using the “Automatically detect the network type” feature.
• When selecting the “All” filter in the list of blocked items, only items from the last month were shown. This has been fixed so that all items are shown.
• When a filter was created that included hardware and software fields, you could not select multiple computers.
• If protection upgrades were disabled in the settings, an upgrade error was displayed in the Details page of computers instead of indicating that upgrades were disabled.
• If there were multiple groups at the first level of the group tree and one of them was collapsed, the rest of groups appeared with no name.
• On the Licenses tab, if there was more than one license contract and any of them was close to expiring, it was incorrectly reported that all contracts were close to expiring.
• Clicking the VirusTotal link did not take you to the page for the specific malware but to a search page.
• After upgrading the protection and restarting the computer, the user was incorrectly prompted to restart their computer again to complete the upgrade.
• Windows 10 version 21H1 was not correctly detected.
• Sometimes, the Windows protection status was incorrectly reported in the web console for a short period of time.
• Fixed an issue starting the Windows protection service in very specific scenarios in some languages.
• The local alerts shown when a computer is isolated were displayed incorrectly when you customized the alert text.
• BSOD error restoring Active Directory on Windows systems.
• The macOS protection stopped starting if multiple errors occurred in a short period of time. From version 2.00.10.0000 of the macOS protection, the protection service starts correctly after multiple errors if it is started on demand or after restarting the computer.
• On Android devices with signature files older than one year, scans failed. Requires version 3.6.7 of the Android protection.
• On Android devices with Android 7 or lower versions, the signature file was not updated. Requires version 3.6.7 of the Android protection.
• In very specific situations, users were not prompted to enter the device name on Android systems.
• Performance improvements at system startup on Android devices.
• Windows 11 computers are now correctly identified as Windows 11 in the web console.
• Ability to install the protection on Windows 11 computers with an ARM processor (used on Surface devices and some specific laptops). Requires Windows protection version 8.00.19.0010 or higher.
• Fixed an issue that caused a BSOD error when you installed the NeuShield software. Requires Windows protection version 8.00.19.0010 or higher.
• Fixed an issue that caused a BSOD error when the SSL header of a message was fragmented into multiple network packets. Requires Windows protection version 8.00.19.0010 or higher.
• Fixed an issue in which the defined configuration was lost, leading to Internet connectivity loss, when you enabled the network discovery feature in the firewall.
• When you installed patches that required a restart, the pending restart notification never disappeared.
• When you created a weekly report, the dates shown in the report schedule were one day before the configured dates.
• The Automatic proxy discovery using Web Proxy Autodiscovery Protocol (WPAD) setting was not applied correctly.

Agent and protection versions

• Windows protection: 8.00.18.0003
• macOS protection: 2.00.08.0000 and 2.00.08.1000 for Catalina and Big Sur
• Linux protection: 3.00.00.0050
• Android agent and protection: 3.5.33
• Windows agent: 1.17.01.0000
• macOS agent: 1.10.08.0000
• Linux agent: 1.10.06.0050

New features

• Software authorization. Ability to configure, in the settings, rules that prevent the advanced protection for Windows from blocking unknown processes. Authorized software is continuously monitored and is prevented from running if classified as malware. Therefore, software authorization is a secure method to allow the execution of unknown processes. These rules can be based on the hash (MD5) or other attributes of files (digital signature, name, path, and version), which can be combined with each other.
• Software authorization. If exclusions are being used to prevent unknown processes from being blocked, we recommend that you move extension, file, and folder exclusions to software authorization rules. For security reasons, exclusions should only be used when it is necessary to avoid all kinds of scans due to performance problems or incompatibility with other applications.
• Software authorization. Added new permissions to user roles in order to allow users to configure or just view this feature.
• Minimize blocking of unknown processes. The new protection version includes a local goodware cache to prevent goodware (legitimate software) from being blocked in case the protected computer cannot connect to the Collective Intelligence platform.
• Removed the ability to unblock items reclassified as goodware as they are already unblocked.
• Windows on ARM. Compatibility with computers running this operating system included in Microsoft Surface devices and some laptops. Now, you can install our Windows protection on both Intel-based and ARM-based Windows computers.
• Windows on ARM. All features provided by our solutions work on this new operating system with the exception of the anti-exploit protection and Cytomic Patch, which works partially since patches for ARM-based operating systems are not detected; nevertheless, patches for third-party applications are detected.
• Windows on ARM. New ‘Windows ARM’ filter that shows computers with Windows on ARM.
• Support for Big Sur, the latest version of the macOS operating system, on Intel-based Macs. Requires version 2.00.07.100 or later of the macOS protection.
• Support for Big Sur, the latest version of the macOS operating system, on ARM Macs (M1). For our macOS protection to work on ARM-based Big Sur computers, Rosetta is used. This is a macOS emulator that enables ARM Macs to run Intel applications. Requires version 2.00.08.1000 or later of the macOS protection.
• Support for System Extensions on macOS. System Extensions is the latest standard recommended by macOS for execution interception. Systems Extensions were first introduced in Catalina.
• For the permanent protection to be active and running on macOS Catalina and later systems, Systems Extensions (SEXT) and Full Disk Access (FDA) must be enabled for our protection. If they are not enabled, the user will be reminded every 2 hours of the need to do so in order to be protected. For more details, see this FAQ.
• Improved scan times on macOS when performing on-demand or scheduled scans. Mapped network drives are not scanned. Also, the scanner is prevented from scanning the same file twice.
• Advanced protection on Linux systems. Added the ability to detect malicious activity on Linux systems using contextual detections. Contextual detections allow us to proactively detect and prevent malware and malwareless attacks.
• Advanced protection on Linux systems. Ability to change the configuration of contextual detections on Linux. New options are available (‘Do not detect’, ‘Audit’, and ‘Block’) in the ‘Detect malicious activity (Linux only)’ setting of the advanced protection. The default option is ‘Audit’ (malicious actions detected are not blocked), although we recommend that you change the setting to ‘Lock’ if, after some weeks, you see that the detections made by the advanced protection for Linux are malicious actions in all cases.
• Exclusions in the anti-exploit technology. If an exploit detection turns out to be a false positive, you can add an exclusion for the exploit technique detected in the affected program.
• Exclusions in the anti-exploit technology. Exclusions added to the anti-exploit technology are displayed in the ‘Programs allowed by the administrator’ widget, from where they can be deleted at any time.
• More details about exploit detections. This version shows the exploit technique in the list of detections and in the detection details. Also, the exploit technique links to a support article with additional information. Finally, the detected exploit’s activity graph is now displayed by default in hierarchical format.
• New URL filtering technology. Added a new URL filtering technology with new URL categories. The existing categories have been mapped to the new ones so that, after the version update, the old URL filtering capabilities are maintained, using the equivalent categories in the new technology. The new categories require that the latest version of the protection (8.00.18 or later) be installed.
• New technology for malicious URLs and phishing. The new version includes a new technology for detecting malicious URLs (‘Web browsing antivirus’ option in the Antivirus settings) and phishing. This new technology requires that the latest version of the protection (8.00.18 or later) be installed.
• New URL filtering technology The new URL filtering technology requires access to the following URL: https://rp.cloud.threatseeker.com. For more information about the URLs our solutions need to access, see this support article.
• Ability to customize local alert messages. Ability to enter a custom text that will be displayed in the local alerts shown when a computer is isolated, a detection is made, an unknown process is blocked by the advanced protection, or a program is blocked.
• Ability to disable the URL filtering local alerts Added an option to disable the local alerts shown by the Web access control feature (URL filtering) when access to an HTTPS page is blocked.
• Cytomic Data Watch. New policy for controlling writing to removable storage devices. Ability to allow write to removable storage devices (USB drives) only when the drive is encrypted with BitLocker. It is not necessary for the drive to have been encrypted with the Cytomic Encryption module.
• Cytomic Encryption. Removable storage drive encryption. Removable storage drive encryption using BitLocker. The authentication method supported is key authentication. All volumes on the same USB device are encrypted with the same key. Only used space is encrypted.
• Cytomic Encryption. Centralized management of removable storage drive encryption policies. Ability to configure USB drive encryption policies from the Cytomic management console. These encryption policies enable you to select on which machines the end user will be prompted to encrypt the USB drives connected to them.
• Cytomic Encryption. Centralized storage of recovery keys keys in the Cytomic console.
• Cytomic Encryption. Recovery key availability. Recovery keys are stored on the machine where the USB drive was encrypted. They are available in the computer details.
• Support for Android 11.
• On Android 11 and later, users cannot change the lock password through the protection. Therefore, when using the lock option, the password set on the device will be used.
• The Android protection only installs on devices with Android 5 or later.
• Improved permission requests on Android: users are asked to grant required permissions only when necessary.
• Improvements to the status information of Windows computers. The new version shows more accurate information about the status of protected computers.
• Now, a computer’s details page in the web console indicates if its settings have been temporarily modified by the administrator from the computer’s local console. A computer’s settings can be modified locally if the administrator knows the password configured in the ‘Per-computer settings.’
• Improved usability Ability to easily copy/paste to/from the clipboard any tags selected by the user in the settings.

Bug fixes

• Fix to the multiple selection feature in the list of duplicate machines. If the user tried to select all computers in the list of duplicate machines, in reality only one more computer than was displayed was selected, instead of all computers.
• Cytomic Patch. If some computers reported that a patch could not be installed, it was impossible to install it on any computer, regardless of whether the selected computers had all the information required for the patch to be properly installed.
• Cytomic Encryption Successfully encrypted computers reporting an “error” status did not show recovery keys in the console.
• Non-persistent virtual machines were not automatically deleted when the maximum configured number of machines was reached.
• Correct detection of virtual machines running under the QEMU emulator.
• Laptops connected to a dock are now correctly reported.
• Improvements to the status information of Windows computers. The protection has been improved in order to report the status of the protections installed on computers more accurately, even when the protection service is not responding.
• Fixed a bug to avoid blue screen of death (BSOD) errors if there are continuous restarts of the protection service.
• The communications agent was uninstalled when upgrading the version.Additional checks in the firewall technology to avoid double context flows that could cause a blue screen of death (BSOD) error.
• If the Power Nap feature of macOS systems was enabled, the protection sometimes reported an incorrect status. This could generate an email alert informing of an incorrect status of the protection.
• The MAC address of macOS computers was not sent correctly.
• When installing the protection, if external software deleted the installation configuration file, the protection was not installed and the generic uninstaller was erroneously launched.
• In very exceptional cases on 64-bit machines, protection updates failed because a file could not be copied.
• The protection was not installed if it was not possible to uninstall the existing security product from the computer. This was always the case regardless of whether the “Automatically uninstall protections from other vendors” option was enabled or disabled.
• The option to export blocked programs did not export all available data. Data such as computer names was missing.
• Now it is not possible to enter more than 15 characters in the “Password required to perform advanced management tasks locally from computers” field of the “Per-computer settings” section.
• Fixed an issue that caused a BSOD error when using 4G or 5G connections on Windows computers with ARM processors.
• Fixed an issue with the Android protection when we scanned APK files from unknown sources but didn’t have permission to access the file directly.
• Updated the Play Core library used by the Android protection to the latest version to fix a vulnerability in versions prior to 1.7.2.

Agent and protection versions

• Windows protection: 8.00.17.0001
• macOS protection: 2.00.06.0006
• Linux protection: 3.00.00.0050
• Android agent and protection: 3.5.8
• Windows agent: 1.16.11.0000
• macOS agent: 1.10.05.0001
• Linux agent: 1.10.06.0050

New features

• Added new feature to search for IOCs (STIX 2.x format) by file name, path, hash (MD5, SHA256), IP address, and domain the computer is connected to.
• Support fort Yara rules in IOC searches.
• Advanced security policies now enabled by default for Cytomic customers.
• Visibility of the activity of the malware and PUPs detected on macOS and Linux systems, including activity details and activity graphs.
• Visibility of the malware and PUPs detected on macOS and Linux systems in Cytomic Insights (Alerts table).
• Visibility of the monitoring of macOS and Linux systems in Cytomic Insights (Ops and Install tables).
• Continuous improvement and adaptation of the Windows protection included in Cytomic EDR/Cytomic EPDR. Added new sensors to detect in-process privilege escalation attacks, domain controller spoofing, port opening, DNS tunneling, processes launching tasks from the WMI, and attempts to delete items protected by the shield. All these events are included in the collected telemetry to enrich our Intelligence and classify malware and malwareless attacks even faster.
• Greater integration with the Windows 10 AMSI (AntiMalware Scan Interface). The use of AMSI provides Cytomic EDR with telemetry and additional information about script and macro execution to improve protection without negatively impacting computer performance.
• The network telemetry collects the actual destination IP when a computer connects to the Internet via a proxy server. Getting the actual IP allows us to check our telemetry against IP-type IOCs (Indicators of Compromise) on our Collective Intelligence platform.
• Detection and blocking of attempted attacks making use of DCSync and DCShadow techniques with our DPIF (Deep Packet Inspection Firewall).
• Improved Anti-Tamper protection: Anti-Tamper protection for the communications agent and other protection services. Additionally, we prevent processes required by the protection from being suspended. These measures are extremely important against hackers trying to stop our services and processes.
• Password-based uninstallation prevention and Anti-Tamper protection enabled by default in the default settings for new customers and in new settings for all customers.
• Cytomic Patch. The ‘Available patches’ list indicates patches that need a restart after having been installed, thus preventing administrators from re-creating installation tasks for those patches.
• Cytomic Patch. The ‘Available patches’ list displays the release date of patches, thus providing administrators with another criterion to evaluate the criticality of patches.
• Cytomic Patch. The Dashboards section now shows the name Cytomic Patch instead of Patch Management.
• Cytomic Patch. Ability to access, from the ‘Available patches’ list, a new Web page with information about high and critical severity vulnerabilities for which exploits are available.
• Cytomic Patch. Ability to install a specific patch on the computers included in any of the existing filters on the COMPUTERS screen.
• Cytomic Patch. Improved cancellation of patch installation tasks. Now, cancellation becomes effective on all computers but those where the installation process has already started.
• Device control. Ability to assign an alias to blocked devices, either from the ‘Blocked devices’ list or from the exclusions defined in the ‘Workstations and servers’ settings.
• Cytomic Data Watch. The Settings screen options have been rearranged. Two new sections have been added: Rule-based monitoring of files and Advanced indexing options, the latter containing the indexing scheduler. The General section is now Personal data (inventory, searches, and monitoring).
• Cytomic Data Watch. The section Personal data (inventory, searches, and monitoring) provides the ability to configure the monitoring of personal data in email and configure exclusions.
• Cytomic Data Watch. The section Rule-based monitoring of files provides the ability to specify the default file extensions to which monitoring will be applied.
• Cytomic Data Watch. The section Rule-based monitoring of files provides the ability to create monitoring rules based on specific files extensions. If any of those extensions is not included in the default list of extensions, the user is given the option to add it automatically to the list.
• Cytomic Data Watch. The section Rule-based monitoring of files provides the ability to create monitoring rules based on specific file names. All files with the entered names will be monitored.
• Cytomic Data Watch. The section Rule-based monitoring of files provides the ability to create monitoring rules based on specific file paths. All files in the entered path will be monitored.
• Cytomic Data Watch. The section Rule-based monitoring of files provides the ability to create monitoring rules based on specific file contents for those files whose contents can be interpreted by Cytomic Data Watch.
• Cytomic Data Watch. The section Rule-based monitoring of files provides the ability to apply AND/OR operators when creating rule conditions.
• Cytomic Data Watch. The section Rule-based monitoring of files provides the ability to group conditions, creating nesting levels related to one another with the logical operators AND/OR.
• Cytomic Data Watch. The section Rule-based monitoring of files provides the ability to edit and delete rules.
• Cytomic Data Watch. The section Rule-based monitoring of files provides the ability to select whether you want to monitor files on disk or in email. Monitored operations for files on disk are stored in the usrrules table in Advanced Visualization Tool. The monitoring of files in email applies to attachments included in inbound and outbound email in Outlook 2013 and 2016 for Exchange. Monitored operations are stored in the usrrulesmail table in Advanced Visualization Tool.
• Cytomic Data Watch. The Dashboards section now shows the name Cytomic Data Watch instead of Data Control.
• Cytomic Encryption. The Dashboards section now shows the name Cytomic Encryption instead of Encryption.
• Cytomic Insights. The button for accessing Cytomic Insights has been renamed Cytomic Insights.
• Cytomic Data Watch. Fixed performance issue when displaying the list of files with personal data for customers with a high volume of files. We have removed the ability to filter files by computer in the list of PII files; nevertheless, it is still possible to view a computer’s PII files from the list of computers with PII files. We have also removed the ability to sort the list of PII files by computer. The list of PII files displays a maximum of 1,000 records, sorted by last connection date.
• Group picker in the Web console to temporarily restrict the data displayed in dashboards and reports to the computers selected by the user. This allows administrators managing hundreds or thousands of computers to be able to focus on one or multiple specific computer groups at any one time; for example, the server group or all computers at a particular location.
• Ability to filter computers by IP address range.
• Ability to filter computers by group. This returns all computers in a group and all its subgroups.
• Ability to filter computers by the “Last proxy used” property. This enables you to view which computers communicate with which proxy.
• Email notifications. Computer information is displayed in email notifications when the alert refers to a single computer.
• Email notifications in all languages supported by the Web console.
• Android: Android device renames in the Web console are applied to all features provided by the solution, even the alerts sent to users via the ‘Snap the thief’ feature.
• Hardware inventory. The hardware inventory now displays the BIOS serial number for Windows computers (in the Web console and in the ‘Hardware inventory’ exported file).
• More control and details during the installation process. The URLs that could not be accessed during the installation process on endpoints are displayed in the local console, agent logs, Event Viewer, and Web console. New step added at the end of the installation process: verification of communications between the protection and servers (Glauka, SRF, Cyren).
• The role permission ‘Modify computer tree’ is now independent of the permissions to edit settings and run tasks. Therefore, any changes made to those permissions won’t affect the ‘Modify computer tree’ permission.
• Agent updates are now more robust: auto-recovery in the event of an error.
• Computers with errors downloading the installer are not displayed as ‘Installing’, but as ‘Installation error’.
• The customer ID is displayed in the Web console, making it easier to identify the customer account.
• New fonts and styles in the Web console following Marketing guidelines.
• Added detailed information (computer, computer group, etc.) in software inventory exports.
• The ‘Malware run’ and ‘PUPs run’ lists are no longer created by default in new accounts.
• If upgrades are disabled in a settings profile and a computer is pending a restart to perform the upgrade, the upgrade is aborted on that computer.
• Users receiving email notifications from our Aether-based products can now opt out of those messages (unsubscribe).
• SQUID technology is disabled by default on macOS computers. The Web browsing antivirus and the phishing detection feature won’t be enabled on macOS computers unless the URL Filtering feature is enabled.
• Advanced protection on Linux systems. Added the ability to detect malicious activity on Linux systems using contextual detections. Contextual detections allow us to proactively detect and prevent malware and malwareless attacks. Malicious actions detected are not blocked by default to avoid possible inconvenience on certain machines. This additional protection layer on Linux systems requires the Linux protection version to be 3.00.00.0000 or later.
• Advanced protection on Linux systems. Ability to change the configuration of contextual detections on Linux. New options are available (‘Do not detect’, ‘Audit’, and ‘Block’) in the “Detect malicious activity (Linux only)” setting of the advanced protection. This additional protection layer for Linux systems requires the Linux protection version to be 3.00.00.0000 or higher.
• Ability to install the Linux protection without dependencies. The Linux protection installs by default with dependencies. This means that it makes use of certain system libraries for some of the protection features. However, with Linux servers not connected to the Internet, we recommend that you install the Linux protection without dependencies, thereby avoiding making changes to the system or updating components. See this FAQ for more information about how to install the Linux protection without dependencies. Installing the protection without dependencies requires the Linux agent version to be 1.10.06.0050 or higher and the Linux protection version to be 3.00.00.0050 or higher.
• Newly created lists do not preload data by default. Data is loaded only after the user selects the appropriate filters. This way, we prevent data loads which, in the case of customers with thousands of computers, can take minutes.
• New Linux distributions supported: Ubuntu 20.04 and RedHat 8.2. For more information about all supported Linux distributions, click here.

Bug fixes

• Fixed bug in the firewall technology that caused a Blue Screen of Death (BSOD) with certain DHCP packets that didn’t meet the required standard.
• Fixed installation issue when changing the license or applying a private-label version (error 1627).
• Fixed protection update issue (error 1603).
• Computers moved from one group to another in Active Directory changed groups in Cytomic console too, but didn’t inherit the settings of the new group.
• When a customer configured scheduled reports in a specific language, they sometimes received them in a different language.
• The content of scheduled reports sent via email is now compressed to minimize delivery issues due to exceeding the maximum size allowed.
• If the user chose to view data from the last 24 hours, the Web monitoring counters showed no data.
• Fixed Internet connection issues via proxy with some specific passwords on RHEL 6.x and CentOS 6.x systems.
• Fixed an issue that prevented the protection from installing on certain CentOS 6.x systems.
• The communications agent was uninstalled when upgrading the version.
• Computers with new versions of Windows 10 Pro Education and Cytomic Encryption enabled were not encrypted.
• Computers with the Cytomic Encryption module enabled and very fast SSD drives gave rise to a sync issue at boot that caused the computer to keep asking for a restart.
• When upgrading the protection, if two restarts were required, the second one was requested after 4 hours instead of immediately.
• If the scheduled time for a protection version upgrade coincided with the Daylight Saving Time or Standard Time change time, the scheduled time was dismissed and the task was never run.
• Fixed an issue that caused the Internet connection to be lost on macOS systems when using SSL VPN and IKEv2 connections.
• Fixed an issue on macOS systems when accessing certain URLs with certain applications such as Teams, Google Sync, BOX, and iTunes.
• On macOS systems, it wasn’t possible to connect to Collective Intelligence if the proxy was configured with a password and the password had symbols.
• On macOS systems, the information displayed in the local console was sometimes not refreshed properly.
• Fixed an issue that caused the Internet connection to be lost on macOS systems when using a Fortinet VPN client.
• The Linux protection froze randomly when scanning very large files.
• Linux workstations/servers were always restarted after 60 seconds regardless of the time selected in the Aether Web console.
• The Cytomic Encryption module attempted to encrypt the sandboxes created with Windows Sandbox on Windows 10. Now, those drives are detected correctly and are not encrypted.

What is Cytomic?

• Cytomic is a new business unit created by Panda Security in 2019 and dedicated to resolving the security problems of organizations with major cyber-security demands and a high level of security maturity.
• Cytomic provides solutions which are entirely cloud-based and address cyber-security through two paradigms: big data analytics (Security Data Analytics ) and leverage of the community to which customers contribute and benefit from. Both are key factors for defensive, adaptive, and efficient cyber-security.
• Cytomic solutions are based on the implementation of two closely integrated technologies: our single, lightweight agent and the Cytomic platform.

Solution and module portfolio

• Cytomic EDR detects and responds effectively to any type of unknown malware as well as the fileless and malwareless attacks that traditional solutions cannot detect. It relies on the Zero-Trust Application service, unique in the market, which prevents the running of any binaries until they are validated as trusted. Cytomic EDR can coexist with traditional security solutions, complementing them.
• Cytomic EPDR prevents, detects, and responds to any type of known and unknown malware as well as fileless and malwareless attacks. It also relies on the Zero-Trust Application Service. It expands on the capabilities of Cytomic EDR with a full range of Endpoint Protection Platform features (firewall, device control, etc.) which are still required to prevent threats from reaching endpoints and reduce the attack surface.
• Cytomic Orion speeds up and simplifies the process of searching, investigating, containing, and remediating cyber-threats and insiders with privileged information, capable of bypassing existing controls by using Living-off-the-Land techniques. Cytomic Orion can coexist with EPP (Endpoint Protection) and EDR (Endpoint Detection and Response) security solutions, complementing them. Cytomic Orion can be purchased by organizations for their own use or as a service managed by our Global Cybersecurity Team and comprising different levels of proactive service.
• Cytomic Patch identifies vulnerabilities in operating systems and hundreds of applications commonly used in business environments in real time, while delivering centralized patching from Cytomic’s cloud-based console.
• Cytomic Encryption provides centralized management of disk encryption on endpoints, as well as the storage and recovery of BitLocker recovery keys from the cloud console.
• Cytomic Data Watch monitors files on devices in search of personal and sensitive data and allows the deletion of files from the Cytomic console to mitigate risks.
• Cytomic Insights aggregates all collected data, correlating and displaying it graphically in real time in order to provide granular visibility into any event that occurs on endpoints. It includes indicators, searches, and preset alerts for security incidents, used applications, bandwidth consumption, etc.
• Cytomic SIEM Connect provides Cytomic telemetry enriched with proprietary threat intelligence, for integration with corporate SIEM solutions without requiring additional deployments on users’ computers.