20.1 All Features

The tables in the following sections list all the features included in all minor releases included in version 21.1 LTS, organized by minor versions. All the features listed below are also included in the 21.1 LTS version.

The tables contain the following information about each feature:

  • The feature area

  • A description of the changes

  • Whether you need to update your server or sensor to the version listed

  • The supported operating system for the machines for the sensor

  • The sensor and server versions required to utilize the feature

Version 20.1.343 (LTS)

Feature

Description

Required Update

Sensor OS

Remote Shell

We have updated the configurations for the Responder user required to use the Remote Shell utility.

Now, if you upgrade from a previous version to the current version and you have users with the Responder role, the option to require two-factor authentication is not automatically enforced.

However, if your users with the Responder role need to use the Remote Shell in Unrestricted mode, you must later select the option requiring two-factor authentication. Learn more

Server

N/A

Quarantine files

You can now use the Unquarantine response option for Endpoint Protection Malops. Learn more

Server and sensor

All

Version 20.1.326

Feature

Description

Required Update

Sensor OS

Sensor installation

When installing a sensor, the sensor installer installs the Microsoft C Runtime Environment (CRT) in a shared folder on Windows (the system32 folder). Installing the CRT in this folder affected other applications by causing them to not function properly.

This issue is now resolved and the sensor installer installs the needed CRT files in the ActiveProbe folder in the ProgramFiles folder.

In addition, as a result of this fix, you do not need to install KB2999226 for operating system versions that previously required this KB. Learn more

Sensor

Windows

Detection rules

We have updated the Process created with Win32_Process::Create WMI method evidence and Process remotely created with the Win32_Process:Create WMI method evidence to better detect instances use of the Win32:Process_Create event.

Server

N/A

Version 20.1.281

Feature

Description

Required Update

Sensor OS

Sensor grouping

This version introduces the ability for system administrators to create different groups to which sensors can be assigned. In addition, we have added a new “Sensor admin L1” user role. Users with this role can manage sensors in one or more specified sensor groups. Learn more

Server

N/A

PowerShell and .NET configuration

We have added several enhancements to PowerShell and .NET protection. You can now exclude domains from download payload protection, exclude modules from .NET floating module protection, and set the .NET to JScript protection mode. Learn more

Server and sensor

Windows

Custom firewall rules validation

When you add new custom firewall rules using the UI, the rules are now validated. An error is visible if a field is empty or invalid.

Server

N/A

Version 20.1.260

Feature

Description

Required Update

Sensor OS

Sensor grouping

This version introduces the ability for system administrators to create different groups to which sensors can be assigned. In addition, we have added a new “Sensor admin L1” user role. Users with this role can manage sensors in one or more specified sensor groups. Learn more

Server

N/A

PowerShell and .NET configuration

We have added several enhancements to PowerShell and .NET protection. You can now exclude domains from download payload protection, exclude modules from .NET floating module protection, and set the .NET to JScript protection mode. Learn more

Server and sensor

Windows

Custom firewall rules validation

When you add new custom firewall rules using the UI, the rules are now validated. An error is visible if a field is empty or invalid.

Server

N/A

Version 20.1.241

Feature

Description

Required Update

Sensor OS

Remote Shell

We have enhanced the Remote Shell utility to enable you to use more PowerShell commands in Unrestricted mode, in addition to the previously limited mode.

Note that existing users with the Responder role have the option for two-factor authentication as a mandatory user setting. Any user you create and assign the Responder role also has the option for two-factor authentication selected and required for use of the Remote Shell utility. Learn more

Sensor and server

Windows

Behavioral document protection exlusions

You can now use Behavioral document protection rule IDs to exclude Behavioral document protection in specific scenarios. Learn more

Sensor and server

Windows

Behavioral document protection

It is now possible to set Behavioral document protection to one of the following modes: Disabled, Detect, Prevent, or Quarantine. In previous versions, the action taken by Behavioral document protection was determined by the Signatures mode. Learn more

Sensor and server

Windows

Endpoint protection - custom firewall rules

It is now possible to add custom firewall rules using the UI, without having to upload a new CSV file. Learn more

Server

N/A

Detection Rules

We have updated the logic for the Command line keyword obfuscation evidence to ensure this evidence returns fewer false positive results.

Server

N/A

Version 20.1.221

Feature

Description

Required Update

Sensor OS

Reputation management

Cybereason has changed the terms ‘blacklist’ and ‘whitelist’ to ‘blocklist’ and ‘allowlist’, respectively. In addition, the ‘Behavioral whitelisting’ feature has been renamed to ‘Behavioral allowlisting’. Functionality for reputation management is unchanged

N/A

N/A

Version 20.1.181

Feature

Description

Required Update

Sensor OS

Anti-Malware configuration

We have added several advanced configuration options for signature-based detection, such as an option to determine how frequently sensors download signature updates, the ability to disable scanning of network paths, and more. Learn more

Sensor, Server

Windows

Anti-Malware configuration

We have added the option to set Signatures protection to Quarantine mode. Cybereason moves malicious files to a different location to prevent them from executing. Learn more

Sensor, Server

Windows

Version 20.1.145

Feature

Description

Required Update

Sensor OS

Delete a policy

Policy administrators can delete policies from the Policy Management screen. You cannot delete the Default or Legacy policies. Learn more

Sensor, Server

Windows, Mac, Linux

User Logon and Management

User administrators can specify the login method for a specific user as either Legacy (user password) or SSO. When SSO is enabled for a user, a password login will not be allowed. When disabled, the SSO login will not be allowed. The default value for the logon value is Legacy. Learn more

The Single Sign On feature is in the beta stage. Contact your Customer Success representative to enable this feature.

Server

N/A

PowerShell detections

When a PowerShell process is identified as trying to run a malicious command or payload, the detected payload is now displayed within the ‘Process ran a malicious command’ Malop. Learn more

Sensor and server

Windows

Version 20.1.120

Feature

Description

Required Update

Sensor OS

Unquarantine file

You can now unquarantine files that you previously quarantined. You unquarantine a file from the file’s associated Malop’s details screen by clicking Respond, and then selecting the files to unquarantine. If the file’s original folder structure no longer exists, Cybereason rebuilds the path. Learn more

Sensor and server

All

Exploit Protection configuration

We have added several configuration enhancements to the System > Policies Management > Create/Edit Policy > Exploit protection screen. You can now select a cautious or aggressive Exploit protection mode, and add Exploit protection exclusions. For more details, see Exploit Protection Settings

Sensor and server

Windows

Linux file collection

In previous versions, Cybereason did not report whether an executable file was considered signed or verified on CentOS 8 and on Red Hat Enterprise Linux. This limitation has been resolved.

Sensor

Linux CentOS and RHEL8

Version 20.1.100

Feature

Description

Required Update

Sensor OS

Email notification management

To allow user admins to easily manage notifications for users, we have added a new checkbox called ‘Enable notifications’ in the Users screen. We have also added a ‘Notifications’ column to the list of users, which shows whether notifications are enabled or disabled. Users with privileges to create and edit users are able to edit this checkbox for all users. Individual users can change notification settings from the user preferences menu. Learn more.

Server

Windows, Mac, Linux

Customized proxy settings

To increase customization it is now possible to enable different proxy settings (for groups of sensors or for all sensors) for communication between the sensor and the Detection server. A new parameter specifies whether to use the customized settings or the settings configured in the Detection Servers screen. Learn more.

Sensor

Windows

Exploit protection

You can now view the ‘Malicious exploit attempt’ Endpoint Protection Malop in the Malops management screen. This Malop is triggered when Cybereason blocks malicious exploit attempts. Learn more.

Sensor,Server

Windows

Version 20.1.80

Feature

Description

Required Update

Sensor OS

CVE detection

We have updated our detection rules to better detect attempts to exploit known CVE reports. This includes adding a suspicion and evidence indicating a possible attempt to exploit a CVE. In addition, we have introduced an ‘Attempted exploitation’ Malop in Research mode for such attempts.

The Malop details report which CVE the attempt tried to exploit. These detections support detection of exploits for CVE reports for which the proper operating system update is installed. The evidence, suspicion, and Malop are supported on machines running Windows 10 and higher. Learn more.

Sensor, Server

Windows

Custom firewall rules validation in UI

When a user imports a custom firewall CSV file, Cybereason now displays the Error uploading CSV file dialog box when the number of columns for a custom firewall rule does not match the number of columns in the header row. The dialog box indicates the specific rows that include errors. Learn more.

Server

Windows

Quarantine file cleanup

Cybereason manages the amount of stored quarantined files by checking if the folder contains files older than x days (30 days by default). If so, the mechanism deletes those files. The cleanup is scheduled to run daily (every 24 hours) and on sensor startup.

Sensor

All

Sensor CPU usage statistics

We have improved the collection of sensor CPU usage statistics and optimized the management of sensor CPU usage logs.

Sensor

All

Version 20.1.64

Feature

Description

Required Update

Sensor OS

Anti-Malware > Last signature update

In the Sensors screen, we have added the Last signatures update column, which indicates the last time the sensor has received an Anti-Malware > Signatures database update. The time displayed is according to the server timezone.

Sensor, Server

Windows, Mac

Anti-Malware > Last signatures version

In the Sensors screen, we have added the Last signatures version column, which indicates the version number of the Anti-Malware > Signatures database.

Sensor, Server

Windows

Custom firewall rules validation

Cybereason performs various checks to ensure that custom firewall rules are applied and configured correctly. Learn more.

Sensor, Server

Windows

Endpoint Controls Windows 7 support

Endpoint controls is now supported on Windows 7 SP1 and later versions. See Prevention features.

Sensor, Server

Windows

Exploit Protection Windows 7 support

Exploit protection is now supported on Windows 7 SP1 and later versions. For more details, see Prevention features and Exploit protection.

Sensor, Server

Windows

MITRE ATT&CK mapping

Throughout the Investigation, Malop Details, and Element Details screen, we have updated relevant Feature (filter) names to include the MITRE ATT&CK ID number as well as the tactic or technique name.

Server

N/A

Version 20.1.43

Feature

Description

Required Update

Sensor OS

Anti-Malware > AI model update

The ‘Anti-Malware > Artificial Intelligence’ model was updated. The updated model is more accurate in identifying malicious executables and not detecting benign ones.

Customers who upgrade to this version are expected to receive more detections based on Anti Malware > Artificial Intelligence. Please contact Technical Support if you believe a false detection was generated.

Sensor, Server

Windows

New Malop types

Cybereason now identifies two types of Malops:

  • AI Hunting Malops, which are triggered by Cybereason’s automatic hunting engine and threat intel sources. In versions prior to 20.1.43, these threats were represented by Malops in the Malop inbox.

  • Endpoint Protection Malops, which are triggered by Cybereason’s NGAV feature. In versions prior to 20.1.43, these threats were represented by malware alerts in the Malware alerts screen.

Learn more.

Server

Windows, Mac, Linux

Malops management screen

The Malops management screen provides analysts a single pane from which to analyze, triage, and respond to threats in their organization.

Learn more.

Server

Windows, Mac, Linux

Automatically assign sensors to default policy

When installing new sensors, all sensors are automatically assigned the default policy and compliance is set to ‘true’. Since this process is automatic, you do not need to customize the installation parameters if you want sensors to adopt the default policy. You can still use installation parameters to assign sensors to specific existing policies. Learn more.

Sensor, Server

Windows, Mac, Linux

Version 20.1.21

Feature

Description

Required Update

Sensor OS

Endpoint controls enhancements

We have introduced the following enhancements to the Endpoint controls feature:

  • You can now add custom firewall rules that include Japanese text into the custom firewall rules CSV file, with the exception of the header row, which must remain in English.

  • The ‘USB device was blocked’ system tray notification is now supported in Japanese.

Important: If you are using a custom firewall rules CSV file that includes Japanese text, you must convert the file to the UTF-8 format before uploading the file.

Learn more about Endpoint controls.

Sensor, Server

Windows

Exploit protection

Exploit protection enables you to automatically block malicious attempts to exploit vulnerabilities on the organization’s endpoints. Exploit protection is a Cybereason prevention feature that includes various security mitigation techniques and is configured as part of the sensor policy. Learn more.

Sensor, Server

Windows

Injection detection improvements

We have updated the detection logic for the ‘Malicious by Code Injection’ Malop to ensure fewer false positive results. We have removed cases of injecting processes of unknown reputation, as this caused most of the false positives. Learn more.

Server

Windows

Prevent mode

We have added the option to set Anti-Malware > Signatures protection to Prevent mode. In this mode, malicious files are prevented but are not modified or moved from their location. Use this mode if you want to use Cybereason as your antivirus tool and prevent malicious files from executing, but do not want to modify files. In version 20.1.21, the Prevent option is hidden in the UI. Ask Technical Support to make this option visible. Learn more.

Sensor, Server

Windows, Mac

Timeline filter improvements

From the Investigation screen’s Timeline filter, you can include only items that were created within the specified time interval by selecting the Created radio button, or items that existed during that interval by selecting the Existed radio button. Learn more.

Server

N/A