21.2 All Features

The tables in the following sections list all the features included in releases included in version 21.2.

The tables contain the following information about each feature:

  • The feature area

  • A description of the changes

  • Whether you need to update your server or sensor to the version listed

  • The supported operating system for the machines for the sensor

  • The sensor and server versions required to utilize the feature

In this topic:

Version 21.2.640 (Service Pack)

Issue

Area

Description

Required Update

Sensor OS

DFND-46765

NGAV

When using NGAV on an endpoint machine, as a non-admin user on the machine, if you clicked the prompt from Windows Security Center to update the Cybereason signatures database, command window continued to display on the machine (while the update ran in the background), disrupting the work of the endpoint machine user.

We have resolved this issue to ensure that the signature database update does not interfere with normal machine usage.

Sensor and server

Windows

DFND-46902

Behavioral Execution Prevention

When using Behavioral Execution Prevention, the cmstp_abnormal_execution and msexchange_owapool_webshell rules were causing the Cybereason platform to generate MalOps that were false positive MalOps.

We have resolved this issue and these rules should no longer generate MalOps that are false positive.

Sensor and server

Windows

Version 21.2.622 (Service Pack)

Issue

Area

Description

Required Update

Sensor OS

DFND-44363

Sensor performance

When performing an installation, upgrade, or uninstallation of a sensor on Windows machines, the Cybereason installer caused applications that use the Powereason.dll file to shutdown or restart due to the installer needing to access shared locker files used by the other programs.

We have updated the installer program configuration to resolve this issue, so that other programs will work as expected during installation, upgrade, or uninstallation.

Sensor and server

Windows

DFND-46239

Device Control

In the Endpoint Controls section of a sensor policy, when adding a device to the allowed devices list, if the device name had more than 1 underscore character in the name, the device was not blocked or allowed correctly as set in the sensor policy.

We have resolved this issue and updated the configuration for parsing device names and devices should be blocked or allowed as set in the policy even with extra underscore characters.

Sensor and server

All

Version 21.2.603 (Service Pack)

Issue

Area

Description

Required Update

Sensor OS

DFND-43432

Mac sensors

In random cases, on sensors running on macOS machines, when the machine restarted, the Anti-Malware > Signatures database reverted to the first version instead of maintaining the current version. This resulted in unnecessary redownloads of the signatures database to the sensor.

We have resolved this issue and the Signatures database version is persisted after the machine restart.

Sensor and server

macOS

DFND-43494

Mac sensors

In recent Cybereason versions, when upgrading sensors through the System > Sensors screen, for sensors running on macOS with 2-way SSL enabled, after the upgrade the sensors were unable to connect to the Cybereason platform.

We have resolved this issue and all Mac sensors using 2-way SSL are able to successfully connect to the Cybereason platform after upgrade.

Sensor and server

macOS

DFND-43950

Detection rules, MalOp details

In some cases, associated suspicions for some MalOps were not included in the MalOp details. As a result, you were not able to see the full scope of the MalOp and related activity and prioritize the analysis and triage appropriately

We have resolved this issue and related suspicions for MalOps should always be part of the MalOp details for MalOps.

Server

N/A

Version 21.2.581 (Service Pack)

Issue

Area

Description

Required Update

Sensor OS

DFND-39979

Sensor tagging

When adding sensor tags by uploading a CSV files, if the CSV file contained more than 10,000 rows, some sensors did not get sensor tags with an unknown entity id error message.

We have updated the sensor tag upload flow to successfully upload CSV files with more than 10,000 rows.

Server

N/A

DFND-41099

Proxy, Linux sensors

When trying to connect to the Global Update server through a proxy connection (configured in the installed sensor package through sensor personalization), sensors on Linux machines were not able to access the Global Update server successfully.

We have resolved this issue and you can now connect Linux machines to the Global Update server through a proxy connection.

Sensor and server

Linux

DFND-40989, DFND-41723

NGAV

If you added a local update server URL to the Anti-Malware settings in a sensor policy, and then updated the policy settings or assigned a sensor to a different policy, the local update server settings on the endpoint machine retained the previous URL from the first policy instead of updating the new URL settings.

We have resolved this issue and changes in the local update server URL from the policy are propagated to endpoint machines correctly.

Sensor and server

Windows

DFND-42766

NGAV

When adding domain exclusions for Fileless Protection (in the Fileless Protection > Domain exclusions section of the sensor policy), if a machine had a slower network connection or performance, the exclusion details did not propagate to the endpoint machine before the timeout period and domains were blocked when they should have been allowed.

We have resolved this and Domain exclusions will propagate correctly for all endpoint machines.

Sensor and server

Windows

Version 21.2.560 (Service Pack)

Issue

Area

Description

Required Update

Sensor OS

DFND-39356

Detections

In recent versions, the Cybereason platform did not always detected process injections - both injection into processes and processes injecting into other processes) correctly.

We have updated the configuration for this detection and related sensor collections to improve the accuracy of these detections.

Sensor and server

Windows

DFND-39625

Sensor performance

In some cases, the sensor was stuck in a loop of repeated crashes of the sensor program (minionhost.exe), possibly from issues with WMI on the endpoint machine.

We have updated the sensor program configuration to continue to work in these situations, and the sensor should not continue to have crash loops if there are WMI issues on the machine.

Sensor and server

Windows

DFND-40164

Device Control

On endpoint machines, when the setting for the Device control mode was set to Read only in the associated sensor policy for the machine, the machine continued to display a notification on the machine indicating that a USB device was blocked (although the machine user was able to access and read the device properly).

We have resolved the issue and this notification is no longer displayed on the machine.

Sensor and server

Windows

DFND-40512

Data collection

When viewing details on Services (such as the image file path or the command line arguments), the details for Service Elements were often reported incorrectly or incomplete in the Element Details screen.

We have updated the configuration used by the sensor collector and details about Services are collected and reported accurately in the Element Details screen.

Sensor and server

Windows

DFND-40693

Reputations

When viewing reputations in the Reputations screen, if you tried to sort the table of reputations by the Description column, a message was displayed, claiming that there were no reputations in the platform.

We have resolved this issue and you can now sort by the Description column without issue.

Server

N/A

DFND-40929

Sensor installation

In the latest Cybereason version, if you downloaded the sensor installation package to a location where the file path contained Unicode characters (such as Japanese characters), the sensor installation/upgrade failed.

We have resolved this issue and the installation should work with Unicode characters in the installation path.

Sensor and server

Windows

DFND-40981

Personal Firewall Control

When creating a custom firewall rules for inbound and outbound communication in the Endpoint Controls section of your sensor policy, the communication was not blocked on the specified ports on Linux machines.

We have resolved this issue and the communication on Linux machines is now blocked according to the custom firewall rules.

Sensor and server

Linux

Version 21.2.541 (Service Pack)

Issue

Area

Description

Required Update

Supported OS

DFND-23077

MalOps management

When loading MalOps created based on a Logon Session Element (MalopLogonSession), the Malops management screen unexpected reported an error and was unable to load the MalOp.

We have resolved this error to ensure all the data related to the MalOp can load and MalOps based on Logon Sessions load without issue.

Server

N/A

DFND-30783

MalOps management

In environments with the new Data Platform, in the Malops management screen, Endpoint Protection MalOps and MalOps created from custom detection rules did not display the detection description in the MalOp details.

We have resolved this issue and the detection description displays for all MalOps.

Server

N/A

DFND-36377

Sensor management

At times, the System > Sensors screen did not load due to a request to view a large number of sensors (tens of thousands)

We have resolved this issue and updated the server configuration to limit the number of sensors retrieved in a single request to help manage the performance of this page to load properly. In particular, the /rest/sensors/query API endpoint now has a maximum limit of 30,000 sensors in a single request.

Server

N/A

DFND-37901

Sensor upgrade

On some supported Linux operating systems (such as RHEL 6 or CentOS 6), upgrades failed due to the sensor upgrade installer not being able to find the correct services.

We have resolved this error and upgrades on all supported Linux operating systems work properly.

Sensor and server

Linux

Version 21.2.521 (Service Pack)

Issue

Area

Description

Required Update

Supported OS

DFND-33731

Malops management

To help you review the Malops in the Malops management screen, we have increased the number of Malops you can view on a page.

By default, the Malops management screen displays 50 Malops. You can also select to view 100, 250, or 500 Malops per page.

Server

N/A

DFND-31144

Sensor system tray icon

In some cases, the sensor created multiple icons in the taskbar for a single sensor.

We have resolved this error and the sensor displays only a single icon in the taskbar of the machine.

Sensor and server

Windows

DFND-33482

Malops management

In Japanese environments using the new Data Platform, in the Malops management screen, the Investigation Status filters listed Pending twice instead of Pending and On Hold.

We have resolved this issue and the filters display correctly now.

Server

N/A

DFND-35360

Malop comments

In environments using the new Data Platform, when adding a comment to Malop in non-English languages (such as Japanese), the comments were displayed in the Malop with strange characters instead of the proper language characters.

We have resolved this issue and comments should display correctly.

Server

N/A

Version 21.2.500 (Service Pack)

Issue

Area

Description

Required Update

Supported OS

DFND-33383

User roles

We have updated the requirements for the Responder L2 role to no longer require two-factor authentication or SSO.

Server

N/A

DFND-33213

Sensor management, notifications

At times, the Cybereason platform sent email notifications for sensors that were manually unarchived (as opposed to automatic unarchive due to platform settings). For example, if you manually unarchived a sensor, the platform would still send a notification that the sensor was archived.

We have resolved this issue and you should not receive email notifications about a sensor being archived even though it was unarchived.

Server

All

DFND-34323

Malops

In environments using the new Data Platform, Malops were not being created for malicious logon sessions.

This issue has been resolved and all Malops are created as expected.

Server

N/A

DFND-34555

Sensor installation/upgrade

When performing the steps required for mitigation of the CVE-2013-3900 vulnerability, it was not possible to install or upgrade sensors on the machine.

We have resolved this issue and you can install/upgrade sensors on a machine even with the mitigations for CVE-2013-3900 applied on a machine.

Sensor and server

Windows

DFND-35360

Malops management

In environments using the new Data Platform, when adding a comment to Malop in non-English languages (such as Japanese), the comments were displayed in the Malop with strange characters instead of the proper language characters.

We have resolved this issue and comments should display correctly.

Server

N/A

Version 21.2.484 (Service Pack)

Issue

Area

Description

Required Update

Sensor OS

DFND-13560

Sensor installation

When installing or upgrading a sensor on Linux machines, the installation log had unexpected results, including numerous repeated and redundant lines in the log. This was due to the results of a verification of the presence of prerequisite libraries on the machine.

We have resolved this issue and the log entries have been streamlined for better use.

Sensor and server

Linux

DFND-14202

Sensor performance

Frequently, the sensor was not able to connect to the Dynamic Sensor Connections service to get sensor content updates. This occurred when the token was expired and a new token was not downloaded.

This issue has been resolved and the sensor is now able to continually connect to the Dynamic Sensor Connections service as expected on a continuous basis.

Sensor and server

Windows

Version 21.2.466 (Service Pack)

Issue

Area

Description

Required Update

Supported OS

DFND-23332

Sensor installation/sensor upgrade

We have added a prerequisite check to the sensor installation and sensor upgrade processes to ensure that you have the Sectigo certificate required by the Microsoft Virus Initiative (MVI) installed on the machine.

Sensor and server

Windows

DFND-23654

Sensor performance

In certain cases, when using the .NET part of Fileless protection, some programs such as the Windows Event Viewer and PowerShell, for example, were unable to run on the machine.

We have resolved this error and programs on the machine should work as expected with Fileless Protection enabled.

Sensor and server

Windows

DFND-28973

User management

When trying to add new users with an .inc domain in the email address, the Cybereason platform failed to add these users correctly.

This issue has been resolved and you can add users with a .inc domain in the user email address.

Server

N/A

DFND-29216

Investigation

When exporting investigation query results to a CSV file, if you selected an option other than All data, the CSV data export did not contain all available data or missed random items in the data.

We have resolved this issue and now exports work as expected with data exported.

Server

N/A

DFND-29800

Sensor performance

On some hypervisor virtual machines, sensors were not able to run due to a crash in the minionhost.exe process.

We have resolved this issue and the sensor starts as expected.

Sensor and server

Windows

DFND-33594

Machine isolation

On the latest version, if your environment has the new Data Platform infrastructure, you could not isolate a machine from the Element Details screen. When you clicked the Isolate button, the isolation command did not work.

We have resolved this issue and you can now isolate a machine and remove the machine from isolation in these environments as expected.

Server

All

Version 21.2.443 (Service Pack)

Issue

Area

Description

Required Update

Supported OS

DFND-16006

User screen

We have updated the quick filters on the left of the Users screen to include all user roles. There is now an All analysts section and an All admins section populated with the relevant roles. Use these filters to quickly display relevant users with these roles:

  • L1 Responders

  • L2 Responders

  • Policy admins

  • L1 Sensor Admins

  • Local Analyst (L1/L2)

  • Local Responder

  • Sensor Viewer

Use these filters to quickly display relevant users with these roles.

Server

N/A

DFND-17947

Predictive Anti-Ransomware

For users in Japanese environments, we have updated the title of the Predictive Ransomware Protection screen to 予測型ランサムウェア保護.

Server

N/A

DFND-28883

Anti-Malware scans

We have updated the logs recorded when you perform an Anti-Malware scan to also report the Static Analysis prediction score for a file and the PE file type for each file.

Sensor and Server

All

DFND-9630

Behavioral Allowlisting

If you created a behavioral allowlisting rule with a special character, you were not able to later edit this rule.

This issue has been resolved and you can edit allowlisting rules with special characters.

Server

N/A

DFND-13846

Sensors screen

At times when an environment uses a proxy, the Internal IP address field value displayed for a sensor in the Sensors screen was 127.0.0.1 instead of the real IP address of the sensor due to the looping of the address as part of the proxy.

We have updated the configuration of the sensor to report the correct IP address for the machine in the Sensors screen.

Sensor and server

All

DFND-19860

Sensor installation

When uninstalling a sensor from the latest version, the uninstallation failed with an error that the sensor installation folder was still in use.

We have resolved this issue and the uninstallation works as expected.

Sensor and server

Windows

DFND-20802

Behavioral Document Protection

Previously, detection rules used with Behavioral Document Protection did not create detections when the document files contained Japanese characters.

We have resolved the issues and detection rules work even when the document file contains Japanese characters in the name.

Sensor and server

Windows

DFND-21372

Local responder role

Previously, users with the Local Responder role had access to non-authorized sections of the Cybereason UI, including

  • Discovery board screen

  • Malop Inbox screen

  • Malware alerts screen

We have updated the permissions for the Local Responder role and users with this role should no longer be able to access these parts of the Cybereason UI.

Server

N/A

DFND-21496

L3 analyst role

Previously, users with the L3 analyst role were not able to view and edit machine isolation exception rules.

We have resolved this issue and users with the L3 analyst role are able to view and edit as expected.

Server

N/A

DFND-22698

Linux sensors

When trying to install sensors on Linux machines running Oracle Linux operating systems, the installation would fail as the minionhost process did not work properly.

This issue has been resolved and installations on Oracle Linux machines work properly.

Sensor and Server

Oracle Linux

DFND-22993

Sensors screen

When exporting details on sensors to a CSV file with the API, the list of sensors was incomplete. For example, the exported might contain 10,000 lines instead of the expected 40,000 lines.

This issue has been resolved and the CSV file exports with the correct amount of data.

Server

N/A

DFND-23360

Sensor system tray icon

At times, the minionhost.exe process used by the sensor created multiple cramtray.exe process instances on the machine, causing a sensor error.

This issue has been resolved and the processes open as expected with a single cramtray.exe process.

Sensor and server

Windows

DFND-23407

Detection rules

Due to a change in the sensor certificate name, Attempt to manipulate Cybereason sensor false-positive detections were generated for the sensor’s amsvc.exe and activeconsole.exe processes.

This issue has been resolved and these detections should no longer be created for the sensor processes.

Server

N/A

DFND-28702

Remediation

When viewing the Response History screen, if you clicked the Back button in your browser, you were returned to the default Discovery Board page, instead of the previous screen.

This issue has been resolved and clicking the Back button returns you to your previous screen.

Server

N/A

Version 21.2.421 (Service Pack)

Issue

Area

Description

Required Update

Supported OS

DFND-19717

Device Control

When using Device Control, after you disable or enable a Read Only for USB devices, endpoint machine users no longer need to re-mount a USB device to ensure that the sensor enforces the Read Only policy setting.

Sensor and server

Windows, Linux

DFND-681

Machine Isolation

By default, actions sent to offline sensors are queued for 3 days. If, after 3 days, the sensor has not come back online, the action is no longer queued and will not execute if the sensor comes back online at a later time. Now, the queued period can be customized.

Sensor and server

All

DFND-20395

Sensor installation

As part of the initiative to meet MVI (Microsoft virus initiative) requirements, we have added a warning and a logic to stop installation when you try to install a sensor on a machine running Windows 7. This installation prevention is due to the fact that the Sectigo certificate used for the MVI compliance is not supported on Windows 7.

Sensor and server

Windows

DFND-15669

Process information collection

At times, when the sensor collected details on the command lines used by processes, the collector on the sensor would add an extra space in the command line string that was sent to the detection server. As a result, if you built a behavioral allowlisting rule to exclude the command line from creating a Malop, the behavioral allowlisting rule would not correctly trigger Malops.

This issue has been resolved and the command line is collected and sent to the Detection server correctly without the extra spaces.

Sensor and server

Windows

Version 21.2.401 (Service Pack)

Issue

Area

Description

Required Update

Supported OS

N/A

Sensor certificates

Sensor binaries are now signed by Sectigo cross certificate to meet MVI (Microsoft’s virus initiative) requirements. Learn more

Sensor and server

Windows

DFND-18847

Variant paylod prevention

To provide a clearer explanation of the protection it provides, we have updated the name of Binary Similarity Analysis (BSA) in-memory protection to Variant payload prevention. As a result, the Binary Similarity Analysis (BSA) in-memory protection section in the Anti-Malware section of the sensor policy is now named Variant payload prevention.

Sensor and server

Windows

DFND-18847

Behavioral execution prevention

To provide a clearer explanation of the protection it provides, we have updated the name of Behavioral execution protection to Behavioral execution prevention. As a result, the Behavioral execution protection section in the Anti-Malware section of the sensor policy is now named Behavioral execution prevention.

Sensor and server

Windows

DFND-17002

Sensor upgrade

If you upgrade a sensor that has had proxy settings changed, after the upgrade, the proxy settings are retained. If the sensor upgrade package contains new proxy settings, the updated proxy settings override the sensor’s existing proxy settings.

Sensor and server

All

DFND-16449

Sensors for Mac

We’ve improved the antivirus initialization flow for sensors running on M1-based Macs. This new flow provides antivirus protection sooner in the installation/upgrade process than in previous Cybereason versions.

Sensor and Server

macOS

DFND-16940

Anti-Malware scans

We have updated the configuration used by the Cybereason platform’s Anti-Malware scans to better handle scans of large archives (e.g. .zip files), including:

  • Increasing the timeout period for the scan completion to give the scan time to finish scanning the archive file

  • Increasing the maximum size of file allowed for a scan

The option to increase the file size allowed for a scan is not enabled by default. Open a Technical Support case to enable this option.

Sensor and server

Windows

DFND-10830

Platform license agreement

We have updated the End User License Agreement (EULA) for the Cybereason platform.

The first user to sign in to the Cybereason console after you deploy this version will be required to accept the new agreement, even if you accepted previous versions of the agreement.

Server

N/A

DFND-5100

Sensors screen

We have updated the configuration the Cybereason platform uses to display information about sensors on machines with unsupported OS versions. Now, the Sensors screen will display Other for these sensors to enable you to better filter these machines.

Server

N/A

DFND-17884

Anti-Malware scans

On-demand scans now scan files that contain any Unicode characters in the file name.

Sensor and server

Windows

DFND-18111

Malops management

In the Malops management screen, only subset of malops were displayed when selecting the preset time filters such as Today, Last week, and so forth due to an incorrect calculation of the time window for these preset filters.

We have resolved this issue and the preset time filters correctly display all relevant Malops for these filters.

Server

N/A

DFND-18658

Behavioral allowlisting

When previewing the effect of a behavioral allowlisting rule in Japanese, the preview would display an error for invalid query syntax.

This issue has been resolved and the preview of the rules in Japanese displays the rules correctly.

Server

N/A

DFND-19310

Malop remediation

When you have a sensor policy with the option to Quarantine malicious files selected (in the Anti-Malware section of the sensor policy edit screen), if you have a MalOp with a quarantined file that you mark to Exclude, it was not possible to remove the quarantined file from the quarantine file location.

This issue has been resolved and you are now able to remove the file from quarantine.

Server

N/A

DFND-15804

Anti-Malware

In rare cases, the Anti-Malware service had recurring crashes and was not able to recover.

This issue has been resolved as we improved our Windows AV service to recover in a more robust way in during these rare cases.

Sensor and server

Windows

Version 21.2.293 (Service Pack)

Issue

Area

Description

Required Update

Supported OS

DFND-15182

Data collection (Windows)

We have updated the detection rule logic for APC injections to minimize false-positive rate.

Sensor and Server

Windows

CYBR-3469

Mac AV

We improved how the sensor initiates signature-based detection so that it reaches a protected state even sooner.

Sensor and Server

macOS

DFND-6581

Sensor Management

On the System > Sensors > Deleted Sensors screen, we have added the Deleted by and Deleted date columns to help you understand more about a deleted sensor.

Server

N/A

DFND-9947

SHA-based prevention support

The Cybereason platform now supports prevention on Windows machines for items based on SHA-1 and SHA-256 hash values.

Previous versions of Cybereason only supported prevention for MD5 hash values. This feature is disabled by default.

This feature is not generally available. Contact your Customer Success Manager to get access to this feature.

Sensor and Server

Windows

DFND-16940

Windows AV

We made configuration improvements to the archive scan to prevent it from timing out.

Sensor and Server

Windows

DFND-12516/DFND-3469

Sensor proxy connection

We have updated the sensor configuration for proxy connection to better ensure that the sensor connects to the proxy when using the auto-detect mechanism on the sensor.

Sensor and server

Windows

DFND-17049

Fileless Protection

In sensor versions between 21.2.180 and 21.2.268, Fileless protection scans that received a null pointer in the source field caused application crashes. This issue has been resolved.

Sensor and Server

Windows

DFND-16419

Remote Shell

Users with the Responder L2 role were unable to open the Remote Shell utility from the Investigation screen. This issue has been resolved and these users can open a Remote Shell utility as expected.

Server

N/A

DFND-13342

User Management

Users with notifications enabled did not receive notifications that a Malop with an unknown detection type was created. This issue has been resolved.

Server

N/A

DFND-17817

Sensors screen

If a Detection Server was disconnected from the Web App server, the Sensors and Detection Servers screen did not load properly.

This issue has been resolved and the Sensors/Detection Server screens in the Cybereason platform’s UI load properly.

Server

N/A

DFND-20505

Sensor Platform

In the latest version, when Application Control was enabled, file or folder rename operations on network drives failed.

This issue has been resolved and all file or folder network rename operations work on the machine as expected. Learn more

Sensor and server

Windows

Version 21.2.265 (Service Pack)

Issue

Area

Description

Required Update

Supported OS

DFND-14925

NGAV

If an error prevents Anti-Malware from being enabled on an endpoint (for example Other AV Found), we have improved reporting of the error and Anti-Malware automatically becomes enabled on the endpoint once the error is resolved.

Sensor and Server

Windows

DFND-7238

MalOp Management

If an affected machine in a MalOp had an undefined attribute, you could not respond to the MalOp. This issue has been resolved.

Server

N/A

Version 21.2.241 (Service Pack)

Issue

Area

Description

Required Update

Supported OS

DFND-13558

Linux AV

If a malicious process is detected by an Anti-malware quick scan, only the malicious process is killed. Other members of the process group continue to run as normal.

Sensor and Server

Linux

DFND-14013

Apple Silicon Mac M1 support

The Cybereason platform supports sensors running on Apple Silicon Mac M1, M1 Max, and M1 Pro. This applies to macOS Monterey and Big Sur. In versions prior to 21.2.241, sensors running on Apple M1 Silicon (Arm) Macs required the Rosetta 2 emulator in order to run.

Sensor and Server

macOS

DFND-14202

Sensor performance

Frequently, the sensor was not able to connect to the Dynamic Sensor Connections service to get sensor content updates. This occurred when the token was expired and a new token was not downloaded.

This issue has been resolved and the sensor is now able to continually connect to the Dynamic Sensor Connections service as expected on a continuous basis.

Sensor and server

Windows

Version 21.2.228 (LTS)

Feature

Description

Required Update

OS

DFIR

The DFIR package is available to add to your environment (at additional cost). To add this package to your Cybereason environment, contact Customer Success.

Server

Windows

Windows proxy

It is now possible to connect to the NGAV Local Update Server through a proxy.

Server

Windows

macOS Monterey 12.3 support

The Cybereason platform has expanded macOS Monterey support to include Monterey 12.3 and later. Previous versions of Cybereason 21.2 support Monterey 12.0 through 12.2.

Note

You must ensure that Python is installed on the machine as Python is no longer provided with macOS beginning with macOS 12.3 (Monterey).

Sensor and server

Mac OS 12 (Monterey)

Fileless Protection

A nonPowerShell .NET process using hooked calls caused the sensor to crash on some systems. This issue has been resolved.

Sensor and server

Windows

Sensor tampering protection

If Enhanced Sensor tampering protection detects an attempt to tamper with the sensor, a MalOp is created. To take part in the beta phase of this feature, contact your Customer Success Manager. Learn more

Sensor, server

Windows

Version 21.2.203

Feature

Description

Required Update

OS

Remote Shell

Use of the Remote Shell utility is now supported on machines running a supported Linux operating system.

This feature is not generally available. Contact your Customer Success Manager to use this feature.

Learn more

Sensor and server

Linux (all)

Version 21.2.190

Feature

Description

Required Update

OS

Behavioral execution protection

Behavioral execution protection is now generally available. Learn more

Sensor, server

Windows

Improved sensor update process

We have improved the sensor update process so you can update 1,000 sensors per hour. To enable this feature, contact your Customer Success Manager. Learn more

Sensor, server.

Windows

Malops management

The Malops Management screen and features are now generally available without the Beta status.

In addition, if your Cybereason environment is built with the newer data infrastructure, the Malops management screen has been updated for a smoother user experience and workflow, including a new search bar above the Malops list, new filters, and a time-based filter.,

Server

N/A

macOS Endpoint Security Framework (ESF) support

Sensors running on macOS Monterey (12) machines now support ESF.

Sensor and server

macOS

Sensor tampering protection

Enhanced Sensor tampering protection is available. To take part in the beta phase of this feature, contact your Customer Success Manager. Learn more

Sensor, server

Windows

Auto remediation for custom rules

You can now specify that the Cybereason platform perform automatic remediation actions when it encounters behavior that satisfies a custom detection rule. Learn more.

Server

N/A

Version 21.2.168

Feature

Description

Required Update

OS

Binary Similarity Analysis (BSA) in-memory protection

This version introduces Binary Similarity Analysis (BSA) protection as part of the NGAV protection suite. BSA in-memory protection performs memory scans to identify binary fractures of highly evasive attack tools (such as Cobalt strike, Emotet, Dridex, and more), and is capable of preventing them on execution. Learn more

This feature is not generally available. Contact your Customer Success Manager to use this feature.

Sensor and server

Windows

Exclusions by process name on Linux machines

To improve performance, the Cybereason platform now excludes known and safe processes by default on Linux machines.

You can also exclude additional files from Anti-Malware scans based on the name of the process that opens the files. To use this capability, contact Technical Support. Learn more

Sensor and server

Linux (all supported versions)

Query result customization

You can now customize a specific number of results in a page of query results. Learn more

Note

This feature requires that your Cybereason instance uses the newer data infrastructure.

This feature is not enabled by default. Open a Technical Support case to enable this feature.

Server

N/A

Debian 10 DNS collection

Sensors running Debian 10 now support DNS collection.

Server

Linux

Version 21.2.145

Feature

Description

Required Update

OS

Updated File search

We have updated the File search screen to make file search more intuitive and effective for you. This includes:

  • Having separate tabs for regular file search and YARA file search operations

  • Additional options for filters to limit the file search

  • Ability to configure a timeout period for the file search operation to minimize the impact on your Cybereason platform performance

Learn more

Server

N/A

Sensor grouping support for Remote Shell

We added the Local Responder role to enable you and your analysts to use the Remote Shell utility when you have sensor grouping enabled in your environment.

If you or a user admin assigns the Local Responder role to a user, you should also assign the Local Analyst role to the same user to enable them to access the sensors in the assigned groups.

Learn more

Server

N/A

Delete sensors from the Cybereason UI

To better manage the sensors within your environment, you can now delete a sensor from the sensors list in the Cybereason platform UI. Once the sensor is deleted from the UI, it is no longer visible in the UI, however, the sensor remains connected to the Detection server and collects and sends data for three days.

Server

N/A

AMSI/.NET modules for Fileless protection

The Cybereason platform provides a new option to select the AMSI and/or .NET modules for Fileless protection. Cybereason recommends that you activate both modules for full protection. This new capability allows you to select the type of protection that best suits your organization’s needs. Learn more

Sensor and server

Windows

Investigation query limits

From the Investigation screen you can select a timeframe within which to apply your query. Options include the last hour, 6 hours, 12 hours, or 24 hours, the last 3 or 7 days, or all data. Default value is 24 hours. Learn more

Server

N/A

Predictive Ransomware Protection

The Cybereason platform now supports a new type of ransomware protection which uses a multi-layered detection mechanism to identify typical ransomware behavior and prevent unknown strains of ransomware. This feature is disabled by default. Contact Technical Support to enable Predictive Ransomware Protection.

This feature is not generally available. Contact your Customer Success Manager to get access to this feature.

Sensor and Server

Windows

Sensor tampering protection

If Enhanced Sensor tampering protection detects an attempt to tamper with the sensor, a MalOp is created. To take part in the beta phase of this feature, contact your Customer Success Manager. Learn more

Sensor and server

Windows

Version 21.2.124

Feature

Description

Required Update

OS

Sensors for Mac

We have updated the sensor program name for the Mac sensors from com.cybereason.activeprobe to CybereasonSensor.app. As a result, after upgrading to this version, you will need to enable Full Disk Access for the new sensor on a macOS machine, even if you did this procedure previously.

If you grant Full Disk Access manually, see Enable Full Disk Access for macOS Sensors.

If you grant Full Disk Access via Jamf MDM, see macOS Deployment via Jamf MDM.

If you have other applications that use the sensor program name, such as OPSWAT, these other programs may no longer recognize or identify the sensor after the upgrade. As a result, you will need to update the sensor name in these programs accordingly.

Sensor and server

macOS (All)

Machine information collected for Windows endpoints

The Cybereason platform now collects and displays the following data for Windows endpoints:

  • The machine’s serial number. This data is visible in the Investigation screen, under the query results Serial number column.

  • The machine’s device model. This data is visible in the Sensors screen under the Device model column.

Sensor and server

Windows

Device control - Linux support

To increase protection across additional OSs and device types, the Device control feature now supports MTP and all USB devices on Linux endpoints. Learn more

Server

Linux

Linux AV

To improve performance of Anti-malware on access scans on Linux machines, the Cybereason platform now excludes network shares by default. In addition, the Cybereason platform excludes the following mount points on local paths by default:

  • /sys

  • /proc

To exclude additional mount points, contact Technical Support.

Sensor and server

Linux

Mac AV

For sensors on machines running macOS with Anti-malware enabled, on the System > Sensors screen, we have improved the reliability of the status displayed in Sensor status column.

Sensor and server

macOS

Mac AV

macOS developer workloads (such as Git and other developer tools) no longer have performance impacts in combination with Anti-malware on access scans.

Sensor, server

macOS

Mac AV

Anti-malware on access scans no longer have a performance impact on upgrading macOS machines to a newer OS version.

Sensor and server

macOS

Sensor installation for sensor groups

When using sensor groups you can download a sensor installation package pre-configured to add sensors to a specific group. Learn more.

Server

N/A

Version 21.2.103

Feature

Description

Required Update

OS

Custom reputations

Cybereason updated the Reputation screen in the UI. The new Reputation screen allows you to easily add, edit, and remove custom reputations without having to use a CSV file. Learn more

Server

N/A

Cybereason Connect

We have now limited access to the Cybereason Connect screen to users with a specific role. To access the Connect screen, you must have the Sensor Admin L1, System Admin, or Executive roles.

Server

N/A

Historical Data Lake

The Cybereason Historical Data Lake feature now enriches your historical queries with Malop data from your live environment. Learn more

N/A

N/A

Version 21.2.84

Feature

Description

Required Update

OS

XDR

The Cybereason platform now supports integration of log source data through the XDR module. You can now import and view log source data from supported platforms such as Okta, Google, and Fortinet to give you a wider view of activity across your organization.

XDR log source data integrates with existing EDR data to enable you to manage all data, both from endpoint sensors and XDR log sources, in a single place.

For more information about supported integrations, see Cybereason Integrations.

For more information about Cybereason XDR, see Extended Detection and Response (XDR).

Note

With the introduction of the XDR module, the User Element is renamed to the User Account Element.

Server

N/A

Windows 10 21H2 support

We now support sensors running on Windows 10 21H2 machines.

Server

Windows

Investigation query result export

On environments with the new Data Platform installed, the option to select the specific number of results to export to a CSV file when viewing investigation query results is enabled by default. You do not need to contact Technical Support to enable this export feature.

Server

N/A

Version 21.2.63

Feature

Description

Required Update

OS

Behavioral execution protection

Behavioral execution protection allows organizations to detect and prevent malicious execution of processes based on the process behavior. Behavioral execution protection uses intricate research data to identify anomalies in the image name, command line, image file metadata, or the process hierarchy. This data is available directly on the endpoint, which significantly shortens response time. Learn more

Note

This feature is not yet generally available. To request access to this feature, contact Customer Success.

Sensor, server

Windows

View Malop activity by timeframe

You can now view Malop activity from a certain time frame from the Malop details screen. Use the ‘View activity since’ feature on the top right of the Malop details screen to select a date range. The Malop details screen will update to reflect activity that occurred within the specified time frame.

Server

All OSs

Version 21.2.43

Feature

Description

Required Update

OS

macOS Monterey support

You can now install sensors on machines running the macOS Monterey operating system. The macOS Endpoint Security Framework (ESF) is not currently supported.

Server

macOS

Debian 10 support

You can now install sensors on machines running the Debian 10 operating system. DNS collection is supported in versions 21.2.168 and later.

Server

Linux

Linux AV

In Linux machines, the Cybereason platform now supports the option to perform on file access scans by default. You no longer need to contact Technical Support to enable this option.

Sensor and Server

Linux

Personal firewall control

To allow protection for additional operating systems, the use of Personal firewall control is now available for machines running Linux operating systems.

Learn more

Sensor and Server

Linux

Investigation query result export

You can now select the specific number of results to export to a CSV file when viewing investigation query results.

Learn more

Note

This feature requires that your Cybereason instance uses the newer data infrastructure.

Contact Technical Support to enable the feature.

Server

N/A

File events collection

We have updated the policy options for file events collection to help you select the proper level of collection in your organization. Now you can select from one of two modes to help you tailor the collection to meet your needs:

  • Moderate: The file events collection only collects from a select list of files relevant for security needs.

  • Aggressive: The file events collection collects from all files.

Learn more

Sensor and Server

Windows

WMI Persistent Object Element

We have added a number of new Features related to the WMI Persistent Element, including:

  • WMI Persistent Objects for the File Element

  • Consumer File Path for the WMI Persistent Object Element

  • Persistent type for the WMI Persistent Object Element

  • Script engine for the WMI Persistent Object Element

Server

N/A

Version 21.2.21

Feature

Description

Required Update

OS

Amazon Linux 2 support

You can now install sensors on machines running the Amazon Linux 2 operating system.

Server and Sensor

Amazon Linux 2

Windows 11 support

On the System > Dashboard screen, machines running Windows 11 are now displayed under the Sensors by OS version section.

Server

Windows

Sensor signatures database

After initial installation, the sensor now reports to the Windows Security Center after the signatures database downloaded is complete. This prevents an unnecessary notification stating virus protection is out of date.

If after 4 hours the signatures database download is not complete, the notification stating virus protection is out of date is correctly displayed.

Sensor, server

Window

Investigation query results

The Investigation screen now displays an estimated total count of all query results in the system. This enables you to understand the full scope of the issue you are searching for with your query. Learn more

Note

This feature requires that your Cybereason instance uses the newer data infrastructure.

Server

N/A

Please see our Legal Disclaimer on links to third party web sites.