Secuno
ENNL
Book demo
All release notes
Platform

Microsoft 365 posture and full incident response

v0.0.50Major

Large consolidated release adding two major new product areas, Microsoft 365 / Entra ID security posture and full incident response, alongside compliance framework mapping, multi-source CVE ingestion, risk templates, parent and child risk relationships, vulnerability age and SLA trending, drill-down dashboards, and a broad set of detection and reporting additions. It also closes gaps found during hands-on testing so that several previously listed capabilities now run end to end.

New

  • Microsoft 365 and Entra ID security posture (new): a read-only assessment of a client's Microsoft 365 tenant and identity environment, connected through a registered Entra application with no agent on Microsoft infrastructure. Secuno reads security-relevant configuration and surfaces findings as risks on a dedicated posture dashboard. Coverage includes MFA registration and identity, privileged-account monitoring, risky users and sign-ins, mail forwarding and SPF/DKIM/DMARC, SharePoint and Teams sharing, OAuth app and consent auditing, legacy-authentication exposure, hybrid sync health, Secure Score and trend, and inactive or guest accounts. Two onboarding paths are offered: a Secuno-managed application with one-time admin consent, or a bring-your-own Entra application, each supporting certificate or client-secret authentication. A new cross-client Microsoft 365 overview and a per-client posture page (findings, users, applications, tenant baseline and scan history) are added under Security.
  • Incident Response (new): a first-class incident capability distinct from risks, describing a coordinated response to an active attack or breach. Incidents carry their own lifecycle (Open, Contained, Eradicated, Recovered, Closed), responder team, affected devices and users, linked risks and tickets, a timeline and a post-incident report. A library of guided playbooks with ordered steps is attached to risk categories, with five global runbooks available out of the box. Detect-to-contain and detect-to-recover durations feed mean-time-to-detect and mean-time-to-remediate reporting. Risks gain an Evidence section for uploading, listing and downloading supporting files.
  • Compliance framework mapping: risks and device checks are mapped to CIS, NIST CSF, ISO 27001, NIS2 and DORA so regulated clients can produce framework-specific reports. A new Compliance page offers a framework selector, optional client scope, summary cards and an expandable per-control breakdown that rolls up to compliant, gap or not assessed.
  • Risk templates: a seeded library of 25 common risk scenarios can be applied as a starting point in the create-risk form, pre-filling title, description, severity, category, scores and remediation while leaving every field editable.
  • Parent and child risk relationships: risks can be linked into a hierarchy so a root-cause risk stays grouped with its derived child risks. Resolving a parent can optionally cascade mitigation to its open children.
  • Vulnerability age and SLA trending: a new Risk Age and SLA dashboard widget shows open count, average open age, SLA-breach (overdue) count, an age-distribution chart and mean time to remediate for resolved risks.
  • Interactive drill-down dashboards: risk metric cards, per-severity rows and distribution bars now deep-link to a pre-filtered risk list, and the risk list reads its filters from the URL so shared links land on the intended view.
  • Single-client dashboard selector: the portfolio dashboard can now be scoped to a single client to view that client's statistics in isolation, in addition to the aggregate view.
  • Multi-source CVE ingestion: two new vulnerability sources are added alongside the existing feed. A direct CVE.org (MITRE) path cuts discovery lag by ingesting newly published CVEs at the source, and a GitHub Advisory Database path adds package-ecosystem coverage for npm, pip, Maven, NuGet, Go, RubyGems and Rust advisories, tagged by ecosystem so a package rule only matches devices that actually use that ecosystem. The existing feed becomes an enrichment layer that adds precise version rules as they arrive.
  • Certificate monitoring: scheduled TLS checks against registered client domains and IPs raise a risk when a certificate is expired or expiring within 30 days, managed from a new Certificate Monitoring tab on the Threat Intelligence page.
  • Threat-intelligence feeds: structured ingestion via a TAXII 2.1 client and VirusTotal hash lookups, plus a Shodan client that sweeps device public IPs for internet-exposure findings and correlates threat-feed indicators against managed devices. External endpoints and keys stay blank until configured.
  • CVE environmental scoring and exploit tracking: CVEs now carry exploit-availability signals (public exploit, Metasploit module, proof-of-concept) for prioritisation, and asset-level environmental modifiers recompute an effective score per correlation result based on each asset's criticality. A formal CVE-device waiver workflow (justification, approver, expiry) suppresses re-correlation for an excepted pair until it expires, distinct from marking a false positive.
  • Audit log export: the audit viewer can be exported to CSV or JSON for external retention, respecting the active tab and current filters, capped at 50,000 rows.
  • Mandatory two-factor authentication: a per-client setting refuses access for users who have not yet enrolled in 2FA until they do.
  • Event-driven email notifications: transactional emails are sent over the existing SMTP integration for high-signal events including new assignment, severity escalation, ticket status change and device compliance failure, honouring each user's notification preferences. Email sending stays dormant until SMTP is configured.
  • Software policy enforcement: a configurable rule engine flags prohibited software by name or publisher, with allowlist exceptions and quick presets for remote-access tools, peer-to-peer clients and crypto miners. A match automatically raises a risk on the device. The Software Policies surface now lives on the Settings page.
  • Geo-IP context: device public IPs and platform login IPs are resolved to country and city, enabling unexpected-country and impossible-travel signals.
  • Impossible-travel detection for logins: each user login is compared against the previous one, and a physically impossible travel speed raises an audit event and a high-severity access-control risk.

Improved

  • Escalating an investigation now opens a coordinated incident pre-filled from the investigation (title, severity, affected device, responders and linked risk) and links the two, with a View Incident shortcut on the investigation.
  • Password-age compliance is now evaluated: an enabled local account with a never-expiring password or a password older than 90 days fails a new password-policy check, alongside the existing BitLocker and antivirus checks.
  • Investigations list page rebuilt to mirror the Risk Management layout: a full-width shell, a sticky left attack-type filter rail, stat cards and results table in the main column, and top-of-page error banners.
  • Expanded internal request tracing and structured logging to speed up support diagnosis, off by default and with no effect on request behaviour.

Fixed

  • A user created with a mixed-case email address could not log in because login lookups lower-cased the address while creation stored it verbatim. Email addresses are now normalised to lower case on create and update.
  • Investigation badges (signal type, confidence, status) no longer stretch into oversized ovals and now truncate cleanly; results-table columns were rebalanced so Status and Detected no longer overlap; and the Risk Management Clear Filters button is now correctly sized.