All release notes
Platform
Microsoft 365 response actions, changes Secuno attributes to its own work, patch policy at scale, and CVE data that no longer disappears
Microsoft 365 can now be acted on, not only watched: fourteen new actions in four families, each behind a permission of its own, and an audit log feed that finds forwarding rules and suspicious app consents hours before the daily scan. Every change on a device is now checked against a ledger of Secuno's own jobs, so a patch Secuno installed no longer reads as a suspicious change, and a change no job may make weighs extra. Patching gained rules that decline, policy templates across clients, a fleet view per KB and compliance reports. CVEs that CVE.org or GitHub had already filled in were blanked as soon as NVD listed them; that is fixed and the affected CVEs are restored. Also: navigation grouped by task, three fewer sources of false positives, stricter checks on remote-access tools, and four long-standing known issues closed.
New
- Microsoft 365 response actions. Beside sign-out and disabling an account there are fourteen new actions in four families, each behind an application permission of its own: account recovery (require a password change at next sign-in, mark a user compromised or dismiss user risk in Entra ID Protection, list and remove MFA methods), the mailbox (switch an inbox rule off or back on or delete it, and switch off every external forwarding rule at once), Defender alerts (resolve and classify, optionally automatically when the Secuno case closes) and Intune devices (sync, lock, restart, a Defender scan or a signature update). An action is offered only when the tenant has granted its permission, and tenants that opted in earlier keep working without consenting again.
- Contain a compromised account. One playbook disables the account, signs it out everywhere, marks it compromised, switches off its external forwarding rules and requires a password change, as far as the tenant granted. Each step is listed as done, skipped or failed. Also new: removing external forwarding rules, revoking app consent and resetting MFA methods. The last is refused while the account is enabled, because an attacker holding the password would otherwise register the next method.
- Where the actions live, and what is deliberately missing. On the Users tab, one Respond button opens a panel with every action and the person's MFA methods (phone numbers masked), inbox rules and Intune devices. Identity cases gain the account actions and device cases the Intune actions, which reach a device even when its agent is offline. Automation gains seven actions, with three library rules that start report-only like every rule. Deliberately not built: wiping or retiring devices, removing roles or app permissions, changing Conditional Access, a Temporary Access Pass, and a password Secuno chooses. Every target is first checked against what Microsoft Graph lists for that user at that moment, every write is one audit row, and a deleted inbox rule's full definition is kept.
- The Microsoft 365 audit log feed, opt-in per tenant. Secuno reads Exchange and Entra ID activity from the Office 365 Management Activity API and opens a case on an inbox rule or mailbox setting that forwards outside the tenant, on rules that hide mail as invoice fraud does, and on consent to an app with access to mail or files. Microsoft typically publishes these events 60 to 90 minutes after they happen. That is hours faster than the daily scan, but it is not detection within minutes.
- Was this change ours? Every change in a device's change report is now checked against a ledger of Secuno's own patch, winget and response jobs. A change counts as explained only when the item, the time window and, for a binary, the SHA-256 all match a job; a name, path or publisher alone never counts. Explained changes open no risk and are left out of attack chains. Some categories no job may change, such as tamper protection, Defender exclusions, the firewall, BitLocker, local administrators, root certificates and the hosts file: a change there always comes out at high or above. The device's timeline shows each change's verdict, reason, job and file hash.
- Patch rules that decline. Auto-approval rules can now match on vendor, product, KB, title and superseded-only, and can decline as well. Decline wins over approve, but a rule never declines a patch a person decided on or one in the emergency lane. One rule can cover several of a partner's clients, and the editor shows a live count of the patches it matches. Also new: a fleet-wide view per KB, bulk actions on up to 5,000 patches at once, policy templates with rings and deployment policy that a partner can apply to every new client, with drift reported, and compliance reports with a daily trend, CSV and PDF export and scheduled delivery.
- Install steps without scripts. A fixed set of steps can be set around an update: stop or start a service, close a process, skip if a process is running, wait for a service to be healthy, and require a restart. Protected services and processes can never be stopped, and a service stopped beforehand is always started again. A device with no patch scan in seven days counts as unknown and is left out of the compliance percentage.
- An analyst's own call on a risk score. An analyst who changes a risk's severity or score no longer sees the change undone by the next rescore: it stands as an override, with who and when, and Revert to calculated score undoes it. The Score card shows the model score, the AI adjustment and the override side by side, and the list can be sorted by score.
- Risk treatment, completed. A risk's timeline shows every proposal, approval, rejection and withdrawal, with who acted, the treatment type and the rationale. The acceptance expiry view shows the rationale, compensating controls and who proposed and approved. Approvers get an email when a treatment is proposed, and proposers when it is decided.
- Navigation grouped by task. The menu is grouped into Overview, Respond, Vulnerabilities, Endpoints, Posture and Admin. Back from a linked record returns to where you came from, also after a refresh, in a new tab or on a shared link, and the return address must be a page of the platform itself.
- Device type can be set by hand, and then stays as set until someone chooses auto-detect from the operating system.
Improved
- Unused software is now visible. Software counts as used when a running process comes from its install folder, and falls into active, idle for 30, 90 or 180 days, watching, or not measurable when the software has no install folder of its own. Before, everything read zero days idle. Because measurement restarted with this release, nothing can read stale or unused until 90 or 180 days after the update.
- Stricter checks on remote-access tools. On Windows, a process named like AnyDesk, TeamViewer, ScreenConnect, Splashtop, Zoho Assist, LogMeIn/GoTo, Atera, TightVNC or NetSupport must carry that vendor's valid signature; without it, it is a high masquerade finding. On Linux the package database decides instead of the path. A name on the sanctioned list no longer suppresses anything. Expect new findings on estates that relied on that list.
- Access to LSASS. The exemption for Microsoft-signed processes now covers only protected processes and signed binaries that are not known dual-use tools and sit directly in the system folders or the Defender folder. PowerShell and rundll32 dumping LSASS memory are therefore no longer skipped. Expect more reports from unprotected third-party software; those belong on the operator's list.
- Ordinary process chains are learned. The agents now count every parent and child pair, not only suspicious ones, so an ordinary chain such as cmd.exe to conhost.exe enters the baseline instead of alerting again every night. A deviation already raised on the device is not raised again.
- Real-time detections reach the platform more reliably. Batches held back by the minimum interval are sent after it instead of being dropped, and event-log detections such as DCSync, LSASS access, permanent WMI subscriptions and clearing the security log use the urgent path.
- File-drop alerts name the process that wrote the file, read from the Windows kernel trace instead of inferred from timing, and each alert says how it was attributed. This arrives with the next Windows agent.
- Background engines and reporting. A review of every known gap in the engines produced 23 fixes. Scheduled work for correlation, Microsoft 365 scans, SLA checks and automatic approvals runs on the shared scheduler, so a job can no longer overlap itself. A control page lists up to 2,000 failing devices instead of 25, and a reopened investigation gets a new SLA due date.
- Telemetry counters say when they last moved. A device that lost events once, weeks ago, no longer reads as if it is losing them now: the warning appears only for a loss in the last 24 hours.
- Severity looks the same everywhere. Around fifteen pages had their own severity colours; every colour now comes from one definition, and an Important patch and a High risk look alike.
- Every change to the platform, the console and the Windows agent is now built and tested automatically, and the compliance control set is versioned, so a control cannot appear or vanish unnoticed.
Changed
- Change batches with items still unexplained are now low instead of informational. There are no job feeds yet for browser updaters, user installs, Intune or other RMM tools, so those read as unexplained. Clients that patch through Windows Update rather than Secuno will see this on KB batches.
- Agent changes from this release, such as the new file-activity rules and signed orders on Linux, are being collected into one agent release for Windows and Linux rather than shipped one by one. Where a fix also has a platform side, as the developer toolchain rule does, that side already applies to every agent.
Fixed
- CVEs that CVE.org or the GitHub Advisory Database had already filled in lost their score, product rules, references and weaknesses as soon as NVD listed them but had not yet analysed them, and stayed blank until NVD finished. The import now merges: what NVD has wins, and what NVD lacks keeps what another source stored. The CVEs already blanked are restored from CVE.org in a one-time repair.
- KEV never reached a risk's score, so no risk received the KEV bonus or the KEV floor. That is fixed. A risk with several CVEs is now scored against its most exploited one, the AI adjustment survives a rescore, and when severity rises the due date moves in, never out. Every risk was rescored after the update, so KEV risks moved up.
- Comparative behaviour detection went quiet about 48 hours after every platform restart, because a cached profile was not refreshed after the nightly rebuild. Each rebuild now refreshes the profile at once, and every cached profile is re-read after an hour.
- Three sources of false positives in the investigation queue are closed: a build tool clearing its cache from a protected folder, a signed installer unpacking in a temp folder such as the VS Code updater, and Windows re-registering its own scheduled tasks. A developer tool or installer that is unsigned, or sits where a user can write, keeps its full weight. A renamed device now shows the name it had when it was detected.
- Privileged logons on Linux always came in as high, even when the agent graded an administrator's ordinary root shell through sudo as medium. The case now takes the agent's grade.
- Four long-standing known issues are closed: PDF reports over very large sets of risks no longer time out (they list up to 500 in detail and count all of them), two-factor setup recovers from a QR code that fails to load, formatting in knowledge base articles and ticket comments now displays, and Risks, Scan Requests, Tasks and Audit Logs work on a phone.
- Duplicate patch entries for the same KB, created when agents reported at the same moment, are merged with every operator decision kept, and can no longer occur.
- Audit coverage gaps opened evidence-tampering cases. Such a case now opens only on an actual audit policy change, and open cases that rested on a gap alone are closed.
- Editing a partner user or a partner's details did not save. Also, the risk queue defaults to newest first again, the Microsoft 365 settings view no longer clips its cards, and truncated text shows its full value on hover.
Security
- From version 0.48 the Linux agent runs only active-response orders the platform has signed, as the Windows agent already did. An unsigned or unverifiable order is refused, only the signed document is executed, and an order is bound to the device it was issued for and expires. This arrives with the next agent release.
- The console now sends HSTS with includeSubDomains and preload, the same value the API already sent.