Secuno
ENNL
Book demo
All release notes
Platform

One case per device, far fewer false alarms, patching that proves its work, and Managed SOC tooling

v0.0.61Major

Two rounds of false-positive review mean far fewer and calmer cases, and every device now holds one case at a time. Patching learns to prove its work: a vulnerability history per device and CVE, a remediation plan ranked by the risk each fix removes, vendor workarounds, and Verified that now means the CVEs actually closed. Also new: a Managed SOC mode with on-call paging and response targets for the partner's own team, custom dashboards and wall screens, two-way PSA sync, L1 and L2 analyst roles, and navigation grouped by job. The open findings of the 8 October security review are closed. Windows agents 0.61 and 0.62 and Linux agents 0.53 and 0.54 were released on 16 October.

New

  • One case per device. Every new detection on a device folds into that device's open case, and identity signals into their user's. The case lists every detection it holds and its headline follows the most severe one. A detection that folds in still runs automations and integrations, so rules written for a single detection keep working. Incidents now open only when an analyst escalates, an automation opens one, or activity spans several devices, and each incident has its own page and link.
  • Vulnerability history. Every CVE on every device is now a finding that opens, carries an SLA and closes with a reason: updated to a version, removed, or no longer affected. Time to fix and SLA met are shown per month, and the question whether a laptop was vulnerable on a given date has an answer. A product risk's due date follows its oldest open finding, so long-lived risks are no longer overdue forever; a date someone typed is kept.
  • Is the vulnerable code running. Each finding shows whether the software is running, was used recently, has been idle for 90 days or more, or is a library that is not loaded in memory. Idle software and unloaded libraries score a little lower; known exploited CVEs keep their floor. CVEs in libraries an application ships in its own folder get their own category, Bundled Vulnerabilities.
  • Remediation plan. A new page ranks the actual fixes (an update, an app upgrade, removing unused software, a workaround) by how much of the client's risk each removes, without counting a CVE twice, and every row can be acted on directly.
  • Vendor workarounds. Twelve built-in mitigations, including Follina, PrintNightmare, SMBGhost, PwnKit and cups-browsed, can be applied and reverted from the console, are checked on every inventory and expire after a set date.
  • Patching with owners and proof. Winget apps and Linux packages now get Emergency and Accelerated lanes and SLAs based on the CVEs they fix, like Windows updates. Declines and device blocks can carry an owner and an end date, after which the decision reopens. Server installs can wait for a recent verified backup, read from the server itself (VSS, Windows Server Backup, Veeam) or from Datto, Azure Backup or Veeam Backup & Replication; this is off until switched on. A bad app version can be rolled back across a client or group in one action, and that version is then declined. Also new: monthly maintenance windows such as every third Saturday or Patch Tuesday plus a number of days, approval for chosen devices only, rollback of Linux packages, and estate-wide and KEV remediation figures in patch reports.
  • Branded restart prompt and tray. The restart prompt takes the partner's logo, accent colour and language (Dutch, French or English), and a Windows tray icon offers Restart now, Postpone and Check for updates.
  • Managed SOC mode. A client can be placed under business-hours or 24/7 coverage by the partner's own team, with acknowledge, contain and resolve targets per severity. An on-call rota and pager escalate untouched cases through primary, secondary and the client's own leads, and a SOC page tracks every target met or missed. A new Twilio integration texts or calls the person on call, and PagerDuty folds every escalation level for a case into one incident.
  • L1 and L2 analyst roles. L1 triages; L2 investigates and contains. Neither can configure the platform, accept risk or manage users, and two-factor authentication is mandatory for both by default.
  • Custom dashboards and wall screens. Named dashboards are built from a fixed catalogue of widgets, shared with the tenant or with clients (each sees only its own figures), exported to PDF or scheduled, with thirteen templates to start from. A Display screen account shows shared dashboards in kiosk mode and nothing else, stays signed in for up to 30 days and can cover one client, several or all.
  • Response rule library. A new Response tab holds Secuno-maintained templates the agent can act on by itself, such as stopping PowerShell that destroys backups, dumps credentials or disables AMSI, plus reviewed YARA and Sigma rules. Every template starts in report-only and can be armed only after 14 days without a false positive.
  • Lateral movement over SMB. The Windows agent now spots executables written to administrative shares, PsExec-style remote service execution, and accounts logging on to a workstation from an address they have never used before.
  • A baseline that knows ordinary activity. Both agents now report a sample of everyday domains and connections, so new on this device no longer only means newly suspicious. The sample carries no addresses, URLs or user names. A new device borrows the combined baseline of its peers at enrolment (per client: off, report only or raising cases), and DNS tunnelling and discovery thresholds can be tuned per client, with out-of-range values refused.
  • Service desk. Tickets open beside the list, with replies and notes from the side pane, j and k to step through, and resizable panes. A new ticket starts with who it is for and fills in the rest. Also new: teams with leads and auto-assignment, one-click macros that reply and update a ticket together, a workload report, a notice when a colleague is already answering, suggested knowledge base articles and pre-made answers. Scan requests are now tickets, and partners can keep their own knowledge base library beside Secuno's.
  • Two-way PSA sync. Jira, ServiceNow, ConnectWise and Autotask keep one ticket per record and add later events as notes, and a ticket closed in the PSA can optionally close the Secuno ticket. Tickets from workflows, automations and Create ticket now reach integrations too. With NinjaOne and Datto RMM job logs, a burst of activity your RMM actually ran can be matched against the RMM's own record, within one client only.
  • API keys and billing export. API keys give machine-to-machine access that acts as the person who made it, read only by default, valid for a year at most and audited. A billing export gives peak workstations, servers, Microsoft 365 identities, websites and modules per client and month, as JSON or CSV.
  • Endpoint transparency. A public page per organisation, and optionally a Windows tray, tells the people whose devices run the agent what it does and does not see.
  • Where false positives come from. Detection Content, Track Record groups dismissed cases by what fired, the process and the device, busiest first, so it is clear what to tune. A playbook suggestion on a case or incident attaches the playbook that fits and says why.
  • New automation triggers for ticket, risk, patch, incident, certificate, compliance, device and Microsoft 365 events, plus client onboarding and offboarding.

Improved

  • Attack stories need a real detection. Everyday administration such as logons, mapped drives, USB sticks, a mistyped password or a new listening port still appears as context but can no longer start or refresh a story on its own. Every change that quiets a signal is tested against the attack it must not hide.
  • Known administrators stay quiet. An administrator who has logged on to a device before raises no case; an account new to the device opens one medium case. Unusual privileges are reported as before. Script blocks, NTLM logons and WMI subscriptions take the grade the agent gave them instead of a fixed high, and NTLMv1 stays high.
  • Windows itself no longer looks suspicious. Windows' own WMI binding, which opened a high persistence case on every reboot, no longer does, and real subscriptions now show what they run. Defender reinstalling its sensor driver on each definition update is recognised by exact name and location; a lookalike elsewhere is still reported. Files signed through a Windows catalog, such as cmd.exe and most of System32, are recognised as signed. Signed copies of Discord, Teams, Slack and Zoom in AppData are not suspicious for their location alone; unsigned or tampered copies still are.
  • Routine bursts fade. A file-activity burst a device shows on five or more days is graded down one step, unless it comes from an unusual folder or arrives alongside another critical signal.
  • Breached passwords page only when targeted. A credential signal on an account with a leaked password is critical only when that account was the actual target, and shared names such as admin@ and administrator@ no longer match every server's local account.
  • Software changes need less review. In-place upgrades and uninstalls are accepted automatically unless a security tool is removed, and pending items can be allowed for a whole client from the risk page. More vendor updaters and routine software churn is recognised and raises nothing.
  • Device travel judged by distance and time. A laptop that changes country with its owner raises nothing; only a trip nobody could have made in the time raises impossible travel.
  • Safer automatic response. A campaign match without matching infrastructure is no longer treated as confirmed, and a low-severity signal can no longer replace the process a kill rule targets. Automated isolation, restarts and kills skip domain controllers and critical assets, fleet caps are stricter, and editing a live rule puts it back in report-only.
  • Firewall connections. Nineteen fixes from reading a real office firewall: fuller FortiGate reads, fewer false findings, per-source event cursors, back-off on failures and respect for Meraki rate limits. Credentials can be rotated in place, adding a firewall asks up front whether to connect by API or by questionnaire, and the Firewalls page spans every client.
  • Console. Navigation is grouped by job (Respond, Risks & Exposure, Assets, Detection & Automation, Compliance & Reports, Organisation and Platform), and eight pages are folded into the pages they belonged to, with every old link redirected. Cases, risks and tickets open beside their list on wide screens. Filters live in the address, so a filtered view survives a refresh and can be shared. Dialogs no longer close on a stray click, tables share one style, dates use one format, and each email notification has its own switch. The Newly exploited banner shows only CVEs CISA added to KEV in the last 30 days and can be acknowledged per user.
  • Agents. Windows 0.61 and 0.62 bring catalog signature checks, stricter masquerade and LSASS checks, smarter script-block grading and file bursts that name their services and folders. Linux 0.53 and 0.54 bring fewer false positives, scheduled destructive commands recorded instead of dropped, package rollback and a correct firewall reading. Both gain software uninstall, mitigations and the ordinary-activity sample, and a crashing collector or event source now recovers on its own.

Changed

  • Expect far fewer cases and incidents after this update. The first administrator logon on each device is reported once at medium, because the history of known administrators starts with this release. On Windows 0.60 devices, script-block cases can open at critical until the device runs 0.61 or later.
  • Integrations subscribed to new-case events now also hear about each new detection that folds into an open case, and about incidents the platform opens and closes itself.
  • Every risk is re-scored once. Some idle-software risks drop a band and some long-lived product risks are no longer overdue. Automation rules or saved searches that filter on the Vulnerability category do not match bundled vulnerabilities; add Bundled Vulnerabilities where needed.
  • Patches that read Verified may show in progress until each device's next inventory, and some will show failed. After three failed installs in a row a device stops retrying and raises one alert instead of one per cycle, with a one-click retry. Apps and Linux packages appear in the Emergency and Accelerated lanes for the first time.
  • New auto-approve rules start in report-only and approve a specific version, so each new release goes back through the rules. Existing rules keep enforcing.
  • The admin-share detections need the File Share and Detailed File Share audit subcategories switched on. Autotask integrations need their integration code filled in before Test connection passes.
  • Uninstall, mitigation and Linux rollback, two-way PSA sync, the RMM job logs and the backup vendor integrations are new. Try each on one client or a lab device before a wide rollout. The backup check before server patching, reading PSA ticket status back, the RMM job logs, Managed SOC and the transparency page for existing organisations are off by default. The tray is on by default and can be switched off per deployment policy before the agent is rolled out.
  • Update the platform before the agents, never the other way round.

Fixed

  • Detections that never fired now do. Audit-policy changes were read the wrong way round, runas /netonly and pass-the-hash were never reported, Defender exclusions were missed in real time, and a YARA match on in-memory shellcode opened no case.
  • Verified meant installed. A successful install is now verified only when a later inventory shows its CVEs gone, and installs that reported success on a still-vulnerable device now show as failed.
  • Status changes stick. Once a person closes or reopens an incident, the correlator no longer changes it back, and a case taken out of an incident stays out. Two alerts landing at once no longer open two incidents, and simultaneous updates no longer overwrite each other's timeline entries.
  • Dismissed cases stay quiet. A replayed signal no longer reopens a closed case, and a dismissal holds for its full window from the moment it was made.
  • Microsoft 365 checks that were skipped now run: forwarding, transport rules, mail DNS and hybrid sync. Forwards to colleagues are no longer called external.
  • Winget package rows that could never install, and Windows runtime packages the agent cannot update, are removed.

Security

  • 8 October security review, second pass. Every open finding is closed. Microsoft identities count as verified only for domain-verified accounts that are not guests, and single sign-on skips the second factor only when the identity provider confirmed MFA. Secuno's own administrators are scoped to their tenant on every route, like every other role, and can no longer manage a peer administrator.
  • Indicator blocks can never target the platform, known remote-management vendors or customer gateways. An internal service now answers authenticated calls only. A revoked device can never be recovered by reinstalling, older enrolment tokens are capped in uses and lifetime, and patch, app and restart work runs only on a properly signed agent.
  • Approval to deliver to an internal address is bound to that address, watching a record checks that the caller can reach its client, dark web watch lists are never copied when a client is cloned, oversized requests are refused, and a set of smaller checks was tightened.