CHANGES FOR PLATFORM

Please choose from the release notes listed below:
 

Portal Update - September 2026

Updates
  • Introduced guided, field-based Search with suggestions for fields, operators, and values.
  • Updated Search to show the retention period for each data source and prevent date selections outside the available period.
  • Simplified workflow-triggered alert emails to provide essential alert information and a direct Portal link without reproducing the full alert payload.
  • Added device-level controls that allow authorized users to exclude selected endpoints from disruptive SOC actions.
  • Improved the reliability of agent-generated alert processing.
Fixes
  • Fixed an issue affecting Microsoft sign-in identity validation.
  • Fixed an issue where failed workflow actions were not recorded with sufficient troubleshooting information.
  • Clarified activity-history messages when workflows close alerts or change alert priority.
  • Fixed missing detection details on some alerts.
  • Restored the macOS log category in Search when applicable data is available.
 

Agent 3.3.4 (Mac-only) - September 10, 2026

Fixes
  • Fixed degraded macOS agent performance when Full Disk Access has not been enabled.
 

Portal Update - August 2026

Updates
  • Improved the Escalation Contacts experience to make escalation settings easier to configure and manage.
  • Updated Global Workflows to indicate when an MDR or MDR Complete subscription is required.
Fixes
  • Improved the consistency of agent counts across billing and reporting experiences.
  • Fixed an issue where services associated with suspended child keycodes could continue to appear active.
  • Fixed issues affecting the display and management of mute rules.
  • Fixed Microsoft alert synchronization issues affecting UK-hosted partners.
  • Fixed an issue that could prevent alert priority updates from being applied correctly.
 

Agent 3.3.3 - August 31, 2026

Updates
  • Improved Windows agent update reliability when other security software temporarily scans or locks the installer.
  • Improved agent communication in environments that use VPNs or network traffic inspection.
Fixes
  • Fixed an issue where eventlog collection would not function on Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2.
  • Fixed an issue where removable Windows drives could not always be safely ejected.
  • Fixed an issue preventing threat intelligence enrichment for some machine-learning file alerts.
  • Fixed an issue where unexpected characters could appear after the username in Windows file owner information.
  • Fixed a quarantine-handling issue that could allow files placed in a quarantine location by a local user to interfere with normal quarantine processing.
 

Agent 3.3.2 - August 20, 2026

Fixes
  • Fixed an issue that could prevent the agent from being uninstalled through the Detection & Response Portal.
  • Fixed an issue where the agent could attempt to access network or redirected drives while identifying local files to scan.
  • Fixed degraded agent performance that could lead to dropped eventlogs.
 

Agent 3.3.0 - August 18, 2026

Updates
  • Added on-agent machine-learning malware detection to identify potentially malicious files directly on the endpoint.
  • Expanded Windows registry and process activity available for detection and threat hunting.
  • Improved alerting capabilities for inventory and file activity.
  • Enriched file events with the type of file activity and, on macOS and Linux, the process responsible for the activity.
  • Improved threat-hunting reliability while reducing agent resource usage and installation package size.
  • Added diagnostic information to help identify the cause of failed agent upgrades.
  • Added dormant mode to stop data collection when a customer does not have an active subscription.
  • Updated Windows and macOS components with OpenText Core EDR branding.
Fixes
  • Fixed security issues affecting the agent and upgrade process.
  • Fixed startup diagnostics that could incorrectly report agent services as unavailable.
  • Corrected browsing-activity timestamps on macOS.
  • Fixed DNS diagnostics that could display results for the wrong data center.
  • Fixed alert-processing issues that could omit activity, duplicate event information, or cause excessive memory usage.
  • Fixed an issue where some macOS file activity, particularly activity performed through Finder, could be missed.
  • Fixed agent reinstallation behavior when an endpoint is moved to a different keycode.
 

Portal Update - July 2026

Updates
  • Added SOC handling and product-level information to alerts, with new filtering options that help partners identify alerts requiring their attention.
  • Added structured SOC escalation settings for contact order, availability, office hours, and disruptive-action consent.
  • Added reminders for incomplete SOC escalation configuration.
  • Added the ability to replay applicable in-product guidance from the user menu.
  • Improved enforcement of read-only permissions for Reader users.
Fixes
  • Fixed SMS and phone-call workflow notifications for some international numbers and improved SMS delivery across alert triggers.
  • Fixed an issue that prevented some users from exporting vulnerability findings to CSV.
  • Fixed Monthly Metrics report generation and delivery.
  • Corrected Microsoft license warnings and improved Autotask and Webroot integration reliability.
  • Fixed portal logout behavior so ending a session requires the user to authenticate again.
  • Fixed duplicate customer and subscription records and corrected SOC escalation for customers without an active MDR subscription.
 

Agent 3.2.1 - June 16, 2026

Updates
  • Improved macOS agent by aligning performance, reliability, and behavior with Windows and Linux, including simplified deployment and more consistent upgrades.
  • Simplified macOS deployment by reducing Full Disk Access (FDA) configuration requirements, enabling upgrades without changes to existing permissions or MDM settings.
  • Improved macOS device identity, reporting accuracy, and synchronization with the OpenText Management Console.
  • Expanded searchable software inventory to include Safari extensions, Visual Studio Code extensions, JetBrains plugins, NPM packages, and Python packages for improved investigation and threat hunting.
  • Improved alert details by allowing multiple detections to appear on applicable alerts in the Portal.
  • Improved alert consistency across endpoint agent restarts.
Fixes
  • Fixed a performance issue on Windows endpoints after waking from sleep for an extended period.
  • Improved browser history collection reliability on macOS endpoints, including performance improvements and preventing browser history events from being dropped.
  • Fixed a rare crash in file threat processing.
  • Improved inventory consistency to prevent duplicate vulnerability entries for Appx packages.
 

Portal Update - June 2026

Updates
  • Updated SOC escalation behavior so escalation is governed by MDR entitlement and alert classification rather than the Escalate to SOC workflow action, supporting Core MDR and upcoming MDR Complete capabilities.
  • Added detection for Kerberos username enumeration and Kerberos-based brute-force activity.
  • Added persistent threat hunter blacklisting for inventory data so future matching inventory items can continue to generate alerts.
  • Added support for provisioning mobile orders in the UK based on partner data locality settings.
  • Improved provisioning and entitlement state handling to reduce partial or inconsistent customer states during product changes.
  • Improved customer lifecycle handling when customers are suspended or cancelled.
  • Improved integration reliability and performance when loading, saving, and updating integration settings.
  • Improved vulnerability reporting support and API consistency.
Fixes
  • Fixed Webroot alert timing so older detections are not treated as newly generated alerts or incorrectly escalated by workflows.
  • Fixed an issue where Assigned Privileged Role alerts could fail to trigger when matching logs were received.
  • Fixed an issue where valid Microsoft Entra ID P1 licenses provided through bundled Microsoft SKUs could be incorrectly reported as missing.
  • Fixed an issue where Autotask ticket closure updates could fail to sync back to alerts in the Portal.
  • Fixed an issue where the Webroot source appeared in Search even though Webroot detections are surfaced through Alerts.
  • Fixed an issue where similar domains threat intelligence queries could fail.
  • Fixed malformed file path data in Microsoft Defender malware alerts.
  • Fixed an issue where trial expiration was not correctly reflected in platform state, which could affect usage and billing accuracy.
  • Hardened UK provisioning behavior to reduce the risk of incomplete or inaccessible MDR/EDR portal setups.
  • Fixed an issue where MDR Complete to MDR downgrade flows could leave a customer inactive or incorrectly provisioned.
  • Fixed malformed alert body formatting for Harmony Mobile alerts.
 

Agent 3.1.4 (Windows and Linux) - June 16, 2026

Updates
  • Improved reliability of agent telemetry delivery, particularly in environments with strict firewall or VPN controls.
  • Enhanced consistency of event reporting to reduce the likelihood of delayed or incomplete telemetry.
  • Simplified and modernized communication approach to improve scalability and reliability of data transmission.
Fixes
  • Fixed an issue where telemetry delivery could be unreliable under certain network conditions.
 

Agent 3.1.3 (Windows and Linux) - June 3, 2026

Fixes
  • Fixed an issue where agent telemetry delivery could be delayed, which could result in delayed or missed alerts.
  • Fixed an issue where agent upgrades could fail under certain network conditions.
 

Portal Update - May 2026

Updates
  • Added support for capturing and displaying partner phone numbers to improve SOC contact options.
  • Added support for Amazon Linux in vulnerability reporting.
  • Improved brute-force detection to trigger alerts more consistently during repeated authentication failures.
  • Improved integration performance to reduce loading times when viewing integrations.
  • Improved integration status visibility so configuration issues are clearly identified.
  • Improved consistency of search behavior across regions, including alignment between UK and US environments.
Fixes
  • Fixed an issue where workflows could report success even when configured actions failed.
  • Fixed an issue where workflow actions could fail or not execute as expected.
  • Fixed an issue where malware detection alerts did not trigger expected escalation workflows.
  • Fixed an issue where alert titles displayed rule IDs instead of descriptive names.
  • Fixed an issue where “impossible travel” detections did not correctly correlate login activity across locations.
  • Fixed an issue where saved searches were not visible without refreshing the page.
  • Fixed an issue where scheduled reports could return empty results despite available data.
  • Fixed an issue where search filters and field values were incomplete in the UK data center.
  • Fixed an issue where valid Microsoft Entra ID licenses were incorrectly reported as missing.
  • Fixed issues affecting integration status reporting and connection handling, including Duo.
  • Fixed intermittent failures in external threat intelligence lookups impacting alerting and investigations.
  • Fixed an issue where a single device could appear multiple times due to identity changes.
  • Fixed issues where new customers or MDR Complete tenants were missing product details or entitlements after provisioning.
  • Fixed an issue where usage reporting could produce incorrect billing quantities.
 

Agent 3.1.2 (Windows and Linux) - May 29, 2026

Updates
  • Improved device identity and hostname consistency to reduce duplicate endpoint entries and improve alignment across systems.
  • Added support for on-demand agent upgrades via the “Force Upgrade” portal action.
  • Improved system detection to enhance device reporting accuracy and performance on supported hardware.
  • Improved reliability of agent communication and data ingestion during partial network or service disruptions.
Fixes
  • Fixed stability issues when backend services were partially unavailable.
  • Fixed issues affecting data ingestion reliability.
  • Fixed installation issues affecting certain Windows ARM-based systems.
  • Fixed resource leaks that could impact system stability over time.
  • Fixed inconsistencies in device state and indexing behavior.
  • Fixed issues affecting communication between the agent and core services.
 

Portal Update - April 2026

Updates
  • Improved alert categorization to support expanded MDR capabilities.
  • Added suspicious login alerting for anomalous ASN and ISP activity.
  • Added alerting for high risk geographic login activity.
  • Added the ability to trigger workflows based on alerts from specific integration sources.
  • Improved workflow stability.
  • Improved visibility into alert muting and unmuting actions.
  • Improved search stability across large and historical datasets.
  • Updated the Endpoint Protection integration to OpenText Core branding while maintaining Webroot search compatibility.
  • Defaulted the portal to light mode for new users and improved theme selection guidance.
  • Improved portal availability and login stability in the UK data center.
  • Improved platform foundations to support future console convergence.
Fixes
  • Fixed an issue where authentication and Windows log data were not displayed in search for UK-based portals.
  • Fixed an issue where threat intelligence queries could return errors in the UK data center.
  • Fixed an issue where portal search could hang during long-running or historical queries and fail to display errors.
  • Fixed an issue where monthly reports showed only a week of data instead of the full reporting period.
  • Fixed an issue where compliance storage usage reporting did not accurately reflect billable usage.
  • Fixed an issue where Webroot integration alerts were not consistently ingested.
  • Fixed an issue where newly provisioned UK customers could not sign in via SSO.
  • Fixed an issue where workflows could fail when multiple agents shared the same hostname.
  • Fixed an issue where alert mute condition changes were not reflected immediately in the UI.
  • Fixed an issue where Linux installers were not generated correctly for GSM deployments.
  • Corrected false positive vulnerability detections for Microsoft .NET Runtime packages.
  • Fixed an issue where Alerts API access for GSM integration was not properly authorized.
Known Issues
  • In some cases, search results may not return expected data while backend indexing completes. This does not impact alerting or detection functionality.
 

Agent 2.1.9 (Mac-only) - April 22, 2026

Updates
  • Brought the macOS agent to feature parity with the Windows 2.1.9 agent.
  • Improved agent registration in the Global Site Manager (GSM) console by applying a virtual machine flag, when appropriate, to prevent duplicate device entries.
  • Updated agent signing to ensure internal trust.
Fixes
  • Corrected isolation status reporting to ensure devices properly update their status after being de-isolated.
Deployment Notes
  • This release is delivered via a gradual rollout. Agents are expected to receive the update over approximately two days, provided the device remains powered on and connected.
 

WRPillr module 2.0.0.2 - April 1, 2026

Updates
  • Improved proxy handling during EDR/MDR component installation.
  • Ensured consistent installation behavior in environments with enforced HTTP/HTTPS proxies.
 

Portal Update - March 2026

Updates
  • Added the ability for users to include a phone number in their profile.
  • Updated the Users list to display phone numbers.
  • Mac and Windows agent downloads now appear alongside all other agent downloads in the Portal.
  • Enhanced performance for app‑based vulnerability reporting.
  • Improved clarity and usability of the Integrations list.
Fixes
  • Fixed an issue where certain versions of Wireshark and Firefox were not appearing in vulnerability alerts.
  • Reduced false positives related to web application shell‑spawn detections.
  • Applied general workflow stability improvements.
 

Portal Update - February 2026

Updates
  • Rule Muting from Alert View: Added the ability to mute a rule directly from a rule’s triggered alert page for faster alert management.
  • Microsoft Integration License Warnings: Added warnings when a customer's Microsoft license level is insufficient to support all alert types.
  • Enhanced CVE Alerts: Added severity scoring and direct links to the vulnerabilities page for faster investigation.
  • Improved consistency and accuracy of threat intelligence reporting.
  • Applied general stability improvements and security hardening across the platform.
Fixes
  • Fixed automated provisioning issues in the UK data center.
  • Resolved workflow execution failures in the UK data center.
  • Corrected an issue that caused URL index data to fail to display in both data centers.
  • Fixed BrightCloud Reputation Index display so low (bad) scores correctly appear in red.
  • Resolved intermittent failures where the Workflow Closures Report did not send on schedule.
  • Corrected behavior where unmapped field headers failed to remain locked during searches.
  • Restored GeoIP map visibility for authentication log searches.
 

WRPillr module 2.0.0.1 - January 13, 2026

Updates
  • Expanded OS support to include older Windows 10 and Windows 11 systems.
  • Removed PowerShell as an installation dependency to streamline deployment in restricted environments.
 

Agent 2.1.9 (Windows-only) / WRPillr Module 2.0.0.0 - January 7, 2026

Components
  • Agent 2.1.9 (Windows-only)
  • WRPillr Module 2.0.0.0
Updates
  • Updated the WRPillr module interface to support Windows EDR and MDR components.
  • Improved agent registration in the Global Site Manager (GSM) console by applying a virtual machine flag, when appropriate, to prevent duplicate device entries.
  • Updated agent signing to ensure internal trust.
Fixes
  • Corrected isolation status reporting to ensure devices properly update their status after being de-isolated.
 

Portal Update - October 2025

Updates
  • Added the ability to run a workflow manually.
  • Improved performance of the Integrations settings page.
  • Improved availability and reliability of threat intelligence backend services.
Fixes
  • Resolved issues with alert muting behavior.
 

Portal Update - August 2025

Updates
  • Added a new workflow action that notifies the primary user for a given partner.
  • Added the ability to mute or silence alerts based on conditions, preventing certain alerts from syncing to integrations.
  • Improved the accuracy and effectiveness of vulnerability reporting.
Fixes
  • Fixed an issue where workflow names containing certain special characters could not be saved.
  • Fixed an issue where alerts table headers were resetting after page refresh; header selections are now preserved.
 

Portal Update - July 2025

Updates
  • Improved accuracy of application CVE reporting.
  • Improved the overall effectiveness of vulnerability reporting.
  • Added support for workflow actions triggered from specified saved search alerts.
  • Enabled saved search alert triggers to be used with workflow actions.
 

Portal Update - June 2025

Updates
  • Added a light mode option for the Portal.
  • Added the ability to multi‑select agents for bulk actions.
  • Added a report showing the percentage of alerts closed manually vs. automatically by workflows.
  • Expanded date‑filtering options on the log retention page.
 

Portal Update - May 2025

Updates
  • Improved performance for concurrently executing workflows.
  • Updated the webhook action in workflows to include a customer field.
Fixes
  • Fixed a saved search scope issue that caused some saved searches to be incorrectly hidden from users.
 

Portal Update - April 2025

Updates
  • Enabled SSO integration with other OpenText platforms.
  • Added the ability to generate reports for multiple customers.
  • Added SOC escalation instructions to the workflow action.
 

Agent 2.1.7 - April 9, 2025

Updates
  • Added the agent as part of the OpenText Detection and Response cybersecurity portfolio.
  • Improved agent diagnostic reporting and backend communication.
 

Portal Update - March 2025

Updates
  • Improved agent filtering by adding more filter options, enabling more fine‑grained filtering.
  • Improved email notifications for custom alerts.
Fixes
  • Fixed workflow validation issues and improved error handling.
  • Fixed an issue that caused agents not to appear for some customers with multiple product subscriptions.
 

Portal Update - February 2025

Updates
  • Improved performance of the log retention report.
  • Added a Microsoft Azure AD user lockout action.
Fixes
  • Fixed an issue that caused duplicate mobile alerts.
 

Portal Update - January 2025

Updates
  • Added a new workflow template library.
  • Improved the alert UI, including making the KB article area scrollable.
  • Added support for macOS Application Vulnerability Reporting.
  • Added isolation status to the Portal.
 

Portal Update - December 2024

Updates
  • Improved input handling for the Check Field workflow task.
  • Added a Discussions tab for Cases.
 

Portal Update - November 2024

Updates
  • Improved case management behavior when changing case status.
  • Improved automatic case creation for brute‑force alerts.
  • Added support for detection fields in the Check Field workflow task.
  • Improved alert‑update email notifications.
 

Portal Update - October 2024

Updates
  • Improved agent diagnostic checks.
  • Updated the Monthly Metrics Report to translate common Windows Event Codes into human‑readable names.
Fixes
  • Fixed an issue in the Check Field workflow task that affected validation of certain Windows log fields in alerts.
 

Agent 2.1.2 - September 12, 2024

Updates
  • Improved the fixes introduced in Agent 2.1.1.
 

Portal Update - September 2024

Updates
  • Improved the alert page UI.
  • Improved syslog alerting.
Fixes
  • Fixed an issue in vulnerability reporting that caused some application vulnerability false‑positive results.
  • Fixed an issue with workflow notification email template rendering.
 

Agent 2.1.1 - August 27, 2024

Updates
  • Tuned ransomware encrypted‑file detection.
Fixes
  • Fixed issues with temporary file handling.
 

Agent 2.1.0 - August 12, 2024

Updates
  • Added alerting for ransomware encrypted‑file detection.
  • Added support for Brave and Opera browser URL inspection.
  • Improved syslog parsing.
  • Tuned YARA rules.
  • Added an agent watchdog to improve resilience.
  • Improved alert delivery speed.
  • Added additional connectivity diagnostics.
  • Added support for additional Linux distributions and macOS versions.
Fixes
  • Fixed conflicts with the SentinelOne agent.
 

Agent 2.0.10 - April 30, 2024

Updates
  • Improved syslog timestamp parsing to ensure correct event times.
Fixes
  • Fixed incompatibilities with certain other security software related to file inspection.
 

Agent 2.0.9 - April 5, 2024

Updates
  • Added new endpoint actions, including the ability to:
    • Quarantine a file
    • Delete a file
    • Shut down the system
    • Restart the system
    • Perform a full disk scan
 

Agent 2.0.8 - February 6, 2024

Updates
  • Improved performance and added additional diagnostic reporting.

 


Is this article helpful?
   
Thanks for your feedback!