New Features
- Added a raw log capture tool that simplifies collecting sample logs for troubleshooting.
- Cisco ISE integration now supports ANC-based endpoint quarantine as an automated response action.
- Alarm whitelists now support IP subnets (CIDR notation) and IP ranges.
- Added an "Action Rule Failed" notification — users can opt in to be alerted, including through the MSS hub, when an automated action-rule action fails.
Plugin & Integration Updates
- Kandji (Iru API) integration has been added.
- Cisco ISE plugin has been updated (session reporting, API authentication, and request headers).
Other Improvements
- Improved cluster stability: internal coordination now survives node identity changes (re-licensing, migration, or re-enrollment), preventing cluster coordination failures.
- Cluster upgrades now automatically recover from stale internal coordination state that could otherwise stall the upgrade.
- Leaf mode now forwards data at higher throughput over a dedicated, TLS-capable connection.
- External Threat Intelligence feed entries now honor their expiration time for automatic cleanup.
- Improved session worker responsiveness under heavy load.
- The co-managed (MSS) worker now idles gracefully when the MSS license is disabled.
Bug Fixes
- Fixed rogue Redis instances that could start on cluster nodes without the Redis role and skew statistics.
- Improved alarm state-tracking accuracy for bucket transitions and event ordering.
- Hardened the "Action Rule Failed" notification against incomplete data.