CylanceGATEWAY release notes Skip Navigation
  1. BlackBerry Docs
  2. Cylance Endpoint Security
  3. Cylance Endpoint Security Release Notes
  4. CylanceGATEWAY release notes

CylanceGATEWAY
 release notes

What's new in the management console

Feature
Description
Date added
Support for multiple private network configurations
You can now configure
CylanceGATEWAY
 to allow access to resources on more than one private network (for example, segments, data centers, and VPCs) both in on-premises and cloud environments. You can view the
CylanceGATEWAY Connector
s that are associated with each specified Connector Group. This feature allows you to deploy multiple
CylanceGATEWAY Connector
s from one Cylance Endpoint Security tenant and provides an aggregated view of the connectors for each private network.
This feature is enabled by default on new tenants. Existing tenants can be upgraded to support multiple private network configurations. You must contact
BlackBerry
 Technical Support if you want to enable this feature.
UI updates
  • The left “Network Routing” navigation menu has been renamed to “Connector Groups”.
  • The “Health Check” and “Source IP restriction” configuration screens have been moved to “Connector Groups".
  • In the "Gateway Connectors" navigation menu, the “Tunnel”, “DNS”, and “HTTP” columns have been combined into the “Health Check Status” column. You can click the Health Check Status column to view additional connector information (for example, whether a tunnel is established and the DNS server IP address).
July 2023
Improved control of network traffic settings
The updated Network Protections settings introduce more granular control over the detection and protection mode of features of
CylanceGATEWAY
, the respective details that you want to have reported and displayed in the Network Events screen, and the level of details shared to your integrated SIEM solution or syslog server, if configured.
  • The current "Network Protection" settings have moved to the
    Protect
     tab. The Network protection action “Enable intrusion protection” has been renamed to “Enable Signature detection”. 
  • The new
    Report
     tab allows you to specify the details that will appear in the Network Events page as detections or normal traffic.
  • The new
    Share
     tab allows you to specify the details that are sent to the SIEM solution or syslog server, if configured. By default, blocked detections are always sent. Optionally, you can choose to also send allowed detections.
For more information, see Configuring network protection in the Cylance Endpoint Security Setup content.
July 2023
Enhancements
On the
CylanceGATEWAY
 Events page,
  • New category
    : Previously the "Security Risk" category was applied as both a content category for destinations that were deemed non-malicious (for example, destinations that teach about malware), as well as an anomaly category for destinations that are considered malicious (for example, destinations that distribute malware). Now when
    CylanceGATEWAY
     detects an IP reputation, the IP reputation will be categorized as one of the following:
    • Dynamic Risk
      : This new category is applied to destinations that are identified to contain potentially malicious threats by using a combination of ML models and IP Reputation database which continuously changes to add or remove destination entries.
    • Security Risk
      : This category is now applied only as a content category to non-malicious destinations.
  • New BlackBerry source IP address filter capability
    : You can now filter events based on the
    CylanceGATEWAY
     tunnel IP address. The "BlackBerry source IP" identifies the tunnel IP address users used to access external destinations. This feature provides administrators with added visibility in the tunnel that was used when an event has occurred.
July 2023
Enable Split DNS
In the Gateway Service policy, you can now enable Split DNS after Split tunneling is enabled. For more information on split DNS tunneling, see "Split tunneling enhancements" below.
June 2023
HTTP content logging
In the ACL rules, you can now specify whether network events should include unencrypted, plain-text HTTP connection data. When enabled, a summary of the request and response details of an event are displayed in the Events Details page. The Events details page displays the first three HTTP events of the total events. You have the option to view all the events and the details that are associated with each one. This feature allows unencrypted HTTP network traffic to be reviewed and analyzed more deeply while further enabling threat hunting.
June 2023
Safe Mode DNS protection support on
Windows
In the Gateway Service policy, you can configure users to use Safe Mode.
This feature extends the tenant’s ACL rules and endpoint protection for devices when Work Mode is not enabled ensuring that devices are always protected. With Safe Mode,
CylanceGATEWAY
 blocks users from accessing potentially malicious destinations and enforces acceptable use policy (AUP) by intercepting DNS requests. The
CylanceGATEWAY
 Cloud services evaluate each DNS query against the configured ACL rules and network protection settings, and then instructs the agent to allow or block the request in real time. If allowed, the network DNS query is allowed to complete over the bearer network. Otherwise, the
CylanceGATEWAY
 agent overrides the normal response and prevents access.
When enabled, Safe Mode automatically takes effect when Work Mode is disabled. Enabling Safe Mode does not prevent users from enabling or disabling Work Mode, if the users' policy allows such operations. Safe Mode events appear in the
CylanceGATEWAY
 Events screen and are sent to the SIEM solution or syslog server, if configured. 
This feature is not supported in environments that use secure DNS with DoT (DNS-over-TLS) and DoH (DNS-over-HTTPS) protocols. DNS queries sent using DoT or DoH cannot be viewed by CylanceGATEWAY.
This feature is supported on
CylanceGATEWAY
 agent for
Windows
 version 2.8 or later.
For more information, see the Gateway Service policy parameters in the Cylance Endpoint Security Setup content.
June 2023
OS-specific ACL support
In the ACL rules, you can create rules and specify which OS that the ACL rule applies to must match. This feature allows you to unify the ACL rules. For example, you have content sensitive resources that you only want desktop devices (
macOS
 and
Windows
) to access. In this scenario, your ACL rule would specify the desktop devices which are allowed access to the resource.
For more information, see the ACL parameters in the Cylance Endpoint Security Setup content.
June 2023
Split tunneling enhancements
Now when you enable split tunneling, split DNS queries allow lookups for the domains that are listed in the Private Network > DNS > Forward Lookup Zone configuration to be performed through the tunnel where network access controls are applied. All other DNS lookups are performed using your local DNS server.
Android
 and 64-bit
Chromebook
 devices do not support split DNS queries and the DNS lookups are performed through the tunnel.
This feature allows you to further ensure user traffic privacy and geographical locality of the DNS queries, enhancing the Split Routing feature of Gateway. Split DNS is disabled by default. If you enabled Safe Mode, DNS traffic that does not use the Gateway tunnel is protected by Safe Mode.
For more information, see the Gateway Service policy parameters in the Cylance Endpoint Security Setup content.
June 2023
Enhancements
On the
CylanceGATEWAY
 Events page,
  • UI Update
    : The “Platform” column has been renamed to “OS”.  
On the Events Details page,
  • UI Update
    : The “Platform” column has been renamed to “OS”.
June 2023

CylanceGATEWAY
 component versions

  • CylanceGATEWAY Connector
     version 2.8.0.848
  • CylanceGATEWAY
     agent for
    Windows
     version 2.8.0.10
  • CylanceGATEWAY
     agent for
    macOS
     version 2.8.14
To download the agent, go to the BlackBerry Website and scroll down to the Download
CylanceGATEWAY
 section.

What's new in
CylanceGATEWAY Connector
 2.8.0.848 (June 2023)

Feature
Description
General updates
The June release rebrands the "blackberry-gateway-connector" debian package to "cylance-gateway-connector" installation files. This updated version is required to enable enhanced features in future releases.
Enhancements
The
CylanceGATEWAY Connector
 now provides additional information on TCP and UDP flows that flow through the tunnel to the private network (for example, the Private NAT Source IP and Private NAT Source Port) after the Network Address Translation (NAT) is applied. When events traverse the private network, the Private NAT Source IP and Private NAT Source Port are displayed on the Events Details page for each event. If the Private NAT Source IP and Private NAT Source Port events are not available or the feature is not enabled, the Events Details page displays "Unknown". Events that are identified as a potentially malicious or blocked based on your network protection settings are sent to the SIEM solution or syslog server, if configured. Health check and DNS events are not sent to SIEM solution or syslog server.
For more information, see the Viewing the Event Details page in the Cylance Endpoint Security Administration content.

What's new in
CylanceGATEWAY
 agent for
macOS
 version 2.8.14 (August 2023)

Feature
Description
Bug fixes
Bug fixes that are described in the CylanceGATEWAY fixed issues section.