CylanceGATEWAY

release notes

DNS Tunneling detection support enhancements

CylanceGATEWAY

now supports detecting DNS tunneling connections using the DNS response that is associated with the TXT records of a destination that users try to access. The Event Details page displays the query type and resource record type as TXT and the SIEM solution or syslog server now includes the new field, rData. Detected anomaly events are sent to the Alerts view and sent to the SIEM solution or syslog server, if configured.

For more information, see Viewing the Event Details page.

Split tunneling enhancements

Now when you enable split tunneling, you can create an exclusive list that specifies the CIDRs for destinations that you do not want to use the tunnel. You might have an inclusive and exclusive option configured, but only the option that is selected and displayed in the console as active is applied to the network traffic. In environments that want all traffic to use the tunnel, except for few apps, this feature will save you time and administration by specifying only the CIDRs for the traffic that should not use the tunnel instead of specifying the traffic that must use the tunnel. FQDNs are not supported in the exclusive option.

For more information, see the Gateway Service policy parameters in the

Cylance Endpoint Security

Setup content.

Network Route enhancements

You can now add a description to each IP address, IP range, or CIDRs that you add to network routing for a connector group. This feature allows you to easily add notes to identify the part of your private network that each address represents. For more information, see Specify your private network in the

Cylance Endpoint Security

Setup content.

Windows

device posture validation on connect

Administrators can require

Windows

devices to be managed by

Microsoft Intune

. This feature requires devices are managed by

Entra ID

, and be

Entra ID

joined, before users can use

CylanceGATEWAY

. For more information, see CylanceGATEWAY service parameters in the

Cylance Endpoint Security

Setup content.

Change to network anomaly detection of users' traffic patterns

CylanceGATEWAY

has deprecated support for behavioral risk detections based on unusual user behavior such as upload volume and download volume that is not consistent with past behavior.

DGA detection

CylanceGATEWAY

now proactively detects domains that have been created using a Domain Generation Algorithm (DGA) when users attempt to access the domain. Identified DGA events are labelled as Zero Day Detection and categorized as a Dynamic Risk and subcategorized as DGA. The anomaly detection threat events are sent to the Alerts view, the Events page, and the SIEM solution or syslog server, if configured. This feature provides a continued evolution of

CylanceGATEWAY

network protection capabilities.

Safe Mode enhancements

CylanceGATEWAY

now extends Machine Learning-based network protection to Safe Mode. In addition to applying the tenant's ACL rules, the Network Protection settings applied to Safe Mode have, therefore, expanded from Destination Reputation to include the following types:

DNS Tunneling
Zero Day

This feature provides additional protection to endpoints against newly emerging network threats and malicious destinations based on the network protection settings that you specify.

Control the network traffic detections that are sent to the Alerts view

On the Network Protection settings screen, you can now specify the following detections that you want to enable and be displayed in the Alerts view:

Signature detections: Blocked and allowed events
Destination reputation: Blocked and allowed events based on the minimum risk level that you set
DNS tunneling: Based on the minimum risk level that you set
Zero Day: Based on the minimum risk level that you set

Blocked and allowed ACL events are not shared to the Alerts view. This feature introduces a more granular control over the events that are shared to the Alerts view.

For more information, see Configure network protection settings in the

Cylance Endpoint Security

Setup content.

Evaluate the risk level of a network destination

You can use the management console to evaluate the risk level and identify the category and subcategory of a network destination, as analyzed, and determined by the

CylanceGATEWAY

cloud services. This feature provides you with insight into how

CylanceGATEWAY

would classify and assign a risk level to a destination. For example, when you configure your access control list (ACL) rules and network protection settings to allow or block destinations and you want to know how a specific destination might be categorized, you can now safely determine the category and risk level that

CylanceGATEWAY

has assigned to the destination.

For more information, see Evaluate the risk level of a network destination page in the

Cylance Endpoint Security

Setup content.

Domain classification enhancements

CylanceGATEWAY

uses Machine Learning that applies categorization to previously uncategorized English destinations. This feature has been expanded to now classify previously uncategorized French, German, Italian, and Spanish-language web destinations (for example, General Interest – Business or Security Risk).

For more information, see Destination content categories page in the

Cylance Endpoint Security

Setup content.

Event Details page enhancements

For more information, see Viewing the Event Details in the

Cylance Endpoint Security

Administration content.