Skip Navigation

CylanceOPTICS
release notes

What's new in
CylanceOPTICS
(June 2024)

Feature
Description
New
Windows
agents
The following versions of the
CylanceOPTICS
agent for
Windows
are now available in the management console. These versions include the latest stability enhancements:
  • CylanceOPTICS
    agent for
    Windows
    3.3.2640
  • CylanceOPTICS
    agent for
    Windows
    3.2.1322
Recommendation to disable the optional Cryptojacking Detection sensor
BlackBerry
recommends disabling the optional Cryptojacking Detection sensor, as we are currently investigating stability issues that this sensor can cause with the device OS.

What's new in
CylanceOPTICS
(January 2024)

Feature
Description
CylanceOPTICS
agent versions
This release includes the new
CylanceOPTICS
agent for
Windows
version 3.3.2311.0.
For more information about supported operating systems, see the Cylance Endpoint Security compatibility matrix.
Enhancements to the logic and methods that
CylanceOPTICS
uses to identify security threats
CylanceOPTICS
3.3 features significant enhancements to the underlying logic and methods that the
CylanceOPTICS
cloud services and the
CylanceOPTICS
agent use to identify security threats. These changes include:
  • Improvements to how the
    CylanceOPTICS
    agent collects context-relevant event data for a given detection.
  • Improved collection and identification of the processes and events that precede a given detection, and of the noteworthy processes and events that follow a given detection. This provides a more detailed and accurate picture of the factors that may have resulted in the detection and of the aftermath of that detection.
  • Improved data collection methodologies controlled by the
    CylanceOPTICS
    cloud services, enabling
    CylanceOPTICS
    to stay ahead of a threat landscape that is always evolving. These changes ensure that the agent can collect the most valuable telemetry while also tuning out data that is not relevant.
New sensors
This release of the
CylanceOPTICS
agent adds three new optional sensors for
Windows
devices:
  • COM Object Visibility: Allows the
    CylanceOPTICS
    agent to monitor COM objects.
  • HTTP Visibility: Allows the
    CylanceOPTICS
    agent to track
    Windows
    HTTP transactions.
  • Module Load Visibility: Allows the
    CylanceOPTICS
    agent to monitor module loads.
These sensors require the
CylancePROTECT Desktop
agent version 3.2 or later.
For more information, see CylanceOPTICS optional sensors in the
Cylance Endpoint Security
Setup content.
Data enrichment for
Windows
events
Previously, the
CylanceOPTICS
agent collected the Provider Name, Class, and Event ID facets for Windows Event artifacts. This release adds significant data collection enhancements for
Windows
Events, with the agent collecting the data defined in the EventData facet of the artifact (for example, this can include ObjectServer, PrivilegeList, Process ID, Process Name, Service, or other facets).
For more information, see Data structures that CylanceOPTICS uses to identify threats in the
Cylance Endpoint Security
Setup content.

What's new in
CylanceOPTICS
(August 2023)

Feature
Description
Enhancements to advanced query
This release introduces the following enhancements to the advanced query feature in the management console:
  • As you type the EQL syntax for a query, syntax options and validation messages will display to help you build your query.
  • You can now schedule the execution of an advanced query for a specific date and time, and you can schedule a query to run on a regular interval.
  • When you set the scope of your query to specific devices, an icon displays indicating whether each device is online.
  • New options to filter query results.
  • When you select a result and open the fly-out menu, you can view additional event data and filter the query results to show matches for one or more facets.
  • Various UI improvements make it easier for you to add a query, copy a query, and apply and clear zones, devices, and filters for queries.
  • You can now export the results of a query to a CSV file.
For more information, see Create an advanced query in the
Cylance Endpoint Security
Administration content.

What's new in
CylanceOPTICS
(April 2023)

Feature
Description
New audit log values for device lockdown configuration in syslog messages
The April update of the
CylanceOPTICS
cloud services adds new event name values to audit log messages that can be reported to SIEM solutions and syslog servers. The new Event Name fields are associated with the lockdown configuration feature:
  • LockdownConfigurationAdd
  • LockdownConfigurationEdit
  • LockdownConfigurationDelete
For more information about audit log events, see the Cylance Syslog Guide.
Lockdown configurations API
The
Cylance
User API now includes the lockdown configurations API. You can use this API to perform actions on partially locked devices, including:
  • Getting a list of custom partial lockdown profiles
  • Creating a custom partial lockdown profile
  • Updating a custom partial lockdown profile
  • Deleting a custom partial lockdown profile
For more information, see the Cylance User API Guide.

Considerations when upgrading from
CylanceOPTICS
2.5.x to 3.x

  • For configuration requirements for
    macOS
    Big Sur (11.x) or Monterey (12.x), see the setup instructions in the Cylance Endpoint Security Setup Guide.
  • If you do not set up a complete MDM profile for the
    CylanceOPTICS
    network extension on devices with
    macOS
    Big Sur (11.x) or later, data collection might not occur as expected. Verify that you satisfy the configuration requirements for MDM managed devices in the Cylance Endpoint Security Setup Guide.
  • BlackBerry
    recommends installing the latest available version of the
    CylancePROTECT
    agent. For more information, see the CylanceOPTICS requirements.
  • On
    macOS
    devices, after you upgrade the
    CylanceOPTICS
    agent you need to restart the device.
  • On
    macOS
    Catalina, Mojave, and High Sierra devices with the SelfProtection level set to LocalSystem, if you upgrade from
    CylanceOPTICS
    agent version 2.5.x to 3.x, the upgrade might not complete successfully. (EDR-7705)
    Workaround:
    Change the self protection level to LocalAdmin, then update the
    CylanceOPTICS
    agent.
  • If you upgrade the
    CylanceOPTICS
    agent on a CentOS/RHEL 8.0 or 8.1 device, you must restart the device after the upgrade is complete. (EDR-6750)
  • Upgrading the
    CylanceOPTICS
    agent on
    Linux
    from version 2.x to a newer version fails if Security-Enhanced Linux (SELinux) is enabled on the device. (EDR-6264)
    Workaround:
    Disable SELinux on the device before you upgrade the
    CylanceOPTICS
    agent and enable it again after the upgrade is complete.
  • When upgrading the
    CylanceOPTICS
    agent on
    Windows
    , to avoid an issue with the
    CylanceOPTICS
    shutdown time taking longer than usual, disable the TDT sensor in the device policy and enable it again after the upgrade is complete. This issue does not occur if you upgrade from
    CylanceOPTICS
    agent version 2.5.3010 or from
    CylanceOPTICS
    agent 3.0 to a later version. (EDR-6058)