CylanceOPTICS

release notes

This release introduces the following enhancements to the advanced query feature in the management console:

As you type the EQL syntax for a query, syntax options and validation messages will display to help you build your query.
You can now schedule the execution of an advanced query for a specific date and time, and you can schedule a query to run on a regular interval.
When you set the scope of your query to specific devices, an icon displays indicating whether each device is online.
New options to filter query results.
When you select a result and open the fly-out menu, you can view additional event data and filter the query results to show matches for one or more facets.
Various UI improvements make it easier for you to add a query, copy a query, and apply and clear zones, devices, and filters for queries.
You can now export the results of a query to a CSV file.

For more information, see Create an advanced query in the

Cylance Endpoint Security

Administration content.

The April update of the

CylanceOPTICS

cloud services adds new event name values to audit log messages that can be reported to SIEM solutions and syslog servers. The new Event Name fields are associated with the lockdown configuration feature:

LockdownConfigurationAdd
LockdownConfigurationEdit
LockdownConfigurationDelete

For more information about audit log events, see the Cylance Syslog Guide.

The

Cylance

User API now includes the lockdown configurations API. You can use this API to perform actions on partially locked devices, including:

Getting a list of custom partial lockdown profiles
Creating a custom partial lockdown profile
Updating a custom partial lockdown profile
Deleting a custom partial lockdown profile

For more information, see the Cylance User API Guide.

This release adds support for the following operating systems:

macOS
Ventura (13.x)
SUSE Enterprise
Linux
15 SP4
Oracle
Linux
Server 7 (non-UEK)
Debian 11
Debian 10

For more information about supported operating systems, see the Cylance Endpoint Security compatibility matrix. For more information about OS requirements, see CylanceOPTICS requirements in the

Cylance Endpoint Security

Setup content.

For more information about supported operating systems, see the Cylance Endpoint Security compatibility matrix. For more information about OS requirements, see CylanceOPTICS requirements in the

Cylance Endpoint Security

Setup content.

This release introduces a new MSI installer package that you can use to install the

CylanceOPTICS

agent version 3.2 on

Windows

devices.

For more information about the OS commands supported by the MSI installer, see OS commands for the CylanceOPTICS agent in the

Cylance Endpoint Security

Setup content.

This release adds support for the following operating systems:

Windows
11 22H2
Windows
10 22H2

For more information about supported operating systems, see the Cylance Endpoint Security compatibility matrix. For more information about OS requirements, see CylanceOPTICS requirements in the

Cylance Endpoint Security

Setup content.

For more information about supported operating systems, see the Cylance Endpoint Security compatibility matrix. For more information about OS requirements, see CylanceOPTICS requirements in the

Cylance Endpoint Security

Setup content.

CylanceOPTICS

version 3.1 introduced the partial lockdown feature for Windows devices. This release introduces the ability to create custom partial lockdown configurations that allow you to specify additional communication channels that you want to allow during a partial lockdown.

For more information, see Lock a device in the

Cylance Endpoint Security

Administration content.

The July 2022 update of

CylanceOPTICS

introduced new administrator permissions that you could assign to roles to control how administrators engage with

CylanceOPTICS

. This release introduces additional

CylanceOPTICS

permission groups and sub-permissions, offering a greater level of access control and customization.

If you previously granted an administrator role a

CylanceOPTICS

permission that was introduced in the July 2022 update, that role will be granted any associated sub-permissions that are introduced in this update. It is a best practice to review the

CylanceOPTICS

permissions that are introduced in this update so that you can make any adjustments that are appropriate for your organization's environment.

For more information, see Permissions for administrator roles in the

Cylance Endpoint Security

Setup content.

The late October update of the

CylanceOPTICS

cloud services will add a new event type that can be reported to SIEM solutions and syslog servers, OpticsCaeApiEvent. This event type is used for events that are detected by the

CylanceOPTICS

agent’s optional API sensor. For more information about the API sensor, see CylanceOPTICS sensors in the

Cylance Endpoint Security

Setup content.

For more information this new event type, see the Cylance Syslog Guide.

The mid-October update of the

CylanceOPTICS

cloud services adds new event name values to audit log messages that can be reported to SIEM solutions and syslog servers. The new Event Name fields are associated with the lockdown feature:

DeviceUnlock
DeviceChangeLockdownProfile

For more information about audit log events, see the Cylance Syslog Guide.