You can now edit the default script used to customize the triage package collected from your host endpoints. By only collecting the information you specify with the script, the triage system performance is improved, and you receive the triage package summary more quickly.
You can now mark generic alerts as false positive from the API or directly from the Alerts page or the Alert Details page of the Endpoint Security (HX) Web UI. You can select the specific conditions to consider for the alert. After you mark a generic alert as False Positive, the user marked FP designator appears on the alert and your new FP rule appears on the False Positive tab of the Alerts page.
The user created FP rules are submitted to DTI as part of the security content upload process. The Endpoint Security (HX) server then sends these rules to the endpoints so modules with an Agent component can process the information, Subsequent generic alerts that match your FP rule will not be generated.
Endpoint Security (HX) now includes Scan Now support for Windows. The following scan types are supported:
Full scan
Custom scan
Memory scan
You can now also pause, resume, or cancel a scan for endpoints running Windows. Administrators can exclude host sets from auto-triage by using either the Endpoint Security (HX) Web UI or by using the API.
Endpoint Security (HX) now supports the following browser audits for the Chromium-based Edge browser on macOS and Windows platforms:
Cookie history
File download history
URL history
Form history
You can now specify which hosts in a custom policy should be excluded from automatic triage data when an alert occurs on a host. For more information on enabling automatic triage exclusion in a custom policy see "Setting Automatic Triage Exclusion" in the Endpoint Security Agent (HX) Administration Guide.
You can now use the Endpoint Security (HX) Web UI to target an entire directory for acquisition on your hosts. You can also use filters to acquire files from a specific directory on your hosts based on indicated criteria, such as:
Path: The file path to the file you want to acquire. This is a required field.
Depth: Depth determines the number of levels into the directory structure you want to investigate with your acquisition.
Raw Mode: Raw Mode considers user input for active and deleted files, and by default selects both files. Raw mode is only applicable for Windows endpoints.
File Size: You can use minimum and maximum file size to only acquire files that fall within the size parameters.
You can access the multi-file acquisition option by selecting Multiple Files in the Actions menu on the Hosts page and the results of the acquisition are available on the Acquisitions page. You can also use the API to acquire multiple files, such as in the following example:
URL : https://<HX-IP>:<PORT>/hx/api/v3/hosts/<Agent-ID>/files
Method : POST
Request Parameter :
{
"req_path": "/Example/Path",
"req_multifile_parameters":{"isMultiFile":true}
}Endpoint Security (HX) now includes the following browser related audit improvements:
Google Chrome form history audits now include First Used Date, Last Used Date and Times Used fields. These fields were previously omitted from the audit for endpoints running windows.
Google Chrome cookie audits have been modified to accommodate the change in location of the cookies database which occurred in the version 96 Chrome update for endpoints running windows.
Internet Explorer cookie audits have been amended to report the CookiePath, CookieName, CookieValue, ExpirationDate, CookieFlags, HostName, LastModifiedDate fields that were previously omitted from the audit output for endpoints running windows.
Internet Explorer download audits have been amended to report the FileName, TargetDirectory, State and BytesDownloaded fields that were previously omitted from the audit output for endpoints running windows.
Firefox download audits have been amended to report download size, end dates and filename correctly in for endpoints running windows.
Firefox url audits have been amended to report the hostname correctly for endpoints running windows.
Firefox cookie audits have been amended to include the IsHTTPOnly, IsSecure, CookieValue, Cookie Creation Date and Last Accessed Date fields that were previously omitted from the audit output for macOS.
Google Chrome form history audits have been amended to include the LastUsedDate field that were previously omitted from the output for macOS.
The Chromium-based Edge browser is supported on both Windows and macOS endpoints for browser audits, including Cookie History, File Download History, URL History, and Form History.
Safari URL audits have been amended to include the Hostname, Typed, Visit From, First Bookmark Date and Hidden values fields that were previously omitted from the audit output for macOS.
Safari download history audits have been amended to include the State, Started and End Date fields that were previously omitted from the audit output for macOS.
Note
Internet Explorer audits for versions earlier than Internet Explorer version 11are no longer supported for endpoints running Windows.