The January 31, 2023 Release contains the following features and fixes:
Features
Datto Ransomware Detection App
Datto Ransomware Detection will monitor for file encryption activity, and can terminate the encrypting process, Isolate the device, and generate an incident for review with details and recommendations.
Datto Ransomware Detection is a powerful tool that can prevent data loss and downtime by stopping an encryption event that has bypassed traditional prevention measures.
The settings are configurable within the app on the Dashboard.
Note- the app has been made available but is in the Off position. Please read the following article that speaks to enabling and configuring the app.
Remediation Actions
RocketCyber can now perform remediation actions for some Incidents, such as deleting a file or terminating a process, or uninstalling a program. Currently, Remediation is available for Incidents generated from the following apps:
-
Advanced Breach Detection
-
Suspicious Tools
-
Defender Manager
-
Malicious File Detection
The user can select Remediate from an Incident that supports it to initiate a remediation. Once the remediation actions are complete, the Incident will be marked as Resolved. Please review this article to learn more!
Rewritten Webroot Monitor integration(Action Required!)
As mentioned in the last release notes, we have rewritten the Webroot monitor app to reduce the number of API calls needed to obtain threat telemetry. If you currently have a Webroot integration configured, you will need to reconnect RocketCyber to your Webroot console. Please follow the Knowledge Base article to reconnect to your Webroot console to continue to receive threat telemetry.
Fixes
-The Sophos integration has been modified to reduce the amount of API calls that need to be made, improving the performance and reliability. NOTE: This is phase 1 of the rewrite and will only produce nominal gains. The remainder of the rewrite will be released in 2 weeks, further improving performance.
-Resolved an issue on the Integrations tab where the user would be redirected to the BitDefender Monitor tab while configuring a different Endpoint Security integration
-Resolved an issue where an error "sort[1[ contains a duplicate value" appeared when selecting Advanced Search on the Incidents page for the second time