These release notes describe the changes that are included in each build that is created for Vali Cyber’s ZeroLock Agents. Before you install one of these builds, familiarize yourself with the new features, resolved issues, and other changes. For more information, see the Vali Cyber Support Page.
Summary of Changes
Performance – Agents and Endpoints
Agent enhanced to support the ‘Add Allow Rule’ capabilities - This enhancement allows for assisted rule generation when a false positive alert has been identified. Using this functionality, the user may quickly create an allow rule for the currently active alert thus reducing the possibility of clutter that can occur from unnecessary alerts. This functionality works for the predominant access alert types of File, Network, and Program access.
Agent enhancement enables protection of 32-bit applications running on 64-bit Linux distributions.
Collector Configuration Verification - To ensure that the Collector configuration has not been tampered with, when Tyr starts, the Collector List on the Endpoint is compared to the list from the ZeroLock service initially installed. If the lists do not match the ZeroLock service will not start.
Memory management enhancements were made that enable the Process Monitor to clear out memory of exited processes.
Enhanced Database Access - The number of database queries required to provide the Collector with the necessary Endpoint data has been reduced resulting in improving database access.
Improved Endpoint Agent Dependency Information - Having detailed information about all the dependencies used by the Endpoint agent can be critical. Recognizing this, the Baldur log now includes the fully qualified versions of an agent’s dependencies and any relevant additional information, such as the system’s architecture.
Syslog Reporting Functionality Enhancement - ZeroLock now supports writing logs to the local syslog on protected systems. This improvement allows you to obtain alert information through any of the SEIM/SOAR type solutions without necessarily having to write custom API integration for each one. The logs being updated with information are the /var/log/messages (centos/rh) or /var/log/auth.log (ubuntu). With this enhancement, and using native Linux syslog protocol functionality, our logging information can move to any log collector or consolidator.
Linux Distributions and curl - For some Linux distributions, curl is not included on the endpoint running the ZeroLock Endpoint Agent. To address this issue, the Re-Install Agent Version option will now use wget to do the reinstall if originally installed with wget.
Jumpbox Improvements - On protected endpoints running Jumpbox performance has been improved and false positives reduced.
Docker Containers - Several performance enhancements were made.
ZeroLock Endpoint Agent Shutdown - The agent shutdown process was adjusted so injected services will be restarted, Baldur detection engines will shut down, and ZeroLock service will be disabled.
Quarantine Improvement - A sync option has been added that refreshes configuration of the endpoint, preventing an endpoint from being reset into a quarantined state if suspended or rebooted.
Installation Enhancements
Improved installation for RHEL 8.8 STIG system – In STIG compliance, the cpio utility is responsible for extraction and digest validation of the files from rpm. This installer enhancement ensures installation stability and consistency by changing the packaging so that rpm digest will be sha256 while also adding support for RHEL STIG and other Linux distributions.
Agent installation enhanced to accept Configuration Profile and Endpoint Groups changes received from the Deploy page Advanced Settings configuration.
Improved installation support on non-Debian or non-rpm systems - Adding additional artifacts to the .tar package improved both the installation and uninstallation processes.
ZeroLock Container Agent now supports running with SELinux enabled on RHEL/Centos - The container-deployed agent is now allowed to install with SELinux enabled.
Alerts Enhancements
SSH MFA Alert - SSH-MFA alerts upgraded to be more precise.
Alert Remediation Information – To give the user more control and address any edge cases, only files that SHOULD NOT be remediated are listed. The user may select any additional files to be remediated from this list.
Behavior Analysis
Behavior analysis engine enhanced to update the path of a file when it is renamed to ensure restoration of all modified/deleted files when response type is set to ‘Suspend’.
Preventing ransomware corruption of /bin/bash program – The ZeroLock Agent’s Process Monitors receiving messages about the chmod system call family treat them as file writes for the purposes of tampering, lockdown rules, and file backup.
Logging enhancement – Logging capabilities have been improved to help troubleshooting of endpoint issues, reducing time to resolution.
Enhanced Cache File Management – Improvements to non-zero threat value processes maintenance include the following:
- High Threat processes - with threat values above the designated threshold, data is kept for 14 days then cleaned up.
- Suspended processes - the process’s data is deleted, and the process is released.
- Exited processes - data associated with the process is deleted.
- Running processes - are not affected.
Detection Enhancement
Improved Program Execution Rule Enforcement – Program Execution rules that
block a program now also prevent the renaming, copying, or moving of the program executable.
Program Execution Override – To make it easier to handle false positives, the system administrator is now allowed to add a Program Execution or File Access rule to override the behavior analysis engines when the process or file behavior has been verified good.
Cryptojacking Engine Improvement - Multiple enhancements to the Cryptojacking engine’s machine learning model have reduced false positives and improved its effectiveness.
Reduce false positives from cron jobs - Performance improved and false positives reduced on protected endpoints running cron jobs.