ZeroLock® Management Console v3.x Build Notes

The build notes contain important information you should know before you install the ZeroLock solution.

Before installing this build, it is recommended that you familiarize yourself with all the new features listed.  

The ZeroLock solution has two components: 

  • ZeroLock Management Console
  • ZeroLock Agent 

 System requirements and installation instructions    

For more information on system requirements and installation instructions, see the following knowledge base articles:  

 


   Build 3.3.5 – September 30, 2024
Item Number Description

SERVER-771

TenantID added to Exception, Memdiag, StreamData, and Streams tables.

   

SERVER-776

SSH-MFA Alerts

Removed options and displays that are not available for an SSH-MFA alert.

  • '0 file(s) affected'. This alert does not affect files.
  • 'Not Remediated'. You cannot remediate this alert type.
  • 'Kill and Remediate', 'Kill Process', and 'Release Process'. These do not function for an SSH-MFA alert.
   

SERVER-807

Welcome message added to ESXi SSH Installer.

   

SERVER-810

Podman Support

Support has been added for the Podman (pod manager) container management tool.

   Build 3.3.4 – September 13, 2024
Item Number Description

SERVER-794

JSON packages will now reference the exact version of shared and database-manager packages.

   Build 3.3.0 – September 11, 2024
Item Number Description

SERVER-749

New Agent Package Upload

New ZeroLock Agent versions may now be downloaded directly from Vali Cyber to the customer's database replacing the filesystem based method.

   

SERVER-761

Improve Upload Agent Button Formatting

The Upload Agent button reformatted for clarity and utility. 

   
SERVER-767

Agent Versions are Tenant Specific

In the Deploy section, the Advanced Settings drop-down menu will now only list agent versions available for that tenant.

   
SERVER-768

Alert Only Mode

When selecting a single, or multiple endpoints, the ZeroLock Management Console verifies that the specified endpoints are running an agent version 3.5.10 or greater.  If not, Alert Only Mode option is greyed out.  

 

   Build 3.2.4 – August 29, 2024
Item Number Description

SERVER-720

New Agent Package Upload through ZMC.

New ZeroLock Agent versions may now be uploaded through the ZMC, removing the requirement to manually add the package to the server/zerolock-server/database/asset directory for import access.

   

SERVER-735

Tenant Agent Uploads

The current installations and agentFiles tables are not tenanted. While installations have a tenantId column, it’s always zero.  To support the SaaS solution, this process must now use a tenantId.

  • The agentFiles table has been modified to use a tenantId column.
  • An agentFiles model is created.
  • The installations table will use the tenantId column.
  • The new agent upload functionality uploads for the user’s tenant.
  • The current file watch process in agents.loadAssets() must load for all tenants when a filesystem change is processed.
   
Server-744

Deep Ordered Ruleset Duplication

This feature adds the ability to duplicate all rules in an ordered ruleset and duplicate the rules and rulesets it contains.

   
Server-747

Agent Alert Only Mode

On the ACTIONS dropdown for the endpoints page, the options for ENABLE ALERT ONLY mode and DISABLE ALERT ONLY  mode are now available. These buttons only work with Agent version 3.5.10 and newer.

When activating Alert Only mode, the user must select a timeout. The default is 24 hours from the current time. Upon reaching the timeout, the agent will automatically revert to its normal mode of operation.

   
 SERVER- 752

The Deploy table now uses the tenantId column.

  • A tenantID column has been added to the Deploy table.
  • The install-zerolock process uses the tenantId of the 'deploy token' to find the correct agent.

 

   Build 3.2.2 – July 31, 2024
Item Number Description

SERVER-693

Enhanced Activity logging details: When deleting a group from ZMC, both the group ID and name will appear in the activity log. 

   

SERVER-697

UX Server logging enhancements have been added.

   
 SERVER-700  HTTP Transport: An activity log entry will now be created for connection and disconnection of the HTTP transport.   
   

SERVER-708

HTTP Transport: Logging performance enhancements have been implemented. 
   Build 3.2.1 – July 29, 2024
Item Number Description

SERVER-722

Local SSH-MFA SSH-MFA resolution will be performed at the agent level, allowing SSH-MFA to no longer require the connection to the ZMC to provide authentication. This will reduce the risk of ZMC communication issues and the user being unable to SSH to a protected endpoint. 

   Build 3.1.19 – July 18, 2024
Item Number Description

SERVER-680

Removed the Agent Container installer from the ZMC agent deployment options. 

   
   Build 3.1.18 – July 18, 2024
Item Number Description

SERVER-680

Removed the Agent Container installer from the ZMC agent deployment options. 

   

SERVER-685

Monitoring of SLPD (Service Level Protocol Daemon) added to prevent exploitation of service vulnerabilities.  

   

SERVER-687

Support Basic HTTP Auth

The Syslog settings were changed to HTTP TRANSPORT as this is a more accurate description of the capability.

Also supported is basic HTTP authorization with a username/password combo.

   Build 3.1.17 – June 27, 2024
Item Number Description

SERVER-676

Allow and Block buttons on an alert process block now provide a confirmation dialog.

Clicking Allow or Block to create a hash rule provides a confirmation dialog, allowing the user to confirm the action and which Policies it should be applied to. 

   

SERVER-677

Creating an Allow and a Block rule for the same hash is not allowed. 

   

SERVER-679

Importing a new ruleset no longer resets all "ValiCyber" rules back to the defaults.

Users using the “modify Policy rule” dialog to modify properties on the ValiCyber lockdown rules no longer lose these modifications when a newer version of the lockdown rules is imported. 

 

   Build 3.1.16 – June 27, 2024
Item Number Description

SERVER-670

Enable Fully Automated Install with Lifecycle Manager.

   

SERVER-675

Use of the latest ZeroLock Agent v3.1.15 is enabled.

   

SERVER-630

Resolved issue: when creating a Hash rule from the process tree and the process name was too long. 

 

   Build 3.1.15 – June 24, 2024
Item Number Description

SERVER-661

Scrollbars added to Server Dashboard screen when the resolution doesn't fit the full page.

   

SERVER-664

"ZeroLock for Linux" is now called "ZeroLock".

   

SERVER-665

Activity Log Enhancement

  • MFA Token Check message now includes the Source IP Address.
  • SSH Session requested message now includes the Source IP Address.
  • Alert ID has been added to the message. This will allow the user to tie the Activity log to the Alerts page.
  • Alert Response information to the activity log.
  • All messages now include the activity time stamp of when it happened.

 

 

   Build 3.1.12 – June 20, 2024
Item Number Description

SERVER-647

Additional Endpoint Activity Log information

In response to customer request, the following information is to be added to the endpoint Activity messages that are being sent to the SIEM.

  • All events now contain the Hostname.
  • The Alert Type is now displayed.
  • On Lockdown rule alerts the Rule Name is now included.  
   

SERVER-648 

SSH-MFA - Added the ZeroLock MFA user logging into the system. 

 

   Build 3.1.11 – June 18, 2024
Item Number Description

SERVER-627

Update ESXi Default Config command LineRegex Field

This enhancement enables monitoring of the local ESXi shell. 

   

SERVER-641

Add updated rules v1.4.13 and agent v3.1.13. 

 

   Build 3.1.9 – June 10, 2024
Item Number Description

SERVER-634

Syslog - Add field for port number and change name from Activity to Syslog. 

 

   Build 3.1.8 – June 10, 2024
Item Number Description

SERVER-609

Remove "REBOOT" and "TERMINATE" Endpoint Actions

The REBOOT ENDPOINT and TERMINATE ENDPOINT options should be removed from the actions dropdown list.

 

  Build 3.1.7 – May 20, 2024
Item Number Description

SERVER-525

Syslog Capability for Activity Logs

On the System Settings screen, an Activity Log box has been added enabling a user to set up the required information to connect with a syslog server.

 

  Build 3.1.5 – May 14, 2024
Item Number Description

SERVER-531

The Policy Rules screen now includes the latest currently installed rules version in the name.

Example: Policy Rules v1.4.10

   

SERVER-511

Ability to Change Response Type of All Rules has been Added.

A user may now change the response options of a rule in the ACTIONS dropdown menu. The options are:

  • Alert level
  • Send email alerts
  • Response type
  • Auto-quarantine
Note: These options do not apply to SSH-MFA and canary rules. 
   

 

  Build 3.1.3 – May 14, 2024
Item Number Description

SERVER-559

Vali Cyber default Lockdown Ruleset updated to v1.4.10 Rules. 

   

 


  Build 3.1.1 – May 29, 2024
Item Number Description
 SERVER-531  Vali Cyber default Lockdown Ruleset updated to v1.4.9 Rules. 
   
 SERVER-546  For signed VIB, ESXi installation commands installs the entire component. 
   

 


  Build 3.1.0 – April 22, 2024
Item Number Description
 SERVER-477 

Confirmation Dialogs

This enhancement ensures clear understanding by the user of actions taken by adding confirmation dialogs on various screens. For example:

  • Roles - Delete roles include a list of roles deleted.
  • Endpoint Screen – Dialog box now confirms actions Reinstall Agent, Deactivate Endpoint, Activate Endpoint, Quarantine Endpoint, and Unquarantine Endpoint.
  • Users - Dialog box now confirms Suspend, Unsuspend, Unlock user. 
   
 SERVER-514

Signed VIB Server

   
 SERVER-515 To improve efficiency, unnecessary indexes were removed from the database.
   

 


  Build 3.0.2 – February 26, 2024
Item Number Description
 SERVER-435

Collector Installation Asset Mirroring 

This enhancement ensures that the Collector only caches the MOST RECENTLY INSTALLED agent version. This action reduces the possibility of slow startup due to loading the entire installations table.

On startup, there should be no cached installer. When an agent installation occurs, the selected version should be cached in memory.
If a new installation request occurs and the version matches the cached version, then the cached version should be used rather than querying the database. Otherwise, query the database to get the requested version, and replace the cached version with the requested one. 

   

 

  Build 3.0.1 – February 26, 2024
Item Number Description
 ZERO-1307  Added an ESXi option to the Environments dropdown menu. 
   
 ZERO-1298 

New Air Gapped Environment option

This enhancement introduces the ability to install the ZeroLock Agent in an airgapped environment. Installation scripts will automatically change to reflect the environment where they are being installed. 
   
SERVER-403 When selecting to add or remove groups from the endpoints screen, the dropdown group entries are now listed in alphabetical order.