New features summary
25 min
These are cumulative release notes. If a release does not appear in this section, then there were no associated new features and enhancements.
Miscellaneous Changes
- Finding History enhanced with scanner-reported status: The History section in the Host Finding Details pane now displays the scanner-reported status for applicable Qualys findings, providing clearer visibility into status transitions. For example, when Qualys reports a finding as Fixed, the finding transitions to Closed. This enhancement helps maintain consistency between the current finding status and its historical record. For more information, see the Host Finding Detail .
Integrations
- Account ID retrieval for Amazon Inspector connector: The Amazon Inspector connector uses this “/members/list endpoint” endpoint to retrieve Account IDs for Account ID filtering. If Account ID data is not returned, contact Amazon Support to verify endpoint access for your account.
- ITSM CMDB connector UI enhancements: The CMDB connector has been enhanced to support Business Criticality, Asset Compliance, and the ability to fetch Configuration Items (CIs) based on sub queries. These enhancements provide additional options for retrieving CMDB data. For more information, see the Ivanti Neurons for ITSM Configuration Management Database (CMDB) Connector Guide.
- Skip Suppressed Findings for AWS Inspector Connector: The AWS Inspector connector now provides an option to exclude suppressed findings from ingestion into RBVM. When Findings marked as suppressed in AWS will not be imported into RBVM check box is selected, findings marked as Suppressed in Amazon Inspector are not imported during connector runs. This helps organizations reduce noise by preventing intentionally suppressed findings from being ingested into RBVM. For more information, see the Amazon Web Services Amazon Inspector Connector User Guide.
- Human-Readable Schedule Summary for AWS Inspector Connector: A new human-readable schedule summary is now available in the Configurations section of the Amazon Inspector connector. The schedule summary dynamically updates based on the selected schedule and provides a clear, readable description of when connector scans are configured to run. This enhancement helps users quickly understand cron-based schedules without having to interpret underlying cron expressions. This enhancement applies only to Custom Cadence frequency under the Daily schedule option. Weekly and Monthly schedules are not affected. For more information, see the Amazon Web Services Amazon Inspector Connector User Guide.
List View Enhancements
- Hierarchical Scanner-Based Column Selection in List Views: The Show Columns menu now organizes scanner-specific columns into hierarchical groups, making scanner-related data easier to manage in supported list views. Instead of appearing in a flat list, columns are grouped under their respective scanners. Users can select or clear an entire scanner group to include or exclude all associated columns or manage individual columns independently. When only some child columns are selected, the parent scanner group displays a partial-selection indicator. This enhancement streamlines column management and improves usability when working with scanner-specific data. For more information, see List View Column and Row Settings.
Miscellaneous Changes
- New Account ID-Based Filter for Amazon Inspector V2 Connector: A new Account ID Filter has been added to the Optional Configuration section of the Amazon Inspector connector. This enhancement enables users to retrieve available account IDs from the configured AWS environment and include or exclude specific accounts from data collection. For more information, see Amazon Web Services Amazon Inspector Connector User Guide.
Miscellaneous Changes
- New Severity Type Filter for Amazon Inspector V2 Connector: A new Severity Type Filter has been added to the Optional Configuration section of the Amazon Inspector connector. Users can now choose to import findings from all severity levels or only from selected severity levels, including Critical, High, Medium, Low, and Informational. This filter enables more targeted data collection by allowing findings to be imported based on their severity. For more information, see Amazon Web Services Amazon Inspector Connector User Guide.
- Additional Timeline Filters for Findings KPIs: The Recent Findings and Overdue Findings KPIs, available in the Host Findings and Application Findings list views, now include two additional timeline filter options:
- Less than 30 Days
- All Time
These new filters provide greater flexibility when analyzing findings across different time ranges.
- Orca Mapping Enhancement: The connector now supports enhanced field mapping capabilities for both Host and Application assets, improving data alignment between Orca and Risk-Based Vulnerability Management (RBVM). This enhancement provides separate field mappings for Host and Application assets, enabling more accurate asset data mapping. It also improves the accuracy and visibility of imported Orca findings and inventory data. For more information, see Orca Connector User Guide.
Miscellaneous Changes
- Orca API endpoint migration: As part of the Orca API version upgrade, the deprecated /api/sonar/query endpoint has been replaced with /api/serving-layer/query. Users must update existing integrations to use the new endpoint. For more information, see Orca Connector User Guide.
- Improved multi-tab navigation in RBVM: Users can now open RBVM platform links in a new browser tab using standard browser options such as Open Link in New Tab. New tabs open without requiring users to sign in again, while left-click behavior remains unchanged and continues to open links in the current tab.
- Bulk Group Selection for Playbook Rules: Playbook rules now support a Reset to All Groups selection option for Add to Groups and Remove from Group actions. This enhancement allows users to include all existing groups in a single step, reducing manual effort and improving efficiency when creating rules that apply to a large number of groups.
The All Groups selection includes only the groups available at the time of selection. Newly created groups are not added automatically. To include new groups, use Reset to All Groups again or manually add the required groups.
For more information, see Playbooks V2: Detailed Walkthrough.
Integrations
- Introduced ITSM CMDB integration to associate findings with configuration items (CIs), providing improved asset context and tracking capabilities. For more information, see Ivanti Neurons for ITSM Configuration Management Database (CMDB) Connector Guide.
Miscellaneous Changes
- Download Detail pane added - The Download Center now includes a Download Detail pane. The pane is hidden by default and opens when you click a row, displaying details such as file name, creation date, expiration date, and download history for the selected file. For more information, see Downloading a File from the Download Center.
List View Enhancements
- Users can now view and filter findings by QUALYS Patch Publication Date on the Host Findings page. The field is available as a filter and can be added to the list view from Show Columns.
Miscellaneous Changes
- END USER LICENSE AND SERVICES AGREEMENT (EUSLA) content is updated with new terms. Administrators will get a popup and with an option to Accept this EUSLA to enter the platform.
List View Enhancements
- Improvements to VRR Trend Line - Enhanced the VRR Trend Line visualization to improve readability and trend analysis. The chart now includes labeled axes, displays a flat line when the VRR score remains unchanged over the previous six months, and highlights the start and end points of stable trends to provide clearer insight into score movement and stability over time.
- Added the Age column to the List View for Application Findings and Host Findings, providing visibility into the number of days a finding has remained unresolved and enabling more effective risk prioritization and remediation planning. The Age column can be enabled from the Show Columns menu.
Miscellaneous Changes
- Improved session management in the Qualys VMDR Integration by closing sessions after all file pulls in a connector run are completed.
Miscellaneous Changes
- Support to skip custom compliance plugins in Tenable.io with plugin ID ranges beyond 1000000.
- The Vulnerability Search API endpoint now enforces response size control. This enhancement restricts requests to those specifically scoped to the Vulnerability subject with a FilterRequest using the IN operator. Requests that include more than 10 values in the filter will be rejected.
- New Asset Type Filter has been introduced in AWS Inspector V2 Integration.
Miscellaneous Changes
- Filter groups that have policy compliance findings in the Policy Compliance Overview widget.
Miscellaneous Changes
- AWS Inspector Integration enhanced daily runs by transitioning from single-threaded to multi-threaded processing, improving data retrieval and ingestion performance.
- Added a selected item count in filter options playbook rule for Delete Asset or Finding.
Miscellaneous Changes
- AWS Inspector v2 mapping extended to include a scanner-specific unique field for the AWS Unique ID, enabling more efficient identification and tracking of existing findings.
- Qualys VMDR Integration enhancement now supports retrieval of IPv6 address details as part of the integration.
Miscellaneous Changes
- Playbook: Deleting Host / Host Finding / Application / Application Finding in an automated manner.
- Playbook ownership transfer.
- The Debug Log option can be enabled when uploading files. If the upload fails, the error logs will be available on the Uploads page once the process is complete.
- Deprecation: Removal of the Legacy Uploads page navigation link.
List View Enhancements
- VRR Trend line - The VRR Trend line provides historical visibility into changes in a vulnerability's Vulnerability Risk Rating (VRR). By displaying how the VRR score has changed over time, security teams can better understand risk progression and evaluate how a vulnerability's priority has evolved.
- Playbook enhancements:
- Delete Host/HostFinding/Application/ApplicationFinding.
- Custom attribute value updates.
Miscellaneous Changes
- ServiceNow connector setup scope.
- Cause Code Guidance in Ivanti ITSM Setup and Ticket Creation.
Miscellaneous Changes
- Patch Tuesday System updates automation.
List View Enhancements
- Scanner-specific fields marked for 'ALL' with propagation enabled are now correctly propagating, resolving a previous issue where these updates were not being applied.
List View Enhancements
- Color Change issue for Severity and Other Columns.
Miscellaneous Changes
- ServiceNow connector setup scope.
- Cause Code Guidance in Ivanti ITSM Setup and Ticket Creation.
List View Enhancements
- Workflow Approvers' names in the details pane.
- Add IPv6 address in Qualys fingerprint default precedence.
Miscellaneous Changes
- ServiceNow connector setup scope improvements.
- Tenable WAS connector beta version is available.
Miscellaneous Changes
- Workflows now show the selected approver in the details panel for improved visibility.
- Added support for Tenable WAS application asset audits to ensure applications move to the archive state correctly.
- Added a workflow filter to search by assigned approver, making it easy to view all workflows linked to a specific approver.
Miscellaneous Changes
- Workflow expiration date introduced.
- "Next X days" filter is added in Workflows.
Miscellaneous Changes
- Changes to enable Tenable WAS Integration (Pre-beta).
- Handshake test for Product analytics platform (Pendo) integration performed.
- Improvements done to the Ticketing connectors publish jobs.
Miscellaneous Changes
- Improved the text shown for tag history entries to eliminate duplicate sentences.
- Added configuration for the ticketing connector's tag sync job, allowing it to run at a different hour of the day (previously, it always synced at the 0th hour UTC; now, the hour can be set).
- Enhanced the Asset Type filter for Expander V2 integration.
Miscellaneous Changes
- Introduced a new “Role Expiration” notification type.
- Password reset emails now comply with Ivanti brand guidelines.
- Enhanced URBA Ingest Cache now stores necessary asset information directly in Redis, replacing reliance on the JP REST API.
Miscellaneous Changes
- Password reset emails now comply with Ivanti brand guidelines.
Miscellaneous Changes
- CISA KEV System View Automatic Updates - CISA Known Exploited Vulnerabilities (KEV) system view now updates automatically on a daily basis, ensuring near real-time coverage as new KEVs are published by CISA.
- Workflow Approver Assignment & Notification - Added the ability to assign up to three users as workflow approvers during workflow creation (optional setting)."Approver(s)" field introduced in Create Workflow; selection is limited to users with relevant approval privileges. Other users can still approve workflows based on role privileges.
- ITSM users can now map ticket Priority to RBVM Severity and VRR score groups during connector setup.
- The improved URBA Ingest Cache feature will enable the ingest pipeline to cache necessary asset information directly into Redis rather than using JP’s REST API.
- A few app ingestion parts of queries have been tuned to work in batch/stream.
Miscellaneous Changes
- Unique Configurable Export Per Ticketing Configuration
- Added ability to define a custom export template for each finding collection when using auto-ticketing.
- Include Tenable PC Findings in RBVM
- Integrated Tenable Policy Compliance (PC) findings into the RBVM platform, improving visibility and reporting.
- Workflow approver notification
- Automatic in-platform notifications for assigned workflow approvers.
List View Enhancements
- In the dashboard, we have provided the ability to sort shared dashboards.
Miscellaneous Changes
- Shared Dashboards Sorting
- Added the ability to sort shared dashboards:
- By Name (alphabetically)
- By Created Date (latest to earliest)
- Role Expiration Notification
- Introduced new notification type: Role Expiration Notification
- Notifies stakeholders when a user's client role is nearing expiry.
- Configuration options for notification schedule:
- 14 days in advance
- 7 days in advance
- 1 day in advance
- Configurable delivery method for notifications.
- ITSM Priority Sync based on Risk
- Added mapping of ITSM Priority to Severity and VRR group.
- Map Priority to VRR (Critical / High / Medium / Low / Info)
- Map Priority to Severity (Critical / High / Medium / Low / Info)
- Improved URBA pre-op and post-op step performance by utilizing a Redis cache and removing the dependency of the REST API.
List View Enhancements
- IP Address Type Display Consistency for Hosts: To maintain consistency, the IP Address Type will not be shown in the host summary section of the details pane whenever the IP Address is null. Previously, when the IP Address was null, the "IP Address" column displayed "N/A", but did not show the associated IP Address Type (external / internal) in the list view, even though this information was visible in the details pane.
List View Enhancements
- Added CVSS v4 vector filter to Host Findings and Application Findings lists for more precise vulnerability filtering.
Miscellaneous Changes
- Snyk Open Source connector now displays new scanner-specific fields in the platform providing greater visibility and context for application security findings to aid vulnerability management:
- Org Name
- Project Target Reference
- Issue Type
List View Enhancements
- Veracode V2: Added "Policy Name" and "Policy Guid" as available filters and list view columns on the Applications page for improved filtering and organization.
Miscellaneous Changes
- Snyk Open Source Connector API Upgrade
- Updated the connector to support the latest API version (2024-10-15) following the deprecation of the older version (2023-05-29).
- Tenable SCv2 Policy Compliance Findings Update
- Added support for ingesting and displaying "Steps to Remediate" information in policy compliance findings.
- Enabled search and filtering of findings based on the presence of remediation steps for streamlined prioritization.
- Previously ingested findings remain unaffected by this update.
- Improved Host Findings Plugin Output Display
- Updated the host findings detail pane to show the "Plugin Output" section if any of the following are present: Output, Patches, or Solutions (previously based only on the presence of Solutions).
List View Enhancements
- Pinned Dashboards: Enabled the ability for privileged users to pin or unpin dashboards in the user-defined custom dashboard menu.
Miscellaneous Changes
- Optimized Upload/URBA Performance
- Improved upload and URBA ingestion performance by utilizing a new JSON mapping table for more efficient queries.
- Prisma Cloud Connector Enhancements
- Added functionality to split large Prisma Cloud files for improved parsing performance based on asset types (e.g., Host, Images, Registry, Container, Container Images).
- Introduced configurable options for maximum assets per file.
Miscellaneous Changes
- Automated ITSM Ticketing Enhancements
- Added functionality for Findings Collections in the ITSM ticketing connector to enable seamless automation of ITSM ticket generation workflows.
- Users can configure custom ticketing settings, add attachments, and define the frequency of ticket creation execution based on preferences.
Miscellaneous Changes
- Previous Severity and VRR Filters
- Introduced new filters to track changes in severity and VRR scores for findings:
- Previous VRR Score: Displays a finding's VRR score before its latest update.
- Previous Severity Score: Displays a finding's severity score before its latest update.
- Previous Score Update Changed VRR Group: Identifies findings that shifted VRR score bands (CHMLI) in the latest update.
- Previous Score Update Changed Severity Group: Identifies findings that shifted severity score bands (CHMLI) in the latest update.
- Enhancements to Exportable Fields and Finding Details:
- Added Previous VRR Score and Previous Severity Score to exports and the Finding Detail pane.
- Additionally, added SLA Due Date Updated On to exportable fields for better SLA tracking.
- Tenable Resurface Date
- Integrated a new Resurface Date field for Tenable.SC (Tenable Security Center) findings:
- Tracks when a vulnerability is "reopened" or "resurfaced" within Tenable.SC.
- Available as a column, exportable field, Group By, and filter.
List View Enhancements
- Notifications for change of Workflow status - A new notification preference card called “Workflow State Change” is added. Using this setting, users can enable Workflow State Change notifications for In Platform, Email, and Slack.
- Custom Attribute Delete - On the Client Settings page, Delete option to remove unused custom attributes is provided. User can review all existing dependencies of the custom attribute in playbooks, filters etc. before performing the delete operation.
- SLA Status in export - User can add SLA status field to the exported data for host findings and Application findings.
Miscellaneous Changes
- END USER LICENSE AND SERVICES AGREEMENT (EUSLA) content is updated. Administrators will get a popup and with an option to Accept this EUSLA to enter the platform.
List View Enhancements
- Information for Workflow Approved By added - The Workflow Details will now show the user who approves a workflow as well as the date of its approval. As an exportable field, the “Approved By” field will be the approver’s username. In addition, this release adds the filters “Approver Username”, “Approver First Name”, “Approver Last Name”, and “Approver ID”.
Miscellaneous Changes
- The scanner specific field “VERACODE Affects Policy Compliance” has been added to the Veracode XML connector. For the beta API connector, the field “VERACODE Violates Policy” has been added.
- Snyk Open Source connector updated to support new base endpoint <https://api.snyk.io>/v1.
Dashboards and Reporting Enhancements
- Updated aging metrics KPIs - The KPI widgets now give users access to “Days since ingestion of the oldest critical finding” and “Days since discovery of the oldest critical finding”. These KPIs allow you to change the asset type or the scoring metric (VRR or Severity). Use these KPIs instead of the EOL widgets “Age of the Oldest Host Finding with Critical Risk” and “Age of the Oldest Application Finding with Critical Severity”.
Miscellaneous Changes
- Batched deletion jobs of tags have been optimized.
- All string terms used for Scanner Reported Severity will now be in upper case. While this change helps to unify the presentation of Scanner Reported Severity, users should filter findings by specific scanners when viewing data. Although scanners often use similar terms to describe risk, differences may exist between each scanner’s rating system.
Integrations
- New field for Tenable Vulnerability Management - The “NESSUS Last Fixed At” field will capture the Tenable Vulnerability Management “last_fixed” date.
- Archived Wiz application assets - Wiz application assets not seen in 30 days will be marked as “system-archived”.
- EOL of the legacy Tenable Security Center connector - On March 7, 2025, only clients that have an existing legacy Tenable Security Center connector will be able to create a new connector of this type. Clients without an existing connector will no longer be able to view the connector card or create a new legacy connector.
Automation Updates
- Automated Severity Change Workflow - Users can now create an automated severity change workflow.
Automation Updates
- Automated ticketing for ServiceNow Incident - Users can now create an auto-ticketing configuration for the ServiceNow Incident ticketing connector.
Miscellaneous Changes
- New instances of the Prisma Cloud Compute connector now uses a different default precedence for container findings. Previously, the connector merged all container findings under one asset regardless of how many instances of the container that the scanner located. As a consequence, new instances of this connector may generate more assets and findings than existing older versions. This new network precedence applies to PRISMACLOUDCONTAINER scanner type findings.
- The Uploads page shows the names of deleted assessments and networks. If the upload has not started, the Uploads page invites users to select a new assessment and / or network (Note that only the owner of an upload will actually have the option to edit the upload).
- On the “Group Performance over Time” widget, users can now configure the widget to show labels for each data point on the chart. To make better sense of the data, reduce the number of groups visible in the widget.
- The text for the automated workflow “Create” dialogue has changed slightly, emphasizing that any finding associated with the workflow will be closed when the workflow is approved (Alternatively, the severity score may be changed by a severity change workflow).
Integrations
- EPSS Information Added - In Ivanti Neurons for Vulnerability KB, users can now view the EPSS probability and percentile for a growing number of CVEs and add these EPSS values as columns. EPSS, a rating system from FIRST, predicts the likelihood of a CVE being exploited within the next 30 days. EPSS information is also available for CVEs shown in the Finding Details within Ivanti Neurons for RBVM/ASPM. Both the probability and the percentile will be shown as percentages. (Note that for the vast majority of CVEs, the probability of exploitation is < .1.)
Miscellaneous Changes
- The “CVSS V2” and “CVSS V3” columns in the Vulnerabilities export have been renamed to “CVSS V2 Vector” and “CVSS V3 Vector” to reflect that the export shows the full vectors rather than the scores.
- Client names can now be two characters.
- Rapid7 InsightVM now gives organizations the option to create assets without vulnerabilities.
Integrations
- CVSS V4 ratings of CVEs are gradually populating within the Vulnerability KB. This information will only be available in the Vulnerability KB for now.
- When creating a manual workflow, the user can longer open the calendar widget and select “Today” as the expiration date.
Miscellaneous Changes
- CVSS V4 ratings of CVEs are gradually populating within the Vulnerability KB. This information will only be available in the Vulnerability KB for now.
- When creating a manual workflow, the user can longer open the calendar widget and select “Today” as the expiration date.
Dashboards and Reporting Enhancements
- Additional filtering added to Top Ransomware Groups - This widget now has two additional settings. By default, the widget will now omit the system-managed groups that contain all assets (“System - All Assets”, “System - All Hosts”, and “System - All Applications”).
Integrations
- New Network Precedence for Tenable SC v2 - This release replaces the default network precedence order for Tenable Security Center v2 assets. The new precedence order aims to more closely reproduce how assets appear in Tenable. The new network precedence rules only affect new networks. This change will not impact existing Tenable SC v2 connector setups. If users feel that duplicate asset have appeared in new networks, they can do a Group By over the Tenable UUID to consolidate and locate duplicate assets.
- WIZ Connector GA - All clients can now enable the WIZ connector. For instructions on how to configure the connector, see the WIZ connector guide.
Miscellaneous Changes
- An “info” icon will now appear next to the Last Discovered On value in the Finding Details. This icon informs users that the platform does not update the value for a closed finding.
- If a user tries to query the Vulnerability KB using the vulnerabilityDetail projection, the platform will now return matching CPEs.
Integrations
- More Host Identifiers Available for Host Generic Scanners - The Generic Upload feature now supports the properties EC2 Identifier and MAC Address.
- Simplified File Attachment Management for Jira Tickets - For clients that opt into this new beta feature, the Jira ticketing connector only supports 1 file attachment on each ticket. The ticketing connector deletes the old attachment and adds a new one with the latest updates. To accomplish this, the ticketing connector must be configured with credentials empowered to delete attachments on tickets. If you have an interest in trying out this feature, please contact support.
List View Enhancements
- New Optional Columns for Findings View - Users can now add Severity Group, VRR Group, and Scanner Plugin as columns within the Host Findings and Application Findings list views.
Miscellaneous Changes
- Users can now save a start date and end date for the “Ivanti RS3 Timeline” widget on a custom dashboard.
- Users can now add a deep link path for Jira ticket attachments. Users who connect to an on-prem installation of Jira through ROSA can use this field to adjust links to tickets within the platform.
Integrations
- When using the Rapid7 InsightVM connector a new field has been added to allow users to add a Proxy URL to the connector.
Dashboarding and Reporting Enhancements
Users will now be able to see a percentage for the following Group Metrics:
- Metric Comparison across Groups
- Current Group Performance
Integrations
- Orca beta connector - Users can now ask to test the beta version of the new Orca connector. This connector uses the Orca API to retrieve security vulnerabilities and threats on cloud endpoints. Depending on the asset type, Orca asset will populate as either network or application assets.
- SonarQube Credentials Update - Users can now enter a username and password instead of just a UserToken in the configuration form.
Automation Enhancements
- Custom Attribute Job Updates - On pages where you can add or update custom attributes, you can track the progress of those updates as well as downstream updates to impacted assets and findings.
- Auto-ticketing now available to most user roles - Users now only need Finding Collection Control to create auto-ticketing configurations. Most foundational roles come with Finding Collection Control by default.
Miscellaneous Changes
- Names and logos have been updated for a few connectors:
- “Synopsys” will now be referred to as “Black Duck”.
- "Black Duck Software Composition Analysis" has been shortened to "Black Duck SCA".
- “Coverity” will now be shown as "Coverity® Static Analysis".
- "WhiteHat Dynamic" will now be shown as "WhiteHat™ Continuous Dynamic Analysis".
- “New user” emails will now have updated contact information for Ivanti support. The emails also use Ivanti colors and branding. Note that the emails refer to ASOC (Application Security Orchestration and Correlation) by its new name, ASPM (Application Security Posture Management).
- The platform now supports UTF-8 characters in client names.
Integrations
- New Capabilities in ServiceNow Incident and Request: These ticketing connectors now have the following configurations:
- Select the type for the associated tag in Ivanti Neurons.
- Lock fields within the ticket.
- Map a ticket field to the Ivanti Neurons SLA date.
- Map the ticket priority to vulnerability risk.
- Configure which fields to include in the ticket attachment by selecting an export template.
Miscellaneous Changes
- Users can now set default address type for network assets without an IP address in Client Settings.
- All clients now have the ability to enable the MetricStream GRC connector. This connector allows users to create a ticket in MetricStream for every Risk Acceptance workflow. Rather than approving the workflow within Ivanti Neurons, the organization approves the workflow within MetricStream.
- All clients can now enable the Rapid7 InsightVM connector. Findings and assets will appear within the Host Findings and Host pages respectively. For more information on this connector, view the Rapid7 InsightVM connector guide.
- All clients can now enable Microsoft Defender for Endpoint. Findings and assets will appear within the Host Findings and Host pages respectively. For more information, view the Microsoft Defender for Endpoint connector guide.
- The field “Nessus Check Type” will now be available on the Host Findings page.
Integrations
- SNOW Priority Synchronization - Service Now Incident tickets can now be configured to set the ticket priority based on the criticality of the findings associated. Users can map the Critical, High, Medium, Low, and Informational VRR score or Severity for the findings to the desired SNOW ticket priority. Adopting ticket prioritization can help organizations ensure the most critical findings are worked first.
Miscellaneous Changes
- The Wiz finding filter options UI on the configuration form has been updated.
- Quick Filters will now load after the list view. When the Quick Filters load, they will expand to show available options. This change in load order will improve the initial responsiveness of our list views.
List View Enhancements
- Links to Collections detail view added to Collections view cards - The Collections detail view can now be accessed from the Collections view card. This addition allows users to delete a finding collection without an auto-ticketing configuration and to view auto-ticketing configuration details (if available) without having to navigate to the Collections section of the findings detail pane.
Integrations
- Wiz Connectors Enhancements - This release contains several updates to the Wiz connector:
- Users can now configure the Wiz connector to only ingest certain types of assets.
- The Wiz connector now supports scheduled synchronization for existing assets and findings in addition to data ingestion. Synchronization will occur every 15 days and bring in the latest “Last Discovered On” dates.
Dashboards and Reporting Enhancements
- Timeline for Finding Discovery - The widget “Findings First Discovered vs. Resolved” shows vulnerability detection based on the First Discovered On date rather than First Ingested On date. This widget allows the user to compare discovery vs. remediation over time. Like the similar widget “Findings First Ingested vs. Resolved”, the user can configure this widget to filter its results on one or more specific groups.
- Custom Widget Edit Title Override - Changes that a user makes to the content of a custom widget have always overridden existing instances of that widget. With this release, updating a widget changes both the content and the metadata (title, description, and max row count) across all instances.
Miscellaneous Changes
- New users will be auto-enrolled in in-platform notifications for API token expiration.
- The logos for Checkmarx connectors have been updated in most locations.
- The family of notifcations that alerts users of newly ingested findings and score changes (e.g. “New Open Critical VRR Findings”) will now will contain more verbose information about deep links to the platform. The changes to the “Click here to view” link will only appear within emails and Slack notifications this release.
- Other than filters with the “is one of” operator, advanced filters will again show the filter values instead of a count of values within the filter pill. Filters with the “is one of” operator will show the first value in the filter list and a count.
List View Enhancements
- Changes to Remediation Time filter - The Remediation Time filter shows the number of days between First Ingested On and Resolved On for closed findings. This release introduces the new filter “Remediation Time based on Discovery”, which shows the time difference between First Discovered On and Resolved On. The older filter has been renamed to Remediation Time based on Ingestion.
- New Case Sensitive Search Option - For the operators “exactly”, “wildcard”, “like”, and “is one of”, users can check a box to make a filter case sensitive. They can save this new setting as part of a view, widget, or finding collection. The platform will automatically turn on case sensitive search if a user applies filters by clicking a column in a Group By or if a filter value contains more than 1000 characters.
- Filters enhanced with counts and read-only search - The filter pill now shows a count of values in the filter rather than actual value. Users can open up a read-only view of all values by clicking the “info” icon that appears on interaction with an advanced filter. The read-only view of the filter lets users search on individual values. Note that the “info” view of a filter is not available for Quick Filters.
Dashboards and Reporting Enhancements
- Widget Group Selection - The “Findings First Ingested vs Resolved” and “Findings Summary” widgets can now filter on specific groups. This feature allows users to place multiple instances of the same widget side by side to compare results for individual groups or sets of related groups.
- First Discovered On added for Remediation Metrics - This release includes new versions of a bar widget and two KPIs that show the metric mean time to remediate. These include the KPI and bar chart “Mean Time to Remediate Since Discovery” and the KPI “MTTR since discovery for findings under SLA”. Unlike the versions based on ingestion, these widgets only include findings with a First Discovered On date, a value that only some scanners supply. Like the Remediation Time filter, the existing widgets based on First Ingested On have been renamed to reflect the source data.
Miscellaneous Changes
- Users uploading data from EdgeScan will now be presented with Mixed networks only.
- The configuration card for the legacy Palo Alto Expander connector will be removed.