Release Notes
We will cover a running list of new features and releases with the latest always placed at the top.
In this release:
- Improved directions for setting up WorkDocs connections
- Handling inability to connect to AWS Marketplace when looking for license
- Fixed IDP support for Cognito in GovCloud
- Fixed issue where included monthly GB is not properly provisioned
- Handle Sophos error code
0070 disk full- For zip and 7z files when 0070 is found the scanner will either mark the file a
unscannable - too largeor send the file off for Large File Scanning (if enabled)
- Improved logging on scanning Agent shutdown
v6.04.007 CloudFormation Template
In this release:
Critical to update your scanning agent - Started March 2, 2023
Please upgrade your scanning agent to avoid scanning down time. If you are on Scanning Agent v6.04.000 or newer, you must upgrade your agent to avoid scanning down time.
If you think you have had a lapse of scanning, you can easily go back and scan data from the missing time frame with an On-demand Scan. It is easy to configure for a specific time frame and only scan the files that haven't already been scanned.
- Various Bug Fixes
- Addressed an update bug where the Sophos scan engine would crash after the signature update halting scanning.
In this release:
- Various Bug Fixes
- ResultKind (sub scan result) added to the API response
- Fixed a scheduled scanning bug caused by an out of band process deleting a bucket and the schedule not being updated accordingly causing the scheduled scan to error
- Storage Assessment - new deployments will not automatically create disabled inventory configs on every bucket
- Storage Assessment - defaulted to off for new installs and upgrades (will remain on if already on)
- Fixed a strange/rare billing bug
v6.04.006 CloudFormation Template
In this release:
Upgrade your scanning agent.
- A patch for the ClamAV scanning engine to address the following vulnerability - CVE-2023-20032. You can learn more about the upgrade on ClamAV's blog.
If you are using ClamAV we recommend you perform an upgrade of the agent immediately.
In this release:
- License Mode Switcher
- You now have the ability to change from BYOL <--> PAYG mode
- For those times you started with one billing model and wanted to switch to the other without re-deploying the solution and losing the history
You must subscribe to the corresponding AWS Marketplace listing so the entitlement check passes appropriately. If you were on BYOL and want to switch to PAYG, you must subscribe to the PAYG listing.
- Various Bug Fixes
- Multi-region bucket crawling in Schedules
- Storage Assessment fix for Linked Accounts
v6.04.005 CloudFormation Template
In this release:
- CloudTrail Lake Integration released
- With the newly launched PutAuditEvents API for AWS CloudTrail Lake, CSS has created a simple integration for you to capture user activity and events from the CSS console. In just a few steps, you can consolidate CSS activity logs together with AWS activity logs in CloudTrail Lake without having to build or manage the event data pipeline.
- Various Bug Fixes
v6.04.004 CloudFormation Template
In this release:
- Patch build to correct found vulnerabilities
- Management Console moved to CentOS Stream 9
- Various Bug Fixes
v6.04.003
v6.04.003 CloudFormation Template
In this release:
- EC2 Tagging
- The EC2 instances that run for Large File Scanning can now be tagged
- Tags are manually defined (at this time) by running a Stack update and filling in the EC2 Tags field
- Export Problem Files report
- Problem Files reporting can now be exported from the Problem Files page within the Console
- Various Bug Fixes
- read-only root file system fixes
- crawling improvements
- API scaling thresholds - reduced thresholds from 1000 to 200
v6.04.002 CloudFormation Template
In this release:
Upgrade your Scanning Agents
Agent-only release
Fixed Storage Assessment data gathering bug where it would crawl and perform S3 Get calls more often than it should causing an increase in logging and potentially higher AWS costs
In this release:
Must Upgrade Linked Account Role
Please upgrade to the latest Linked Account Role. If you are prior to version 1.11.000, then you will have to upgrade each linked account's role manually (sorry). Going forward you will be able to update through the console.
- Storage Assessment
- The new Storage Assessment feature is the start of additional functionality we are adding to give you better intelligence around your data
- This new functionality helps you answer the questions: what do I have? where is it located? what are my data trends? what coverage for scanning and encryption do I have for my storage?
Additional Costs - This feature is automatically turned on when you upgrade to this release through the standard console upgrade process. You can disable this feature at upgrade by manually updating the stack and turning the drop down selection to
False.This feature will start by crawling all of your data to give you an initial overview to all of the files you have stored in Amazon S3. After that initial crawl, Storage Assessment will leverage S3 Inventory to continue to assess the data. Both the crawl and S3 Inventory have minimal charges associated with them.
Percent Scanned requires the checking of S3 Tags to determine if the scan-result tags exist on the objects. GetObjectTagging calls will be made against every inventoried S3 bucket
- read-only root file system fix
- Made it so the Fargate container root file systems are read-only
- Various Bug Fixes
- Improved unusual character handling in object key values - specifically those files that happen to have
//in the key itself
In this release:
- EventBridge integration to solve event conflicts on buckets
- There are 3 conflicts that can occur in respect to Amazon S3 bucket notifications: lambda, queue, and topics. Lambda and SQS created a scenario where the scanning engine and the existing workflow could not share events.
- The EventBridge integration will allow existing Lambdas and Queues and AVforS3 to each receive the
All Object Createevent and perform the work needed. - A new attribute, 'useEventBridge`, has been added to the Bucket-->Protect API call to allow you to specify whether or not to use EventBridge with a given bucket.
!!! note "Setting this up" The UI will allow you to simply protect a conflicted bucket as you do any other bucket, but in this release you must activate protection through the Management API. This is a very simple process by using the Swagger documentation we have attached to the AVforS3 Console (https://consoleURL/swagger)
Setting This Up
The UI will allow you to simply protect a conflicted bucket as you do any other bucket, but in this release you must activate protection through the Management API. This is a very simple process by using the Swagger documentation we have attached to the AVforS3 Console (https://consoleURL/swagger)
- Object Key added to the Scan Result filterable attributes
- With the Key added to the Message Attributes, you can now filter the message by path or entire file name for advanced filtering
- This is a great set of AWS doc pages that show the power of how message filtering can work: Amazon SNS subscription filter policies
- Various bug fixes and improvements
- Job crawling improvements - crawling in parallel and scanning is kicked off immediately as opposed to when crawling completed
- Fixe public IP override for task definitions
- Improve S3 registration with SNS Topic
- Jobs status cleanup
- Dashboard custom date selection fix
- Deregister all task definitions upon service termination
- Cleanup Notifications
- AppConfig resources now created and cleaned up by the CFT
- Permissions updates
In this release:
- Various bug fixes and improvements
- Multiple proxy deployment related adjustments and fixes
In this release:
- Scanning Agents check updates over proxy
- Private Mirror was required when deployed in
proxy mode - With this release the scanning agents can check for signature updates over the proxy
!!! note Ensure you have the proxy open to allow for the ClamAV traffic`https://database.clamav.net` - Better handling for encrypted files
- With this release we will identify more encrypted file types and mark them as
unscannable - encryptedrather than letting them pass through - Sophos Engine Only - ClamAV will still pass most of these through as
clean
!!! note SafeGuard encrypted file (self-extracting) Microsoft Office 2007 Encrypted Package (password protected) Microsoft Excel 2007 onwards [encrypted] Microsoft PowerPoint 2007 onwards [encrypted] Microsoft Word 2007 onwards [encrypted] Open Packaging Convention file format (OPC) [encrypted] Open Document Format for Office Applications [encrypted] PK ZIP archive [encrypted] SafeGuard encrypted file ACE archive [encrypted] Kremlin encrypted file xBase Database File (DBF) [encrypted] PGP encrypted file (binary) OpenPGP/GPG encrypted file AxCrypt Encrypted File SecurityBox encrypted file PGP encrypted message (ASCII-Armored) - Various bug fixes and improvements
- Addressed inconsistency with establishing the S3 Client for us-east-1
In this release:
- Bucket Configuration Remediation
- Help enforce best practices throughout your Amazon S3 buckets:
- Block Public Access - allows you to turn off the
public accesssettings - Reconcile Encryption - allows you to determine whether the objects in your bucket are encrypted or not and remediate by specifying an encryption key if so desired. Otherwise it will simply output the list of files that are not encrypted
- Enable Logging - turn on logging for select Amazon S3 buckets
- Deployment Improvements
- One of the most secure ways to deploy any solution is to air-gap it as much as you can. Restrict the access in and even the access out. We fully support this option with the use of VPC Endpoints, a Proxy Server (of your choice) to limit the outbound and the ability to Private Mirror the signature updates
- This update fully makes this a reality with a documented approach on how to do it
- Admin API Additions
- Added more functionality to simplify solution management: deployment, tear down, protection, etc
- Type
/swaggerto the end of your deployment base URL for all the details on the available APIs
- Object Tagging for Errors
- Added details to objects there were unscannable due to error
- Various bug fixes and improvements
In this release:
- Amazon WorkDocs Scanning
- We're happy to announce
event-based scanningfor Amazon WorkDocs - Following our simple-to-protect philosophy, you will easily be able to enable protection and quarantining of files stored and managed within Amazon WorkDocs
- More details to come, look under
Configuration-->WorkDocs Connectionsto configure within your Console
- Various bug fixes and improvements
- Fix race condition on v6 upgrade with entitlement
- Fix uploadedBy required in the scan API
- Fix API data tracking in dashboard and reports
In this release:
- SSL Certificate Update
- Console and API Agent updates to support updated built-in SSL certificate
In this release:
- API bug fix introduced in v6.00.000
- Agent-only release
In this release:
- Data Classification for Amazon S3
- The initial release of our new
sensitive data discoveryfunctionality - Data Classification for Amazon S3 is a cloud-based in-tenant solution that leverages the power of Sophos to identify sensitive data at petabyte scale across all S3 buckets. Knowing what sensitive data exists and where it exists enables you to proactively manage data privacy and protection as well as compliance with frameworks such as SOC 2, PCI DSS, and HIPAA.
- Identifies hundreds of sensitive data types across a variety of file types and 11 regional localizations; looks at bucket configurations
- Pinpoint Personally Identifiable Information (PII), financial data, health care information, government ID numbers and more, as well as where it resides, at scale
- DC for Amazon S3 can be run stand-alone or in tandem with AV for Amazon S3
- Various bug fixes and improvements
In this release:
- Notification Bell and Page
- Centralized visual to monitor all
proactive notificationsand AWS Security Hub findings - Allows to more easily track activity without having to subscribe to notifications
- Allows you to determine which notifications you should be subscribing to
- Enhanced AWS Security Hub Integration
- Added the ability to ingest findings from AWS Security Hub
- Findings can be leveraged for actions taken as part of Proactive Notifications responses
- True File Type
- Each Scan Result now includes what the scanning engine has determined as the actual file type being scanned
- Allows you to take action based on the "real" file type no matter the naming
- This is a filterable value in the Proactive Notifications
- Improved Special Character Handling
- AWS APIs handle special characters in Buckets / Paths / File Names inconsistently
- Changed the way we are handling files so all Keys can be handled in the same way and fewer to no errors are encountered when processing files
- New Proactive Notification Type -
job- Tracking by job is now available via Proactive Notifications
!!! warning "Notification Type Removal" We have removed
bucketCrawling and extraLargeFile filterable messages and now labeled those as the job notification type.- Various bug fixes and improvements
- Unscannable results from API Scanning now have a message indicating why
- Scan Results page charts were incorrectly reflecting the results
In this release:
- Notification Bell and Page
- Centralized visual to monitor all
proactive notificationsand AWS Security Hub findings - Allows to more easily track activity without having to subscribe to notifications
- Allows you to determine which notifications you should be subscribing to
- Enhanced AWS Security Hub Integration
- Added the ability to ingest findings from AWS Security Hub
- Findings can be leveraged for actions taken as part of Proactive Notifications responses
- True File Type
- Each Scan Result now includes what the scanning engine has determined as the actual file type being scanned
- Allows you to take action based on the "real" file type no matter the naming
- This is a filterable value in the Proactive Notifications
- Improved Special Character Handling
- AWS APIs handle special characters in Buckets / Paths / File Names inconsistently
- Changed the way we are handling files so all Keys can be handled in the same way and fewer to no errors are encountered when processing files
- New Proactive Notification Type -
job- Tracking by job is now available via Proactive Notifications
!!! warning "Notification Type Removal" We have removed
bucketCrawling and extraLargeFile filterable messages and now labeled those as the job notification type.- Various bug fixes and improvements
- Unscannable results from API Scanning now have a message indicating why
- Scan Results page charts were incorrectly reflecting the results
In this release:
- Various bug fixes and improvements
- API Endpoint - replaced port 80 with port 443 for the Target Groups health check (scanning traffic is always secure)
- Newly installed API endpoints only
- For existing endpoints, you'll have to remove and reinstall (unfortunately)
- Sophos engine update
In this release:
- Deployment Improvements
- You can now add/remove the Load Balancer at any time. Previously you had to completely reinstall the product to add a load balancer.
- Upgrade to this version, then simply run a stack update (from the AWS CloudFormation page) and enter or remove the load balancer information
- Single Sign On Support
- We are taking advantage of Amazon Cognito's inherent support for SAML Identity Providers you can now add support to leverage SSO providers like Okta to sign in to the console
- Various bug fixes and improvements
- Replaced port 80 with port 443 for the Target Groups
- Upped the Static and Dynamic Analysis file size limit to 100MB
- Chrome browser javascript fix (introduced in January 4 Chrome update)
In this release:
- Extra Large File Scanning
- Files up to the Amazon S3 max file size (5TB) are now support for scanning
- Performance improvements
- Various bug fixes and improvements
In this release:
- Automatic Bucket Protection
- This feature leverages tags on buckets to identify and automatically provision event-based scanning on bucket(s). Any time a bucket is discovered with the specified tag it will be protected. The system checks for bucket information every 30 minutes. In this check we will look at the bucket configuration and tags and respond accordingly
- To support this feature we've added the ability to "stage" regions with run configuration information. Check out ==Event Agent Settings== page for these details
- Proactive Notifications Subscription UI
- Antivirus for Amazon S3 provides real-time notifications for many aspects of the system including: scan results, bucket characteristics (like public/private), system characteristics and more. Up to this point you were required to subscribe to an SNS Topic inside of the AWS Console
- This feature provides a page where you can setup and manage the subscriptions to the notifications
- API Endpoint Enhancements
- 1 new APIs:
scan by URL- With
scan by URLyou specify the full HTTPurlto a file for scanning - There are many uses for this, but one in particular we think will be useful is for Amazon S3 pre-signed URLs. These are a good way to hand off objects, but also to implement what we call
Scan on Read.Scan on Readwriteup coming soon
- Audit Logging
- Anything and everything that is done through the Management Console is now logged to a new CloudWatch Log Group for auditing messages - CloudWatch --> Log Groups --> CloudStorageSecurity.Console.AuditLogging
- Self-Service
Prepaid DiscountMarketplace Listing- New AWS Marketplace purchasing option where you can buy in bulk in a discounted, pre-paid fashion
- This is a self-service purchase option that offers discounted pricing without having to talk to anyone
- Note: If you are planning to purchase more than 6TB of
new dataand / or more than 100TB ofexisting data, reach out to us to discuss a Private Offer with custom pricing
- Various bug fixes and improvements
In this release:
- Cloud Detonation Sandbox
- Sometimes you require additional analysis of problematic files you encounter. You can now send those files to the cloud sandbox for detonation. You can perform a simpler
Static Analysisor aDynamic Analysiswhere the file is executed on a system and the outcome shared. - This leverages the Sophos Cloud Sandbox for detonation. Cloud Storage Security has a dedicated slice of this sandbox specifically for scanning their customer's files.
- Activity by Bucket Reporting
- The Scan Results reporting page has been enhanced to show bucket activity by day, week, month and custom time frames.
- Linked Account Management Simplification
- See the version and status of the linked account roles connected to your deployment
- Upgrade one / multiple / all linked accounts from the console
- No longer do you need to go to each linked account to run the stack update for the role
- Various bug fixes and improvements
In this release:
- API Endpoint Enhancements
- 2 new APIs:
scan and then uploadandscan an existing S3 object(both customer requests)- With
scan and uploadyou specify a newuploadToattribute in the header that specifies a "<container> / <object-path>" like "mybucket/full-path-to-file.txt" Note: this is an add on to the existing scan api - The
scan existing S3 objectis a new API, not just a modification to the existing scan option. You will callapi/Scan/Existingand specify the location information ("container" and "objectPath") in the header
- Setup Simplification
- You can now leverage the Cloud Storage Security SSL cert and application domain for your API Endpoint access
- Prior to this release you were required to provide your own certificate and DNS registration. Now, like the Management Console itself, you can register your API Endpoint(s) with the
cloudstoragesecapp.comdomain. - This makes testing and configuring the API Endpoint much simpler and a whole lot quicker to get setup
- API calls log to CloudWatch and Problem Files
- All scan API calls now log CloudWatch and Problem Files if they are in fact problem files
- API-Only Users
- Prior to this release, users authorized to make API calls could also log into the Management Console. You can now create a user that only has the rights to make API calls, but won't be able to login to the console
- Multi-factor Authentication
- Users can now setup multi-factor authentication to assist in more secure access
- CFT Updates
- Added the ability to use the
HostedZoneIDin addition to theHostedZoneNamefor use with Route53
- Various bug fixes and improvements
In this release:
- Patch fix to make the proper regional endpoint calls
- Upgrade Notes
- If upgrading from 5.05.x and prior, you should have no issues upgrading to 5.06.002
- If coming from 5.06.001, you will have to take an additional action this one time
!!! warning "Upgrading from 5.06.001" Release 5.06.001 introduced two new parameters into the CloudFormation Template. These new parameters were entered with blank default behaviors and due to CFT functionality those needed default values. We've added the default values now, but in order for the upgrade to work properly you will need to reboot your Management Console. Once you've rebooted the console the upgrade will go smoothly. This process should not take any longer than 5 minutes.??? tip "Reboot and then Upgrade"Rebooting the console is a simple process. We will walk you through it below.1. Login to the <a href="https://console.aws.amazon.com" target="_blank">AWS Console</a>*Note: ensure you are in the region you installed the Antivirus for Amazon S3 Management Console*2. Navigate to the Elastic Container ServiceWhich will lead you to:3. Click into the Cluster that matches your deployment to see the details and services4. Tick the box for the Console service and click the `Update` button5. Tick the box for `Force New Deployment` and click the `Skip to Review` button6. Click the `Update Service` buttonThat is it. Once the new console instance has come online you will be able to proceed with the [standard upgrade process](./console-overview/product-upgrades.md)
In this release:
- Multi-Engine Scanning options
- You can now select to scan your files with all the engines we support - currently Sophos and ClamAV
- Two options for activating multi-engine scanning:
All Files- every file that is scanned will be scanned by all enginesBy File Size- Smaller files (<2gb) will be scanned by ClamAV and larger files (>2gb) will be scanned by Sophos can handle much larger file sizes (<195gb)
- Dashboard and Reporting Updates
- ==Dashboard== now reflects all 3 scan models (Event, Retro and API) for the GB Scanned and Object Scanned Charts
- ==Scan Results== received two enhancements - data can be exported to CSV and individual findings (infected, error, unscannable) are clickable and will redirect you to the specific results on the Problem Files page
- Enhanced Scan Result details
- Each and every Scan Result now includes the
Engine Name,Engine Version,Virus DB Versionand theScan Type - This is included in multi-engine scan results ??? note "Sample Multi-Engine Scan Result"{"guid": "f3780373-ca3c-4324-bdd0-774d8b04f92e","dateScanned": "2021-08-24T12:25:30.4494053Z","bucketName": "preview-destination-bucket","key": "virus/YNtbRiwU4Iyv5vOY_virus_157_eicar_com.zip","versionId": null,"result": 1,"scanResults": [{"result": "Infected","virusName": ["Win.Test.EICAR_HDB-1"],"message": [],"dateScanned": "2021-08-24T12:25:30.4494053Z","engine": "ClamAV","engineVersion": "0.103.3","virusDbVersion": "26231","scanType": "GoFwd"},{"result": "Infected","virusName": ["EICAR-AV-Test"],"message": ["eicar.com"],"dateScanned": "2021-08-24T12:25:30.4564762Z","engine": "Sophos","engineVersion": "3.82.1","virusDbVersion": "5.86","scanType": "GoFwd"}],"actionTaken": "Move","virusUploadedBy": "AWS:AROA3K5IVNMVJTERL6GIW:preview-bucket-transfer","fileExists": true,"movedTo": "cloudstoragesecquarantine-pk913wa-779353418538-us-east-1","region": "us-east-1","accountId": "779353418538","allowOnceExemptionAdded": false,"permanentlyAllowed": false}
- Various bug fixes and improvements
In this release:
- API Endpoint Agent Changes
- We now allow you to use IAM based certificates with the API endpoint
- Enabled CORS in the API Agent - currently allowing all sources
- CFT Changes
- We now allow you to specify custom, pre-existing roles to leverage
- Quarantine Bucket Changes
- Added new configuration option that allows you to quarantine files centrally to the deployment account or keep current settings of quarantining files within linked accounts
- Add Life Cycle Policy days attribute to quarantine buckets - after set number of days quarantined objects will be deleted
- DynamoDB Changes
- Allow you to turn on / off Point In Time Recovery on our tables
- Various bug fixes and improvements
In this release:
- Various bug fixes and improvements
- Console Settings
- API Agent Settings
- Job Status filtering
- Schedule overlap message
- Linked Account bucket, assumed role, SNS topic and permissions fix
- Multi infected message for a single file fix
!!! important You must upgrade the Linked Account Role (cross account role) for any linked accounts. You can launch the stack up from the Manage Accounts.
In this release:
- Security Hardening
- Improved allowed TLS versions and cipher suites
- Added content security policy
- Added additional security headers
- Various bug fixes and improvements
In this release:
- API Driven Object Scanning
- To go along with event-based scanning, scheduled scanning and on-demand scanning, we are happy to introduce API-driven scanning. As it sounds, we are providing a REST API where you are able to hand us a file or object for scanning directly.
- For those environments where you have applications and workflows where you need to insert file scanning before deciding what next to do with the file, you can leverage this to slip it right into your solution. This is often desired if you want to scan the files before they are written to "disk" (Amazon S3 or anywhere else).
- This can have a public or private access URL allowing you to integrate this in to any application running on-prem, in AWS or any other cloud. The implications are such that you are not required to have the object residing in Amazon S3 in order to scan it. You can get the verdict back before placing the file into Amazon S3
- Scan Results Report
- This simple report gives you the
Scan Resultsbreakdown for all files processed by day (last 30 days), by week (last 12 weeks), by month (last 12 months) and for custom time ranges - You can drill down into any time window to see the activity by Account
- Various bug fixes and improvements
In this release:
- Detailed usage rollup reporting
- Today you can piece together activity from the Dashboard and the Logs, but haven't had a clean rollup for usage and issues by Groups and Accounts. This is the first step towards interesting reports. More to come
- This new Monitoring page will give you a high-level view for the last 12 months by Group and Account in the charts. It will also provide a more detailed view by current month, last month, 3 months, 6 months and 12 months within the Group panels
- Increased File Size Handling (200GB)
- This latest release now takes advantage of AWS Fargate's new disk size options (new max size is 200GB). The larger native disk size allows for larger file handling without having to bring in additional AWS services (like EFS)
- As AWS Fargate allows for even larger disk sizes, scanned file size will also increase
- If you know you will be scanning larger file sizes, you can simple change the Scanning Agent disk size on the ==Agent Settings== page
- Re-architecture of On-Demand and Scheduled Scanning
- Each schedule execution or on-demand scan is treated as its own stand-alone job
- Each job will get its own resources (queue, scanning agents, etc) for the duration of the job
- This allows for great scale and simultaneous jobs won't step on or delay each other
- For existing customers:!!! important This will remove the Retro Service that has been in place to manage both of these types of scanning. Run Task functionality is now replacing the Retro Service.This will not impact existing schedules.
- Job monitoring for On-Demand and Scheduled Scanning
- Added the ability to track historically and in real-time the jobs (on-demand and scheduled scans) executed by the system. No longer do you have to question if you ran an on-demand scan or if a scheduled scan executed or not
- You will have the ability to monitor and manage the jobs
- Various bug fixes and improvements
!!! warning If you have been using the system for many months and have processed a lot of data, especially leveraging Smart Scan, then the post-upgrade process could take a "long" time. It is dependent on the amount of data you have in the DynamoDB tables. One customer has seen this process take upwards of 4 hours.
If you are not upgrading to this version, but install from this version or later you will not face this upgrade time.
In this release:
- Local Task Image Support
- We now support the ability to host the container images locally
- You can download the images from our repo and place them locally in your own repo
- Simply specify and account number where the repo will be located and make sure to use matching names
- Various bug fixes and improvements
- Fixed a billing issue introduced in the v5 release
- Fixed a out-of-memory issue in the Dashboard Widgets when you have a lot of Agent data
- Fixed a bug in the Scheduled Scan modal
- Improved agent data lookups
- Many small bugs have been fixed, as well as tweaks to the UI behavior and appearance.
In this release:
- Various bug fixes and improvements
- Deployment Overview page updated to better reflect real-time scan protection vs schedule protection in your overall regional bucket protection score
- Improved Object Tag handling
- Fixed discarding existing tags on object when we place our tags
- New object scanning will evaluate whether the object has been scanned before and skip it if it has the "scan-result" tag on it
- This is useful if copying objects that have been previously scanned into the same or another protected bucket
- Note: if a replacement object has been uploaded "over the top" of the existing object, we will scan it (it will come in without tags and erase existing tags)
- Many small bugs have been fixed, as well as tweaks to the UI behavior and appearance.
In this release:
- Premium Scan Engine Added - Sophos
- Sophos is a well known household name in security providing excellent detection and great performance
- Sophos provides the ability to scan much larger file sizes
- 15gb to start, but much larger in the very near future
- Improvements to Local Signature Updates
- New lambda and guide for ClamAV updates
- Offering local updates for Sophos right out of the gate
- More Deployment Options Added
- Auto Assign Public IP - Console and Agents
- You can control whether your Console and Agents are publicly accessible through multiple methods, but we were still assigning public IPs even if they weren't accessible. You now have the option to turn off the assignment if they will never be used
- Agent Scan Engine
- You can choose which engine, ClamAV or Sophos, you'd like to start with - this can be ==changed in the console== after deployment as well
- Info Opt-out
- In order to provide a proper SSL-protected persistent URL for application access, we register your IP and subdomain info with our hosted Route53. If you plan to leverage a Load Balancer and would prefer not to send us that info, you can now make that choice
- Various bug fixes and improvements
- Bucket Protection page modified to reflect protection through real-time or scheduled scans
- Many small bugs have been fixed, as well as tweaks to the UI behavior and appearance.
!!! note
Agent vCPU and Memory recommendations have changed. We recommend to run the scanning agents with 1 vCPU and 3gb Memory. The defaults have been 2 vCPU and 4gb Memory, but we are finding there is no advantage to those settings at the moment. Switching to 1 and 3 is a worthwhile cost savings while having no impact on performance. In the Performance Throughput Table the ClamAV numbers were produced with 2vCPU and 4gb Mem, but the Sophos numbers were run with 1vCPU and 3gb Mem. In subsequent testing, we saw no noticeable reduction in performance with ClamAV as well.
----
Leveraging the Sophos engine has an add-on cost associated with it. Check our <a href="https://aws.amazon.com/marketplace/pp/B089QBV2GC/?ref=_ptnr_help_doc_" target="_blank">**AWS Marketplace Listing**</a> for more details on the pricing. Please [Contact Us](./contact-us.md) if you would like to discuss pricing in more detail.