Changelog and Release Notes

Agent : new supported backend: Azure Data Explorer (ADX) (via Azure Event Hubs).

Application hangs (macOS) : application hangs are now detected and reported under macOS.

Browsers : the Chrome/Firefox browser extensions have been rewritten to fully support Manifest V3 and improve performance as well as reliability.

Configuration : credentials can now be securely retrieved from the operating system's credential store.

Dashboards : added Japanese translation of the uberAgent® ESA and uberAgent UXM Splunk dashboards.

Machine errors (macOS) : macOS kernel panics are now detected and reported.

Network monitoring : loopback traffic monitoring. Can be enabled via IgnoreLoopbackTraffic in the [NetworkTargetPerformanceProcess_Config] stanza.

Security & Compliance Inventory (macOS) : the SCI feature is now supported on macOS.

Threat Detection Engine : TDE rule customization & postprocessing via the new stanza [ThreatDetectionRuleExtension].

uAQL : new operators regex and regex_envvars and their case-insensitive counterparts iregex, iregex_envvars that replace the uAQL functions regex_match and regex_match_path. The new builtin operators allow uberAgent to perform optimizations when using regular expressions in uAQL.

Agent (macOS): after the installation, the daemon is only started if an active configuration can be found. Configuration template files are no longer copied to the configuration directory automatically.

Application errors (macOS) : crash reports are now also evaluated when automatically marked as retired.

Application inventory (macOS) : all installed applications on all locally mounted volumes as well as the user home directories are now reported.

Automatic application identification (macOS) : improved mapping for privileged helper tools and applications installed with a package manager.

Browsers : reduced performance impact of the browser extensions, especially for websites with many requests.

Central config file management : enhanced robustness versus external tampering with the cache or its metadata.

Configuration : added support for multiline uAQL queries in configuration files.

Configuration : new ConfigFlags setting POQTimeoutMs.

Machine inventory (macOS) : virtual machine detection now works on ARM-based machines.

Machine inventory (macOS) : uberAgent now reports warranty information.

Network monitoring (macOS) : improve accuracy of the flow-specific data traffic metrics.

Process startup (macOS) : distinguishing between fork and exec events is now supported. It is shown on the Process Tree, Process Startup, and Application Startup dashboards.

Process startup and stop (macOS) : added new option EnableCdHash to support collection of the code directory hash.

Process stop (macOS) : the sourcetype uberAgentESA:Process:ProcessStop is now available on macOS.

Security Score Splunk dashboard : transferred SCI score calculation searches to separate index and improved overall dashboard performance.

Setup (Windows) : copy optional Security Inventory files when deploying uberAgent on endpoints using the Splunk app uberAgent_endpoint.

Threat Detection Engine : the rule author is now shown on the Threat Detection Events dashboard to adhere to Sigma's detection rule license.

Threat Detection Engine : added new common event property: uberAgent.Pid.

Threat Detection Engine (macOS) : added event properties for team id, signing id and SHA256 hash.

Threat Detection Engine (Windows) : added new registry event properties Reg.EventType and Reg.TargetObject to match Sigma and Sysmon specifications.

uAQL : enhanced error messaging for unreferenced variables, dynamic expressions, or functions, now specifically identifying the non-existent referenced item by name.

Agent (Windows) : fixed a rare agent crash while retrieving machine inventory metrics.

Authenticode signature verification (Windows) : fixed an issue that caused the current time to be used instead of the signing time.

Authenticode signature verification (Windows) : fixed an issue that led to an incorrect result due to caching.

Boot duration (Windows) : fixed an issue leading to incorrect PostBoot calculations in specific scenarios.

Citrix Cloud™ monitoring : fixed query to check the existence of Citrix DaaS Remote PowerShell SDK.

Configuration : SCI configuration changes are now monitored and trigger an agent restart.

Dashboards : the startup detail table on the Application Startup and Process Startup dashboards now correctly shows process starts on macOS.

Dashboards : fixed incorrect token usage and a visualization issue on the Security Score dashboard when no SCI test description was found.

Dashboards : aligned the hostinfo lookup across sourcetypes in props.conf to always output the same fields.

Dashboards : the Security Score dashboard only displayed a maximum of ten SCI categories. Any additional categories were merged into "OTHER".

Dashboards : the overall score calculation on the Security Score dashboard did not match historical data.

Dashboards : the filter option SessionUser led to faulty panels on the Session Scores dashboard.

GPU (Windows) : uberAgent now reinitializes GPU metrics in case of a graphics driver update.

Machine inventory (macOS) : fixed missing virtualization status of physical machines.

Machine inventory (macOS) : fixed incorrect values with the BatteryWearLevelPercent metric.

NetScaler® : fixed a bug where closing the NetScaler connection too early resulted in no further data being collected.

Network monitoring (macOS) : incoming and outgoing packet counts now both only count packets with a payload. This was previously only the case for outgoing packets.

Network monitoring (macOS) : network flows with unknown transport protocols (other than TCP/UDP) are now ignored.

Network monitoring (macOS) : fixed faulty calculation of TCP retransmission count in sourcetype NetworkTargetperformance.

Network monitoring (Windows) : uberAgent's network driver could slow down network transfers or freeze the system with many incoming UDP packets in high-throughput environments.

Process monitoring (macOS) : the ProcCPUTimeMs and SessionCPUTimeMs metrics are now reported as a delta for the current measurement interval instead of an absolute value.

Process monitoring (Windows) : ProcessTampering no longer gets disabled when Hashing and Authenticode are turned off.

Registry monitoring : prevent handling empty registry keys causing the log message: Failed to retrieve HIVE of.

Custom scripts (Windows) : scripts couldn't be started as SYSTEM in user sessions (UserSessionAsSystem).

uAQL : fixed handling of improperly bracketed expressions and arrays that previously did not generate syntax errors.

uAQL : fixed a possible crash on faulty queries.

Dashboards : removed the deprecated dashboard Session Info:VMware in uberAgent UXM.

Libraries : updated third-party libraries to the following: Boost 1.84, {fmt} 10.2.1, JSON for Modern C++ 3.11.3, libcurl 8.5.0 (Windows).

NetScaler : renamed the Citrix ADC dashboards to NetScaler.

Setup (Windows) : updated WiX Toolset to version 3.14.1.

Sourcetype (macOS) : uberAgent:Process:ProcessStartup has a new field: StartupEventSource.

Sourcetype (macOS) : uberAgent:System:MachineInventory has a new field: CoverageEndDate.

Sourcetype (macOS) : uberAgent:Process:ProcessStartup has a new field: CdHash.

Sourcetype (macOS) : uberAgentESA:Process:ProcessStop has a new field: CdHash.

Sourcetype (macOS) : new sourcetype uberAgent:System:MacOsErrors with fields: KernelBugType, KernelBuild, KernelCrashReporterKey, KernelErrorType, KernelIncident, KernelPanicFlags, KernelPanicString, KernelProduct, KernelVersion.

Splunk CIM : changed the method from EXTRACT to EVAL for the fields src_nt_domain and user in the Authentication data model to work around a Splunk bug.

Splunk CIM : the Authentication data model has new field(s): dest.

Splunk CIM : the Inventory data model has new field(s): cpu_mhz, cpu_cores, cpu_count, status.

Splunk CIM : the Network Traffic data model has new field(s): user.

Splunk CIM : the Updates data model has new field(s): dvc, file_name, status, vendor_product.

Splunk data models : added the uberAgent ESA data model uberAgentESA_Score with the dataset uberAgentESA_Score_SCI.

Splunk data models : added the field SessionUser to uberAgent UXM data set uberAgentUXM_Score.

Splunk index : added a new index score_uberagent_esa for security score calculations in uberAgent ESA. This index can be deleted if uberAgent ESA is not used.

Threat Detection Engine : renamed the stanzas [ActivityMonitoringRule], [ActivityMonitoringRule_Filter], [AddActivityMonitoringExpression] to [ThreatDetectionRule], [ThreatDetectionRule_Filter], [AddThreatDetectionExpression], respectively. The previous names are still supported, but deprecated from now on.

Threat Detection Engine (Windows) : changed data type of Reg.Value.Data to string to simplify query rules using registry values.

Agent (Windows) : under heavy load the following message may be logged: CheckEventRecord,Events were lost. This may affect uberAgent's per-process disk, network, or UI-responsiveness metrics.

Agent (Windows) : under Windows 7/8, the user logoff is recognized too late, which leads to too many metrics being determined during this time.

Browsers : on systems with many user sessions the URL of the foreground tab might not match the browser's window title.

Browsers/IE add-on (Windows): metrics are not collected on page reload.

Browsers/IE add-on (Windows): metrics are collected incompletely for the configured start page.

Browsers/IE add-on (Windows): monitoring does not work if IE is published from Citrix Virtual Apps. It does work from Citrix Virtual Desktops, however.

Browsers/Firefox add-on : if the option privacy.resistFingerprinting is set to true, browser metrics are not available due to invalid data being sent from Firefox.

Citrix ADC: in very rare cases, the content of the Virtual Server Performance field vServerName contains spaces in wrong places.

Citrix site monitoring (Windows): data collection issue if the Citrix Remote Powershell SDK (required for Citrix Cloud monitoring) is installed on a CVAD controller.

Citrix Virtual Apps and Desktops™ Machines (Windows): when running the Citrix VDA on a Citrix Delivery Controller, some per-machine information is missing.

Experience Score : scheduled searches generate three warnings in Splunk's _internal index every 30 minutes. The messages look like the following: DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event.. However, there is no impact on uberAgent's functionality.

GPU (Windows) : values for the fields ComputeUsagePercentAllEngines, ComputeUsagePercentEngine0 and similar can be higher than 100 with Intel Iris GPUs on Windows Server 2016 1607.

Kafka : in rare cases sending data to Kafka results in a SEC_E_BUFFER_TOO_SMALL error message in the logfile. This should have no effect; the transmission is repeated and succeeds on the second try.

Network monitoring (Windows) : in rare cases the determination of NetUtilizationPercent can lead to higher CPU load on Windows 7 x64.

Single boot : on Windows 11, no information can be retrieved if there is no active session within the data collection period.

Update inventory (Windows): not all installed Windows updates may be reported due to API limitations.

User input delay (Windows) : determining this metric may trigger a handle leak in uberAgent caused by Windows. This was fixed by Microsoft in most OS versions, but still happens on Windows Server 2022 22H2.

Volume inventory (macOS): the encryption status of mounted read-only APFS snapshots may not be reported due to API limitations. This includes the root directory volume in a default installation of macOS