Developer Roll Up: November 2020

Another month rolls off the calendar and the team at LimaCharlie has been busy. A lot of our effort is currently being directed towards some big capabilities we are going to be launching in the new year, but that doesn’t mean we are not getting other things done. The following is a rollup of the improvements we made to the endpoint agent during the month of November.

Sensor v4.22.1

• Fixes an issue where Yara scanning would always be enabled even without rules being set. This fixes a memory leak on Linux.

• Fixing proxy support where some proxies would reply with an HTTP 1.1 OK even to HTTP 1.0 requests.

• Fixing support for Payloads and Artifact collection with proxies.

• Better error reporting to artifact errors. In addition, the installer has also been updated for Windows. Mainly this changes an internal behavior of the agent where some payloads used to be loaded into memory manually, this new version loads them "properly" from OS perspective. This solves some issues with proxies and environment variable use and the sensor. You should not need to upgrade the installer on existing deployments unless you have a specific need for it.

Sensor v4.22.0

• Hardened LC protocol with the sensor talking to the cloud. This fixes a rare issue where a sensor could become unresponsive if it had encountered a failure mid-enrollment.

• New task available dns_resolve. It will cause the sensor to resolve a given domain name. This is mainly geared towards a future global-level API to correlate multiple sensors and users living on the same devices.

We recommend using the new installers for future installs, but should not be needed for current ones.