- A new detection policy “coverage drop” allows for the option to alert when the sensor experiences gaps in coverage.
- Conserving memory continues to be a priority. We’ve reduced memory usage on workloads that include a lot of ephemeral processes.
- We’ve added more options for tuning the resource usage of the file monitor detection policy.
- Container image IDs can now be extracted when using the containerd container runtime.
- The console can now bind on ports below 1024 post-installation without needing root access.
- Noise cancellation! We’ve refined our container escape detection policy, removing a detection method that led to many false positives.
- See only what you need - if you’re not using Capsule8 Investigations, the Investigations features will be hidden from the console.
- A rare case where the sensor could crash when events are lost is resolved; we’ve also made some performance improvements around cases of dropped events.
- Unsuccessful unauthorized network connection attempts are now recorded in Investigations.
- Fixed a bug that occasionally caused unstable behavior when the sensor started up.