Scripts can now take arguments. Before running a script, the endpoint agent checks a signed manifest, the exact script content and arguments, the platform and the expiry, and refuses anything that doesn't match.
Every action run now records an outcome for each targeted endpoint, not just an overall result.
Script content is now delivered by checksum and cached on the endpoint, with automatic retries and staggered downloads to spread load across the fleet.
Added read-only query scripts, whose results can be queried like a table and are briefly cached.
The endpoint agent now ships with a built-in set of core scripts and starter actions, including network isolation and release.
Signing keys are now separated by purpose and can be rotated without interrupting endpoints.
Hardened the script runner on the endpoint agent: scripts never run through a shell, a timeout stops the whole process tree on every platform, output is capped, and jobs interrupted by a restart are recovered.
Hardened network isolation, including enforcement on Windows.
Strengthened protections around endpoint enrollment keys and connection security.
Fixed the console's ls command treating flags such as -la as part of the path. Other file commands now show a clear error when given an unsupported flag.
Fixed an issue that could stop live response sessions from starting after a signing key change.