> For the complete documentation index, see [llms.txt](https://docs.cloudcyte.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloudcyte.com/release-notes/v4.4.0.md).

# v4.4.0

**New Features**

* Added Windows File Integrity Monitoring — a new threat-analytics artifact that detected unauthorised changes to critical Windows files in real time, recording file hashes, signature status, and the process and user account (via Event ID 4663) behind each change, with risk scoring, MITRE mapping and AI analysis. To collect data, Windows File Integrity Monitoring policy had to be configured.
* Added Windows USB Device Management — real-time monitoring and control of USB devices on Windows endpoints, configured through the Windows USB Device Management policy and enforced according to the forensics\_windows\_usb\_device\_management\_rules table, synchronised from CLAPI. Permit and block rules could target device class, vendor, product and serial number pattern; unauthorised devices were ejected with configurable retries and disabled at driver level once attempts were exhausted, while Monitor Only mode allowed detection without enforcement. All insertion events, permitted and blocked, were recorded under Artefact Analysis > Windows > Windows USB Device Activity.
* Added the USB Device Management dashboard under Dashboards, consolidating USB insertion outcomes, file-level data movement, user behaviour and policy effectiveness into a single view across all managed Windows endpoints. Eight KPI tiles covered total events, permitted, ejected, disabled and monitor-only outcomes, files copied to USB, high-risk file types and active rules, each drilling through to the matching activity grid pre-filtered by the tile's criteria. The dashboard supported date range and endpoint filters, manual and automatic refresh, and PDF export, and was linked from the Windows USB Device Management policy page.
* Added a "Dynamic Reports" category to Reports, built on artefact categories and their default columns. It shipped with a report type per category — Dynamic Threat Analysis, Vulnerability Analysis, Misconfiguration Analysis, Asset and Identity — plus a general Dynamic Artifact Report where the user selected which artefacts to include (with search, as the list exceeds 500). Each report was driven by acknowledgement state, time range, a risk level, tag and group selectors.
* Added Remediation/Response Summary report, that include statistic about active and finalized Windows/Linux Remediation jobs, Third party App Management and Patch Management. Report is based on Remediation/Response Analysis Dashboard.
* Added the Windows Deep Threat Hunting dashboard as the first tab of the Threat Hunting module. It defaulted to a Shadow-IT filter (with Shadow-IT / Not Shadow-IT / All options) to surface unmanaged assets first, and expanded the threat matrix to six columns — Malicious, Critical, High, AI Critical, AI High and Shadow-IT — ordered by analyst response priority. Its expandable sections provided actionable grids with inline editing, letting hunters change the risk score, set Not Shadow-IT, add to a list and view details without leaving the dashboard.
* Added the Fortigate Firewall Analysis dashboard under Dashboards > Security & Network Devices, giving the SOC a single prioritised view of VPN activity, firewall and system events, CIS benchmark posture, external exposure, policies and VPN identities without logging into the firewall console. It combined KPI tiles, a data source priority matrix, charts and seven expandable grids with row actions such as blocking a source IP or creating a remediation, all filterable by date, tag, Shadow-IT and firewall, with every element drilling through to the matching grid.
* Added the Third Party Dashboard in TPRM Management, replacing the previous vendor dashboard with a single prioritised view of internal maturity, external attack surface, questionnaire results, data exposure and contract expiry. Six KPI tiles filtered a risk priority matrix that ranked vendors by composite risk, showing tier, questionnaire state, data exposure and linked assets and identities. Charts covered vendor type, operational impact, PII, questionnaire status and a 14-day risk trend, alongside an agreement and NDA lifecycle timeline, with every element drilling through to the matrix or vendor detail.
* Added Risk Acceptance to GRC — an end-to-end workflow for requesting, approving and tracking the formal acceptance of risks. A background job drove requests through a state machine (Requested → In Review → Approval → Treatment → Validation → Terminal states) with SLA monitoring and breach alerts. Requests could be created from artifact grid selections or generated automatically from maturity rules.
* Added rollback support to AI-generated remediation. When AI created a remediation script it also recommended a matching reverse (rollback) script where possible, adding a rollback\_script parameter across the Windows and Linux remediation functions and jobs, the vulnerability grids and AI recommendations, exposed via a new #${ai\_rollback\_script} variable. The Windows and Linux job grids showed a "Rollback Script" column next to Executed Script, and a right-click "Rollback" action created a new rollback job. The "New Remediation Task" form gained a Rollback Script property, pre-populated from the function's values when available.

**Improvements**

* Improved the structure of the Installation Management page in Development Settings.
* Improved the TPRM Vendor creation form by adding several new fields. NDA and Service Agreement fields (signed, signed date and expiry date) were added, along with Critical Information Access, PII Access and Material Vendor checkboxes. An Operational Impact dropdown (negligible, low, medium, high, critical) and file uploads were also added.
* Improved security across the agent and platform. All UI calls were given hash protection, TLS was enforced for agent-to-server communication, and a "Bypass TLS Security" checkbox (unchecked by default) was added under Deployment Settings > Installation Management. Configuration files were encrypted — any alteration set the agent state to "Unauthorised Modification" — encryption keys were obfuscated, generic data submissions were restricted by a table whitelist, credentials were returned encrypted for the agent to decrypt, and agents could no longer alter remediation actions. On Linux, the OpenVAS port was bound to localhost, its password was changed, and file permissions were tightened.
* Improved the GRC module with new properties across the Assets, Vendors and Documents grids, and reorganised their creation forms so that less frequently used fields moved to a second tab. Also added new grids for Organisations, Important Activities, Roles, Stakeholders and GRC Notification Templates.
* Improved performance across several areas. Shadow-IT was changed to run for flagged artifacts only, via the "..." → "Execute Rule & Lists" action. Reworked the processing structure. A "Run Once at Night" option, with a recommended time of 02:00–04:00, was added to classification rules.
* Improved Fortigate analysis with support for Hitcont & Traffic Analysis.
* Improved the DB Ops grid. The table selector, which was not working, was fixed. Two buttons were added: one to terminate long-running queries (over 10 minutes), and another to run SQL through "Run Command" and display the result.
* Improved the Windows DNS Cache artefact so that DNS cache entries on the Global Allow List were excluded from collection.
* Improved Windows Threat Monitoring with the addition of the "Parent Origin File Path", "Parent Origin Signature", "Root Parent Origin File Path" and "Root Parent Origin Signature" fields.
* Improved the Uptime format in Asset Management, which was now displayed as days and hours.
* Improved the "Login With One Time Password" flow.
* Improved Sysmon Collections.
* Added an "Exposure Score" column and a "Critical Exposure" top button to all grids. The score was calculated by AI analysis for records with a risk score of 90 or higher. This analysis was added to the Vulnerability Assessment, Hygiene and Shadow-IT dashboards.
* Added an organisation-level "Save All" action that created all missing jobs from one place and surfaced any errors, replacing the previously unmanageable per-job creation.
* Added a "Show Asset Properties" button to the grid that displayed the Asset: IP Address, Asset: Username and Asset: Operating System columns.
* Added a "Related Artifacts" field to the Policy; when it was set, users could navigate from the grid to the policy by tapping the "Go to Related Policy" button.
* Added the ability to link GRC Assets and Asset Groups to Risks and Control Activities when editing them, and to view the related Assets and Asset Groups from within an Control Activity.
* Added the ability to link a TPRM vendor to Assets and Identities.
* Added an "Import" action next to Export in Vulnerability Scan Results, offering "Download Import Template" — a CSV with the defined headers and a sample row — and "Upload File", which processed and uploaded the results.
* Added a Region column to Standards & Best Practices, whose value was included in the Standard's name.
* Added domain tracing to TPRM.
* Added the Username and Operating System columns to the Group Management grid.
* Added a MAC Vendor column to Asset Management. The value was calculated based on the IEEE OUI database. An "Update MAC Vendor" button was added to refresh the values.
* Added a description field to the organisation creation form; organisations now recorded their creation date, creating user and description, shown in the grid as Creation Date, Creating User and Organization Name.
* Reviewed the Windows Patches policy and added controls to the updater to prevent errors.
* Disabled external functions by default.

**Bug fixes**

* Fixed an issue that occurred during Monitor All on the Vendor Domains grid.
* Fixed an error that occurred while creating a Fortigate "Unblock Device" remediation job.