Mobile app, application groups, and multi-cloud collectors
Start with the full note if you need shipped details, or jump to the roadmap and wishlist if you are comparing what to do next.
I want the release list
Go back to the index if you need to compare versions or pick another note.
I want the roadmap
Open the roadmap when the question is direction rather than a specific release.
I want to request something
Send a wishlist item if this release page surfaced a gap you want prioritized.
I want the current note
Jump to the release body and read the shipped change in full.
Release notes
What's new
Companion mobile app (iPhone and Android)
Sotiras now has a mobile app focused on the moment you actually need your phone: alerts, notifications, and auto-ban activity. Pair it from /portal/settings with a tenant-scoped access token, and lift a ban yourself from the app when the token allows it. The app does not try to replicate the full portal — it is intentionally scoped to review and response.
Application groups
Multi-host systems no longer have to be tracked as unrelated individual assets. Group the servers, VMs, and services that make up one real application from the assets workspace, and evidence, risk, and action history roll up to the group as well as the individual host.
DNS inventory gap scan
A new read-only DNS scan helps you find IP addresses and hosts that resolve under your domains but are not yet represented as managed assets — a common source of shadow infrastructure. Results surface as candidates you can promote into the asset inventory, not automatic changes.
Kubernetes and Falco collectors
Two new collectors extend coverage into container workloads: a Kubernetes audit log collector for API-server activity, and a Falco runtime detection collector for suspicious in-container behavior. Both integrate with the same evidence, review, and action workflow as host and web collectors.
Microsoft Entra ID and Google Cloud collectors
New cloud-native collectors cover sign-in and audit activity without installing anything on a server: Microsoft Entra ID sign-in log monitoring, and GCP Cloud Logging plus a Cloud Functions wrapper for serverless workloads.
Agent self-update
Collector and agent bundles can now check for updates on a schedule and, when explicitly opted in, reinstall themselves safely — verifying package signatures and checksums first, and restarting only what changed. Fleet-wide reinstall (reinstall-bundle) is also safer now: it detects which agents are already running on a host so a targeted fix cannot accidentally disable an unrelated collector.
Fixes and improvements
- Fixed a firewalld enforcement bug where an unsupported rule syntax for outbound blocks could cascade into inbound block failures on the same host. Enforcement for each direction now initializes independently.
- Failed enforcement attempts are easier to distinguish from expected, already-expired temporary bans in the action queue.
- Asset creation and CSV import now support assigning the new asset directly to an application group.