Release Notes: Sensor 3.0.4

Sensor 3.0.4

What’s New

• A new detection policy “coverage drop” allows for the option to alert when the sensor experiences gaps in coverage.

Improvements

• Conserving memory continues to be a priority. We’ve reduced memory usage on workloads that include a lot of ephemeral processes.
• We’ve added more options for tuning the resource usage of the file monitor detection policy.
• Container image IDs can now be extracted when using the containerd container runtime.
• The console can now bind on ports below 1024 post-installation without needing root access.
• Noise cancellation! We’ve refined our container escape detection policy, removing a detection method that led to many false positives.
• See only what you need - if you’re not using Capsule8 Investigations, the Investigations features will be hidden from the console.

Bug Fixes

• A rare case where the sensor could crash when events are lost is resolved; we’ve also made some performance improvements around cases of dropped events.
• Unsuccessful unauthorized network connection attempts are now recorded in Investigations.
• Fixed a bug that occasionally caused unstable behavior when the sensor started up.