Version 3.8.7 includes:
This section describes the new features added in version 3.8.7.
The following features have been added to the Coro console:
This release enhances the Executive Summary report by including new information:
- New trend charts in the top summary section to represent changes in users, devices, and tickets since the preceding period.
- Total tickets by module and top vulnerabilities has been replaced by Security impact this period, showing an overview of the impact Coro has had on your workspace by detecting and remediating threats. This section provides summary statistics for each enabled module with the number of tickets raised for significant trigger events.
- For each module in the Protection section, Coro now shows trend graphs for generated tickets during the period.
- For Cloud security, a new pie chart showing Suspected bot attacks per country. The top 5 countries are displayed separately, with all others grouped into a single category.
- For Email security, new panels showing entries added to the allowlist and blocklist, the number of warning-only email events, and the percentage of warning-only emails measured against all inbound email.
- The Security Awareness Training section has been redesigned for better presentation. It also now includes pie charts showing completion of scheduled training and interaction with phishing simulations.
For more information, see Reports.
The following features have been added to Connectors:
Coro’s public API is enhanced with the following changes:
- New ticket endpoint descriptions with much greater detail about available actions.
- New ticket comment endpoint.
For more information, see API change log.
The following features have been added to Endpoint Security and EDR:
This release adds support for Microsoft Defender Attack Surface Reduction (ASR) rules to detect common attack techniques on Windows endpoint devices, such as macro abuse, Office child process spawning, and WMI persistence.
Admin users can enable Windows ASR rules for selected device labels through the Endpoint Detection & Response settings page.
For more information, see EDR settings.
The following features have been added to Cloud Backup:
Subscribers to Coro’s Cloud Backup module can now connect Dynamics 365/Power Platform, Autodesk Forma, and Jira/Jira Service Management services for backup and restore.
For more information, see Supported cloud apps.
Managed Service Provider admin users can now edit an existing customer’s Cloud Backup service to add or remove connectors, or to modify the seat count.
For more information, see Updating the connector configuration for an existing connector.
Managed Service Provider admin users can now only activate Cloud Backup for their customer workspaces where an active Cloud Backup subscription is in place.
For more information, see Adding customer workspaces for cloud backups
Coro now stops Keepit from creating backups when the Cloud Backup module is disabled in a workspace subscription, or where a workspace moves to inactive status.
For more information, see Backup activity for inactive workspaces.
Version 3.8.7 introduces the following additional changes:
The workspace hierarchy view in the MSP Global View has been improved in the following ways:
- The left and right panes now scroll independently, improving how you view the workspace tree against the information pane.
For more information, see Using hierarchy view.
Coro now archives closed tickets after 90 days of inactivity.
Archived tickets cannot be viewed through the console, and cannot be unarchived. However, Coro still provides visibility of all current and archived tickets through the Ticket Log CSV export.
For more information, see Tickets in Coro and Viewing and creating exports.
Coro’s MCP server now applies role-based access in parity with the console. That is, when an admin user authenticates through the MCP server, Coro assigns access privileges based on the role assigned to that account in the workspaces the user can access.
For more information, see Connecting AI services to Coro.
If an admin user marks a user in a protected group with Protection disabled, Coro retains this excluded status even after an automatic or manual cloud resynchronization.
For more information, see User Management.
This release adds a new security and business-sensitive data type for monitoring in your User Data Governance configuration - Credentials and secrets.
This covers data items such as API keys, access tokens, client secrets, cloud credentials, connection strings, private keys, and signed URLs.
For more information, see Configuring Data Governance settings.
When a User Data Governance ticket is triggered for a security and business sensitive data types violation, Coro now displays a Findings section in the ticket.
This impacts the following security and business sensitive data types:
- Passwords
- Certificates
- Source code
- Data objects with specific keywords
- Credentials and secrets
- Specific file types
For more information, see Ticket types for User Data Governance.
This feature requires Coro Agent v3.8.7
In this release, Coro enables you to select the performance mode for your endpoint scans.
Choose from:
- Low impact - The scan uses fewer system resources, but takes longer to complete.
- High impact - The scan uses greater system resources, resulting in a faster scan.
Scan quality is unaffected, and this new setting only impacts the amount of system resources (CPU and RAM) Coro consumes to complete the scan cycle. Admin users can choose the approach that best suits their requirements.
For more information, see Scan performance mode.
This feature requires Coro Agent v3.8.7.
Coro now includes a new endpoint device policy - Monitor File Integrity - that regularly checks one or more files for changes.
Coro raises a File Integrity Violation ticket for any detected changes.
For more information, see Device Policies.
When Coro’s Inbound Gateway blocks emails and later releases/allows them, Microsoft 365 and Google Workspace display the email's timestamp as the release date and time, rather than the original send date and time.
In this release, Coro is adding the original send date and time to a banner within the email.
For more information, see How Coro handles malicious email.
This section describes the following additional Agent updates that we are releasing with version 3.8.7.
The Coro Agent software must be updated on your device before changes take effect. The features described may not function until the updated macOS and Windows Agents are installed. Coro commences roll-out of Agent updates after the release.
macOS and Windows Agent 3.8.7 includes the following:
If an admin user has disabled protection for the device from the console, the agent now shows this status in the desktop app.
When an agent update required a device restart, Coro previously allowed only a 60-minute notice, a 60-second final warning, and then restarted the device with no way to postpone.
This release introduces an extended restart countdown of three hours. A restart-now option is provided at each reminder, but now with the option to postpone by a further 60 minutes.
Coro still enforces a restart at the three-hour mark as the device is unprotected until the restart completes.
The agent now ensures conflicting malware and sensitive data scans do not overlap and run concurrently. If the agent is scheduled to perform both types of scan (perhaps due to a period of being offline), malware scans take priority and start first. Other scans start only after the malware scan has completed.
End users can now view real-time scan progress from the desktop app.