Changelog
What changed, newest first.
Every change to Kandaro that you can notice. False-alarm fixes have their own label: they show what we changed after a customer told us an alert wasn’t real.
How false alarms get fixed
When a customer marks an alert as a false alarm, we find the root cause and fix it for everyone. Each fix is listed here, without customer details.
No false-alarm fixes yet. How we measure them is on the proof page.
Improved
False alarms: root cause and fix, per month
When you mark an incident as a false alarm you can now say what caused it and what you changed. Your Organization settings show how many false alarms your team reported this month and over the last six.
Security
Sensors no longer receive bait fingerprints
Decoy sensors used to be sent the fingerprints of your bait credentials, which they never needed. They no longer receive them, so a compromised decoy exposes less. Bait use is still recognised the same way.
New
Active Directory decoys
Generate a script that creates a fake service account, a fake admin user and a fake server name in your own domain. Any use of them leads to a decoy and raises a “bait used” alert. The accounts can’t log on to your real domain, and Kandaro never gets your domain credentials.
Read moreNew
Known-good sources and “Was this real?”
Mark the systems that are allowed to touch your decoys, like your vulnerability scanner, so they never raise incidents. Bait use is never silenced, even from a known-good source. Every incident now has a “Was this real?” answer that feeds our false-alarm count.
Improved
The AI never decides how serious an alert is
Severity now comes only from fixed rules; the AI only explains what happened. This is checked by 44 hand-written test cases on every change.
Read moreNew
Published detection tests
Every decoy profile is tested on each sensor release: every service must raise an alert when touched, a scan must be recognised, a stolen bait secret must be caught, and an idle decoy must stay silent.
Read moreNew
More ways to install a sensor
Docker, Docker Compose, a Linux install script, a Helm chart for Kubernetes, Ansible, Terraform with cloud-init, and Raspberry Pi. The ready-to-run packages are in your console once you start a free trial.
Read more