• Increased available specificity for whitelists, such as parent process path and arguments.

  • Expanded support for identity access analytics to more credential databases.

    • Identity access is now also monitored for Slack, Opera, Thunderbird, Discord, and Vivaldi.

  • Expanded whitelist support to include identity access.


  • Reduced the bandwidth used between agents and the rest API.

  • Fixed some older Windows Server editions displaying canaries on in Explorer.

  • Fixed some identify access logs missing certificate trust indicators.

WHCP/WHQL Validation Status


MD5 Hashes

service.exe = e289ef44c5a1bca39d57861ff9d05bee assistant.exe = d8e83309372b43ffc70feaf2bd538f36 CCRRSecMon.sys (Windows10) = db736330f5a690a2e828472a357ee6b6 CCRRSecMon.sys (Windows8) = b9d644930fc52495229dc7f96ffea299 CCRRSecMon.sys (Windows7) = 7b1ece332986dadfcc6463574fd16616