UEC — Unified Endpoint Control v7.6.0
UEC — Unified Endpoint Control v7.6.0 extends the platform with two new security integrations and a substantial expansion of Linux endpoint coverage.
| Field | Value |
|---|---|
| Release | v7.6.0 |
| Released | 2026-10-22T04:49:14.350+05:30 |
| Source | GitLab release |
Release notes
Section titled “Release notes”UEC — Unified Endpoint Control v7.6.0 extends the platform with two new security integrations and a substantial expansion of Linux endpoint coverage. ANY.RUN sandbox detonation and the Threat Lens vulnerability feed join the console as opt-in modules, the Linux agent gains file and folder protection, USB device control, DNS telemetry and host-integrity monitoring, and device groups now support a parent/child hierarchy with install-time keys and dynamic membership. The release also hardens Configuration Assessment and brings per-OS agent configuration. No breaking API changes; all new capabilities are additive and opt-in.
Improvements
Section titled “Improvements”- Sandbox (ANY.RUN integration). Operator-driven malware detonation from file upload or URL, with behavioural reports, extracted indicators, process and network detail, plus Threat Intelligence lookup, YARA search and TAXII feeds. Opt-in per tenant; configured in Settings, Integrations.
- Vulnerability Feed (Threat Lens). Enriches the software UEC already inventories with CVE, CVSS, EPSS and CISA-KEV data, mapped directly onto the Software Catalog: per-row severity and CVE count, a vulnerabilities view in the software detail, and an honest coverage banner that never presents an unmatched product as clean. Opt-in per tenant.
- Linux endpoint protection and telemetry. File and folder protection (kernel BPF-LSM with a fanotify fallback), USB mass-storage device control, DNS query telemetry, rootcheck-style host-integrity monitoring, change-only inventory of processes, users, groups, services and packages, agent start and stop lifecycle records, additional kernel probes (memfd, module load, listening sockets, image load), and console, GUI and PAM logon visibility. Every stream is opt-in through agent configuration.
- Device groups. Parent and child group hierarchy with nearest-ancestor agent-configuration inheritance, OR-clause dynamic membership rules evaluated on a schedule, and an administrator-enabled install-time group key delivered through the Windows MSI and the Linux installer.
- Per-OS agent configuration. A configuration can now target Windows, macOS or Linux; existing all-OS configurations continue to resolve and deliver unchanged.
- Windows and macOS sensors. Sigma rule indexing, bounded detection-pack memory and hash-verdict lookup.
- Configuration Assessment. Benchmark pack endpoints no longer return 500 on a query the database could not translate; scan runs now close once a device reports; device capability is inferred correctly; and per-device results expose a paging cursor.
- Linux agent. Uninstall leaves no residual files and the enrolment token is sealed; the kernel probe mirrors the agent’s enforcement tier; log accounting is complete between tail and spool; memory-scan triggers default off; and the musl static build is fixed.
- Agent configuration. Per-OS global fan-out and caching are scoped to the target OS, an unchanged target OS is accepted on update, and the real-time hint resolves against the device’s reported OS.
- Connectivity. The SignalR initial-connect retry now backs off instead of a flat loop, and a proxy bypass-list conflict no longer stops the agent.
Upgrade notes
Section titled “Upgrade notes”- The two new modules — Sandbox and Vulnerability Feed — are off by default and enabled per tenant from the Platform Modules panel. Each needs an API key entered in Settings, Integrations before it does anything.
- Additive database migrations (ANY.RUN, Vulnerability Feed, the device-group hierarchy and inventory roll-up) run automatically on startup.
- All new Linux capabilities (file protection, device control, DNS, host integrity, inventory) are opt-in through agent configuration; an upgrade changes no endpoint behaviour on its own.
Compatibility
Section titled “Compatibility”- No breaking API or route changes. Platform dependencies are unchanged: PostgreSQL 18.3, Redis 8.6.3, NATS 2.14.0, ClickHouse 26.3.
- Endpoint agents older than v6.0.0 do not carry the new handlers; the server treats them as before and the commands are ignored safely.