Secure Endpoint release notes - Version 9.1 hotfixes

In the Policies > Rules area, you can now configure and activate a rule that automatically triggers one or more actions when a device state change event is logged to Event History.

Action rules support the following actions:

• Change policy group
• Freeze
• Run script
• Send message
• Email

Learn more

The Agent Management Tool for Mac has been updated to support devices running macOS 15. Tool functionality remains unchanged, but its file name has changed from DDSInfo to AbtMT.

To verify installation of the Secure Endpoint Agent for Mac, or to force a call, download the new version of the tool.

The Report, repair and reinstall option is now available for Microsoft Defender for Endpoint.

When this option is selected, you can upload a local onboarding script that will onboard a device if it's not onboarded.

Learn more

In the request overview dialog on the Actions page, the Scheduled date for a Scheduled Freeze request is now shown in local device time.

• Failed to add device to policy group

  This event is logged only when a device fails to move to the specified policy group when an Action rule is triggered.

The following events are now logged to Event History for Offline Freeze rules:

• Offline freeze set
• Device freeze failed
• Device freeze removed by passcode

• Scheduled freeze ready

• The status of the theft report
• The reason for the theft report status
• The police report file name (if it was uploaded later)

Previously, in some rare cases, when an Agent self healing call event was logged, a duplicate event was logged two months later. This issue is now fixed.

Previously, for accounts with a very large number of devices, attempts to filter the Events page may have failed to generate any results because the request took too long to be processed. This issue is now less likely to occur.

For the safety of Absolute customers, and to maintain the integrity of the theft investigation, a stolen device's location is now hidden until the Investigations team closes the theft investigation. Specifically, a stolen device's location is no longer visible in the following areas of the console:

• Device Details:

  • Overview
  • History
  • Location History

• Map view of any report or page that lists devices

• Geolocation-related report columns

• History > Events page (geolocation-related events are not logged)

This enhancement also applies to queries to the Absolute API.

After the investigation is closed, the device's current location shows in the console. Note that location information that was collected during the investigation is not included in the device's location history.

This enhancement only applies to devices that are reported stolen after the release of Secure Endpoint 9.1.0.2 at the end of October. Devices with existing theft reports are not affected.

To delete a policy group that is referenced in an Action rule, your user role needs the Manage permission for Rules. Note that deleting the policy group automatically deactivates the rule.

To edit a custom script that is referenced in an Action rule, your user role needs to be granted the Manage permission for Rules. If you can't or don't want to edit the script, you can now Make a copy of the script and edit the copy. Learn more

To delete a custom script that is referenced in an Action rule, your user role needs to be granted the Manage permission for Rules to delete the script. Note that deleting the script automatically deactivates the rule.

Previously, the (Remove filter) icon may have been obscured if the width of the filter fields exceeded the width of the dialog (for example, using the between operator with a long filter name). This issue is now fixed.

Previously, using the SHIFT key to select consecutive items in some large reports may have produced unexpected results. This issue is now fixed.

A new option, Do not reinstall or upgrade if the app is already installed, is now available when you’re configuring the Report, Repair, and Reinstall option for the following applications:

• Microsoft SCCM

• Tanium

• Deep Instinct

• VMware Workspace ONE

Previously, if you uploaded a file of device identifiers and submitted a bulk device action, such as a Freeze, the action may have failed unexpectedly, or its status may have been reported inconsistently in different areas of the console. This issue is now fixed.

This issue only applies to accounts in the EU data center (cc.eu2.absolute.com).

A new version of the Chromebook extension has been released. Version 2657 of the extension now receives messages using the latest Google Cloud Messaging API, which offers enhanced security and customization.

On Chromebooks running Chrome OS version 120 or lower, a small notification now shows momentarily when the device receives a message, such as a Freeze request, from the server.

Previously, an incomplete list of device groups may have been shown in the device groups drop down menu in the following areas in the console:

• User management: assigning a device group to a user

• Custom fields > View and edit device fields: selecting a device group

• Bulk device action: assigning devices to an existing device group

• Device Analytics report: adding device groups to a new report

This issue is now fixed.

Previously, deleting a smart group and then navigating to the Device Details > Groups page of any of the group’s devices resulted in a runtime error. This issue is now fixed.

In the Summary area for a Send Message request, Message name has been changed to Message request name to more accurately reflect the information provided.

To help you identify devices that are failing to report a Wi-Fi location, a new filter, Geolocation technology > Wi-Fi error, can now be added to device reports. A corresponding report column is also available.

For example, you can use the new filter to identify Mac devices that are not reporting a Wi-Fi location because the device user did not allow Absolute Secure Endpoint to collect location information. Learn more

On the Location History page in Device Details, the Last known location field now shows the date and time when the location was detected on the device, not the time the location information was uploaded.

To improve the accuracy of a device's reported location, the location date and time now corresponds to when the location scan ended on a device, not when it started.

If a device that is assigned a Lenovo Security Assurance license is unenrolled, it is now automatically reassigned the Lenovo Security Assurance license when it is re-enrolled.

When a device's license is removed due to a license buyback agreement, an equivalent license, if available, is now automatically assigned to the device.

The console banner that shows when licenses are due to expire in the next 30 days no longer includes devices with an expired license when the device’s status is one of the following:

• Frozen

• Missing

• Reported stolen

To ensure that all unlicensed devices are shown in the report that opens when you click View devices in the unlicensed devices banner, the following filter has been added to the report: Final license expiration date is empty. Learn more

The following script is now available in the Script library: Dell Trusted Device Import.

You can run this script to inspect a Dell Trusted Device Agent installation, and then show the results in Custom Fields in the console. For more information about running this script, view the script in the Script library.

To improve the reporting of a device's most recent agent connection:

• The Last connected field and report column now shows the date and time when the component manager The component manager (also known as CTES) is installed on top of the core agent and manages the agent components responsible for initiating device actions and collecting device data. Most agent components are controlled by policies, such as the Hardware and Installed Applications policies. The component manager typically connects to the Absolute Monitoring Center every 15 minutes, at a minumum, to send device data and receive instructions. last connected to the Absolute Monitoring Center. Previously, it also included core agent connections.

  For online devices, connections by the component manager typically occur every 15 minutes, at a minimum.

• A new report column, Last core agent connection, is available. This column shows the date and time when the core agent The core agent (also known as rpcnet) is a small software client that resides in devices that are managed in the Secure Endpoint Console. After the core agent is initially installed on a new device, it is activated with its first connection to the Absolute Monitoring Center and the device is enrolled in Absolute. The core agent then makes scheduled connections every 24.5 hours. last connected to the Absolute Monitoring Center. For online devices, core agent connections typically occur every 24.5 hours. You can add the Last core agent connection column to any device report using > Edit columns.

• The Last connected field on a device's Device Details page now shows the date and time when the device's component manager last connected to the Absolute Monitoring Center.

The Last connected column is no longer a default column in the Upcoming Offline Device Freeze report, but you can add it using > Edit columns.

The new Last core agent connection filter and report column have been added as defaults to the Dark Devices report.

Note that the addition of the Last core agent connection filter does not change the report results. Learn more

The agent is now supported on devices running the macOS 15 operating system.

For devices running macOS 15, Wi-Fi adapter speed can't be detected, so each Wi-Fi adapter's Speed field is empty.

Previously, if automatic agent upgrades were disabled, a device may have upgraded to a new agent version if an internal error prevented the system from determining the device's policy group. This issue is now fixed. The device's agent is no longer upgraded.