Sophos Cloud Optix

No entries match these filters. Clear filters

1. December 2025 Dec 1, 2025 · release notes

   Updated CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmark policies for AWS and Azure in December 2025 release

   • Updated CIS AWS Foundations 5.0 policies are now active in Cloud Optix, including new checks like AR-1087 (EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. IMDSv2) and AR-1088 (CIFS access restrictions).

   1 detail in Everything

2. June 2024 Jun 1, 2024 · release notes

   Sophos Cloud Optix upgrades Standard to Advanced; updates AWS Lambda dependencies.

   • Sophos Cloud Optix Standard is deprecated and automatically upgraded to Sophos Cloud Optix Advanced for all active customers at no additional cost
   • The third-party libraries urllib3 and requests within Cloud Optix Lambda functions have been updated for newly onboarded AWS environments

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Sophos Cloud Optix Standard is no longer offered as of June 15, 2024; customers previously on Standard are automatically migrated to Sophos Cloud Optix Advanced
   • !Newly onboarded AWS environments will use updated Python runtimes and libraries (urllib3, requests) in Lambda functions, requiring existing manual installs (added before June 19, 2024) to be repaired via the AWS Environment Repair process
3. February 2024 Feb 1, 2024 · release notes

   Adds Add Compliance tags as labels option to Sophos Cloud Optix Jira integration

   └──▷ HOW TO FIND IT
   Enforce that all Jira tickets created from compliance findings include the specific compliance tags for easier filtering and reporting in the ticketing system.
   📍In the Sophos Cloud Optix console, navigate to the Integrations settings, select your Jira integration, and toggle Add Compliance tags as labels to On.
4. September 2023 Sep 1, 2023 · release notes

   Adds PDF export for Compliance Score Report, AWS ELB inventory view, and Azure IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Groups CSV export.

   └──▷ HOW TO FIND IT
   Download the Compliance Score Report as a static PDF for offline sharing with stakeholders.
   📍In the console, navigate to Compliance › Compliance Score Report and select Export › PDF
   Export your Azure IAM Groups inventory for external analysis or archival.
   📍In the console, navigate to Inventory › Azure and select Export › CSV for IAM Groups
   • Compliance Score Report can now be exported to a PDF file
   • AWS Elastic Load Balancer (ELB) instances are now visible in the Network Inventory
   • Azure IAM Groups inventory data can now be exported to a CSV file

   3 details in Everything

5. August 2023 Aug 1, 2023 · release notes

   Introduces Serverless Storage Protection for AWS S3 to scan files stored in buckets for malware with configurable remediation.

   └──▷ HOW TO FIND IT
   Enable protection for a specific S3 bucket to automatically detect and handle malware in stored objects.
   📍In the Cloud Optix console, navigate to Add Environments › Serverless Storage, select your AWS region, and configure the target S3 bucket for scanning.
   • Adds Serverless Storage Protection for AWS S3 that scans files in protected buckets for malware across executables, media, and documents.

   1 detail in Everything

6. March 2023 Mar 1, 2023 · release notes

   Sophos Cloud Optix adds Azure Activity Anomalies detection, more cloud regions, and Azure Tenant ID in Accounts API.

   └──▷ HOW TO FIND IT
   Monitor user activity in Azure workloads to detect potential insider threats or compromised accounts via behavioral anomalies.
   📍Check the Cloud Optix dashboard under Activity Anomalies for your Azure environment to view flagged users and their deviating behaviors.
   • Adds Activity Anomalies for Azure environments to flag user behavior deviations such as unusual actions, off-hours access, or riskier activities than normal.

   1 detail in Everything

7. February 2023 Feb 1, 2023 · release notes

   New Automatic Remediation section in alert details for cloud-optix shows available serverless remediation functions

   └──▷ HOW TO FIND IT
   View available automatic remediation options for a specific cloud security alert in the dashboard.
   📍Navigate to Alerts › Alert Details and locate the Automatic Remediation section
8. January 2023 Jan 1, 2023 · release notes

   New CIS BenchmarkCIS BenchmarkConsensus-based configuration hardening guidelines published by the Center for Internet Security, covering OSes, cloud platforms, and software; cyber tools use them as a ready-made ruleset to audit or enforce secure system baselines. for AWS Foundations v1.5.0 policy with specific security assessment rules.

   └──▷ HOW TO FIND IT
   View compliance against the new AWS CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Foundations v1.5.0 standard in the UI.
   📍In the console, go to Compliance › Policies and filter for 'CIS Benchmark for Amazon Web Services Foundations v1.5.0'
   • CIS Benchmark for Amazon Web Services Foundations v1.5.0 policy template is now available
   • Security rule AR-1082 added to ensure Auto Minor Version Upgrade is enabled for RDS Instances
   • Security rule AR-1083 added to ensure MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Delete is enabled on S3 buckets
   • Security rule AR-653 added to ensure no security groups allow ingress from ::/0 to remote server administration ports

   4 details in Everything

9. November 2022 Nov 1, 2022 · release notes

   Sophos Cloud Optix November 2022 adds unusual behavior detections and updates MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Flex billing metrics.

   • Enhances Activity Anomalies for AWS to detect unauthorized actions and unusual activity in specific AWS regions
   • Changes MSP Flex billing calculation to average hourly cloud asset usage over the previous 30 days

   2 details in Everything

10. September 2022 Sep 1, 2022 · release notes

    Sophos Cloud Optix adds View Usage dashboard with CSV export for cloud asset usage data.

    └──▷ HOW TO FIND IT
    Export hourly cloud asset usage for the last 3 days to CSV for capacity planning.
    📍In the Cloud Optix console, navigate to Environments › select your environment › View Usage. Export the data for Hourly usage.
    • Adds a new View Usage button under Environments in the Cloud Optix console, displaying average daily asset usage (last 30 days) alongside asset type breakdown and entitlements.

    1 detail in Everything

11. July 2022 Jul 1, 2022 · release notes

    Sophos Cloud Optix July 2022 adds IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. user types and automation detection to Activity Anomalies plus Dark mode UI support

    • Adds IAM user type context (IAM User, Root, Assumed Role) to Activity Anomalies for AWS
    • Highlights anomalies attributed to likely Automation users based on activity patterns
    • Introduces Dark mode support in the Sophos Cloud Optix console

    3 details in Everything

12. June 2022 Jun 1, 2022 · release notes

    Cloud Optix adds Jakarta, Bahrain, and Milan AWS regions to supported onboarding scope.

13. May 2022 May 1, 2022 · release notes

    CIS BenchmarkCIS BenchmarkConsensus-based configuration hardening guidelines published by the Center for Internet Security, covering OSes, cloud platforms, and software; cyber tools use them as a ready-made ruleset to audit or enforce secure system baselines. for Azure Kubernetes Service and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mapping in alerts

    └──▷ HOW TO FIND IT
    Apply the new CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Benchmark policy to an Azure Kubernetes Service cluster to identify non-compliant configurations.
    📍Steps: In the Cloud Optix Console, navigate to Policies › New Policy › Select Azure Kubernetes Service - CIS Benchmark 1.1.0.
    Review MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. context for an alert to understand adversary tactics.
    📍Steps: In the Cloud Optix Console, go to Alerts, click on an Alert to open the full-page details view, and locate the MITRE ATT&CK section for tactic/technique identifiers and links.
    • Adds Azure Kubernetes Service - CIS Benchmark 1.1.0 policy template with 27 rules
    • Enhances Alert Details view to display relevant MITRE ATT&CK tactics/techniques names, identifiers, and links

    2 details in Everything

14. March 2022 Mar 1, 2022 · release notes

    Sophos Cloud Optix March 2022 adds IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. rules for Azure service app/storage and AWS SQS public access detection.

    • Adds Terraform Azure checks for service app and storage accounts in built-in IaC policies
    • Adds rule AR-1080 to detect if an SQS queue allows access to unauthenticated users

    2 details in Everything

15. February 2022 Feb 1, 2022 · release notes

    Sophos Cloud Optix Feb 2022 adds new regions, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. policy rules, S3 filters and network visualization improvements

    └──▷ HOW TO FIND IT
    Filter S3 Storage Inventory to find buckets lacking MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. delete protection.
    📍In the Optix console, go to S3 Storage Inventory and apply the MFA delete turned off filter.
    Check IaC policies for new privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. risks in Terraform AWS deployments.
    📍Review the updated built-in IaC policies in the Optix console for Terraform AWS rules targeting privilege escalation.
    • Adds support for Azure regions: Australia Central, Australia Central2, South Africa North, Norway East, West US3, Jio India West, Sweden Central
    • Updates built-in Infrastructure as Code (IaC) policies with new rules for Terraform AWS, CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call., and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. to detect privilege escalation, data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., credential exposure, and write access without constraints
    • Adds checks for ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. repositories, data encryption, load balancer, Elasticsearch, and Lambda functions in IaC policies
    • Adds new filters to the S3 Storage Inventory page for unencrypted buckets, disabled Access Logging, and disabled MFA delete
    • Enhances Network Visualization topology diagram filters to allow filtering traffic by inbound or outbound on ports 80/443 or others

    +1 more show less

    • Allows selection of storage SKU type when adding an Azure Environment in the console (default: Standard_GRS)

    6 details in Everything

16. January 2022 Jan 1, 2022 · release notes

    Adds ability to configure multiple distinct Jira integration instances per environment in Cloud Optix

    └──▷ HOW TO FIND IT
    Link different Jira projects for Dev, Test, and Prod environments using the UI.
    📍In the Console, go to Settings › Integrations › Jira Integration and click Add Jira.
    Configure ticket cleanup behavior when moving an environment to a new Jira instance.
    📍During Environment migration in the Jira Integration page, enable the option to 'close tickets for the Environment'.
    • Adds support for multiple Jira Integration instances linked to specific Environments via the Jira Integration page UI
    • Adds configurable option to close existing tickets when migrating an Environment between Jira Instances

    2 details in Everything

17. December 2021 Dec 1, 2021 · release notes

    New Azure IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Visualization and GCP/Azure Activity Log uploads to Sophos XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Live Discover

    └──▷ HOW TO FIND IT
    Visualize IAM identity relationships in Azure to audit access permissions.
    📍In the Threat Analysis Center, navigate to the new Azure IAM Visualization section.
    • Adds Azure IAM Visualization to view relationships between IAM Roles, Users, and Services in the console.
    • Enables uploading GCP Activity logs (from Audit logs) to the Sophos Data Lake for Live Discover queries.
    • Enables uploading Azure Activity logs to the Sophos Data Lake for Live Discover queries.

    3 details in Everything

18. November 2021 Nov 1, 2021 · release notes

    New Custom Policy Alerts via search queries, Activity Anomalies detection with feedback loop, and enhanced Spend Monitor and Hosts Inventory views

    └──▷ HOW TO FIND IT
    Set up an alert for Cloud Optix Advanced customers to trigger when a custom search query matches resources during security benchmark scans.
    📍Create Custom Policy Alert › Use advanced search query › Save alert
    Review detected activity anomalies, analyze contributing factors on the timeline, and provide feedback to refine future detection accuracy.
    📍Activity Anomalies view › Click anomaly › Review timeline & contributors › Use thumbs up/down feedback
    • Enables Custom Policy Alerts for Cloud Optix Advanced customers, allowing alerts to be triggered based on custom advanced search queries during subsequent security benchmark scans
    • Introduces Activity Anomalies detection that flags user behavior deviations, provides anomaly contributor reasoning, highlights contributing actions on a timeline, and allows feedback via thumbs up/down to improve future detections
    • Extends Spend Monitor Cost option to include Net Amortized alongside existing Blended and Unblended metrics
    • Enhances Environment Status information in Settings to display additional synchronization status for each environment
    • Updates Hosts Inventory for AWS to show the IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role assigned to each host

    +1 more show less

    • Enhances Azure Advisor Alerts to display detailed descriptions and remediation steps

    6 details in Everything

19. October 2021 Oct 1, 2021 · release notes

    New container image scanning API and AWS Elasticsearch inventory in October 2021

    • Remediation Functions for AWS and Azure allow automatic remediation via serverless functions based on Cloud Optix Alerts.
    • AWS Search now includes IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Users SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.) for AWS environments.
    • AWS Elasticsearch Inventory added to Storage Inventory listing.
    • AWS RDS Inventory Enhancement adds Database Size and Instance Type information.
    • New API endpoint enables obtaining vulnerability details from the last scan result for a container image.

    +1 more show less

    • Update to policy AWS - ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001: The rule “Ensure access keys are rotated every 180 days" has been removed.

    6 details in Everything

20. September 2021 Sep 1, 2021 · release notes

    Container Image Scanning V2 with new security rules, Redshift inventory, XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Live Discover integration, and enhanced UI/search

    • Adds IS_7011 through IS_7019 rules to the Container Images - Sophos Cloud Optix Best Practices policy for insecure container settings
    • Adds Security Policy column to the Scanned Images page showing pass/fail status against selected container scanning policies
    • Displays next scheduled scan time for each image in the Scanned Images inventory view
    • Adds AWS Redshift cluster inventory data (public/encrypted status) to the Storage inventory
    • Enables uploading activity logs to Sophos Data Lake for use with XDR Live Discover queries from Settings > Advanced > XDR Data Lake Upload

    +5 more show less

    • Enhances Scanned Images page to show at-a-glance policy compliance and detailed rule breakdowns on click
    • Updates Last Interaction Timestamp format in SophosLabs Intelix Malicious Traffic Alerts to standard datetime
    • Adds VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Id and Instance Id details to Anomaly Alerts for AWS environments
    • Shows execution log file location during onboarding for AWS, Azure, and Kubernetes
    • Enables searching Activity Logs for AWS, Azure, and GCP from the search bar

    10 details in Everything

21. August 2021 Aug 1, 2021 · release notes

    Sophos Cloud Optix August 2021 adds container inventory CSV export and AWS Security Hub integration

    └──▷ HOW TO FIND IT
    Export all container inventory data to CSV for offline analysis or reporting.
    📍In the Inventory view, select Export and choose CSV format to download container lists for EKS, AKS, GKE, and K8S.
    Connect Cloud Optix to AWS Security Hub to ingest findings from native services like GuardDuty or Inspector.
    📍Go to Settings › Integrations › AWS Security Hub and follow the setup instructions to configure the integration.
    • Adds ability to export the list of containers for all container types (EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure., K8S) in the Inventory to a CSV file.
    • Adds AWS Security Hub integration to generate Cloud Optix alerts from AWS native security services (Amazon Inspector, Amazon Macie, Amazon GuardDuty, AWS Systems Manager Patch Manager, AWS Firewall Manager, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Access Analyzer).
    • Adds new alert-type for Security Hub alerts to enable identification and filtering in the alerts list.
    • Adds Operating System (Windows or Linux) information for each EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance/Virtual Machine to the host inventory for AWS and GCP.
    • Adds indicators on Activity Logs and Flow Logs pages showing if cloud environments are not sending data to Sophos Cloud Optix.

    +3 more show less

    • Adds a list of sample searches under Discover > Search, including examples like finding over-privileged IAM users created over a month ago.
    • Adds Rule AR-1075 exemption for Sophos Firewall deployments on AWS EC2 instances so it no longer raises an alert.
    • Adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Microsoft Azure Foundations Benchmark v1.3.0 policy template and associated security rules (AZ-2501 through AZ-2553) for Azure environments.

    8 details in Everything

22. July 2021 Jul 1, 2021 · release notes

    New AWS ECSAWS ECSAmazon's managed container orchestration service that runs Docker containers on clusters of EC2 instances or Fargate, letting tools offload scheduling, scaling, and infrastructure management to AWS./Fargate/AMI/EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. inventory views, auto agent removal, CSV env export, and enhanced policy/report features

    └──▷ HOW TO FIND IT
    Export cloud environment inventory for external auditing or integration.
    📍Navigate to Settings › Environments and click the Export to CSV option.
    Enable automatic cleanup of server agents for decommissioned cloud instances.
    📍Go to Settings › Advanced › Automatic Agent Removal and toggle the feature on as a Super Admin.
    Export custom policy templates for migration or reuse across tenants.
    📍Navigate to Policy Templates, select your template, and choose Export CSV to download with rule descriptions.
    • Adds AWS ECS Fargate Inventory to see Task Definitions and Container Definitions for Amazon ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. on Fargate in the Containers inventory.
    • Adds AWS AMI Inventory to Hosts inventory to list AMIs, their owners, and associated EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances.
    • Adds EBS Volume Inventory to list Elastic Block Store Volumes, attachment status, encryption status, and linked EC2 instances.
    • Enables export of Cloud and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. Environments list to CSV from Settings > Environments.
    • Enables suppression of up to 10 alerts at once with a single reason for audit purposes in the console.

    +9 more show less

    • Adds Automatic Agent Removal feature (opt-in) to remove dangling server agents for terminated AWS EC2 instances and Azure VMs.
    • Adds new rules AR-1078 (EC2 Termination protection) and AR-1079 (AWS scheduled events) with associated alerts.
    • Enables export of Detailed Policy Reports to PDF format.
    • Enables export of custom policy templates to CSV including rule descriptions for import into other tenants.
    • Enhances Azure IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. inventory to show Azure AD tenant ID and allows filtering by tenant ID.
    • Adds Diagram link in Hosts Inventory view column for direct access to Network Visualization for Azure and GCP hosts.
    • Adds system alerts for API synchronization failures between Cloud Optix and cloud environments due to authorization problems.
    • Enhances Serverless inventory to provide a direct link from AWS Lambda execution role details to IAM inventory.
    • Improves Environments list to clearly distinguish GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure./AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations./EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Clusters from parent environments.

    14 details in Everything

23. June 2021 Jun 1, 2021 · release notes

    Cloud Optix June 2021 adds weekly PDF summary emails, AWS CloudShell onboarding support, and enhanced alert views.

    └──▷ HOW TO FIND IT
    Configure weekly PDF reports for your team by navigating to Report Settings in the Advanced menu.
    📍In the left-hand menu, select Advanced › Report Settings to add/remove email recipients for the weekly summary.
    Use AWS CloudShell to deploy agents without needing local SSH access or credentials management.
    📍Run the Sophos Cloud Optix onboarding script directly inside the AWS CloudShell browser-based shell environment.
    • Adds Advanced settings to the left-hand menu for Standard customers, including IP Allow List configuration for user login anomaly alerts
    • Enables automated weekly summary report emails (PDF attachment) sent to registered users starting June 14, 2021
    • Supports onboarding via AWS CloudShell using the existing Sophos Cloud Optix on-boarding script
    • Displays total number of affected resources for each severity level in the Alerts page UI
    • Includes Environment Tags in Jira tickets as Labels and displays them in the Alert details popup

    5 details in Everything

24. May 2021 May 1, 2021 · release notes

    Sophos Cloud Optix May 2021 adds Intelix malicious traffic anomaly alerts, auto-removal of dangling agents, and UK Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. compliance templates.

    └──▷ HOW TO FIND IT
    Activate the new UK Cyber Essentials compliance template for your organization's self-assessment.
    📍In Cloud Optix, go to Policies › Compliance Templates and enable UK Cyber Essentials.
    • Adds SophosLabs Intelix-based Anomaly alerts for outbound network traffic to known bad IP addresses identified in VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Logs
    • Automatically requests removal of terminated server agents from Sophos Central when corresponding EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. or Azure VMs are terminated

    2 details in Everything

25. April 2021 Apr 1, 2021 · release notes

    April 2021 release adds Unscanned container filter, S3 inventory data, Amazon Detective default enablement, and read-only ticket creation.

    └──▷ HOW TO FIND IT
    Filter inventory to find containers whose images haven't been vulnerability scanned yet.
    📍Navigate to Inventory › Containers and select the Unscanned filter.
    Verify new S3 bucket attributes are captured in inventory for compliance checks.
    📍Review Inventory › AWS S3 Buckets for columns: Logging enabled, MFA Delete enabled, and Versioning enabled.
    Grant read-only users the ability to initiate incident response via ticketing systems.
    📍Open an alert in Cloud Optix as a read-only user and click Create Jira Ticket or Create ServiceNow Ticket.
    • Adds an Unscanned filter to the Containers tab in Inventory to show containers from images that have not been scanned for vulnerabilities
    • Expands AWS S3 bucket inventory data with Logging enabled, MFA Delete enabled, and Versioning enabled status
    • Enables Amazon Detective integration by default for new customers, including those on Cloud Optix for EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.
    • Adds AWS Osaka Region (ap-northeast-3) support as a standard region
    • Adds an Images column to the Containers tab in Inventory showing the source image for each running container with links to scan results if scanned

    +3 more show less

    • Adds a direct link from the Scanned Images list's new Containers column to the inventory page details
    • Allows users with the read-only role to manually create Jira and ServiceNow tickets from alerts
    • Makes new security monitoring rules automatically available for use in custom policies when added by Sophos

    8 details in Everything

26. March 2021 Mar 1, 2021 · release notes

    Sophos Cloud Optix March 2021 adds container image scanning, API submission, Azure quick-start setup, webhooks, and alert customization.

    └──▷ HOW TO FIND IT
    Add a new Azure environment to Cloud Optix using the quick-start setup to start monitoring core features immediately.
    📍In the left-hand menu, navigate to Settings › Environments › Add Environment. Select Azure and choose Quick-start Setup. Follow the two-step wizard to authenticate and sync without downloading scripts.
    Configure a webhook to send alerts to a custom HTTP endpoint for automated remediation workflows.
    📍In the Console, go to Settings › Integrations › Webhooks. Click Add Webhook, enter your target URL, and configure the alert triggers (e.g., Critical Vulnerability). Save to activate the integration.
    • Adds container image scanning for vulnerabilities against Amazon ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure., Azure ACR, Docker Hub, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. environments (Bitbucket, GitHub), accessible via the new console UI or API
    • Enables submitting container images for scanning via API to integrate with build pipelines
    • Introduces a global Flow Logs page in the left-hand menu with search fields for srcAddr, dstAddr, and dstPort
    • Adds an Azure Quick-start Setup option allowing administrators to add Azure environments via a two-step process without downloading scripts
    • Adds native webhook support for remediation and reporting, including integrations with Jira, Slack, and Teams, and the ability to send alerts to custom HTTP endpoints

    +8 more show less

    • Allows customization of the Alerts list UI: resizing columns, hiding/showing columns (except Alert ID and Description), reordering columns via drag-and-drop, and persisting alert severity filters
    • Adds description and tags fields to the AWS Security Groups list in the inventory
    • Displays operational status for Flow Log ingestion and Activity Log ingestion on the Environments page for AWS, Azure, and GCP environments
    • Enhances the Unused Azure NSG filter to include SQL Server, DB Server, CosmosDB, App Service, Function App, and Storage Account alongside VMs
    • Replaces the date range selector with a new flexible selector supporting common ranges and custom calendar selection across Dashboard, Alerts, and Activity logs
    • Adds Compliance Tag details to alert popups and enables linking from alerts list to policy details pages via compliance tags
    • Enables importing and exporting custom policies as CSV files for sharing between Cloud Optix accounts
    • Allows specifying whether to sync all AWS regions or only selected regions on the Edit Environment page

    13 details in Everything

27. February 2021 Feb 1, 2021 · release notes

    Adds IP whitelist CSV import, persistent env filters, GuardDuty per-env correlation, and Azure Sentinel connector.

    └──▷ HOW TO FIND IT
    Whitelist specific IPs to prevent login anomaly alerts by importing a CSV file.
    📍Settings › Advanced › IP whitelist (Import CSV)
    Filter alerts by multiple severities to focus on high-priority issues.
    📍Alerts page › Filters › Severity › Check Critical and High
    • Enables importing IP addresses/ranges for the IP whitelist via a CSV file under Settings > Advanced > IP whitelist
    • Persists the Environments filter selection across logouts so admins do not need to reapply it
    • Associates aggregated Amazon GuardDuty alerts to individual AWS environments instead of the master account
    • Publishes the Azure Sentinel connector in the Microsoft Azure Sentinel Gallery (Public Preview)
    • Allows multi-selection of severity levels on the Alerts page filters (e.g., Critical and High)

    5 details in Everything

28. January 2021 Jan 1, 2021 · release notes

    Custom policies gain exclusion filters, GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. inventory adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists./Encryption details, and JIRA integration adds Mark as closed action.

    • Adds environment exclusion filtering to custom policy templates
    • Adds Application-layer Encryption and RBAC Security Group info to GKE cluster inventory
    • Adds Azure App Services visibility in Inventory > Serverless > Azure
    • Introduces CIS BenchmarkCIS BenchmarkConsensus-based configuration hardening guidelines published by the Center for Internet Security, covering OSes, cloud platforms, and software; cyber tools use them as a ready-made ruleset to audit or enforce secure system baselines. for AWS Foundations v1.3.0 (Level 1 & 2) as new policy templates
    • Adds six new AWS security assessment rules for S3, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., and Organizations

    5 details in Everything

29. December 2020 Dec 1, 2020 · release notes

    Sophos Cloud Optix December 2020 adds Sophos Workload Protection discovery, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy download, tag filtering, and EFS rules.

    └──▷ HOW TO FIND IT
    Identify EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances with Sophos agents installed in the network visualization.
    📍Navigate to Cloud Optix host inventory and filter for Sophos Intercept X for Server status.
    Download a remediated IAM policy for an over-privileged role via the IAM Visualization UI.
    📍Select the entity in IAM Visualization › choose Revoke access › download JSON policy.
    Filter alerts to see only those affecting resources tagged with a specific cost center.
    📍Enter tags.CostCenter:Production into the Cloud Optix Search box.
    • Adds support for discovering AWS and Azure hosts with Sophos Intercept X for Server agents in the host inventory and network visualization.
    • Provides a right-sized replacement IAM policy JSON download and apply instructions for over-privileged entities in the IAM Visualization.
    • Enables filtering alerts by AWS resource tags using tags. prefix syntax in the Search box (e.g. tags.CostCenter:Production).
    • Adds alert trend graph filtering to display specific alert types (Spend, Anomaly, Security, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup., GuardDuty) via optix.sophos.com/#/alerts/trend.
    • Introduces AWS EFS encryption rule AR-1072 and replacement Azure disk encryption rules AZ-2358 through AZ-2360.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Azure security benchmark rules AZ-2352, AZ-2353, and AZ-2354 are deprecated.
30. November 2020 Nov 1, 2020 · release notes

    New AWS onboarding via S3/Wizard, ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. root/privilege checks, XG Firewall discovery, PDF export, GCP Best Practices policy, and Feedback menu

    └──▷ HOW TO FIND IT
    Use the new Feedback button to request a feature or report a bug directly from the console.
    📍Click Feedback (bottom-left) › Request a Feature
    Export Executive Summary data to PDF for reporting.
    📍Navigate to Exec Summary page › Click Export › Select PDF
    • AWS on-boarding now exports VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Logs and CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. logs to S3 (not CloudWatch) and includes a new CLI script wizard for CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call./Terraform-based setup.
    • Adds security rules AR-1069 (ECS/Fargate container root user) and AR-1070 (ECS container elevated privileges) to the Sophos Best Practice Policy for AWS.
    • Allows discovery of Sophos XG and UTM Firewall deployments in AWS environments via Network Visualization and Host inventory based on AMI ID.
    • Enables export of Exec Summary page data to a formatted PDF document for management reporting.
    • Adds Request a Feature, Contact Support, and Report a bug routing options via the new Feedback button menu in the console.

    +1 more show less

    • Provides a new Sophos Best Practices policy template for GCP to host future security checks not covered by CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. or other compliance templates.

    6 details in Everything

31. October 2020 Oct 1, 2020 · release notes

    Sophos Cloud Optix October 2020 adds spend monitoring visualization, new Microsoft Teams and Azure Sentinel integrations, and Amazon Detective linking.

    • Adds daily and monthly Spend Monitoring visualizations with filtering by date range, environments, tags, services, and regions, including expandable graphs and CSV-exportable cost data tables
    • Adds Executive Summary of spend for the last full month compared to the prior full month, highlighting top service increases and decreases
    • Adds new Spend Recommendations (Alerts) via Sophos rules for AWS covering unused infrastructure and expensive instance types
    • Adds integration with AWS Trusted Advisor requiring AWS Business or Enterprise support plan
    • Adds integration with Azure Advisor cost recommendations

    +5 more show less

    • Enhances Inventory improvements by adding CSV export options to GCP inventory pages (Host, Network, Storage, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access.)
    • Enhances Inventory improvements by including ingress and egress rules in the AWS Security Groups inventory CSV export
    • Adds Microsoft Teams integration allowing Cloud Optix alerts to be sent to a designated MS Teams channel
    • Adds Azure Sentinel integration sending Cloud Optix alerts to an Azure Sentinel (SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.) workspace
    • Adds Amazon Detective integration linking to Detective findings pages in the AWS console from GuardDuty alerts and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances in the inventory, enabled via Settings > Integrations

    10 details in Everything

32. September 2020 Sep 1, 2020 · release notes

    Context-sensitive help for console pages; new IMDS v1 detection rule; suppressed alert notes; SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. user inventory tab.

    └──▷ HOW TO FIND IT
    Use the new context-sensitive help to quickly navigate documentation relevant to your current view in the console.
    📍Click Help with Sophos Cloud Optix from the Help menu while viewing any console page.
    Navigate to the new SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Users tab in the AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. inventory to audit SAML user activity and identities.
    📍In the AWS IAM inventory view, select the SSO Users tab to see user, login count, last event time, last API call, and ARN.
    • Adds context-sensitive help that links to the relevant console page when available
    • Adds a new AWS rule in the Sophos Best Practices policy to detect EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances with Instance Metadata Service V1 (IMDS) enabled and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles assigned
    • Displays suppression notes for affected resources in alerts via a note icon next to struck-through resource names
    • Adds an SSO Users tab to the AWS IAM inventory page displaying user, login count, last event time, last API call, and ARN for SAML users

    4 details in Everything

33. August 2020 Aug 1, 2020 · release notes

    Alert export includes suppression notes, Rule ID, and consolidated resource view; host inventory adds Private IP search

    └──▷ HOW TO FIND IT
    Export alerts grouped by affected resource to correlate issues across multiple rule violations for a single VM.
    📍In the Alerts page, select CSV export and choose By Affected Resources Consolidated.
    Search the host inventory for specific internal IPs to identify compromised private endpoints across cloud providers.
    📍In the Host inventory search bar, enter a Private IP address (e.g., 10.0.0.5).
    • Includes Reasons/notes provided when suppressing alerts in the alerts CSV export.
    • Displays Rule ID for each alert on the Alerts page.
    • Adds By Affected Resources Consolidated option to CSV export for grouping alerts by resource in a single worksheet.
    • Alert trend graph supports logarithmic scale (default) and stacked bar chart views.
    • Platform preference (AWS/Azure/GCP) is retained when navigating between inventory pages.

    5 details in Everything

34. July 2020 Jul 1, 2020 · release notes

    July 2020 release adds AWS Quick Start, SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. tag filtering, PagerDuty auto-resolve, and Save Searches to Cloud Optix

    └──▷ HOW TO FIND IT
    Quickly onboard an AWS environment using the new partial deployment template without manual resource creation.
    📍Use the CloudFormation template linked in the release notes to deploy the stack.
    Access and manage saved searches from the new console page.
    📍Navigate to the Search page in the Cloud Optix console left-hand menu, run a query, and click Save.
    • AWS Quick-start Setup option: A new CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. template allows admins to add AWS environments via partial deployment without running scripts or creating manual resources.
    • Amazon SNS integration enhancement: Alerts sent to Amazon SNS now include Environment Tags as Message Attributes, enabling downstream filtering by environment groups.
    • Save Searches feature: A new Search page in the console allows administrators to enter, run, save, edit, and delete search queries. Saved queries are stored at the account level for team reuse.

    3 details in Everything

35. June 2020 Jun 1, 2020 · release notes

    Cloud Optix June 2020 adds Environment Access Control via tags, advanced search operators, Terraform 0.12 support, and Ansible credential checks.

    • Environment Tags allow Super Admins to restrict administrator access to specific groups of environments
    • Advanced search now supports logical operators (and/or/not), wildcards, and regular expressions for complex queries
    • IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanning extends credential checking coverage to Ansible (AWS) templates alongside existing CFN, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware., and Terraform checks
    • IaC scanning adds support for Terraform 0.12 templates
    • New Terraform checks include verifying EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. encryption in launch configurations, S3 MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. delete, access logging, and public read ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource.

    5 details in Everything

36. May 2020 May 1, 2020 · release notes

    AWS Activity Logs visualizations, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. secrets scanning policies, multi-API keys per account, and Jira integration enhancements.

    └──▷ HOW TO FIND IT
    Generate and manage multiple API keys for your Cloud Optix account via the console UI.
    📍Navigate to Console › Integrations › API Keys to view existing keys, generate new ones, or delete old keys.
    Validate your Jira integration settings immediately without waiting for a security alert to trigger ticket creation.
    📍Go to Integrations › Jira and click the Test configuration button.
    • Adds graph views to AWS Activity Logs in the Inventory showing geolocation of CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. IPs, public S3 buckets over time, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance counts by region (map view), top 10 active IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. users, and top error types/sources
    • Introduces IaC - Sophos Credentials Checker policies for AWS CloudFormationAWS CloudFormationAn AWS service for declaring cloud infrastructure as code in JSON or YAML templates, letting cyber tools provision and tear down entire environments reproducibly without manual console steps., Terraform (AWS/Azure), and Azure Resource Manager templates to detect embedded secrets/passwords/keys
    • Enables Super Admins to create multiple API keys for a single Cloud Optix account with console management capabilities including description, creator, expiry date display, deletion, and generation
    • Allows users with Admin role (previously Super Admin only) to create Jira tickets manually from the Alerts UI
    • Adds Test configuration button on the Jira integration page to validate settings without generating security alert tickets

    5 details in Everything

37. April 2020 Apr 1, 2020 · release notes

    April 2020 release adds email alert configuration, co-branded PDF reports for MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs., and new inventory views for serverless functions and Azure IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Hubs.

    └──▷ HOW TO FIND IT
    Configure which administrators receive critical email alerts for specific types using the console UI.
    📍In the console, go to Integrations › Email Alerts and configure the recipient list and alert filters
    • Adds Email Alerts configuration on the Integrations page to send account-level notifications via email for Security Monitoring, Anomaly detection, GuardDuty, or IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. alerts based on severity
    • Adds co-brandable PDF compliance report exports for MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Flex Cloud Optix accounts
    • Adds Inventory API endpoints to pull inventory information for serverless functions and containers
    • Enhances Amazon SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. integration to include the environment's account name and ID in Message Attributes with each alert
    • Extends IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Visualization to show users/groups/roles that have access to the AWS Lambda service

    +3 more show less

    • Adds visibility of Network ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. rules in the right-hand panel of the AWS Network Visualization for a sub-net
    • Adds an IoT Hub tab to the Azure Network inventory section with legacy TLS 1.0/1.1 detection and new security rules AZ-2356 and AZ-2357
    • Adds a Logic Apps tab to the Azure Serverless inventory section identifying public Logic Apps

    8 details in Everything

38. March 2020 Mar 1, 2020 · release notes

    New AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Access Analyzer integration, Amazon Inspector findings UI, AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. support, and CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. onboarding.

    └──▷ HOW TO FIND IT
    View external access risks using IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Access Analyzer for AWS resources.
    📍Navigate to Inventory › IAM › External Access in the Cloud Optix console
    • Adds Inventory > IAM > External Access view for AWS IAM Access Analyzer integration
    • Adds new GET APIs for Environments, Hosts and Users inventory in the Cloud Optix Rest API
    • Adds Super Admin role for standalone Cloud Optix accounts to manage user invitations and role assignments
    • Adds region selection option in Custom Settings on the Add your cloud environment page for Azure on-boarding
    • Adds AKS inventory and topology visualization support for on-boarded Azure AKS clusters

    +3 more show less

    • Adds AWS CloudFormationAWS CloudFormationAn AWS service for declaring cloud infrastructure as code in JSON or YAML templates, letting cyber tools provision and tear down entire environments reproducibly without manual console steps. (including StackSets) as an onboarding method for AWS environments
    • Adds Amazon Inspector filter tab on Host inventory page and CVEs filter on Network Visualization page
    • Adds configurable table columns via the cogs icon in Cloud Optix console tables

    8 details in Everything

39. February 2020 Feb 1, 2020 · release notes

    IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Visualization, EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. onboarding, Spend Monitor alerts, Azure Cosmos DB inventory, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. certification for GCP benchmarks added in February 2020 release.

    • IAM Visualization: See relationships between AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Roles, IAM Users, and Services to trace access paths across roles, groups, and inline policies.
    • Spend Monitor with threshold-based alerting: Set alert thresholds for daily spend spikes across AWS, Azure, and GCP to identify potential security issues.
    • On-board Amazon EKS clusters for inventory, topology, and security checks via a separate onboarding script requiring additional permissions.
    • New Azure Cosmos DB inventory page in the Storage area with additional security checks, counting as Cloud Assets for licensing.
    • CIS Certification for GCP benchmarks: CIS BenchmarkCIS BenchmarkConsensus-based configuration hardening guidelines published by the Center for Internet Security, covering OSes, cloud platforms, and software; cyber tools use them as a ready-made ruleset to audit or enforce secure system baselines. for Google Cloud Platform Foundations v1.0.0 Level 1 and Level 2.

    5 details in Everything

40. January 2020 Jan 1, 2020 · release notes

    January 2020 update adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. certification for AWS, VM Scale Set inventory filtering, and enhanced outbound traffic reporting.

    └──▷ HOW TO FIND IT
    Filter Azure hosts to identify those within a specific VM Scale Set.
    📍In the Hosts inventory area, click the VM Scale Set column header to filter by scale set name.
    View ISP and country details for outbound traffic destinations without leaving the report.
    📍In the outbound traffic report, click the destination IP address in the list.
    • Adds CIS BenchmarkCIS BenchmarkConsensus-based configuration hardening guidelines published by the Center for Internet Security, covering OSes, cloud platforms, and software; cyber tools use them as a ready-made ruleset to audit or enforce secure system baselines. certification for Amazon Web Services Foundations Benchmark v1.2.0 Levels 1 and 2
    • Adds VM Scale Set column to Azure Hosts inventory enabling filtering by scale set membership
    • Enhances outbound traffic report with UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. Port 53, Port 0 (wildcard), and ephemeral port pair visibility
    • Adds clickable destination IP in outbound traffic view for WHOIS IP lookup including ISP and country details
    • Enables migration from standalone Cloud Optix account to Sophos Central via Super Admin console

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !After migrating to Sophos Central, users can no longer log into Cloud Optix via optix.sophos.com.
41. December 2019 Dec 1, 2019 · release notes

    Sophos Cloud Optix December 2019 adds AWS console deep links, Terraform 0.12 onboarding, and PS5A integrations.

    • Adds deep links to the AWS console for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances, S3 buckets, Security Groups, and RDS alerts to speed up manual remediation
    • Links VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Id in topology visualization to VPC details in Inventory
    • Links EC2 instance Id in topology to host details in Inventory
    • Links VPC Id on Security Group Inventory page to VPC details in Inventory
    • Adds support for AWS accounts onboarding using Terraform v0.12

    +1 more show less

    • Includes suppression reason, resources, and user in PDF compliance reports under a Notes section

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !AWS Lambda functions for newly onboarded AWS environments now use Python runtime instead of Node.js 8.10
42. November 2019 Nov 1, 2019 · release notes

    Sophos Cloud Optix November 2019 adds Sophos Central integration, custom policy rule search, Splunk JSON length setting, on-demand sync icon, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. Scan API.

    • Adds Max JSON length setting (default 10K characters) to the Splunk integration page in the Cloud Optix console
    • Adds a Sync icon in the Actions column of the Environments list page to initiate on-demand benchmark scans
    • Introduces the new IaC Scan API for uploading IaC templates and retrieving scan results via https://optix.sophos.com/apiDocumentation
    • Adds free-text rule search field when creating or customizing policies to filter by rule summary text

    4 details in Everything

43. October 2019 Oct 1, 2019 · release notes

    Cloud Optix October 2019 adds AI-driven high-risk AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. detection and shareable inventory URLs

    └──▷ HOW TO FIND IT
    Quickly focus AWS dashboard visibility on potentially risky IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. activities without manual log analysis.
    📍Navigate to the AWS dashboard and toggle High-risk changes in the Changes in your environments area.
    Share a specific view of inventory data with a colleague on the same account for collaborative review.
    📍From the desired inventory page, generate and share the short URL provided in the Console.
    • Adds an AI-driven High-risk changes toggle on the AWS dashboard's Changes in your environments area to filter for IAM entities making unusual modifications.

    1 detail in Everything

44. September 2019 Sep 1, 2019 · release notes

    AWS Marketplace availability, new AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. compromise detections, expanded global search across GCP/Azure, PDF remediation options, and SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. alerting integration.

    └──▷ HOW TO FIND IT
    Configure alerts to be forwarded to an existing SNS topic for integration with other monitoring systems, filtering only by severity.
    📍Settings › Integrations › Amazon SNS: Select topic and choose alert levels (Critical, High, Medium, Low)
    Export compliance reports with actionable remediation steps included for easier team coordination.
    📍Settings › Report Settings: Enable Include remediation instructions in PDF reports
    • Adds 'IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role assigned to EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. used from different resource' detection for AWS Credential Compromise
    • Adds column showing number of AWS services accessed by IAM users in the last 12 months to the IAM Users inventory
    • Adds GCP search support to global search (Host, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., Users, Storage)
    • Adds AWS-specific filters to global search (Security groups, S3, RDS, VPC NACL)
    • Adds Azure search support to global search (Host, DB, Users, Security Groups, Storage)

    +4 more show less

    • Adds option to include remediation instructions in downloadable PDF compliance reports
    • Enables separation of duties for Azure on-boarding script (Stage 1: create enterprise app; Stage 2: add subscriptions)
    • Adds GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. support with topology visualization, inventory details, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmark checks
    • Adds Amazon SNS integration to push Cloud Optix alerts to SNS topics with severity filtering

    9 details in Everything

45. August 2019 Aug 1, 2019 · release notes

    Sophos Cloud Optix August 2019 adds AWS AR-1039 check, Azure App Service rules, local search on Alerts page, and auto-loaded compliance policies.

    └──▷ HOW TO FIND IT
    Identify AWS Security Groups with overly permissive inbound rules (wider than /24) using the new automated check.
    📍In the Alerts page, use the local search bar to filter results for AR-1039 to find affected security groups.
    • Adds AR-1039 AWS check to detect Security Groups with ingress CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges wider than /24
    • Adds Benchmark checks for Azure App Service in the Azure - Sophos Cloud Optix Best Practices policy

    2 details in Everything

46. July 2019 Jul 1, 2019 · release notes

    July 2019 release adds Azure Function inventory view, GCP/Azure compliance policies, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. repo filtering capabilities.

    └──▷ HOW TO FIND IT
    Monitor serverless workloads and their compliance posture directly in the Inventory.
    📍Navigate to Inventory › Serverless to view Azure Functions.
    Filter scanning scope to specific infrastructure-as-code repositories without disabling the integration entirely.
    📍In Settings, go to IaC environments list and toggle the status for individual code repos.
    Gain visibility into inferred database and application architecture in AWS topology maps.
    📍Check the AWS topology visualization for ELK stack nodes under Inferred DBs/Apps.
    • Adds Azure Functions to the Inventory (Serverless) section with associated security checks in the Azure benchmark policy
    • Extends Inferred DBs/Apps detection on AWS topology visualization to cover Elasticsearch, Logstash, and Kibana
    • Enables customers to enable or disable scanning for specific IaC environments via the Settings > IaC environments list

    3 details in Everything

47. June 2019 Jun 1, 2019 · release notes

    Azure ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. template IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanning, GCP login anomaly detection, mass policy toggle, customizable scan cadence, and automated sync stop on expiry.

    └──▷ HOW TO FIND IT
    Configure continuous scanning for a specific environment via the UI settings.
    📍Settings › Environments › Edit Environment › Select Continuous in scan cadence options
    • Adds IaC - Sophos Best Practices - Azure Resource Manager policy with 25 security checks for Azure ARM templates
    • Enables User Login Anomaly Detection (AI) on GCP cloud platform
    • Extends Show Inferred DBs visualization to Azure and GCP network topology views
    • Adds Settings > Environments > Edit Environment configuration to customize scanning frequency with options including 30m, 1h, 2h, 6h, 12h, 24h, continuous, or custom hours
    • Changes default scan cadence to 1 hour for all accounts

    +1 more show less

    • Adds bulk disable/enable capability for compliance policies via the console interface

    6 details in Everything