https://cybertoolchain.io/tools/sophos-cloud-optix New releases and features in Sophos Cloud Optix, tracked by The Cyber Toolchain. en Mon, 01 Dec 2025 00:00:00 GMT https://optix.sophos.com/releasenotes/ https://optix.sophos.com/releasenotes/ Mon, 01 Dec 2025 00:00:00 GMT Updated CIS benchmark policies for AWS and Azure in December 2025 release • Updated CIS AWS Foundations 5.0 policies are now active in Cloud Optix, including new checks like `AR-1087` (EC2 IMDSv2) and `AR-1088` (CIFS access restrictions). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-cloud-optix https://optix.sophos.com/releasenotes/ https://optix.sophos.com/releasenotes/ Sat, 01 Jun 2024 00:00:00 GMT Sophos Cloud Optix upgrades Standard to Advanced; updates AWS Lambda dependencies. • `Sophos Cloud Optix Standard` is deprecated and automatically upgraded to `Sophos Cloud Optix Advanced` for all active customers at no additional cost • The third-party libraries `urllib3` and `requests` within Cloud Optix Lambda functions have been updated for newly onboarded AWS environments Breaking changes: • `Sophos Cloud Optix Standard` is no longer offered as of June 15, 2024; customers previously on Standard are automatically migrated to `Sophos Cloud Optix Advanced` • Newly onboarded AWS environments will use updated Python runtimes and libraries (`urllib3`, `requests`) in Lambda functions, requiring existing manual installs (added before June 19, 2024) to be repaired via the 'AWS Environment Repair process' Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-cloud-optix https://optix.sophos.com/releasenotes/ https://optix.sophos.com/releasenotes/ Wed, 01 Mar 2023 00:00:00 GMT Sophos Cloud Optix adds Azure Activity Anomalies detection, more cloud regions, and Azure Tenant ID in Accounts API. • Adds `Activity Anomalies` for Azure environments to flag user behavior deviations such as unusual actions, off-hours access, or riskier activities than normal. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-cloud-optix https://optix.sophos.com/releasenotes/ https://optix.sophos.com/releasenotes/ Wed, 01 Feb 2023 00:00:00 GMT New Automatic Remediation section in alert details for cloud-optix shows available serverless remediation functions • Adds an `Automatic Remediation` section to alert details that displays available serverless remediation functions for AWS and Azure Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-cloud-optix https://optix.sophos.com/releasenotes/ https://optix.sophos.com/releasenotes/ Sun, 01 Jan 2023 00:00:00 GMT New CIS Benchmark for AWS Foundations v1.5.0 policy with specific security assessment rules. • `CIS Benchmark for Amazon Web Services Foundations v1.5.0` policy template is now available • Security rule `AR-1082` added to ensure Auto Minor Version Upgrade is enabled for RDS Instances • Security rule `AR-1083` added to ensure MFA Delete is enabled on S3 buckets • Security rule `AR-653` added to ensure no security groups allow ingress from ::/0 to remote server administration ports Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-cloud-optix https://optix.sophos.com/releasenotes/ https://optix.sophos.com/releasenotes/ Thu, 01 Sep 2022 00:00:00 GMT Sophos Cloud Optix adds 'View Usage' dashboard with CSV export for cloud asset usage data. • Adds a new 'View Usage' button under Environments in the Cloud Optix console, displaying average daily asset usage (last 30 days) alongside asset type breakdown and entitlements. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-cloud-optix https://optix.sophos.com/releasenotes/ https://optix.sophos.com/releasenotes/ Fri, 01 Jul 2022 00:00:00 GMT Sophos Cloud Optix July 2022 adds IAM user types and automation detection to Activity Anomalies plus Dark mode UI support • Adds IAM user type context (IAM User, Root, Assumed Role) to Activity Anomalies for AWS • Highlights anomalies attributed to likely Automation users based on activity patterns • Introduces Dark mode support in the Sophos Cloud Optix console Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-cloud-optix https://optix.sophos.com/releasenotes/ https://optix.sophos.com/releasenotes/ Tue, 01 Mar 2022 00:00:00 GMT Sophos Cloud Optix March 2022 adds IaC rules for Azure service app/storage and AWS SQS public access detection. • Adds Terraform Azure checks for service app and storage accounts in built-in IaC policies • Adds rule AR-1080 to detect if an SQS queue allows access to unauthenticated users Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-cloud-optix https://optix.sophos.com/releasenotes/ https://optix.sophos.com/releasenotes/ Tue, 01 Feb 2022 00:00:00 GMT Sophos Cloud Optix Feb 2022 adds new regions, IaC policy rules, S3 filters and network visualization improvements • Adds support for Azure regions: Australia Central, Australia Central2, South Africa North, Norway East, West US3, Jio India West, Sweden Central • Updates built-in Infrastructure as Code (IaC) policies with new rules for Terraform AWS, CloudFormation, and ARM to detect privilege escalation, data exfiltration, credential exposure, and write access without constraints • Adds checks for ECR repositories, data encryption, load balancer, Elasticsearch, and Lambda functions in IaC policies • Adds new filters to the S3 Storage Inventory page for unencrypted buckets, disabled Access Logging, and disabled MFA delete • Enhances Network Visualization topology diagram filters to allow filtering traffic by inbound or outbound on ports 80/443 or others • Allows selection of storage SKU type when adding an Azure Environment in the console (default: Standard_GRS) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-cloud-optix https://optix.sophos.com/releasenotes/ https://optix.sophos.com/releasenotes/ Sat, 01 Jan 2022 00:00:00 GMT Adds ability to configure multiple distinct Jira integration instances per environment in Cloud Optix • Adds support for multiple Jira Integration instances linked to specific Environments via the Jira Integration page UI • Adds configurable option to close existing tickets when migrating an Environment between Jira Instances Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-cloud-optix https://optix.sophos.com/releasenotes/ https://optix.sophos.com/releasenotes/ Wed, 01 Dec 2021 00:00:00 GMT New Azure IAM Visualization and GCP/Azure Activity Log uploads to Sophos XDR Live Discover • Adds `Azure IAM Visualization` to view relationships between IAM Roles, Users, and Services in the console. • Enables uploading GCP Activity logs (from Audit logs) to the Sophos Data Lake for Live Discover queries. • Enables uploading Azure Activity logs to the Sophos Data Lake for Live Discover queries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-cloud-optix https://optix.sophos.com/releasenotes/ https://optix.sophos.com/releasenotes/ Mon, 01 Nov 2021 00:00:00 GMT New Custom Policy Alerts via search queries, Activity Anomalies detection with feedback loop, and enhanced Spend Monitor and Hosts Inventory views • Enables `Custom Policy Alerts` for Cloud Optix Advanced customers, allowing alerts to be triggered based on custom advanced search queries during subsequent security benchmark scans • Introduces Activity Anomalies detection that flags user behavior deviations, provides anomaly contributor reasoning, highlights contributing actions on a timeline, and allows feedback via thumbs up/down to improve future detections • Extends Spend Monitor Cost option to include Net Amortized alongside existing Blended and Unblended metrics • Enhances Environment Status information in Settings to display additional synchronization status for each environment • Updates Hosts Inventory for AWS to show the IAM role assigned to each host • Enhances Azure Advisor Alerts to display detailed descriptions and remediation steps Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-cloud-optix