Sysdig Secure

No entries match these filters. Clear filters

1. changelog Oct 29, 2026 · issue 124

   Sysdig Secure adds PHP standalone binary scanning and risk acceptance for non-package components across CLI Scanner, Registry Scanner, and Agentless Host Scanning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   • Extend risk acceptance to every component type in CLI Scanner v1.31.0, so accepted risks now apply to vulnerabilities in standalone binaries and other components that are not packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Registry Scanner v0.13.0 now adds standalone binary scanning, identifying applications not installed by a package manager — including PHP compiled from source — so distroless and scratch images can surface new findings after upgrade.
   • Registry Scanner v0.13.0 adds license detection for packages in scanned images, available in Technical Preview, under License Classification.
   • Agentless Host Scanning now identifies PHP in standalone binary scanning, including PHP compiled from source such as the official Docker Hub php images, with no new deployment steps required.
   • Extend risk acceptance to every component type in CLI Scanner v1.31.0, so accepted risks now apply to vulnerabilities in standalone binaries and other components that are not packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Registry Scanner v0.13.0 adds license detection for packages in scanned images, available in Technical Preview, under License Classification.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Registry Scanner v0.13.0 standalone binary scanning may surface new findings on images (distroless, scratch) that previously showed none — review results after upgrading.
2. changelog Oct 21, 2026 · issue 115

   Sysdig Secure adds SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. forwarding rules to filter by data type, severity, and policy name before sending to downstream platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Reduce SIEM noise by forwarding only high-severity Runtime Policy Events to your SIEM integration, rather than all data.
   📍In Sysdig Secure, go to Integrations › SIEM & Data Platforms, select your integration, then under Forwarding Rules add a rule: set data type to Runtime Policy Events and filter by severity High or Critical. Save the integration.
   • Adds SIEM forwarding rules to replace the Data to Send field, letting you attach one or more rules to each integration with a data type and optional filters — such as severity or policy name for Runtime Policy Events, or type for Activity Audit — so only matching data is forwarded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Rules column to the integrations list showing the number of forwarding rules configured per integration.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Data to Send field in SIEM & Data Platforms integrations is replaced by forwarding rules; existing integrations relying on that field will need to be reconfigured with the new rules model.
3. changelog Oct 5, 2026 · issue 095

   Sysdig Secure: Adds a Supply Chain Findings page (Technical Preview) listing license and end-of-life findings across pipeline, registry, and runtime resources, with filtering by severity, stage, finding type, license category, or license name, and grouping by package, image, or runtime resource

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Look up a CVE that has no active findings in your environment to understand exposure before it appears in a scan
   📍Steps: In Sysdig Secure, select Vulnerability Catalog, search by CVE ID, and filter by severity, fix, or exploit status. Select the CVE to open the CVE Details drawer, which shows metadata and whether the CVE affects your environment.
   Prioritise real threats by sorting the Threats page by AI evaluation score to surface the most malicious activity first
   📍Steps: In Sysdig Secure, navigate to Threats, sort by the Evaluation column (Malicious › Suspicious › Benign), or use the Evaluation filter. Select a threat to open the Threats Detail panel and review the evaluation alongside its confidence level.
4. October 05, 2026 Oct 5, 2026 · release notes

   Sysdig Secure adds GitHub Advisory source for non-OS package CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores, prioritizing earlier severity data.

   • Uses GitHub Advisory Database severity and CVSS scores for Java, JavaScript, Python, Go, Rust, PHP, Ruby, .NET, Erlang, Dart, and Swift package vulnerabilities
   • Falls back to NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. score when GitHub has no score available

   2 details in Everything

5. changelog Oct 4, 2026 · issue 094

   Sysdig Secure adds Vulnerability Catalog, Supply Chain Findings (Preview), and AI-powered Threat Evaluation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Look up a CVE across all tracked assets — even before it surfaces as a finding — to assess scope and exploitability before a patch ships.
   📍In Sysdig Secure, go to Vulnerability Catalog, enter a CVE ID in the search box, then filter by Severity and Exploit to open the CVE Details drawer and check whether the CVE affects your environment.
   Triage active threats quickly by surfacing the most likely malicious events first using AI-powered evaluation.
   📍In Sysdig Secure, go to Threats, click the Evaluation column header to sort descending (Malicious first), then use the Evaluation filter to narrow to Malicious and review confidence levels in the Threats Detail panel.
   • Adds an Evaluation column to the Threats page (requires Secure AI entitlement) ranging from Malicious to Benign with Suspicious in between, sortable and filterable, plus a confidence level in the Threats Detail panel.

   1 detail in Everything

6. October 02, 2026 Oct 2, 2026 · release notes

   Adds Vulnerability Catalog UI and API for CVE lookup regardless of findings

   └──▷ HOW TO FIND IT
   Navigate to the new Vulnerability Catalog to filter CVEs by exploit status.
   📍Policies › Vulnerability Catalog
7. October 01, 2026 Oct 1, 2026 · release notes

   New Supply Chain Findings page in Attack Surface to list license and end-of-life findings.

8. docs update Sep 30, 2026 · issue 090

   Sysdig Secure: Adds an Evaluation column to the Threats list that can be sorted and filtered, surfacing the AI-derived rating and confidence level inline.

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Quickly triage the most dangerous threats by sorting and filtering on AI evaluation — useful at the start of an investigation shift to surface confirmed malicious activity first.
   📍In Sysdig Secure, go to Threats › Threat Management. Select the Evaluation column header to sort threats by rating. Use the Evaluation filter to show only Malicious threats, then check the confidence level in the detail panel to prioritize your response.
   • Adds Evaluation and Detection (covering malware and AI categories) and Source as filterable dimensions in the Threats list for Secure AI entitlement holders.
   • The Threat detail panel now opens with the threat's evaluation (Malicious, Suspicious, or Benign) and confidence level when the Secure AI entitlement is active.
   • Adds Evaluation and Detection (covering malware and AI categories) and Source as filterable dimensions in the Threats list for Secure AI entitlement holders.

   1 more in Everything

9. September 29, 2026 Sep 29, 2026 · release notes

   Threats page gains Evaluation column and filter for prioritization

   └──▷ HOW TO FIND IT
   Filter the Threats list to focus only on high-priority malicious activity.
   📍In the Threats view, use the filter control to select Evaluation › Malicious
   • Adds the Evaluation column to the Threats list view, categorizing threats as Malicious, Suspicious, or Benign
   • Enables filtering by Evaluation in the Threats UI
   • Includes threat evaluation and confidence level details in the Threats Detail panel

   3 details in Everything

10. changelog Sep 17, 2026 · issue 077

    Sysdig Secure: Risk acceptances scoped to an operating system or CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. architecture are now evaluated against the scanned asset's platform in the CLI Scanner.

    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Scan a container image for vulnerabilities including binaries not tracked by any package manager, and flag unrecognized executables too.
    copy

    $ sysdig-cli-scanner --detect-unknown-executables <image>

    Get a quick license summary for the ten most common licenses found in an image — useful for a fast compliance spot-check in CI.
    copy

    $ sysdig-cli-scanner --show-licenses <image>

11. changelog Sep 16, 2026 · issue 076

    KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. Analyzer v1.49.5 reduces node IOPS by excluding kubelet pod volume mounts from CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Linux Benchmark filesystem scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
12. September 16, 2026 Sep 16, 2026 · release notes

    Sysdig CLI Scanner v1.30.0 adds standalone binary scanning, license info in JSON output, and Hummingbird OS support

    • --detect-unknown-executables flag enables identification and reporting of vulnerabilities in applications not installed via a package manager.
    • Binary Allow List and Binary Deny List rules are now evaluated by the CLI Scanner for vulnerability policy enforcement.
    • JSON scan results (v1 schema, default) include each detected package's license and its category.
    • --show-licenses flag displays the ten most frequent licenses in console output; --full-licenses-table shows all licenses found.
    • Support for Hummingbird OS distribution is added.

    5 details in Everything

13. changelog Aug 16, 2026 · issue 047

    Sysdig Secure adds image layer analysis, base image allow/deny list rules, and CNI plugin detection for CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmark automation.

    ⤢ ⤢ ⤢
    • Adds a Vulnerability Policies tab to the Resource Details drawer in Vulnerability Findings, showing how each resource was evaluated against configured policies, with a details panel listing CVEs, components, or remediation guidance and inline exception creation.
    • Adds a Layers tab to the Resource Details drawer for container image resources, showing the image layer stack grouped by base image or Application Layers, with the Dockerfile instruction and per-severity vulnerability counts per layer.
    • Adds a Layer filter to the CVE list in Vulnerability Findings so practitioners can slice findings directly by image layer.
    • KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. Analyzer v1.49.3 adds detection of Container Network Interface (CNI) plugins in use on each Kubernetes node, enabling automatic evaluation of CIS KubernetesCIS KubernetesHardening benchmarks published by the Center for Internet Security for Kubernetes clusters, giving cyber tools a concrete, versioned checklist of configuration checks to run and report against. Benchmark v2.0.0 recommendation 5.3.1 without manual attestation.
    • Sysdig CLI Scanner v1.29.0 adds support for Base Image Allow List and Base Image Deny List image configuration rules, so vulnerability policies governing base images are now evaluated by the CLI Scanner.

    5 details in Everything

14. docs update Aug 15, 2026 · issue 046

    Sysdig Secure adds per-layer vulnerability breakdown in the Resource Details drawer, letting teams pinpoint which Dockerfile instruction introduced a CVE.

    ⤢ ⤢ ⤢ ⤢
    • Adds a Layers tab in the Resource Details drawer for container images, listing every layer grouped by base image or Application Layers, with the Dockerfile instruction and per-severity vulnerability counts for each layer.
    • Adds a Layer filter on the Findings view to slice the CVE list by a specific image layer directly.
    • Adds Layer Number and Layer Command fields in the Findings Details drawer to show which layer introduced the affected component for a single vulnerability.

    3 details in Everything

15. docs update Aug 15, 2026 · issue 046

    Sysdig Secure findings panel now shows the image layer number and Dockerfile instruction that introduced a vulnerable component.

    ⤢ ⤢ ⤢
    • Adds Layer Number field to the findings panel, showing the index of the image layer that introduced the affected component (displayed when Sysdig can attribute the finding to a layer).
    • Adds Layer Command field to the findings panel, displaying the Dockerfile instruction (e.g. RUN apt-get install -y curl) that created the layer — selecting it opens the Layers tab for deeper inspection.

    2 details in Everything

16. August 13, 2026 Aug 13, 2026 · release notes

    Sysdig Secure adds Vulnerability Policies tab in Resource Details drawer with base image allow/deny rules and layer analysis.

    • Adds Vulnerability Policies tab in the Resource Details drawer for vulnerability findings to show policy evaluation results and create exceptions without leaving the drawer
    • Adds Layers tab in the Resource Details drawer for container image resources showing the image layer stack grouped under base images, Dockerfile instructions, and vulnerability counts by severity
    • Adds Layer filter to the CVE list view for slicing vulnerabilities directly by layer
    • Adds Base Image Allow List and Base Image Deny List rules under Image Configuration in rule bundles to govern approved or blocked base image pull strings

    4 details in Everything

17. August 12, 2026 Aug 12, 2026 · release notes

    KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. Analyzer adds automated detection of CNI plugins to evaluate CIS BenchmarkCIS BenchmarkConsensus-based configuration hardening guidelines published by the Center for Internet Security, covering OSes, cloud platforms, and software; cyber tools use them as a ready-made ruleset to audit or enforce secure system baselines. 5.3.1 without manual attestation.

    • Adds automated detection of Container Network Interface (CNI) plugins on Kubernetes nodes to automatically evaluate CIS KubernetesCIS KubernetesHardening benchmarks published by the Center for Internet Security for Kubernetes clusters, giving cyber tools a concrete, versioned checklist of configuration checks to run and report against. Benchmark v2.0.0 recommendation 5.3.1.

    1 detail in Everything

18. August 11, 2026 Aug 11, 2026 · release notes

    Sysdig CLI Scanner v1.29.0 adds Base Image Allow/Deny list rule evaluation

19. August 3, 2026 Aug 3, 2026 · release notes

    Sysdig Secure August 3 2026 release allows reusing scope attributes across multiple conditions in Vulnerability Policies for Admission Control and Runtime stages.

    • Vulnerability policy scopes for the Admission Control and Runtime stages now let you use the same attribute in more than one condition

    1 detail in Everything

20. changelog Jul 23, 2026 · issue 023

    Sysdig Secure adds multi-bucket Custom Storage support and a redesigned Posture Overview & Findings experience.

    └──▷ HOW TO FIND IT
    Configure a MinIO bucket for use with Captures and Rapid Response via the new Custom Storage settings.
    📍In Sysdig Secure, go to Data Sources › Storage, click Add Bucket, select S3-compatible endpoint, enter your MinIO endpoint URL and credentials, then click Test Connection and Save.
    Identify the weakest posture areas and assign remediation to platform teams using the new Findings workspace.
    📍In Sysdig Secure, navigate to Posture › Findings, apply filters for high-severity controls, group results by resource or category, and use the Assign Remediation action to route issues to the appropriate team.
    • Adds Custom Storage: connect multiple S3 or S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. buckets (MinIO, Google Cloud Storage, etc.) for use across Captures, Response Actions, and Rapid Response — replacing the previous single shared S3 Capture Storage configuration.
    • Supports AWS access keys, AWS role delegation (AssumeRole), and S3-compatible endpoints for bucket authentication, with connection testing on save and per-bucket failure history.
    • Introduces a new Posture Overview page surfacing passing scores, 30-day trends, and hotspots across weakest categories, resources, and high-severity controls.
    • Introduces a new Posture Findings workspace with filtering, grouping, and remediation assignment to drive faster issue resolution.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The previous single shared S3 Capture Storage configuration is replaced by the new Custom Storage system; existing Capture Storage settings will need to be reconfigured under Data Sources > Storage.
21. docs update Jul 23, 2026 · docs issue 004

    Sysdig Secure adds multi-bucket Custom Storage support and a redesigned Posture Overview & Findings experience.

    └──▷ HOW TO FIND IT
    Configure a MinIO bucket for use with Captures and Rapid Response via the new Custom Storage settings.
    📍In Sysdig Secure, go to Data Sources › Storage, click Add Bucket, select S3-compatible endpoint, enter your MinIO endpoint URL and credentials, then click Test Connection and Save.
    Identify the weakest posture areas and assign remediation to platform teams using the new Findings workspace.
    📍In Sysdig Secure, navigate to Posture › Findings, apply filters for high-severity controls, group results by resource or category, and use the Assign Remediation action to route issues to the appropriate team.
    • Adds Custom Storage: connect multiple S3 or S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. buckets (MinIO, Google Cloud Storage, etc.) for use across Captures, Response Actions, and Rapid Response — replacing the previous single shared S3 Capture Storage configuration.
    • Supports AWS access keys, AWS role delegation (AssumeRole), and S3-compatible endpoints for bucket authentication, with connection testing on save and per-bucket failure history.
    • Introduces a new Posture Overview page surfacing passing scores, 30-day trends, and hotspots across weakest categories, resources, and high-severity controls.
    • Introduces a new Posture Findings workspace with filtering, grouping, and remediation assignment to drive faster issue resolution.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The previous single shared S3 Capture Storage configuration is replaced by the new Custom Storage system; existing Capture Storage settings will need to be reconfigured under Data Sources > Storage.
22. July 16, 2026 Jul 16, 2026 · release notes

    Sysdig Secure July 16 2026 adds multi-bucket Custom Storage for Captures and Response Actions

    └──▷ HOW TO FIND IT
    Configure a MinIO bucket for storing capture data and response artifacts in the SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. console.
    📍Navigate to Integrations › Data Sources › Storage and add an S3-compatible endpoint.
    • Adds support for multiple S3 or S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. buckets (MinIO, Google Cloud Storage) via Integrations > Data Sources > Storage

    1 detail in Everything

23. June 26, 2026 Jun 26, 2026 · release notes

    Sysdig Secure adds Azure Monitor Logs Ingestion API for Sentinel forwarding and refreshes Threats experience.

    └──▷ HOW TO FIND IT
    Switch Sysdig Secure Sentinel forwarding from the legacy HTTP Data Collector API to the supported Azure Monitor Logs Ingestion API.
    📍In the console, go to Settings › Integrations › Microsoft Sentinel and select Azure Monitor Logs Ingestion API as the authentication method.
    Review historical context for a detected threat by switching between its occurrences.
    📍In the Threats experience, open a specific threat and use the occurrence tabs to switch between Last and previous occurrences.
    • Supports the Azure Monitor Logs Ingestion API as a new authentication method for Microsoft Sentinel SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration
    • Adds occurrence tabs to review previous or last threat occurrences from the same threat

    2 details in Everything

24. June 9, 2026 Jun 9, 2026 · release notes

    Sysdig Secure adds EOL visibility in Vulnerability Management with Lifecycle column and Component Lifecycle rule type.

    • Adds a new Lifecycle column and filter in the Components tab of Sysdig Vulnerability Management to identify unsupported components alongside vulnerability data
    • Adds lifecycle metadata to CLI scanner JSON output and scan results API for pipeline integration
    • Adds a new Component Lifecycle rule type to Rule Bundles that can fail policy evaluations when a component is EOL or within 90 days of it

    3 details in Everything

25. May 15, 2026 May 15, 2026 · release notes

    Adds Response Actions directly in the resource drawer for hosts, containers, files, K8s workloads, and AWS resources.

    • Enables performing Response Actions (Host, Container, File, Kubernetes, AWS) directly from the resource drawer without leaving the view
    • Allows reviewing Response History for a resource to inspect execution status, target information, and configuration details

    2 details in Everything

26. May 5, 2026 May 5, 2026 · release notes

    New Response History page for viewing and managing response actions.

27. April 15, 2026 Apr 15, 2026 · release notes

    Sysdig Secure adds Windows, Fedora, and Bottlerocket support to Agentless Host Scanning

    • Agentless Host Scanning now supports Windows hosts (vulnerability scanning from snapshots)
    • Agentless Host Scanning now supports Fedora hosts (host and container vulnerability scanning from snapshots)
    • Agentless Host Scanning now supports AWS Bottlerocket hosts (host and container vulnerability scanning from snapshots)

    3 details in Everything

28. March 25, 2026 Mar 25, 2026 · release notes

    Host Scanner v0.16.2 adds Talos Linux OS support for non-OS package vulnerability matching

29. March 17, 2026 Mar 17, 2026 · release notes

    Sysdig Secure adds managed Falco rules and policies to detect suspicious AI coding agent activity.

    └──▷ HOW TO FIND IT
    Enable monitoring for suspicious AI coding agent behavior via the UI.
    📍In the console, go to Policies › Runtime Policies and enable Sysdig AI Runtime Notable Events
    • Adds detection rules for Codex, Gemini CLI, and Claude Code installation, unauthorized access, config directory access, risky CLI arguments, and sensitive file access

    1 detail in Everything

30. February 26, 2026 Feb 26, 2026 · release notes

    Sysdig Secure introduces Cloud Response Actions for AWS in Threat Detection, with Terraform provider updates.

    • Adds Cloud Response Actions for AWS, allowing containment and investigative actions directly from the Events feed.
    • New Configure Threat Response on AWS setup path is available.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Cloud Detection and Response (CDR) is renamed to Threat Detection across UI and documentation.
    • !All Sysdig Terraform modules for AWS, GCP, Azure, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. bumped to a new major version.
31. February 17, 2026 Feb 17, 2026 · release notes

    Adds Amazon Kinesis Data Streams and Kinesis Firehose integrations for streaming data out of Sysdig Secure

    └──▷ HOW TO FIND IT
    Stream security telemetry from your cluster to Kinesis for real-time processing or custom S3 storage.
    📍In the Sysdig Secure dashboard, navigate to Integrations › SIEM & Data Platforms and select Forwarding to Amazon Kinesis Data Streams.
    • Adds support for streaming Sysdig data to Amazon Kinesis Data Streams via the UI under Integrations > SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. & Data Platforms.
    • Adds support for streaming Sysdig data to Amazon Kinesis Firehose via the UI under Integrations > SIEM & Data Platforms.

    2 details in Everything

32. February 10, 2026 Feb 10, 2026 · release notes

    Sysdig CLI Scanner v1.25.0 adds insecure registry flags and v2 CSV output format.

    • Added flag --registry-insecure to support pulling images from HTTP registries in Sysdig CLI Scanner v1.25.0
    • Added flag --registry-skiptlsverify to disable TLS certificate verification when pulling images from registries in Sysdig CLI Scanner v1.25.0
    • Added flag --api-skiptlsverify to disable TLS certificate verification for interactions with the Sysdig backend in Sysdig CLI Scanner v1.25.0
    • Added v2 format for CSV output in Sysdig CLI Scanner v1.25.0, which includes non-package components such as Application, OS, and Container Image

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --skiptlsverify flag is deprecated in favor of the new --api-skiptlsverify and --registry-skiptlsverify flags.
33. February 3, 2026 Feb 3, 2026 · release notes

    New Posture and VM Findings pages with risk trends, hotspot analysis, and auto-sorting

    • Adds Posture Overview page showing passing scores, 30-day trends, and hotspots for weakest categories, resources, and high-severity controls
    • Adds Findings workspace for filtering, grouping, and assigning remediation in Posture management
    • Expands Program Dashboards to view risk trends by namespaces, cloud accounts, images, and repositories
    • Enhances context depth across image, OS, application, and package layers for vulnerability remediation
    • Sorts vulnerability findings by default to highlight critical, exploitable, and recently discovered items

    5 details in Everything

34. January 27, 2026 Jan 27, 2026 · release notes

    KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. Analyzer v1.47.0 adds Kubernetes 1.29–1.32 support and MCR Docker audit skip.

    • Added support for Kubernetes versions 1.29 through 1.32 with new compliance audits
    • Improved Docker audits to skip evaluation when Mirantis Container Runtime (MCR) is detected

    2 details in Everything

35. January 24, 2026 Jan 24, 2026 · release notes

    Sysdig Secure agentless workload scanning adds support for LVM and multi-partition root volumes

    └──▷ HOW TO FIND IT
    Scan hosts using LVM for multi-partition root volumes
    📍Initiate agentless host scan; ensure /etc/fstab is accessible to reconstruct mount points like /, /usr, /var, /home.
    • Adds LVM-based instance support to Agentless Host Scanning

    1 detail in Everything

36. January 19, 2026 Jan 19, 2026 · release notes

    Sysdig Secure adds Agentless scanning for AWS Lambda ZIP functions and new Runtime Action types for Automations.

    • Expands Agentless Workload Scanning to support AWS Lambda functions packaged as ZIP archives
    • Adds Kill Process, File acquire, File quarantine, Kubernetes Rollout restart, Kubernetes Volume snapshot, Kubernetes Get Logs, and Kubernetes Network isolate as new Runtime Actions in Automations

    2 details in Everything

37. Secure SaaS - November 3, 2026 · issue 130
    • New compliance framework CIS Kubernetes Benchmark v2.1.0 control 1.2.1 node audit
    • New compliance framework CIS Kubernetes Benchmark v2.1.0 control 4.1.11 node audit
38. Secure SaaS - October 29, 2026 · issue 125

    Sysdig Secure adds Vulnerability Findings automations that group alerts by resource or image, reducing per-finding notification noise⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
39. Secure SaaS - October 22, 2026 · issue 117

    CLI Scanner extends risk acceptance to standalone binaries and non-package components; Registry Scanner adds standalone binary scanning and license detection (Technical Preview).

    • Extends risk acceptance to every component type in the CLI Scanner, so accepted risks now apply to vulnerabilities in standalone binaries and other non-package components.
    • New supported platformAdds standalone binary scanning to the Registry Scanner, enabling detection of applications not installed by a package manager in distroless and scratch images.
    • New detectionAdds license detection for packages in Registry Scanner scanned images, available in Technical Preview.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Registry Scanner v0.13.0: images that previously showed no findings (such as distroless and scratch images) may show new findings after upgrading due to standalone binary scanning being enabled.
40. Secure SaaS - October 14, 2026 · issue 109

    Sysdig Secure adds SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. forwarding rules to filter by data type, severity, and policy name before sending to downstream platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Reduce SIEM noise by forwarding only high-severity Runtime Policy Events from a specific policy, rather than all events.
    📍In Sysdig Secure, go to Integrations › SIEM & Data Platforms, select your integration, and add a forwarding rule with data type Runtime Policy Events, filter by severity (e.g. High or Critical) and policy name, then save.
    • Adds forwarding rules to SIEM & Data Platforms integrations, replacing the Data to Send field, with per-rule filters including severity and policy name for Runtime Policy Events and type for Activity Audit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Rules column to the integrations list showing the number of active forwarding rules per integration.
    • Adds forwarding rules to SIEM & Data Platforms integrations, replacing the Data to Send field, with per-rule filters including severity and policy name for Runtime Policy Events and type for Activity Audit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Data to Send field in SIEM & Data Platforms integrations is replaced by forwarding rules; existing configurations using that field will need to be migrated to the new rules model.
41. Secure SaaS - October 05, 2026 · issue 095

    Sysdig Secure now sources CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores for non-OS packages from the GitHub Advisory Database, delivering earlier scores across 11 ecosystems.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ BREAKING ON UPGRADE

    • !Severity ratings on existing non-OS package findings may change (commonly from High to Medium) after upgrade; vulnerability policies that trigger on High or Critical may now pass or fail on different packages following the next scan.
42. Secure SaaS - October 02, 2026 · issue 093

    Sysdig adds a Vulnerability Catalog to look up any tracked CVE — even with no findings in your environment — via UI and API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Look up a CVE your team is investigating to see its severity, fix availability, exploit status, and whether it affects your environment — even if no findings exist yet.
    📍In Sysdig Secure, go to Policies › Vulnerability Catalog, enter a CVE ID in the search bar, and apply filters for severity, fix, or exploit. Select the CVE to open the CVE Details drawer.
    • Adds the CVE Catalog API to programmatically retrieve CVE metadata and environment-impact data, available on SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. now and on-premises from version 7.10.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the CVE Details drawer, opened by selecting a CVE in the Vulnerability Catalog, showing CVE metadata and whether the CVE affects your environment.

    2 details in Everything

43. Secure SaaS - October 01, 2026 · issue 092

    Sysdig Secure adds a Supply Chain Findings page (Technical Preview) surfacing license and end-of-life issues across pipeline, registry, and runtime.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Review license and end-of-life supply chain findings for runtime resources, grouped by image, to prioritize remediation in production.
    📍In Sysdig Secure, go to Attack Surface › Supply Chain Findings. Set the Stage filter to runtime, the Finding Type filter to end-of-life, then use the Group By control to group by image.
    • Adds the Attack Surface > Supply Chain Findings page (Technical Preview) listing license and end-of-life findings across pipeline, registry, and runtime resources, with filtering by severity, stage, finding type, license category, or license name, and grouping by package, image, or runtime resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Supply Chain Findings tab to the Resource Details drawer and the Component Details drawer.

    2 details in Everything

44. Secure SaaS - September 29, 2026 · issue 090

    Sysdig Secure adds AI-powered Threat Evaluation column with Malicious/Suspicious/Benign scoring and confidence levels to the Threats page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Triage the highest-priority threats first by sorting the Threats page by AI evaluation score.
    📍In Sysdig Secure, go to Threats › Threats page, click the Evaluation column header to sort by evaluation (Malicious first), then use the Filter by Evaluation control to narrow the view to Malicious events only.
    • Adds an Evaluation column to the Threats page, ranging from Malicious to Suspicious to Benign, enabling sort and filter by evaluation to prioritize the most critical threats first.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a confidence level indicator in the Threat Detail panel alongside the Evaluation score, reflecting the amount of context available for each threat — requires the Secure AI entitlement.

    2 details in Everything

45. Secure SaaS - September 16, 2026 · issue 076

    Sysdig CLI Scanner v1.30.0 adds standalone binary scanning, license reporting, and Hummingbird OS support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Scan a container image and surface vulnerabilities in binaries that were not installed via a package manager, including unrecognized executables.
    copy

    $ sysdig-cli-scanner --detect-unknown-executables <image>

    Audit an image for license compliance by getting a full per-package license breakdown alongside vulnerability results in machine-readable JSON.
    copy

    $ sysdig-cli-scanner --output json <image>

    Quickly review the most common open-source licenses present in an image during a CI pipeline scan.
    copy

    $ sysdig-cli-scanner --show-licenses <image>

    • Adds standalone binary scanning via --detect-unknown-executables to identify and report vulnerabilities in applications not installed by a package manager, including executables the scanner does not recognize.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds support for Binary Allow List and Binary Deny List rules, so vulnerability policies that allow or deny specific binaries are now evaluated by the CLI Scanner.
    • Adds per-package license data (including license category) to the JSON scan result under the v1 schema, available via --output json, in Technical Preview.
    • Adds --show-licenses to print the ten most frequent licenses and their occurrence counts in console output, and --full-licenses-table to show every license found, in Technical Preview.
    • Adds support for the Hummingbird OS distribution.
    • Adds standalone binary scanning via --detect-unknown-executables to identify and report vulnerabilities in applications not installed by a package manager, including executables the scanner does not recognize.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds per-package license data (including license category) to the JSON scan result under the v1 schema, available via --output json, in Technical Preview.
    • Adds --show-licenses to print the ten most frequent licenses and their occurrence counts in console output, and --full-licenses-table to show every license found, in Technical Preview.

    2 more in Everything

46. Secure SaaS - August 13, 2026 · issue 046

    Sysdig Secure adds image layer analysis, vulnerability policy results in the resource drawer, and base image allow/deny list rules.

    ⤢ ⤢ ⤢
    • Adds a Vulnerability Policies tab in the Resource Details drawer (opened from Vulnerability Findings) showing how each resource was evaluated against configured Vulnerability Policies, with a details panel per rule surfacing CVEs, affected components, and remediation guidance, plus in-drawer exception creation.
    • Adds a Layers tab in the Resource Details drawer for container image resources, displaying the full image layer stack grouped by base image or Application Layers, with per-layer Dockerfile instruction and vulnerability counts by severity — select a layer to filter the Vulnerabilities tab, or use the new Layer filter to slice the CVE list directly.
    • Adds Layer Number and Layer Command fields to the Findings Details drawer to identify which layer introduced an affected component.
    • Adds Base Image Allow List and Base Image Deny List rules under Image Configuration in rule bundles, accepting base image pull strings to approve or block entire registries or namespaces in a single entry.

    4 details in Everything

47. Secure SaaS - August 12, 2026 · issue 043

    KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. Analyzer v1.49.3 auto-evaluates CIS KubernetesCIS KubernetesHardening benchmarks published by the Center for Internet Security for Kubernetes clusters, giving cyber tools a concrete, versioned checklist of configuration checks to run and report against. Benchmark 5.3.1 by detecting CNI plugins on each node.

    • Adds automatic detection of Container Network Interface (CNI) plugins in use on each Kubernetes node, enabling CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Kubernetes Benchmark v2.0.0 recommendation 5.3.1 to be evaluated automatically instead of requiring manual attestation.

    1 detail in Everything

48. Secure SaaS - August 11, 2026 · issue 042

    Sysdig CLI Scanner v1.29.0 adds support for Allow/Deny Base Image supply chain rules in vulnerability policies.

49. Secure SaaS - August 3, 2026 · issue 039

    Sysdig Secure vulnerability policy scopes now allow the same attribute in multiple AND-joined conditions for Admission Control and Runtime stages.

50. Secure SaaS - July 29, 2026 · issue 030

    Sysdig CLI Scanner v1.28.0 adds NixOS and Arch Linux package detection plus dnf/microdnf support.

    • Adds detection of NixOS (nix) packages in the CLI Scanner.
    • Adds detection of Arch Linux packages in the CLI Scanner.
    • Adds dnf and microdnf to the package manager detection policy rule.

    3 details in Everything

51. Secure SaaS - July 16, 2026 · issue 017

    Sysdig Secure now supports multiple S3/S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. custom storage buckets across Captures, Response Actions, and Rapid Response.

    └──▷ HOW TO FIND IT
    Connect a MinIO bucket to use as storage for Captures and Rapid Response sessions.
    📍In the console, go to Integrations › Data Sources › Storage, click Add Bucket, select S3-compatible endpoint, enter your MinIO endpoint URL and credentials, then click Test Connection and Save.
    • Supports connecting multiple S3 or S3-compatible buckets (MinIO, Google Cloud Storage, and others) for use across Captures, Response Actions, and Rapid Response.
    • New Custom Storage configuration supports AWS access keys, AWS role delegation (AssumeRole), and S3-compatible endpoints, with connection testing on save and per-bucket failure history.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The previous single shared S3 Capture Storage configuration is replaced by Custom Storage; existing setups must be migrated to the new multi-bucket configuration under Integrations > Data Sources > Storage.
52. Secure SaaS - July 14, 2026 · issue 015

    Sysdig Secure adds column customization for Vulnerability Management Findings reports.

    └──▷ HOW TO FIND IT
    Tailor a new Vulnerability Management Findings report to surface only the columns your team cares about, in the order that fits your workflow.
    📍In the console, go to Vulnerabilities › Reporting, create a new report, and use the Column Customization option to select and reorder the columns to include.
    • Enables selection and reordering of columns in newly created Vulnerability Management Findings reports.

    1 detail in Everything

53. Secure SaaS - April 15, 2026 · issue 014

    Agentless Host Scanning now covers Windows, Fedora, and AWS Bottlerocket hosts via snapshot-based scanning.

    • Adds agentless snapshot-based host vulnerability scanning for Windows hosts.
    • Adds agentless snapshot-based host and container vulnerability scanning for Fedora hosts.
    • Adds agentless snapshot-based host and container vulnerability scanning for AWS Bottlerocket hosts.

    3 details in Everything

54. Secure SaaS - July 1, 2026 · issue 014

    Registry Scanner v0.12.0 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image format and multi-architecture bundle scanning across all supported registries.

    • Supports scanning of OCI image manifests (application/vnd.oci.image.manifest.v1+json), covering single-platform images published in OCI format.
    • Supports OCI image indexes and Docker manifest lists (application/vnd.oci.image.index.v1+json and application/vnd.docker.distribution.manifest.list.v2+json), resolving multi-architecture images to a platform-specific manifest for scanning.
    • Recognizes image manifests that omit the optional mediaType field (e.g., those produced by buildah), which were previously skipped as unsupported.
    • Adds intelligent multi-architecture platform selection: prefers linux/amd64, then any linux/*, then the first scannable manifest; skips attestation manifests and unknown/unknown entries.
    • Publishes the Registry Scanner job image as a multi-architecture manifest (linux/amd64 and linux/arm64), enabling native support for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based clusters.

    5 details in Everything

55. Secure SaaS - July 9, 2026 · issue 014

    Host Scanner adds Google COS/GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. node vulnerability coverage and improved Ruby gem file-level attribution.

    • Supports Google Container-Optimized OS (COS): Host Scanner now identifies installed packages on COS hosts (e.g., GKE nodes), extending vulnerability scanning to those workloads.
    • Improves Ruby package detection: Host Scanner tracks source .rb files within installed gems, enabling more precise file-level vulnerability attribution.

    2 details in Everything

56. Secure SaaS - June 25, 2026 · issue 014

    Sysdig CLI Scanner v1.27.2 adds detection support for Google Container-Optimized OS (COS) packages.

57. Secure SaaS - June 26, 2026 · issue 014

    Sysdig Secure refreshes the Threats UI with bulk actions and resource focus, and adds Azure Monitor Logs Ingestion API for Sentinel.

    └──▷ HOW TO FIND IT
    Switch your Sentinel forwarding integration to the new Azure Monitor Logs Ingestion API before Microsoft's HTTP Data Collector API reaches end of life.
    📍In Sysdig Secure, go to Integrations › Forwarding, select your Microsoft Sentinel destination, and choose the Azure Monitor Logs Ingestion API authentication method, then save.
    • Adds bulk actioning on Threat aggregations, allowing review of multiple occurrences at once from a single pane.
    • Threats now scoped to a single resource, surfacing context-aware risk signals per asset.
    • New occurrence tabs let practitioners toggle between the latest and prior threat occurrences within the same view.
    • Supports the Azure Monitor Logs Ingestion API for Microsoft Sentinel SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration, replacing the deprecated HTTP Data Collector API.

    4 details in Everything

58. Secure SaaS - June 9, 2026 · issue 014

    Sysdig Secure adds end-of-life visibility and policy enforcement for OS and Go runtime components in Vulnerability Management.

    └──▷ HOW TO FIND IT
    Enforce a pipeline gate that fails builds when any scanned component is end-of-life or within 90 days of EOL — configured via a Component Lifecycle rule in a Rule Bundle.
    📍In the Sysdig Secure console, go to Policies › Rule Bundles, create or edit a bundle, add a new rule of type Component Lifecycle, and set the condition to fail when a component has reached its end-of-life date or is within 90 days of it. Attach the bundle to the relevant pipeline policy.
    Consume lifecycle metadata from the CLI scanner JSON output in a CI pipeline to programmatically detect EOL components without a UI.
    copy

    $ sysdig-cli-scanner <image> --json-scan-result result.json && jq '.info.resultDetails.packages[] | select(.lifecycle.status == "end-of-life")' result.json

    • Adds end-of-life (EOL) visibility for operating systems and the Go runtime in Vulnerability Management, surfacing lifecycle status alongside vulnerability data in the Resource Details drawer, Components tab, Findings Details drawer, CVE Details drawer, and scan result side panels.
    • New Lifecycle column and filter in the Components tab lets practitioners quickly identify components no longer receiving vendor support.
    • CLI scanner JSON output and the scan results API now include lifecycle metadata, enabling pipeline and integration consumers to act on EOL status programmatically.
    • New Component Lifecycle rule type in Rule Bundles enables policy evaluations to fail when a component has reached its EOL date or is within 90 days of it.
    • Sysdig CLI Scanner v1.27.1 adds end-of-life support for Vulnerability Management.

    5 details in Everything

59. Secure SaaS - May 15, 2026 · issue 014

    Sysdig Secure adds Response Actions directly in the resource drawer for hosts, Kubernetes workloads, and AWS resources.

    └──▷ HOW TO FIND IT
    Contain an active incident on a Kubernetes workload without leaving the resource view — inspect the workload in the resource drawer, then trigger a Response Action inline.
    📍In Sysdig Secure, navigate to the resource drawer for a Kubernetes workload › select the Response Actions tab › choose a compatible Kubernetes action and execute it.
    Audit past containment decisions on an AWS resource by reviewing execution status and configuration history in one place.
    📍In Sysdig Secure, open the resource drawer for an AWS resource › select the Response History tab › inspect each action's execution status, target information, and configuration.
    • Enables Response Actions (threat hunting, incident containment) directly from the resource drawer without navigating away from the resource view.
    • Supports host, container, and file Response Actions for hosts when Host Shield is configured.
    • Supports Kubernetes Response Actions for workloads when Cluster Shield is enabled.
    • Supports Cloud Response Actions for AWS resources when Cloud Response Actions are deployed.
    • Adds a Response History panel in the resource drawer to review past actions, execution status, target info, and configuration.

    5 details in Everything

60. Secure SaaS - May 26, 2026 · issue 014

    Sysdig CLI Scanner v1.27.0 adds Flashpoint KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. tag and Flashpoint CVSSv3 Temporal score to vulnerability output.

    • Adds Flashpoint KEV (Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) tag to CLI Scanner vulnerability output for faster exploit-aware triage.
    • Adds Flashpoint CVSSv3 Temporal score to CLI Scanner vulnerability output, surfacing real-world exploitability context alongside base scores.

    2 details in Everything

61. Secure SaaS - May 5, 2026 · issue 014

    Sysdig Secure adds Response History page for auditing all Response Actions across events, automations, and APIs.

    └──▷ HOW TO FIND IT
    Review and roll back a containment action that was triggered incorrectly by an automation rule.
    📍In Sysdig Secure, go to Response History, locate the containment action by timestamp or actor, review the collected artifacts, and select Revert to undo the action.
    • New Response History page centralizes all Response Actions taken manually, via Automations, or through APIs — showing what was done, where, when, and by whom.
    • Enables retrieval of collected artifacts and reversal of containment actions performed in error from a single audit view.

    2 details in Everything