IRONCLADHELP CENTERBack to Portal
All docs

Ironclad Agent

Ironclad Agent Release Notes

1.0.0.356 — Agent Upgrade and Optional Sysmon Support

Released: June 2026

Added

  • Added Windows and Unix upgrade scripts so existing endpoints can upgrade to a requested published version or latest without manually downloading a new installer.
  • Added support for preserving the decianx-agent/tools directory across uninstall/reinstall cycles so upgrade tooling can survive cleanup.
  • Added optional Sysmon installation for Windows endpoints.
  • Added enable_logging.ps1 as a persistent Windows logging enablement tool.

Improved

  • Refined the Windows agent upgrade process
  • Improved uninstall behavior so agent cleanup can remove installed components while preserving upgrade tools.

1.0.0.343 — YARA Integration and Windows Logging Improvements

Released: May 2026

Added

  • Added YARA support for Windows endpoints when Ironclad SIEM is installed.
  • Added a seed YARA ruleset and active-response script so the SIEM can trigger on-demand file scans.
  • Added a Windows logging provisioner to configure audit policies and event logging expected by SIEM rules.

Improved

  • Trimmed the default ossec.conf to a minimal controlled configuration so policy can be managed centrally by the SIEM manager.
  • Improved logging around YARA setup and configuration rewriting.

1.0.0.335 — Linux and macOS Agent Bundles

Released: May 2026

Added

  • Added Linux and macOS installer support through a shared install.sh script.
  • Added OS and architecture detection for Linux/macOS bundles.
  • Added service registration for systemd on Linux and launchd on macOS.
  • Added Unix bundle publishing for agent service and UI binaries.

Improved

  • Published public agent artifacts through the standardized Artifactory path.

1.0.0.318 — Dynamic Agent Configuration

Released: March 2025 - October 2025

Added

  • Added installer-time generation of config.yaml based on selected components instead of shipping one static config file.
  • Added default config handling and base config merge logic.

Improved

  • Improved Logstash and syslog receiver config generation.
  • Fixed Stunnel enrollment parameter handling.
  • Adjusted syslog file path checks and log file naming.
  • Fixed Logstash install condition logic.

1.0.0.275 - 1.0.0.308 — Syslog Receiver and Logstash Installer

Released: November 2024 - February 2025

Added

  • Added a working Logstash install path for Windows endpoints.
  • Added bundled 7-Zip extraction support used by component installers.
  • Added Logstash service configuration through NSSM.
  • Added syslog receiver configuration and Logstash pipeline configuration.

Improved

  • Switched Logstash to the OSS build and a newer version.
  • Ensured Logstash is installed when syslog collection is enabled.
  • Added checks to ensure the syslog log file exists before SIEM is configured.
  • Improved Java handling for Logstash by using embedded Java where available.

1.0.0.274 — Signed Installer Publishing and Component Packaging

Released: August 2024 - October 2024

Added

  • Added signed Windows artifact publishing through the release pipeline.
  • Added pipeline downloads for installer dependencies instead of relying on PowerShell downloads during install.
  • Added Windows service and UI artifact packaging from dependent build pipelines.

Improved

  • Converted Artifactory upload to use the signed files.
  • Cleaned up release branch handling and binary filename handling in the pipeline.
  • Updated uninstall display naming and application icons.
  • Removed the startup Run registry entry so the UI is not started unexpectedly at login.

1.0.0.161 — Stunnel TLS Tunnel and Uninstall Cleanup

Released: June 2024

Added

  • Added Stunnel as the TLS tunnel component for SIEM agent and enrollment traffic.
  • Added Stunnel service install and removal using NSSM.
  • Added command-line parameters for Stunnel agent and enrollment endpoints.

Improved

  • Fixed public download paths used by the installer.
  • Improved Stunnel logging and config file ordering.
  • Fixed Stunnel service startup argument handling.
  • Improved uninstall cleanup so Stunnel services and related icons are removed correctly.
  • Confirmed a working uninstall path for the Windows installer.