Cisco Secure Access Documentation Changes

PDF

Cisco Secure Access Documentation Changes

Cisco Secure Access Documentation Changes 2026-10-19

Updated: November 2, 2026

Want to summarize with AI?

Log in

Lists changes to Cisco Secure Access documentation published on October 19, 2026.

Summary

Changed Pages

Limitations and range limits

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/introduction-secure-access-intro/limitations_and_range_limits.html

  • Removed: Single Stack versus Dual Stack

  • Removed: The terms "single stack" and "dual stack" refer to how a client or network device is configured:

  • Removed: Single stack: A configuration that uses only one IP version (IPv4 or IPv6) for communication.

  • Removed: Dual stack: A configuration that supports both IPv4 and IPv6.

  • Removed: Secure Access receives traffic from any client configured with single stack IPv4, dual stack, or single stack IPv6 (via Remote Access VPN (RAVPN) or IPsec tunnels).

  • Removed: Upstream connectivity and fallback: For upstream connectivity to web servers and internet-hosted resources, Secure Access connects using either IPv4 or IPv6.

  • Added: Protocol Configuration Type

  • Added: Pure IPv6 stack: A configuration where the entire communication path, including tunnels and end to end traffic, is strictly IPv6.

  • Added: Dual stack: A configuration where tunnel endpoints communicate over IPv6, while the encapsulated internal traffic flows as IPv4.

  • Added: Upstream connectivity and protocol handling: For upstream connectivity to web servers and internet-hosted resources, Secure Access connects using either IPv4 or IPv6 depending on the client configuration and destination resource.

  • Removed: Dual stack configurations provide backward compatibility.

  • Removed: If a session transaction cannot be completed using IPv6, the system falls back to IPv4.

  • Removed: Clients configured exclusively for single stack IPv6 cannot perform this fallback.

  • Removed: In these scenarios, the inability to connect to an IPv4-only resource is a limitation of the client configuration rather than the Secure Access service.

  • Removed: See the table below for what type of internet protocol is supported.

  • Removed: Note that this table is not all-encompassing.

  • Added: Secure Access does not support automatic IPv6 fallback to IPv4.

  • Added: If an upstream session or resource connection fails over IPv6, the system does not fall back or translate the request to IPv4.

  • Added: Clients attempting to reach IPv4-only resources over a pure IPv6 connection or unresolvable IPv6 path will fail to connect.

  • Added: Ensure your network routing and client configurations support the intended protocol end-to- end.

  • Added: The following table outlines internet protocol and configuration support across Secure Access functions:

  • Removed: IPv4

  • Removed: IPv6

  • Added: Client-to-Cloud Connection (Ingress)

  • Added: Cloud-to-Destination Forwarding (Egress)

  • Removed: Dual stack

  • Removed: IPv6 traffic forwarding

  • Added: IPv4, pure IPv6, or Dual stack

  • Added: IPv4 and IPv6 traffic forwarding (No IPv6 to IPv4 fallback)

  • Removed: Dual stack

  • Removed: IPv6 traffic forwarding

  • Added: IPv4, pure IPv6, or Dual stack

  • Added: IPv4 and IPv6 traffic forwarding (No IPv6 to IPv4 fallback)

  • Removed: Dual stack

  • Removed: Dual stack

  • Added: IPv4 or pure IPv6

  • Added: IPv4 or pure IPv6

  • Removed: Single stack

  • Added: IPv4 or pure IPv6

  • Removed: Dual stack

  • Removed: Supported

  • Added: IPv4, pure IPv6, or Dual stack

  • Added: IPv4 or pure IPv6

Manage Connections to Private Destinations

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/connections-private-destinations-intro/manage_connections_to_private_destinations.html

  • Removed: Does not require SRV DNS records.

  • Removed: Examples: Active Directory, Kerberos, SCCM.

AD Integration with Virtual Appliances

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/provisioning-active-dir-intro/ad_integration_with_virtual_appliances.html

  • Removed: You must have at least one virutal appliance already associated with your Active Directory Connector server and account.

  • Added: You must have at least one virtual appliance already associated with your Active Directory Connector server and account.

  • Removed: You must have at least one virutal appliance already associated with your Active Directory Connector server and account.

  • Added: You must have at least one virtual appliance already associated with your Active Directory Connector server and account.

  • Removed: You must have at least one virutal appliance already associated with your Active Directory Connector server and account.

  • Added: You must have at least one virtual appliance already associated with your Active Directory Connector server and account.

Add an Internet Access Rule

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/internet-access-rules-intro/add_an_internet_access_rule.html

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Added: Yes

  • Removed: In an internet access rule, add as destinations any applications from the tables under Advanced Application Controls, or a configured application list that includes any of the those applications.

  • Removed: The Advanced Application Controls option will appear:

  • Added: When you create or edit an internet access rule, you can add specific applications or application lists as destinations.

  • Added: You can select applications from the Advanced Application Controls tables or use a configured application list.

  • Removed: Click Edit.

  • Removed: In the pane on the left, select the types of activities to block.

  • Removed: (Optional) Filter the list in the main pane by clicking All categories and choosing a category.

  • Removed: In the main pane, select the activities to block for each application in the list.

  • Removed: (Optional) If you filtered the list, choose a different category, then select the activities to block for that category.

  • Removed: Repeat as needed for each category in the All categories list.

  • Removed: Click Save.

  • Added: When creating or editing an internet access rule, enter the application name in the To text box, and select the Application categories check box.

  • Added: Note You can select all applications or a single application in the To text box.

  • Added: Click Block actions to restrict specific activities.

  • Added: In the left pane, select the types of actions to block.

  • Added: (Optional) Filter the list in the main pane by clicking All categories and choosing a specific category.

  • Added: In the main pane, select the Activities to block for each application in the list.

  • Added: (Optional) If you filtered the list, choose a different category, and then select the activities to block for that category.

  • Added: Repeat this process for each category as needed.

  • Added: Click Done to apply your changes.

Add a Private Access Rule

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/private-access-rules-intro/add_a_private_access_rule.html

  • Removed: Navigate to a rule, and then click on the horizontal elipsis (...) to expand the rule menu.

  • Added: Navigate to a rule, and then click on the horizontal ellipsis (...) to expand the rule menu.

Security Profiles for Internet Access

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/security-profiles-intro/security_profiles_for_internet_access.html

  • Removed: Follow the steps in this procedure to configure the settings on the security profile.

  • Removed: Navigate to Decryption, and then click Edit.

  • Added: Navigate to Decryption.

  • Removed: Navigate to SSO Authentication, navigate to Single Sign-On (SSO), and then click Edit.

  • Added: Navigate to SSO Authentication.

  • Removed: For Threat Categories, click Edit.

  • Added: Click the Threat Categories dropdown and expand your setting to open the dialog box.

  • Removed: For SafeSearch, click Edit.

  • Removed: Enable this option to filter out offensive, explicit, unsafe, and harmful search results in Google, YouTube, Yahoo, and Bing.

  • Removed: AI Supply Chain Blocking

  • Removed: Control access to AI models by selecting AI supply chains to block.

  • Removed: Once enabled, select AI model categories to block.

  • Removed: For more information, see AI Supply Chain Report.

  • Removed: Procedure

  • Removed: For AI Supply Chain Blocking, click Edit.

  • Removed: Enable this option to control end user access to files that can pose AI supply chain risk to security and compliance.

  • Removed: Select one or more AI model categories to block:

  • Removed: Prohibited Suppliers—Restrict AI models sourced from banned or untrusted suppliers.

  • Removed: Code Execution—Prevent AI models that may introduce or exploit vulnerabilities in your environment.

  • Removed: Copyleft License—Block AI models licensed under copyleft licensing agreements.

  • Removed: Click Save.

  • Removed: What to do next

  • Removed: Note: Decryption is required for AI Supply Chain Blocking to work properly.

  • Removed: For more information, see Enable or Disable Decryption.

  • Added: Enable the SafeSearch to filter out offensive, explicit, unsafe, and harmful search results in Google, YouTube, Yahoo, and Bing.

  • Removed: Navigate to End-User Notifications.

Manage Threat Categories

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/threat-categories-intro/manage_threat_categories.html

  • Removed: Navigate to Secure> Settings> Threat Categories and click Add.

  • Added: Navigate to Secure> Settings> Threat Categories and click Add Threat Category.

  • Removed: Select security categories.

  • Added: Select Security Categories.

  • Added: Select Security Feeds.

Manage Traffic Decryption

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/traffic-decryption-intro/manage_traffic_decryption.html

  • Removed: Under IP/CIDR, to add multiple IP addresses and CIDRs manually, click the Manual radio button, enter the IP addess and CIDR, then click Add to exempt IP addresses and CIDRs from HTTPS inspection, and then click Save.

  • Added: Under IP/CIDR, to add multiple IP addresses and CIDRs manually, click the Manual radio button, enter the IP address and CIDR, then click Add to exempt IP addresses and CIDRs from HTTPS inspection, and then click Save.

Manage Client-Based Zero Trust Access in Secure Access

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/zero-trust-access-intro/manage-client-based-zta-overview.html

  • Added: Customers that are new to ZTA now experience the broad match policy enforcement model to provide a more consistent, reliable, and efficient security enforcement experience.

  • Added: This update streamlines our infrastructure to ensure greater system stability while establishing a unified foundation for future platform enhancements.

  • Added: Note: While you can sustain multiple site environments note that having duplicate destinations assocaited with a resource connector may affect mobile functionality with Secure Private Access.

  • Added: Cached Block Verdict Types for ZTA

  • Added: The Zero Trust Access module caches blocked verdicts to reduce the load from client interception and cloud enforcement.

  • Added: Blocked Verdict Types and Cache Intervals

  • Added: Block Type

  • Added: Verdict Cache Interval

  • Added: Verdict Cache Scope

  • Added: Geolocation-based

  • Added: 5 minutes

  • Added: Global

  • Added: No matching access policy rule

  • Added: 1 minute

  • Added: Global

  • Added: Explicit block rule

  • Added: 5 minutes

  • Added: Process

  • Added: Time-based

  • Added: 5 minutes

  • Added: Global

  • Added: DNS errors

  • Added: 1 minute

  • Added: Global

  • Added: Resource matching or definition issue

  • Added: 5 minutes

  • Added: Global

  • Added: This function is only available on desktop platforms running Client version 5.1.17 and later.

  • Added: For more information about supported features on desktop and mobile platforms, see Zero Trust Access Requirements and Limitations.

  • Removed: Note Virtual interfact detection is only supported with version 5.1.13 and later.

  • Added: Note Virtual interface detection is only supported with version 5.1.13 and later.

  • Added: Table 6.

Get Started with Virtual Appliances

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/virtual-appliances-intro/get_started_with_virtual_appliances.html

  • Removed: Ensure your Virtual Appliance (VA) complies with Secure Access requirements annd prerequisites prior to onboarding them.

  • Added: Ensure your Virtual Appliance (VA) complies with Secure Access requirements and prerequisites prior to onboarding them.

  • Removed: Secure Access supports the folowing KVM Linux versions:

  • Added: Secure Access supports the following KVM Linux versions:

Manage VAs in Secure Access

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/virtual-appliances-intro/manage-vas-in-secure-access.html

  • Removed: Locate a Virtual Appliance and click the ellipsis (...), and then seelect Reset Password.

  • Added: Locate a Virtual Appliance and click the ellipsis (...), and then select Reset Password.

Deploy VAs in KVM

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/virtual-appliances-intro/deploy_vas_in_kvm.html

  • Added: Describes Deploy VAs in KVM in Cisco Secure Access and explains Prerequisites and Configure Authentication for the Virtual Appliances.

  • Added: It summarizes the behavior, configuration context, and operational considerations presented throughout the topic.

  • Added: Deploy Cisco Secure Access Virtual Appliances (VAs) in KVM.

  • Added: Note You must deploy at least two Virtual Appliances (VAs) in a Secure Access Site.

  • Added: It is critical that these VAs are not cloned or copied in any way.

  • Added: Configure and set up each VA manually.

  • Added: Prerequisites

  • Added: Full Admin user role.

  • Added: For more information, see Manage Accounts.

  • Added: For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.

  • Added: A Linux system with qemu-utils package installed.

  • Added: Only VAs running 2.5 or above can be deployed in KVM.

  • Added: Virtual Appliance deployments in KVM are supported with specific Red Hat Linux and Ubuntu Linux versions only.

  • Added: KVM on Ubuntu Linux (supported LTS versions)

  • Added: KVM on Red Hat Linux (supported versions)

  • Added: Configure Authentication for the Virtual Appliances

  • Added: Before you can download the Virtual Appliance images in Secure Access, you must configure your Secure Access API keys for the Virtual Appliances in your organization.

  • Added: Secure Access enables the Download Components only after the API keys for the VAs are configured.

  • Added: For more information, see Configure Authentication for Virtual Appliances.

  • Added: Procedure for Deploying VAs in KVM

  • Added: Prerequisites

  • Added: Full Admin user role.

  • Added: For more information, see Manage Accounts.

  • Added: For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.

  • Added: A Linux system with qemu-utils package installed.

  • Added: Only VAs running 2.5 or above can be deployed in KVM.

  • Added: Virtual Appliance deployments in KVM are supported with specific Red Hat Linux and Ubuntu Linux versions only.

  • Added: KVM on Ubuntu Linux (supported LTS versions)

  • Added: KVM on Red Hat Linux (supported versions)

  • Added: To successfully deploy a virtual appliance in a KVM envinronment, follow the steps as they are listed below:

  • Added: Step 1 – Download and Extract the KVM Installer

  • Added: Step 2 – Launch the Virtual Appliance on KVM

  • Added: Step 1 – Download and Extract the KVM Installer

  • Added: Procedure

  • Added: Navigate to Connect> DNS Forwarders and click Download Components.

  • Added: Click Download next to VA for KVM.

  • Added: Secure Access generates and downloads a.tar file unique to your deployment.

  • Added: This tar file includes:

  • Added: A zip file containing the KVM-compatible virtual hard disk images (.qcow2 format) and configuration files

  • Added: A signature file

  • Added: A Cisco public certificate to validate the signature

  • Added: A readme file

  • Added: Extract the contents of the tar file using the tar –xvf <tar filename> -C <Destination folder> command.

  • Added: Verify the integrity of the downloaded file by following the signature validation instructions in the readme file.

  • Added: On a successful verification, the message Verified OK is displayed.

  • Added: Extract the.zip file.

  • Added: The extracted contents include the Virtual Hard Disks folder, the Virtual Machines folder, and a configuration file.

  • Added: The Virtual Hard Disks folder contains the KVM-compatible.qcow2 files (namely, dynamic.qcow2 and forwarder-va.qcow2).

  • Added: Step 2 – Launch the Virtual Appliance on KVM

  • Added: Procedure

  • Added: Open the Virtual Machine Manager on your Linux system running KVM and click Create a new virtual machine.

  • Added: In the first step of the wizard, choose Import existing disk image.

  • Added: Provide the existing storage path to your forwarder-va.qcow2.

  • Added: Set the OS type to Linux and click Forward.

  • Added: Set the memory and CPU settings to at least 1 CPU and 1 GB RAM and click Forward.

  • Added: In the last step of the wizard, select Customize configuration before install and then click Finish.

  • Added: Select Add Hardware.

  • Added: Select Storage, add or create custom storage, add the dynamic disk, and then click Finish.

  • Added: You should then see two disks.

  • Added: Click Begin installation to create the VA.

  • Added: If your network supports DHCP, the VA will get auto-configured with a DHCP IP address and will register to Umbrella using this IP.

  • Added: You can configure the VA on KVM through two mechanisms:

  • Added: Press Ctrl+B on the VA console and entering the Configuration mode.

  • Added: Or

  • Added: Initiate an SSH connection to the DHCP IP—this IP can be retrieved in Secure Access—and enter Configuration mode.

  • Added: What to do next

  • Added: You can now configure the VA.

  • Added: For information about configuring VAs, see Configure Virtual Appliances.

Manage File Inspection and File Analysis

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/file-inspection-analysis-intro/manage_file_inspection_and_file_analysis.html

  • Removed: bat, bz2, chm, dll, doc, docx, eml, exe, gz, hta, hwp, hwt, hwpx, iso, jar, jtd, jtt, jtdc, jttc, lnk, msg, msi, mhtml, rar v5, rtf, xls, xlsx, ppt, pptx, pdf, ps1, sep, slk, swf, tar, vbe, vbn, vbs, wsf, xml, xps, xz, zip, 7-zip

  • Added: bat, bz2, chm, dll, doc, docx, exe, gz, hta, hwp, hwt, hwpx, iso, jar, jtd, jtt, jtdc, jttc, lnk, msg, msi, mhtml, rar v5, rtf, xls, xlsx, ppt, pptx, pdf, ps1, sep, slk, swf, tar, vbe, vbn, vbs, wsf, xml, xps, xz, zip, 7-zip

Enable File Type Controls

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/file-type-controls-intro/enable_file_type_controls.html

  • Removed: Navigate to Security and Acceptable Use Controls, navigate to File Type Blocking, and then click Edit.

  • Added: Navigate to Security and Acceptable Use Controls, navigate to File Type Blocking.

Manage Notification Pages

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/notification-pages-intro/manage_notification_pages.html

  • Removed: Note The notification pages described in this section do not apply to private access rules in the Access policy.

  • Added: Note: The notification pages described in this section do not apply to private access rules in the Access policy.

  • Removed: Note You can pin a specific column or re-arrange columns in your desired layout by clicking on the Settings gear icon.

  • Added: Note: You can pin a specific column or re-arrange columns in your desired layout by clicking on the Settings gear icon.

  • Removed: Note You can View or Edit the Default Settings End User Notification Page, but you cannot Delete it.

  • Added: Note: You can View or Edit the Default Settings End User Notification Page, but you cannot Delete it.

  • Removed: Note

  • Removed: The value of the user input field is a case-insensitive string.

  • Added: Note: The value of the user input field is a case-insensitive string.

Add a Real Time Rule to the Data Loss Prevention Policy

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/data-loss-prevention-intro/add_a_real_time_rule_to_the_data_loss_prevention_policy.html

  • Removed: Note Policies based on the Executables file type group, specifically those targeting.exe files, do not apply to the Endpoint DLP channel.

  • Removed: Additionally, exe file-type-based policies do not apply to the Endpoint DLP channel.

  • Added: Note Within the Paste to Application, ChatGPT (Desktop) is available under AI Apps and MS Teams is available under Collaboration; both require Endpoint DLP for Windows version 1.8.0.376 or later.

Add an Email Rule to the Data Loss Prevention Policy

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/data-loss-prevention-intro/t_add-an-email-rule.html

  • Removed: The rule will search for any of the configured label names in document properties of email attachements.

  • Added: The rule will search for any of the configured label names in document properties of email attachments.

Manage Certificates for Private Resource Decryption

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/certificates-intro/manage_certificates_for_private_resource_decryption.html

  • Removed: Secure Access uses decryption to inspect traffic with Intrusion Prevention (IPS) and the Data Loss Prevention policy or validate a custome domain.

  • Added: Secure Access uses decryption to inspect traffic with Intrusion Prevention (IPS) and the Data Loss Prevention policy or validate a custom domain.

Get Started with Cisco Secure Client on Windows, macOS, and Linux Devices

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/secure-client-windows-mac-linux-intro/get-started-cisco-secure-client.html

  • Added: Note If you are using Cisco Secure Client with Secure Web Gateway (SWG), Cisco recommends disabling the QUIC protocol in your browser settings (for example, Google Chrome, Microsoft Edge, or Firefox) to prevent issues with browser services like search, Gmail, or YouTube.

  • Added: For more information, see Disable QUIC Protocol to Ensure Compatibility with AnyConnect SWG.

Manage Zero Trust Access using Cisco Secure Client

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/zta-secure-client-intro/manage_zero_trust_access_using_cisco_secure_client.html

  • Removed: Now continue to the SSO authetnication enrollment procedure.

  • Added: Now continue to the Enroll Devices in Zero Trust Access Using SSO Authentication.

Manage Endpoint Data Loss Prevention Using Cisco Secure Client for Windows and Mac

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/edlp-secure-client-intro/c_Manage_EDLP_Using_Cisco_Secure_Client__1.html

  • Added: Media/Portable Devices: Prevents sensitive files from being exfiltrated to Android phones and cameras.

  • Removed: Disk space: Atleast 1 GB of free disk space available

  • Added: Disk space: At least 1 GB of free disk space available

Cisco Endpoint Diagnostic Tool

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/endpoint-diagnostic-tool-intro/t_client_endpoint_diagnostic_tool.html

  • Removed: Donot close CEDT while the diagnostic run is paused.

  • Added: Do not close CEDT while the diagnostic run is paused.

Log Formats and Versioning

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/logging-intro/log_formats_and_versioning.html

  • Removed: The UTC time the event occured in milliseconds. (e.g., 2017-10-02 23:52:53).

  • Removed: Note: Unlike the Secure Access dashboard and reports, Secure Access logs do not convert the timestamp to your local timezone.

  • Added: The UTC time the event occurred in milliseconds. (e.g., 2017-10-02 23:52:53).

  • Added: Note

  • Added: Unlike the Secure Access dashboard and reports, Secure Access logs do not convert the timestamp to your local timezone.

  • Removed: timestamp,policy identity label,internal client ip,external client ip,destination ip,content type,action,url,referer,user agent,status code,request size,response size,response body size,sha—sha256,categories,av detections,puas,amp disposition,AMP malware name,amp score,policy identity type,blocked categories,identities,identity types,request method,dlp status,certificate errors,file name,ruleset id,rule ID,destination list ids,isolate action,file action,warn status,forwarding method,producer,msp organization id,geo location of blocked destination countries,application ids,hostname,data center,egress,server name,time based rule,security overridden,detected response file type,warn categories,organization id,application entity name,application entity category, egress ip,ai model name,ai suply chain categories,event correlation id,isolation profile id,source country

  • Added: timestamp,policy identity label,internal client ip,external client ip,destination ip,content type,action,url,referer,user agent,status code,request size,response size,response body size,sha—sha256,categories,av detections,puas,amp disposition,AMP malware name,amp score,policy identity type,blocked categories,identities,identity types,request method,dlp status,certificate errors,file name,ruleset id,rule ID,destination list ids,isolate action,file action,warn status,forwarding method,producer,msp organization id,geo location of blocked destination countries,application ids,hostname,data center,egress,server name,time based rule,security overridden,detected response file type,warn categories,organization id,application entity name,application entity category, egress ip,ai model name,ai supply chain categories,event correlation id,isolation profile id,source country

Activity Search Report

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/activity-reports-intro/activity-search-report.html

  • Removed: Connection Staus

  • Added: Connection Status

Data Loss Prevention Report

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/dlp-report-intro/data_loss_prevention_report.html

  • Removed: The exact fields displayed varies depending upon the platform associated with the event.

  • Added: The fields displayed vary depending on the platform associated with the event.

  • Removed: File Name—The name of the email fle that triggered the violation.

  • Removed: Subject—The subject line of the email that tirggered the violation.

  • Added: File Name—The name of the email that triggered the violation.

  • Added: Subject—The subject line of the email that triggered the violation.

  • Removed: Endpoint API Events

  • Added: Endpoint DLP Events

  • Removed: Detected—The date and time the content was detected.

  • Removed: Action —The action triggered by the rule when a violation is detected.

  • Removed: File Name—The name of the file or attachment where a classification match was found.

  • Removed: This includes attachments to email messages, Jira pages and comments, and Confluence pages, but not attachments to comments on Confluence pages.

  • Removed: If content is found in a message, post, or form data, this field name displays Message, Content, or Form.

  • Removed: For Salesforce chatter posts, this field name displays Chatter Post.

  • Removed: For Salesforce sObjects, this field name displays SObject followed by object name.

  • Removed: For Confluence and Jira pages, this field name displays the title of the page.

  • Removed: For comments on Confluence and Jira pages, this field name displays Comment followed by Page title.

  • Removed: Identity —The identity that made the request.

  • Removed: Application—The application where the file was uploaded or posted.

  • Removed: Application Category—The category for the application where the file was uploaded or posted.

  • Removed: Destination URL—The URL of the destination for the event.

  • Removed: Rule—The rule that triggered the event.

  • Removed: Severity—The severity of the rule that triggered the event.

  • Removed: File Label—File label names in the file's document properties.

  • Removed: This includes Microsoft Office Document Properties, and AdobePDF Document Properties.

  • Removed: For Microsoft 365 or Box tenants this includes Microsoft Office sensitivity labels.

  • Removed: Within the Box application these are referred to as classification labels.

  • Removed: If no labels are detected, this field displays Unclassified.

  • Removed: Direction—Direction of traffic.

  • Added: File Name—The name of the file on the endpoint that triggered a classification match:

  • Added: For the printer channel, it holds file name - printing application, for example, allow-824.txt - Notepad.

  • Added: For clipboard channel, it holds application filename reading from clipboard (PID), for example, chrome.exe (9096).

  • Added: Application—Available only for the Application File Access and Paste to Applications channels..

  • Added: Destination URL—This field contains the endpoint channel for the event such as BLUETOOTH or NETWORK SHARE.

  • Added: Device Type—The category of the destination device, for example, USB, printer, network device, application file access, media devices, or media portable devices.

  • Added: Device Name—The human-readable display name of the device.

  • Added: Manufacturer—The device manufacturer name.

  • Added: Model—The hardware model name of the device.

  • Added: Serial Number—The hardware serial number of the device.

  • Added: Vendor ID—The USB vendor ID.

  • Added: Product ID—The USB product ID.

  • Added: Instance ID— The OS device instance ID or hardware ID.

  • Added: Raw Device Path—The raw OS-level device path.

  • Added: Removable—Indicates whether the device is removable.

  • Added: File System—The file system type of the device.

  • Added: Media Type— The physical media category of the device, for example, removable, SD, HDD, or virtual.

  • Added: Bus Type—The bus interface type of the device.

  • Added: First Observed—The ISO-8601 or epoch time stamp indicating when the device was first observed.

  • Added: Mount Options— The OS mount options for the device volume.

  • Added: Volume UUID—The UUID of the mounted volume.

  • Added: Mount Path—The file system path where the device is mounted.

  • Added: Volume Label—The display label of the mounted volume.

  • Added: Share Name— The network share name.

  • Added: Server FQDN— The fully qualified domain name of the file server.

  • Added: Protocol—The network protocol used to access the share.

  • Added: Print Server—The hostname or IP address of the print server.

  • Added: Print Type—The type of the printer, for example, local, network, virtual.

  • Added: Print To File—Indicates whether the print job was directed to a file.

  • Added: IP Address—The IP address of the device.

  • Added: Hostname— The hostname of the device.

  • Removed: Remove all collaborators, and change the file owner to the Salesforce admin who has performed the authorization, and who has been assigned the permisson set for the quarantine app.

  • Added: Remove all collaborators, and change the file owner to the Salesforce admin who has performed the authorization, and who has been assigned the permission set for the quarantine app.

  • Removed: Threshold Severity Represents the total number of occurances of a data identifier that must be detected in a document for Secure Access to generate an incident.

  • Added: Threshold Severity Represents the total number of occurrences of a data identifier that must be detected in a document for Secure Access to generate an incident.

Events Report

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/events-report-intro/events-report-overview.html

  • Removed: Update a saved search: If you modify the filters in an applied saved search, click the Update saved search button that apears to save your changes to the current saved search.

  • Added: Update a saved search: If you modify the filters in an applied saved search, click the Update saved search button that appears to save your changes to the current saved search.