Ease-of-use

User login with or without an Email Address

Clusters can now be configured with or without an SMTP server, with the option to toggle the SMTP settings post deploying a cluster. Site administrators can create users with usernames, which allow users to log in with or without an email address depending on the SMTP configuration.

For more information, see Add a User

Product Evolution

AI Policy Statistics

The AI Policy Statistics feature in Cisco Secure Workload employs a new AI engine to track and analyze policy performance trends over time. This functionality is crucial for users, offering insights into policy effectiveness and facilitating efficient audits.

With detailed statistics and AI-generated conditions–No Traffic, Overshadowed, and Broad, users can identify and address policies that require attention. The AI Suggest feature in Secure Workload further refines policy precision by recommending optimal adjustments based on current network flows. This comprehensive toolset is essential for maintaining a strong security posture, optimizing policy management, and aligning security measures with organizational goals.

For more information, see AI Policy Statistics

AI Policy Discovery (ADM) inclusion filters are used to whitelist the flows used in ADM runs. You can create inclusion filters that matches only the required subset of flows after the ADM is enabled.

For more information, see Policy Discover Flow Filters

Secure Workload UI has been re-skinned to match the Cisco Security design system.

There has been no change to the workflows, however, some of the images or screenshots used in the user guide may not fully reflect the current design of the product. We recommend using the user guide(s) in conjunction with the latest version of the software for the most accurate visual reference.

Partial OpenAPI 3.0 schema for APIs is now available for users. It contains about 250 operations covering users, roles, agent and forensic configs, policy management, label management and so on. It can be downloaded from the OpenAPI site without authentication.

For more information, see OpenAPI/schema @https://{FQDN}/openapi/v1/schema.yaml.

Hybrid Multicloud Workloads

The workflow of the Azure and GCP connectors are revamped and simplified with a configuration wizard that provides a single pane view for all projects or subscriptions of the connectors.

For more information, see Cloud Connectors.

New alerts connectors–Webex and Discord are added to the alerts framework in Cisco Secure Workload.

Secure Workload now sends alerts to Webex rooms, to support integration and configuration of the connector.

Discord, which is another widely used messaging platform now supports integration to send out Cisco Secure Workload alerts.

For more information, see Webex and Discord Connectors.

Data Backup and Restore

Cluster Reset without Reimaging

You can now configure Secure Workload clusters based on the SMTP configuration:

• When SMTP is enabled, the UI admin username is preserved, and users will need to click "forgot password" from the login screen after the cluster is deployed post reset.

• If SMTP server configuration is disabled, existing users logging in with their email addresses can continue to do so using their current passwords. Users will need an UI admin password to login, which is provided by Site Admins.

For more information, see Reset the Secure Workload Cluster.

Platform Enhancement

Service Mesh Support

Secure workload provides comprehensive visibility and segmentation capabilities for all applications running within Kubernetes or OpenShift clusters that have Istio or OpenShift Service Mesh enabled on them.

For more information, see Secure Workload for Visibility/Enforcement with Istio/Openshift Service Mesh

Enhanced Network Telemetry with eBPF Support

Cisco Secure Workload Agent now leverages eBPF to capture network telemetry. This enhancement is available on the following operating systems for the x86_64 architecture:

• Red Hat Enterprise Linux 9.x

• Oracle Linux 9.x

• AlmaLinux 9.x

• Rocky Linux 9.x

• Ubuntu 22.04 and 24.04

• Debian 11 and 12

Secure Workload Agent Support

• Cisco Secure Workload Agents now supports Ubuntu 24.04 on x86_64 architecture.

• Cisco Secure Workload Agents now extend its capabilities to support Solaris 10 for both the x86_64 and SPARC architectures. This enables visibility and enforcement across all types of Solaris zones.

Agent Enforcement

Cisco Secure Workload Agents now support policy enforcement for Solaris shared-IP zones. Enforcement is managed by agents in the global zone, ensuring centralized control and consistent policy application across all shared-IP zones.

Agent Configuration Profile

You can now disable the deep packet inspection feature of Cisco Secure Workload Agents that include TLS information, SSH information, FQDN discovery, and Proxy flows.

Data Flow Visibility

If Secure Workload Agents are not configured in a cluster, the agents can still capture and store data flows. These flows are now marked with a 'watch' symbol in the Flow Start Time column on the Flow page.

Cluster Certificate

You can now manage the validity period and renewal threshold of the cluster's CA certificate on the Cluster Configuration page. The default values for the validity period are set to 365 days and 30 days for the renewal threshold.

The self-signed client certificate generated and used by agents to connect with the cluster, now has validity of one year. Agents will automatically renew the certificate within seven days of its expiration date.