Product Evolution

AI Policy Statistics

The AI Policy Statistics feature in Cisco Secure Workload employs a new AI engine to track and analyze policy performance trends over time. This functionality is crucial for users, offering insights into policy effectiveness and facilitating efficient audits.

With detailed statistics and AI-generated conditions like No Traffic, Overshadowed, and Broad, users can identify and address policies requiring attention. The AI Suggest feature further refines policy precision by recommending optimal adjustments based on current network flows. This comprehensive toolset is vital for maintaining a strong security posture, optimizing policy management, and aligning security measures with organizational goals.

For more information, see AI Policy Statistics

AI Policy Discovery (ADM) inclusion filters are used to whitelist the flows used in ADM runs. You can create inclusion filters which match only the required subset of flows after the ADM is enabled.

For more information, see Policy Discover Flow Filters

Secure Workload UI has been re-skinned to match the Cisco Security design system.

There has been no change to the workflows, however, some of the images or screenshots used in the user guide may not fully reflect the current design of the product. We recommend using the user guide(s) in conjunction with the latest version of the software for the most accurate visual reference.

Partial OpenAPI 3.0 schema for APIs is now available for users. It contains about 250 operations covering users, roles, agent and forensic configs, policy management, label management and more. It can be downloaded from the OpenAPI site without authentication.

For more information, see OpenAPI/schema @https://{FQDN}/openapi/v1/schema.yaml.

Hybrid Multicloud Workloads

Revamped and simplified the workflow of the Azure and GCP connectors with a configuration wizard that provides a single pane view for all projects or subscriptions of Azure and GCP connectors.

For more information, see Cloud Connectors.

New alerts connectors- Webex and Discord are added to the alerts framework in Secure Workload.

Secure Workload can now send alerts to Webex rooms, to support this integration and configure the connector.

Discord is another widely used messaging platform that we now support integration to send out Cisco Secure Workload alerts.

For more information, see Webex and Discord Connectors.

Platform Enhancement

Service Mesh Support

Secure workload provides comprehensive visibility and segmentation capabilities for all applications running within Kubernetes or OpenShift clusters that have Istio or OpenShift Service Mesh enabled on them.

For more information, see Secure Workload for Visibility/Enforcement with Istio/Openshift Service Mesh

Enhanced Network Telemetry with eBPF Support

The Secure Workload Agent now leverages eBPF to capture network telemetry. This enhancement is available on the following operating systems for the x86_64 CPU architecture:

• Red Hat Enterprise Linux 9.x

• Oracle Linux 9.x

• AlmaLinux 9.x

• Rocky Linux 9.x

• Ubuntu 22.04 and 24.04

• Debian 11 and 12

Secure Workload Agent Support

• Secure Workload Agents now support Ubuntu 24.04 on x86_64 on architecture.

• Secure Workload Agents now extend its capabilities to support Solaris 10 on both the x86_64 and SPARC architectures. This update enables visibility and enforcement features across all types of Solaris zones.

Agent Enforcement

Secure Workload agents now supports policy enforcement for Solaris shared-IP zones. Enforcement is managed by the agent in the global zone, ensuring centralized control and consistent policy application across all shared-IP zones.

Flow Visibility

When agents are not connected to a cluster, they can still capture and store data flows. These flows are now marked with a watch symbol in the Flow Start Time column on the Flow page.

Agent Configuration Profile

You can now disable the deep packet inspection feature of Secure Workload Agent that includes TLS information, SSH information, FQDN discovery, and Proxy flows.