Cisco Secure Workload
Release Notes, Release 3.10.5.7
New and Changed Information
This section lists the new and enhanced features, and known behaviors in this release under these topics:
New Features in Cisco Secure Workload, Release 3.10.5.7
Introduction
This document describes the features, caveats, and limitations for Cisco Secure Workload software, release 3.10.5.7.
The Cisco Secure Workload platform, formerly branded as Cisco Tetration, is designed to provide comprehensive workload security by establishing a micro perimeter around every workload across on-premises and multi-cloud environments using firewalling and segmentation, compliance and vulnerability tracking, behavior-based anomaly detection, and workload isolation.
The platform uses advanced analytics and algorithmic approaches to provide these capabilities. This solution supports the following capabilities:
- Automatically generated micro-segmentation policies resulting from comprehensive analysis of application communication patterns and dependencies
- Dynamic label-based policy definition with a hierarchical policy model to deliver comprehensive controls across multiple user groups with role-based access control
- Consistent policy enforcement at scale through distributed control of native operating system firewalls and infrastructure elements such as ADCs (Application Delivery Controllers) plus physical or virtual firewalls
- Near real-time compliance monitoring of all communications to identify and alert against policy violation or potential compromise
- Workload behavior baselining and proactive anomaly detection
- Common vulnerability detection with dynamic mitigation and threat-based workload isolation
To support Cisco Secure Workload analysis and use cases, consistent telemetry (flow data) is required across the environment. Cisco Secure Workload collects rich telemetry using software agents and complementary ingestion methods. This release supports the following telemetry sources:
- Secure Workload agents installed on virtual machine and bare-metal servers
- DaemonSets running on container host operating systems
- ERSPAN connectors that can generate Cisco Secure Workload telemetry from mirrored packets
- Telemetry ingestion from ADCs (Application Delivery Controllers) such as F5 and Citrix appliances
- NetFlow connectors that can generate Cisco Secure Workload telemetry based on NetFlow v9 or IPFIX records
- ASA connector for collection of NSEL (NetFlow Secure Event Logging) telemetry
- AWS connector for flow telemetry data generated using VPC flow log configurations
- Azure connector for flow telemetry data generated using NSG flow log configurations
- GCP connector for flow telemetry data generated using Google Cloud data sinks
In addition, this release supports ingesting endpoint device posture, context, and telemetry through these integrations:
- Cisco AnyConnect installed on endpoint devices such as laptops, desktops, and smartphones
- Cisco Identity Services Engine (ISE)
Secure Workload agents also act as policy enforcement points for application segmentation. Agents enforce policy using native operating system capabilities, eliminating the need to sit in the data path and providing a fail-safe option. Additional product documentation is listed in the “Related documentation” section.
These release notes may be updated with the latest information about restrictions and caveats. For the most recent version, visit the Cisco Secure Workload support page.
Table 1 Online History Change
| Date | Description |
|---|---|
| November 6, 2025 | Release 3.10.5.7 became available. |
New Software Features
This section provides a brief description of the new software features introduced in this release.
Application Centric Infrastructure (ACI) integration with Secure Workload
Application Centric Infrastructure (ACI) is Cisco’s flagship datacenter network fabric that automates networking constructs so users can provision workloads faster, at scale, and with consistent security through both UI and programmatic controls.
Secure Workload discovers, automates, and operates policy controls for segmentation while ACI manages the networking provisioning, delivering tightly integrated zero-trust segmentation across fabric-enabled datacenters.
Table 2 New Software Features
| Product Impact | Feature | Description |
|---|---|---|
| Ease of Use | Microsoft Modern Authentication for SMTP | Adds OAuth 2.0-based SMTP authentication alongside Basic SMTP. Cluster administrators can now select Microsoft Modern Authentication, provide Azure AD client ID, tenant ID, and client secret, and allow Secure Workload to authenticate to office365.microsoft.com on port 587 without storing reusable passwords. |
| Ease of Setup | Secure Workload Software Appliance | Secure Workload can now be deployed as a software appliance on customer-managed VMware vSphere clusters. The software form factor mirrors hardware and SaaS functionality and is available in 20,000- and 40,000-agent scales for private datacenters. |
| Ease of Use | Dark Mode Experience | Users can toggle between dark and light modes from the preferences menu in the top-right corner, enabling low-light accessibility without altering workflows. |
| Ease of Use | Applications Landing Page Refresh | Introduces streamlined list and tree views that highlight recent ADM runs, workspace states, and AI-suggested tasks. Users can switch between the new and prior layouts via the sidebar toggle. |
| Upgrade | Agents-Only Patch Upgrade | Administrators can deploy lightweight patches that deliver updated agent packages to clusters already running release 3.10.5.x without impacting cluster services. |
| Software Reliability | Agent Package Revocation | Allows administrators to revoke specific agent packages when critical issues are detected, preventing new installs or upgrades to the revoked version until reinstated. |
| Software Reliability | Publicly Trustable SaaS Certificates | Cisco Secure Workload SaaS clusters now present publicly trusted Cisco-issued certificates for agent-facing services, standardizing authentication to FQDN endpoints under secure-workload.cisco.com. |
| Software Reliability | Service Protection for AIX and Linux Agents | Extends service protection controls to AIX and Linux agents so administrators cannot stop or uninstall agents when protection is enabled. Access can be restored with a TOTP override if needed. |
| Software Reliability | Binary and User-Based Policy Enforcement | Linux agents on el7.1+ equivalents can now enforce policies that match binaries and users in addition to existing networking parameters for outbound flows. |
| Upgrade | Supplement RPM | Introduces the tetration_supplement_k9 RPM that ships additional fixes alongside every major release. The RPM is uploaded with the rest of the installation media for fresh deployments or upgrades. |
Deprecated features
No features were deprecated in Cisco Secure Workload release 3.10.5.7.
End of support hardware
No hardware components reached end of support in this release.
Changes in Behavior and Enhancements
Once the agent is installed on a workload, unzip is no longer required for subsequent agent upgrades.
Enhancements in Cisco Secure Workload, Release 3.10.5.7
- AIX, Linux, and Solaris agent packages are now signed via a centralized Cisco GPG service, requiring gpg (or equivalent) for all 3.10.5.7 agent installs and upgrades.
- Linux agents enforce segmentation policy directly in nftables on hosts that include nftables version 1.0.0 or later.
- Secure Workload agents now support Fedora versions 28 through 32.
Known Behaviors
No additional known behaviors beyond the items documented above were identified for this release.
Compatibility
For detailed compatibility information, refer to the Cisco Secure Workload platform information on Cisco.com.
Resolved Issues
The resolved bugs for this release are accessible through the Cisco Bug Search Tool, which maintains information about bugs and vulnerabilities across Cisco products. Click a Bug ID to open its Cisco Bug Search Tool entry.
Table 3 Resolved Issues for Cisco Secure Workload, Release 3.10.5.7
| Bug ID | Description |
|---|---|
| CSCvf63373 | Sensor: signed with public trusted CA to meet STIG requirement. |
| CSCwq10185 | FMC connector creation failing when using FMC HA. |
| CSCwq83014 | CSW: Access policy is lost on FTD failover. |
| CSCwr78143 | Agent fails to save or delete offline flows after upgrading to 3.10.4.8. |
| CSCwr46882 | AIX agent does not add existing users of the config file when creating /etc/security/audit/config.tet. |
| CSCwr57676 | Agent reports flow export stopped anomaly when using a proxy. |
| CSCwr61435 | TetSen.exe crash on Windows agents related to the dns_cache feature. |
| CSCwo89435 | Agent Enforcement Health shows “Policy out of Sync”. |
| CSCwp19084 | Firewall rules are not programmed on hosts after On-Prem to SaaS migration. |
Open Issues
No open caveats were documented for Cisco Secure Workload release 3.10.5.7 at publication time. Refer to the Cisco Bug Search Tool for the most current information.
Documentation Feedback and Support
If you cannot resolve an issue using the online resources listed above, contact Cisco Technical Assistance Center (TAC).
- Email Cisco TAC: tac@cisco.com
- Call Cisco TAC (North America): 1.408.526.7209 or 1.800.553.2447
- Call Cisco TAC (worldwide): See Cisco Worldwide Support Contacts
Legal Information
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2025 Cisco Systems, Inc. All rights reserved.
Feedback