What's New in 26.2.12-VEN
This release provides support for the following features:
Linux Process-Based Flow Visibility and Outbound Policy Enforcement
Note
This feature is supported with this PCE and VEN combination: PCE 26.2.10 and VEN 26.2.12. Feature enablement is required.
This functionality lets you observe and control outbound network connections from Linux workloads using the process identity as additional context to port and protocol rules. This helps security teams enforce least-privilege outbound access by specifying which processes are authorized to use allowed network paths.
See Linux Process-Based Flow Visibility and Outbound Policy Enforcement.
Adaptive User Segmentation: Continued Enforcement if PCE is Unreachable
Note
This functionality is supported with the following PCE and VEN combinations: PCE 26.2.10 and later & VEN 26.2.12 and later.
The Adaptive User Segmentation (AUS) now maintains policy enforcement even when the PCE is temporarily unreachable.
Previously, the VEN required a live PCE connection to report user status and fetch the needed AUS policy. With this release, the enforcement layer proactively fetches and caches AUS policy for all configured user groups, so rules are available locally and enforced even if the PCE is unreachable.
This applies to both supported integration types:
Microsoft Entra ID environments, where group and user data is automatically synced to the PCE via the UGM service.
Microsoft Active Directory environments, where groups are manually configured in the PCE.
When the PCE comes back online, AUS policy is refreshed automatically and normal enforcement resumes without dropping existing sessions.
AUS policy resilience applies at the PCE cluster level and defaults to off. To enable this feature, add the following to the PCE runtime_env.yml, then restart the PCE.
agent_service: aus_resiliency_enabled: true
For more about AUS generally, see Adaptive User Segmentation in the Security Policy Guide.