Administration Guides
What's New
Home

What's New

For a full list see the feature list page here.


Easy Auditor Enhancements:

  1. Quick Scan Path Search - New architecture to accelerate results for path searching when no user is specified.  The user search is already indexed in a way to easily find all events by a user. The new search index will offer the same search speed for a path search. (patch release coming soon)

  2. AI Analytics of user behavior - Analysis of the Auditor database can determine the optimal Ransomware Defender settings to best protect data and avoid false positives. (patch release coming soon) 

  3. WireTap provides filtering, folder browsing and event filtering. Complete update with advanced filtering options full screen UI.  Realtime IO monitoring of users, paths , folder trees, or single folder.  Allows debugging performance issues.

  4. Real-time Syslog Forwarding - Allow the ECA cluster to forward formatted syslog message to 3rd parties example SIEM tools, event filtering for user, path, event type with regex filters

  5. Where did my folder go?  It will now track directory deletes in a fast cache lookup, and copy and paste results to Excel

  6. HDFS protocol auditing - Supported now with current release

  7. Builtin reports have been enhanced for performance and provide partial results while they execute

  8. Optimized active audit triggers offers more performance at higher event rates to real-time DLP and Mass delete triggers

  9. Active Auditor - Realtime Audit Triggers - Automate security, "No MORE Report Reading"

    1. If this happens and OR that happens send an alert, triggers do not use the database and process event data with stream based analytics.

    2. Predictive Analytics - Each custom trigger created evaluates event data over 1 minute intervals and every 5 minutes a prediction computation runs to provide more accuracy to your security policies getting triggered.

    3. Combine path, user and event types into a customized real-time audit policy that continuously monitors events and fires a trigger when the condition is met.

    4. Geofencing by user or path  - Network Aware Security - Real-time triggers can use the source ip of hosts or even entire subnets.  This allows a whole new security layer that can alert when access to storage is from authorized subnets or detect remote access from VPN or Wifi Guest networks

      1. Combined with user, path, file action, file name and more options powerful Geofence polices can be created to secure your data with network aware policies.​

    5. This allows and event to be sent via email or configure syslog forwarding to a SIEM.

    6. The only customizable real-time audit solution with no lag auditing for PowerScale.

  10. S3 Object data access reporting with Easy Auditor for Onefs 9.x releases.

    1. Supports reporting on data access based S3 protocol access to the cluster

    2. Supported Features

      1. Reporting based on query builder

      2. Wiretap

      3. Where did my Folder go?  delete of folders, file only

Ransomware Defender Enhancements:

  1. No HDFS needed!!!! We have redesigned Ransomware Defender to no longer needed HDFS. Easier to install with fewer dependancies

  2. New GUI for flag as false positive to view users that have been flagged and reset the a user to factor default detection settings

  3. Allow file list add UI for whitelisting files on the dynamic extension list

  4. SIEM Integration - audit data real-time syslog forwarding

Security Enhancements:​

  1. IGLS cli command to automate changing eyeglass service account password and restarting the process to take affect.  Useful for customers with a lot of clusters and regular password change policy can now automate this task.

Cluster Storage Monitor:​​  

  1. Large AD direct collection over LDAP will support direct connect to AD to collect users and groups.  Supports 1 million or greater object collection in < 2 minutes.

  2. This new collection method will be shared by all products that need this information example Ransomware, defender, Cluster Storage Monitor all need user to SID resolution and user to group information.

Eyeglass Cluster Agent:

  1. New distributed model allows remote sites to be managed by Mini-Eca a single VM to collect audit data and forward it centrally for process, analysis, storage and searching.  This is designed for customers that have distributed clusters and want centralized security and ransomware defense of all clusters.

  2. New model can support PowerScaleSD clusters used at edge locations and offer centralized services.


  1. New in 2.9.0

On Clicking View the Report tab will show a new window with all the events in that Report.

The Auditor Report View will show different fields like User, Event Type, Time , Cluster , Path, Client IP , New Name and Status of the operation. Some fields will be empty based on the Event Type that was done on it.

The downloaded CSV file will also have the same fields present as searching and filtering.




  1. New in 2.5.3
    1. Auto Save Report to an NFS mount igls command to change location of saves and remount to PowerScale for centralized report storage
    2. Streamed Result Reporting - Long running queries will now return data for every 50,000 records and the CSV file will allow partial download of results while the query continues to execute.
    3. Reports now support 1,000,000 records for CSV download
    4. Active Auditor - real-time policy based auditing
      1. Mass Delete detection
      2. Data Loss Prevention detection
      3. Actions- alarm, lockout, snapshot
    5. What's Happening now?   A new way to audit based on stream processing technology that builds an indexed in memory view or active paths with IO visible in a new file system audit viewer that is visible before being written to the database.
      1. Avoids searching for audit events with the last 48 hours.  Auto refreshed based on current event stream
      2. Allows filtering based on time or event type 
    6. New ECA Alarm detection for audit event ingestion issues
    7. New ECA Alarm for failure to write to Analytics Database
    8. New ingest IGS CLI select a date range of gz PowerScale archived audit events.  
      1. Ingest missing data
      2. Ingest data on disk before Easy Auditor installation
      3. Avoids and detects duplicate events during ingestion process
    9. Load Balance processes on 6 node ECA clusters
    10. Historical search logs UI archives all query logs to the PowerScale over HDFS with UI to download or navigate logs
    11. Support for 1 Million events in CSV reports
    12. Support for continuous results feature that allows retrieval of partial report data while its running 50 000 events at a time.  Cancel a report search if the data required is already returned
    13. Support for NFS User ID in reports for NFS audit events plus source IP of the NFS client in reports
    14. New Builtin reports
      1. HIPAA Report and Security report for Login , logoff an failed logins by AD user report.  Each time a user authenticates to PowerScale or is logged off a netbios session an audit record will be saved for a new Builtin report
      2. Employee Exit Report - captures all user activity for 30 days for sending to HR as a record upon an employee leaving your company
    15. HA Ingestion with TuruboAudit  
      1. if an ECA node goes down Turboaudit will move ingestion log processing to another ECA node.  When the ECA comes online turboaudit will balance the work load between ECA nodes again.
      2. checkpointing log position is written into cluster controller and allows another ECA to process at the same place in the log file that was last processed
      3. Load balancing node audit ingestion between ECA nodes.  Dynamic load balancing audit log files between ECA nodes.
    16. RobotAudit - This feature performs continuous auditing by creating user events as an SMB connected user.  The events are created , ingested and stored in the database.  The Robot audit process runs reports and counts file and directory events and logs success or failure.  This offers the highest level of confidence that audit data is being processed and stored.  The audit lag is the time from when an event is created to when the data is searchable. 
  2. Existing Release
    1. Quick searching for audit events with filtering and data range
    2. Running reports with csv and summary HTML reporting with download and email
    3. Scheduled reporting of searches to find specific audit events
    4. Wiretap real-time event monitoring by user or path
    5. Where did my folder go search interface for directory renames
    6. Scalable storage with HDFS and HBASE billions of audit records stored in compressed search able format
    7. Native PowerScale storage for Analytics database protected by snapshotIQ and syncIQ lowers the cost of storing and protecting audit data
    8. Real-time event processing with automatic triggered responses
    9. Integrated with Eyeglass DR and Ransomware Defender into unified single pane of glass
    10. Role based management and login with centralized AD or PowerScale user account database
© Superna Inc