Snare Agent v5.11.0 · Snare Agent Manager v2.3.0 – Whats New

Forensic-grade log collection. Greater control. Built for evolving security environments.

Snare Agent v5.11.0 extends Windows visibility to Event Tracing for Windows (ETW), hardens every management connection with stronger TLS, and adds ARM64 support for cloud workloads. Snare Agent Manager 2.3.0 brings OIDC single sign-on, remote Linux agent upgrades and centralised secrets management, so you can run more of your agent fleet from one console.

ETW

New Windows log source

TLS 1.2 / 1.3

OpenSSL security level 3

OIDC SSO

Microsoft Entra ID, Okta

ARM64

Ubuntu 22.04 and 24.0

Forensic-grade security and audit log collection

Consistent collection policies across distributed estates

Control over what is collected and where it goes

Vendor-agnostic SIEM and analytics integration

On-premises, hybrid and cloud-connected architectures

Introducing Snare Agent v5.11.0 and SAM 2.3.0

What’s new in this release

This release extends what you can collect, strengthens the cryptography protecting your agent estate, and gives administrators more control from Snare Agent Manager.

Snare Agent for Windows

Event Tracing for Windows (ETW) log collection

Snare Agent for Windows can now collect events from ETW providers. This reaches telemetry that Event Viewer audit sources don’t cover, including manifest-based providers that write to .etl channels, such as DNS Analytic and Debug logs. Windows audit policies can’t reach these logs.

  • A new ETW Event Providers page under Log Sources lets you define providers and channels
  • Apply filters and assign event criticality levels per provider
  • ETW policies are set on the agent. SAM displays the ETW settings in Master Configuration once they are in use; editing them from SAM is not yet available.

Why it matters: DNS analytic events are valuable for detecting command-and-control traffic, DNS tunnelling and data exfiltration, and analysts can now collect them through the same agent and pipeline as the rest of their Windows audit data. ETW streams in real time, so events are captured only while the agent is running. Where Basic or Advanced Audit Policies can collect the same events, those remain the preferred source.

Windows log sources

Security, System, Application    Audit policy
PowerShell, RDP, WMI    Event Log
DNS Analytic / Debug    ETW · new
Other manifest-based providers    ETW · new
Per-provider filtering and criticality    ✓

Agent web server · security level 3

TLS 1.2 / TLS 1.3    Accepted
AES-256-GCM + ECDHE / DHE    Accepted
RSA ≤ 2048-bit keys    Rejected
SHA-1 signatures    Rejected
RC4, 3DES    Rejected

Using custom server certificates? Check the release notes before you upgrade.

Snare Agent + SAM

Hardened TLS and cryptography

The Agent web server now enforces OpenSSL security level 3, with selected level 4 controls, for all management traffic. SAM 2.3.0 includes matching updates to its certificate and cryptography settings.

  • Connections require TLS 1.2 or TLS 1.3
  • Only strong cipher suites using AES-256-GCM with ECDHE or DHE key exchange are accepted
  • RSA keys of 2048 bits or smaller, SHA-1 signatures and legacy ciphers such as RC4 and 3DES are rejected
  • Stronger path validation for JSON and INF configuration exports

Why it matters: Agent management interfaces control what evidence gets collected, so they need the same protection as the logs themselves. This release is part of Snare’s ongoing cryptographic modernisation across the suite, which is aligned with post-quantum readiness guidance such as NIST’s 2024 post-quantum standards (FIPS 203, 204 and 205), the ASD Information Security Manual and the UK NCSC migration timeline.

Snare Agent Manager 2.3.0

OIDC single sign-on for Snare Agent Manager

SAM now supports OpenID Connect authentication, so administrators can sign in with accounts from cloud identity providers such as Microsoft Entra ID and Okta. You can set up OIDC in the installer or under Settings › General. It works alongside the existing LDAP support.

  • Administrators sign in with the cloud identity accounts they already use
  • Configurable web session timeout from the Settings page

Why it matters: Whoever controls the agent console controls what gets logged. With OIDC, access to SAM is managed through your organisation’s existing identity provider instead of a separate set of console credentials.

SAM authentication options

OIDC: Microsoft Entra ID    New
OIDC: Okta    New
LDAP / directory    ✓
Role-based access control    ✓
Configurable session timeout    New

New Linux platforms in v5.11.0

Ubuntu 22.04 / 24.04    ARM64
RHEL 10    New
AlmaLinux 10    New
Oracle Linux 10    New
Debian 13    New

Snare Agent for Linux + SAM

Remote Linux upgrades and ARM64 support

SAM 2.3.0 can now remotely upgrade Snare Agents for Linux, alongside Windows agents. New Linux builds add ARM64 support and current enterprise distributions.

  • Remote Linux upgrades need Linux Agent 5.11.0 or later before the upgrade, and SAM 2.3.0 or later
  • ARM64 builds for Ubuntu 22.04 and 24.04, the Arm-based processors widely used across AWS, Microsoft Azure, Google Cloud and Oracle Cloud
  • New support for RHEL 10, AlmaLinux 10, Oracle Linux 10 and Debian 13

Why it matters: Many organisations are moving cloud workloads to Arm-based instances for better price-performance. Arm is a different CPU architecture that needs its own agent build, and with one available, those hosts get the same forensic-grade collection as the rest of the estate. Remote upgrades mean Linux fleets no longer need a host-by-host maintenance cycle.

More in this release

More control from one console

Snare is steadily moving agent administration into Snare Agent Manager, so teams make fewer changes on individual hosts. Version 2.3.0 takes that further, with new controls for policy, secrets and upgrading at scale.

Policy and configuration

  • Drag-and-drop policy group ordering: agents are automatically reassigned to the first group they match
  • Tree-style policy selector for network destinations in Master Configuration, matching the agent interface
  • Heartbeat routing: choose which network destinations receive agent heartbeats
  • Remote Event Source ID configuration when the type is None or Registry Path
  • Non-English characters supported in Windows basic auditing categories

Secrets and key rotation

  • Edit the SAM Authentication Key and TLS Authentication Key, and reset the Agent Password, directly from Master Configuration
  • Apply a new SAM Authentication Key to every relevant master configuration in one step
  • Rotation grace period (24 hours by default, configurable) so agents still on the retired key can connect and pick up the new one
  • TLS key validation now consistent between SAM and the agent

Fleet operations and audit

  • Upgrades at scale: filter, search and sort the upgradeable agents list, then schedule upgrades for every agent that matches
  • Bulk delete: a new Delete All option that respects the current filter, with an agent-count confirmation
  • Audit events for agent deletion: written to the SAM log in Snare Central on Linux, and to the Windows Application log (Event IDs 2570 and 2571)
  • Better performance under load through parallel handling of agent connections
  • Lighter, modernised interfaces: much lower resource use in the Agent web UI, and a refreshed SAM Licenses UI

Upgrading from v5.9 or earlier? You also gain the v5.10 / SAM 2.2.0 capabilities

  • Windows log translation to English while endpoints keep their native locale
  • Default configuration templates, removing the “master agent” dependency
  • LDAP authentication for SAM, with user and group audit tracking
  • Expanded remote policy for network destinations, FIM, RIM and Linux audit
  • Bulk tagging, and an Unmanaged group for reverting agents to local control
  • Agent import/export through the UI for air-gapped networks
  • Policy-to-destination routing, and Devo direct-to-table tagging
  • Linux telemetry: CPU, disk, memory and network metrics

The Foundation

Built for reliable, forensic-grade log collection

Comprehensive security event collection

Collect security and audit events from supported operating systems, building a reliable evidence base for monitoring, investigations and compliance.

  • Windows Event Log and ETW, Linux auditd/journald, macOS Unified Logging, Solaris, AIX, HP-UX
  • Process context: PID, PPID, command line, user and parent-child chains
  • File and registry integrity monitoring with SHA-256 hash verification

Consistent collection and policy control

Standardise configuration across distributed infrastructure. Snare Agent Manager, included at no additional cost, centrally manages agent policy, secrets, upgrades and health.

  • Template-driven baselines, ordered policy groups and bulk actions
  • Firewall-friendly, pull-style configuration management
  • OIDC and LDAP authentication, role-based access and a full audit trail

Flexible forwarding and SIEM integration

Send the same event stream to up to 256 network destinations at once (SIEMs, data lakes, archives and Snare Central), each with its own format and filter. Run multiple SIEMs in parallel or migrate between them without re-collecting data.

  • Splunk HEC, Microsoft Sentinel, IBM QRadar, Securonix, Devo, Kafka, S3, syslog
  • Snare native, Syslog (RFC 3164/5424), JSON, CEF and LEEF output
  • Filter at the source by event ID, user, process, keyword or regex to reduce ingestion noise

Control and integrity of your security data

Decide what is collected and where it goes, in line with security policy, operational requirements and data sovereignty obligations.

  • TLS 1.2/1.3 with strong cipher suites, plus certificate-based mutual TLS
  • Encrypted local buffer keeps events through outages and delivers them in sequence
  • Tamper-resistant agent process and sequence-numbered log streams
Platform coverage at a glance
Windows Server 2008 R2 to 2025, Windows 10/11, Core/Server Core editions
Linux (x86-64) RHEL 6+ including RHEL 10 NEW, AlmaLinux 10 NEW, Oracle Linux 10 NEW, Debian 9+ including Debian 13 NEW, Ubuntu 16.04+, CentOS, Rocky
Linux (ARM64) Ubuntu 22.04 and 24.04 NEW
macOS 10.14 to 15 Sequoia, and macOS 26 NEW
Unix Solaris 10/11, AIX 6.1+, HP-UX 11i v2/v3
Cloud workloads AWS, Microsoft Azure, Google Cloud and Oracle Cloud virtual machines on x86-64 and supported ARM64 builds, with image-based and cloud-init deployment
Specialised agents MSSQL, Windows Event Collection (WEC), Epilog file monitoring, Syslog for network devices

One agent. Four deployment pathways

Extend your Snare environment as your requirements evolve

Snare Agent is the collection layer in every Snare architecture. Whether you stay fully on-premises or extend into cloud-connected operations, the same agent and the same policies carry forward, alongside your existing SIEM and XDR investments rather than replacing them.

PATHWAY 01

Fully on-premises

Keep collection, management and security operations entirely within your own infrastructure, including air-gapped networks.

PATHWAY 02

On-premises + AskSnare

Add natural-language investigation over your on-premises Snare data, without moving that data.

PATHWAY 03

Unified on-prem + cloud

Bring on-premises and cloud log sources, including ARM64 cloud workloads, together through Snare Central, with AskSnare available across both.

PATHWAY 04

Hybrid / separated

Keep selected environments isolated while others connect to cloud-based operations, matching each to its risk and compliance profile.

Where Snare Agent delivers value

Proven across demanding environments

Enterprise security operations

Consistent audit, ETW and security event collection across large, distributed Windows, Linux and cloud estates, managed from one console.

Government and defence

Hardened cryptography, evidence retention, data sovereignty and air-gapped deployment for controlled environments.

MSSPs and service providers

Standardised collection, policy and key rotation across customer tenants, with the freedom to deliver into whichever SIEM each customer runs.

Compliance and investigations

Chain-of-custody event records and an audited admin trail supporting PCI DSS, ISO/IEC 27001, NIST CSF, HIPAA and NERC CIP requirements.

Ready to Upgrade to Snare Agent v5.11.0?

Whether you’re maintaining an established deployment, adding ETW sources or bringing ARM64 workloads into scope, a Snare specialist can review your agent versions and certificates, confirm compatibility with SAM 2.3.0 and Snare Central, and plan your upgrade.

Contact Sales Request a Demo Talk to Support

FAQ’s

Latest Blogs

Telemetry is lightweight and configurable. You can tune or scope metrics collection per policy and estate needs.

In most cases, no re-install is required—updates are delivered via standard upgrade paths. Templates and translation are policy-driven features managed via SAM.

Snare integrates with leading platforms including Securonix, Devo, Splunk, and others via policy-to-destination routing and standards-based protocols.

Yes. Move agents to the Unmanaged group to restore local policy control while keeping visibility in SAM.

SAM can delegate auth to your directory (LDAP), so you can apply enterprise identity and access policies consistently.

Check the Release Notes and EOL Notices for platform support timelines and planning guidance.

Snare Solutions
Powered by  GDPR Cookie Compliance (opens in a new tab)
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.