Enterprise Recon 2.16.1
ER 2.16.1 Release Notes
The Release Notes provide information about new features, platforms, data types, enhancements, and all the changes that have gone into Enterprise Recon 2.16.1.
For a quick view of the changes since the last Enterprise Recon release, see Summary of Changes.
Contents:
-
Highlights
- Important Notes
- Enterprise Recon 2.16.1 Changelog
New and Improved Features
Integrate Single Sign-On (SSO) for Enterprise Recon Users
NEW Enterprise Recon 2.16.1 now supports Single Sign-On (SSO) integration via OpenID Connect (OIDC). This allows your users to log in seamlessly using their Microsoft Entra ID (Azure AD), centralizing access management and improving the user login experience.
Administrators can enable local username/password and OIDC individually or both to fit organizational security requirements.
For more information, see Single Sign-On.
New Platform Integrations
Expand macOS Support to Run Natively on Apple Silicon and Scan macOS 27 Golden Gate
NEW Enterprise Recon 2.16.1 expands macOS ecosystem support with a new native arm64 for Apple Silicon devices, eliminating the need for Rosetta 2.
With this added support, you can now scan and remediate macOS 27 (Golden Gate) environments. Scanning (local scanning, agentless scanning, and remote scanning via SSH), remediation, access control actions, data classification, and reporting features are supported.
An Agent Upgrade is required to take advantage of this capability in ER2.
Uncover Blind Spots in Databricks Environments
NEW As users frequently replicate raw production data into ad-hoc tables, temporary views, or scratchpad volumes, data warehouses become high-risk environments where sensitive data may be stored. Enterprise Recon 2.16.1 expands coverage for sensitive data discovery in modern data warehouses, starting with the newly supported Databricks target. With the new Databricks target, you can scan, inspect, and remediate across managed and external tables, analytical views, and unstructured and semi-structured files stored inside Unity Catalog volumes.
For more information, see Databricks.
Detect Sensitive Data in Azure Cosmos DB Environments
NEW As modern cloud applications heavily use NoSQL databases like Cosmos DB for rapid app development and other real-time processing, the risk for security oversight becomes higher. For instance, teams may regularly insert unstructured JSON payloads with sensitive data directly into document stores.
With the newly supported Azure Cosmos DB target, Enterprise Recon 2.16.1 brings non-relational datastores into the same security perimeter as traditional databases, eliminating data blind spots.
For more information, see Azure.
Support Scanning TLS-Encrypted Connections for Database Targets
The updated MariaDB, MongoDB, MySQL, and PostgreSQL database protocols in Enterprise Recon 2.16.1 now support scanning over TLS connections, enabling comprehensive discovery across databases that require encrypted connections. Additionally, the updated MongoDB protocol now supports scanning MongoDB Atlas and FIPS-compliant environments.
For more information, see Databases.
New and Improved Data Types
Protect Quantum Secrets and Key Management Systems
NEW Enterprise Recon 2.16.1 introduces two newly added data types: Quantum-Unsafe Secrets and Quantum- Safe Secrets data types. Both are available in relaxed and robust search mode.
The new Quantum-Unsafe Secrets data type detects the presence of classical asymmetric keys and certificates that a large-scale quantum computer could easily crack. This includes keys using classical algorithms that a large-scale quantum computer could break, RSA, RSA-PSS, DSA, DH, EC (all curves, including SM2), Ed25519/Ed448, X25519/X448 and GOST R 34.10. Detecting quantum-unsafe assets uncovers vulnerabilities and attack surfaces, and allows you to prioritize re-encrypting high-value targets first.
On the other hand, the new Quantum-Safe Secrets data type detects post-quantum cryptographic (PQC) assets such as private keys, public keys, and certificates across your organization’s environment. This includes keys using the NIST-standardized post-quantum algorithms, ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), plus composite ML-DSA hybrids. Detecting quantum-safe secrets provides verifiable metrics that show successful upgrades and prove compliance.
Detect European National IDs & Tax Identifiers
NEW Enterprise Recon 2.16.1 now features expanded detection capabilities for European national IDs and tax identification numbers. This update introduces support for four key data types: the Cypriot Identification Card Number data type for citizens of the Republic of Cyprus, the German Tax Identification Number data type to detect 11-digit personal tax identifiers, the Greek Personal Number data type for citizens of Greece, and the Liechtenstein PEID data type to identify national ID and master tax numbers for both individuals and corporate entities.
Detect Mexican National & Tax Identifiers
NEW Enterprise Recon 2.16.1 expands its coverage in Latin America with the introduction of three new Mexican data types. The release includes the new Mexican INE data type to detect Mexico’s primary de facto national ID card number used for official, commercial, and civil matters, the new Mexican NSS data type to detect the standard social security number used for non-public sector workers, and the Mexican RFC data type to detect the primary tax identification number assigned to both individuals and corporate entities.
Expand Coverage for Healthcare & Social Security Identifiers
NEW Enterprise Recon 2.16.1 expands its medical and benefits coverage with the addition of two new health data types. The release introduces the new Croatian Health Insurance Number (MBO) data type to detect the unique health insurance identifier assigned to insured individuals in Croatia, and the new Portuguese Número de Utente do SNS to detect the national health service code used to identify patients across Portugal’s public healthcare system.
Enhance Existing Data Types
Enterprise Recon 2.16.1 includes updates to several existing data types to enhance detection accuracy and flexibility. Structural and formatting improvements feature in the Albanian NID data type (enhanced birth year identification), the Latvian Personas Kods data type (support for the post-July 1, 2017 format), the Mexican CURP (enhanced identification of structural restrictions on the first four characters and of the ‘X’ character in the 2nd and 11th positions), and the US Health Plan Identifier data type (support for the optional ‘80840’ prefix).
Additionally, you can now apply either a stricter or a lenient search to your scan by selecting Robust Search or Relaxed Search to the following data types: Estonian IK, Lithuanian Asmens Kodas, and Portuguese Social Security Number (NISS) data types.
Finally, improved overall detection capabilities have been made for the updated Czech RC, Slovakian RC, Personal Names (Peru), and Polish Identity Card data types, while the updated Passport Numbers data type has improved detection accuracy through granular country-level validation and full support for Machine Readable Zone (MRZ) formats.
Early Access
The Early Access stage allows Ground Labs to collect a round of usability and performance feedback before a feature is made generally available.
If you would like to request access to any of the Early Access features, please get in touch with the Ground Labs Support Team for assistance.
Early Access Features
- Apache Hive - Enables sensitive data discovery on Apache Hive (and Cloudera Hive) database Targets.
Important Notes
CRITICAL: Upgrade Node Agents to the Latest Version
Enterprise Recon 2.16.1 introduces critical library upgrades and improvements that require updating your Node Agents to take effect. Ensure all Node Agents that you use are upgraded to the latest version to maintain optimal performance and secure scanning capabilities.
See Agent Upgrade.
CRITICAL: Update Commands for Restarting Linux Agents
Linux node agents in Enterprise Recon now natively integrates with ‘systemd’, making background service management simpler and more reliable.
-
Impact: The change affects the commands used for restarting Linux node agents. Running the old command will cause the agent installation to fail.
-
Action Required: If you use the Linux agent restart commands in any custom automation, you must update your automation to run the updated commands.
For more information, see Linux Agent.
CRITICAL: One Way Upgrade to Enterprise Recon 2.16.1
Certain data sets, storage formats and components for the
Master Server have been updated in
Enterprise Recon 2.16.1.
Therefore once the Master Server is updated from Enterprise Recon 2.15.0 (and
below) to ER 2.16.1, the
datastore is not backward compatible and downgrading
ER 2.16.1 to an earlier
version is not supported.
Please contact the Ground Labs Support Team
for assistance with upgrading the Master Server.
CRITICAL: End of Support for CentOS 7 Master Server
Master Server installations with CentOS 7 as the base operating system are no longer supported in Enterprise Recon 2.16.1. Consequently, upgrading a CentOS 7-based Master Server to version 2.16.1 through an online update is no longer possible.
If you have existing installations of CentOS 7-based Master Server, create a backup of your Master Server datastore and datastore configuration file, and migrate to Enterprise Recon on the new operating systems to continue receiving support for new features and product updates.
See How To Install the Master Server Appliance (from ISO) or How To Install the Master Server on RHEL 8 and 9 (from RPM).
Changelog
The Changelog is a complete list of all the changes in Enterprise Recon 2.16.1.
What’s New?
- New Data Types
- NEW Croatian Health Insurance Number (MBO)
- NEW Cypriot Identification Card Number
- NEW German Tax Identification Number
- NEW Greek Personal Number
- NEW Liechtenstein PEID
- NEW Mexican INE
- NEW Mexican NSS
- NEW Mexican RFC
- NEW Portuguese Número de Utente do SNS
- NEW Quantum-Unsafe Secrets
- NEW Quantum-Safe Secrets
- New Platform Integrations
- Azure Cosmos DB
- Databricks
- MongoDB Atlas
- New OSes/Agents
- NEW macOS agent - Apple Silicon
- NEW macOS Golden Gate 27
-
Added:
- Updated MariaDB, MongoDB, MySQL, and PostgreSQL database protocols to support scanning over TLS-encrypted connections. Additionally, the updated MongoDB protocol now supports scanning MongoDB Atlas and FIPS-compliant environments.
Enhancements
-
Improved Features:
- Updated data compression, image processing libraries, and other third-party library upgrades for increased application security.
- Added an “Agent Host Collision” Activity Log event when an approved agent reconnects to the Master Server using a different key. This appears alongside the “Agent Pending” entry, allowing administrators to quickly identify agent key changes on existing hosts versus brand-new agent connection requests.
- Minor security and UI enhancements.
Ensuring we are delivering the best technology for our customers is a core value at Ground Labs. If you are interested in future early builds of Enterprise Recon with forthcoming features, please email your interest to product@groundlabs.com.