🥳 Mondoo 11.30 is out! This release includes notes for cases, expanded Windows snapshot scanning, updated policies, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container

🎉 NEW FEATURES​

Notes for cases​

Cases are an important way to communicate with the team fixing security issues. Now you can provide the context that downstream teams need to remediate problems quickly: When you create a case, you can write a note, which automatically syncs to your ticketing or project management system.

Package data in Windows snapshot scans​

You can now expose package vulnerabilities on Windows cloud hosts without deploying agents. Windows cloud snapshot scans now include package discovery.

Parse fstab entries with MQL​

Dive head first into Linux fstab entries with new MQL resources for fstab data.

fstab.entries: [
  0: {
    fsck: 1
    options: "defaults,noatime"
    device: "UUID=7c4e7e0e-ce36-42f9-b456-16f78f3a1eb1"
    fstype: "xfs"
    mountpoint: "/"
    dump: 1
  }
  1: {
    fsck: 2
    options: "defaults,noatime,uid=0,gid=0,umask=0077,shortname=winnt,x-systemd.automount"
    device: "UUID=C155-24D2"
    fstype: "vfat"
    mountpoint: "/boot/efi"
    dump: 0
  }
]

Discover VMware distributed virtual switches and port groups​

Mondoo's new and expanded MQL resources for VMware let you discover and secure VMware distributed virtual switches and port groups.

vsphere.datacenters { distributedPortgroups { name properties } }

and

vsphere.datacenters {distributedSwitches {*} }

🧹 IMPROVEMENTS​

CIS Debian 12 v1.1.0 benchmark policy​

Secure Debian 12 systems with the latest recommendations from the Center for Internet Security. This newly updated policy includes 365 updates including all new checks, updated descriptions, and improved remediation steps.

CIS macOS 12 v3.1.0 benchmark policy​

Secure legacy macOS 12 systems with the newly updated macOS 12 (Monterey) benchmark, including updated checks, recommendations, and remediation steps.

Resource updates​

files.find​

• New depth field

microsoft.conditionalAccess​

• The namedLocations field now returns the new microsoft.conditionalAccess.namedLocations resource

vsphere.vswitch.dv​

• New moid field

🐛 BUG FIXES AND UPDATES​

• Improve help in the GitHub provider.
• Handle nil directory names in the files.find resource.

🥳 Mondoo 11.29 is out! This release includes asset risk factor customization, Windows Server 2025 support, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container

🎉 NEW FEATURES​

Risk factor customization​

Tailor Mondoo's security model to match the needs of your business with risk factor customizations. Choose which risk factors matter to you and tune how much impact each risk factor has on the prioritization of findings. That way, the unique needs of your infrastructure determine which systems require urgent attention.

Expanded risk factors​

Focus on the most important systems first, with new risk factors for critical databases, file sharing, and directory services. These new risk factors surface your most critical systems first, so you can focus your energy on the highest risks to your business:

• Cassandra
• Elasticsearch
• MariaDB
• MongoDB
• OpenLDAP
• OpenSearch
• Samba

Descriptions for organizations and spaces​

Communicate the intended purpose of organizations and spaces to your coworkers, or maybe just your future self, with long descriptions for organizations and spaces. Set a description in the new organization and space creation pages or edit them after the fact in the settings pages.

🧹 IMPROVEMENTS​

Windows 2025 support​

It's been over three years since the last major Windows Server release, and Microsoft has been busy putting plenty of new security features in Windows 2025. If you're testing the waters on this new version, released this week, Mondoo has your back! We have full support for securing Windows Server 2025, including the new Arm processor variants.

If you're interested in learning more about everything new in this release, check out our Overview of Changes and New Security Features in Windows Server 2025 blog post.

CloudLinux support​

Query and secure CloudLinux assets with new support in Mondoo for the hosted-optimized Linux distribution.

CIS AWS Foundations benchmark 4.0​

Stay on top of the latest threats against your AWS infrastructure with the updated CIS AWS Foundations benchmark 4.0. This new release includes 14 new and updated recommendations for the most commonly used Amazon services.

Resource updates​

microsoft.user​

• New mfaEnabled field

🐛 BUG FIXES AND UPDATES​

• Improve the text describing policy scoring.
• Improve the layout of the page when adding an integration and all recommended policies are already enabled.
• Add more input validation for GitHub Enterprise URLs in the GitHub Issues integration setup.
• Fix a panic querying aws.eks.clusters { * } when no disks are present.
• Include RPM packages with the vendor of "(none)" in the packages resource.
• Improve scalability of the GitHub provider in very large organizations.
• Provide a helpful error message when clients can't authenticate with Mondoo Platform.
• Report IBM dB2 and Amazon Aurora RDS instances in asset overviews.
• Support fetching Windows Appx packages during filesystem scans.
• Update policy and query pack download icons to be more consistent with other console icons.
• Don't include the properties tab on policies that don't have any properties.
• Include the create date in asset overviews for AWS EFS filesystem assets.
• Fix a failure running some Microsoft 365 integration scans.
• Update VMware ESXi 7 EOL to the new extended EOL date.
• Don't show internal query packs on the query packs page.
• Update Microsoft Teams notification support to use the new AdaptiveCard system in Teams.

🥳 Mondoo 11.28 is out! This release includes Azure DevOps ticketing, policy scoring configuration, updated policies, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container

🎉 NEW FEATURES​

Create Azure DevOps issues from Mondoo​

Mondoo now supports creating remediation tickets in Azure DevOps. This option joins our existing support for ticketing with Jira, Zendesk, GitHub, GitLab, and email.

Mondoo can create tickets in these external systems and update them as it detects changes. When all the findings are remediated, Mondoo can automatically close tickets. When previously resolved findings regress, Mondoo can automatically open new cases to track remediation.

Policy scoring weight configuration​

Configure how Mondoo scores your policies with a newly redesigned policy page. The new page makes it easier to enable or disable a policy, share that policy with colleagues, and now to modify how that policy is scored. Select the scale icon from the top of any policy page to display five new scoring options.

Learn more about scoring systems in the Mondoo documentation.

🧹 IMPROVEMENTS​

Updated CIS Windows benchmark policies​

Secure critical Windows servers with the latest CIS recommendations for Windows 2016 and 2019:

• CIS Windows Server 2016 benchmark 3.0.0
• CIS Windows Server 2019 benchmark 3.0.1

Creation and scan details for integrations​

Integration detail pages now expose creation and scan information to help with understand and troubleshooting integrations

• Creation date
• Last modification date
• Last successful scan date
• Last attempted scan date

Fedora 41 support​

Mondoo now detects Fedora 41 servers, workstations, and containers including EOL and package CVE support.

Simplified policy property editing​

You can now modify policy property values directly on the policies page at Security -> Policies, making it easier to customize policies to your needs.

Resource updates​

asset​

• New purl field

aws.ec2.instance​

• New iamInstanceProfile field using the new aws.iam.instanceProfile resource

aws.iam​

• New instanceProfiles field using the new aws.iam.instanceProfile resource

🐛 BUG FIXES AND UPDATES​

• Fix formatting on sample commands in the workstation integration setup page.
• Detect CVEs on recent VMware vCenter releases.
• Improve password expiration checks in Windows policies.
• Fix a failure loading the AWS integration details page with certain configuration options enabled.
• Identify new M4 iMacs in the asset overview.
• Improve the icon for uploading custom frameworks, policies, and query packs.
• Fix package detection on the latest releases of openSUSE/SLES.
• Use the asset name defined in inventory files when scanning assets over SSH.
• Fix command line help for the Azure provider not showing all available flags.
• Fix a failure scanning Microsoft 365.
• Fix some AWS resources not fetching tags properly.
• Don't show the filter search bar on the Policies page when there are no enabled policies.

🥳 Mondoo 11.27 is out! This release includes simplified policy management, Shodan scanning, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container

🎉 NEW FEATURES​

Simplified policy and query pack management​

Say goodbye to the Registry and hello to simplified policy management and insights. A more intuitable organization puts the content you need at your fingertips:

• All the tasks you perform with policies are now accessible under Security.

• All the tasks you perform with query packs are now accessible under Inventory.

• All the tasks you perform with frameworks are now accessible under Compliance.

We listened to your feedback and made it easier to see what content is enabled and to enable or disable those policies, query packs, and frameworks. Customization is within closer reach with improved management of custom content and configuration of scoring vs. preview policies.

Understand external exposure with continuous Shodan scans​

Gain visibility into your infrastructure's external exposure with continuous Shodan scanning. Our new Shodan integration allows you to automatically monitor domains, IPs, and even entire IP blocks for external risk.

Paired with our new Shodan Security policy and query pack, this scanning provides critical insights into what attackers know about your systems. Now you can prioritize essential fixes effectively.

Search available integrations​

Quickly find the exact integration you're looking for with search on the integrations page.

🧹 IMPROVEMENTS​

Support non-ASCII characters in space and organization names​

We got a bit wrapped up in 'Merica and tossed a few too many bald eagles on the space and organization creation pages. The eagles have been relocated and now customers across the globe can safely create spaces and organizations with all your favorite non-ASCII characters.

Updated CIS VMware benchmark policies​

Secure your critical VMware infrastructure with the latest recommendations from The Center for Internet Security (CIS):

• CIS VMware ESXi 6.7 Benchmark v1.4.0
• CIS VMware ESXi 7.0 Benchmark v1.4.0
• CIS VMware ESXi 8.0 Benchmark v1.1.0

🐛 BUG FIXES AND UPDATES​

• Improve email address validation in integration setup pages.
• Add GitHub token validation to GitHub integrations.
• Update GitHub integration setup instructions to better clarify required vs. optional fields.
• Fix rendering of dividers on integration status pages.
• Fix display of Windows setup commands on the workstation integration page.
• Improve the display of policies with multiple authors.
• Improve the alignment and display of risk factor icons on vulnerability, advisory, and check pages.
• Show larger descriptions by default on advisory and CVE pages.
• Improve the layout of EC2 filtering options in the AWS serverless integration setup.
• Improve alignment of text in affected asset, top vulnerabilities, and top security findings tables.
• Fix application of some policies on Terraform assets.
• Identify the new 14" MacBook Pro M4 in the asset overview.
• Improve the reliability of queries in the Mondoo Microsoft Azure Security policy.
• Fix a failure to load some older AWS serverless integrations.
• Fix a failure scanning in the ms365.exchangeonline.reportSubmissionPolicy resource.
• Expose additional labels on Amazon ECS containers.
• Support scanning Shodan assets using an inventory file.
• Improve command line help for Snowflake and Slack.
• Display the cnspec version used to scan hosted integration assets in the asset configuration.

🥳 Mondoo 11.26 is out! This release includes new AWS scan filtering options, custom fields in Zendesk cases, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container

🎉 NEW FEATURES​

AWS resource scan filtering​

Pick and choose the exact AWS resources that Mondoo evaluates with new scan filtering.

The AWS serverless integration now includes the ability to define AWS resources to scan with region-, instance-, and tag-based include and exclude filters. Scan just a single region or exclude resources using owner tags.

For CLI users, now you can specify a comma-separated list of tag values with the --filters flag.

To include only EC2 instances with the "Owner" tag of "backend", "frontend", or "dba":

--filters ec2:tag:Owner=backend,frontend,dba

To exclude EC2 instances with the "Owner" tag of "qa" and "dev":

--filters exclude:ec2:tag:Owner=qa,dev

Custom fields for Zendesk cases​

Improve the routing of cases generated in Zendesk with new globally set custom fields.

🧹 IMPROVEMENTS​

Improved policy risk display​

Understand the risk scores distribution of policies across assets in your spaces with improved asset scan results on the security policies page.

Ubuntu 24.10 platform support​

Secure workstations running the latest release of Ubuntu with full Ubuntu 24.10 support including Linux security policies, vulnerability detection, and EOL support.

🐛 BUG FIXES AND UPDATES​

• Fix errors on the Software page versions graph if all risk severities are unchecked.
• Add a creation date column to ticketing integration lists.
• Don't display "Last scanned" on ticketing integration pages.
• Don't display the "Schedule Now" button on ticketing integration pages.
• Don't include the "Pause Scanning" menu option on ticketing integration pages.
• Improve display of affected assets on advisories, CVEs, and checks pages.
• Fix flickering of text fields on integration setup pages.
• Improve rendering of manual setup instructions on the Workstation integration setup page.
• Don't show base scores in the score summaries of CVEs or Advisories.
• Fix incorrect rendering of some tool tips on overview pages.
• Improve rendering of compliance progress bars at 0% progress.
• Improve reliability of advisories and MTTR values on the vulnerabilities overview page.
• Improve readability of markdown generated by cases.
• Expand and improve help in cnquery and cnspec.
• Properly parse command line flags containing double hyphens (--).
• Improve performance loading asset checks.

🥳 Mondoo 11.25 is out! This release includes expanded platform and AWS region support, updated Ubuntu 22.04 CIS policies, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container

🧹 IMPROVEMENTS​

Updated CIS Ubuntu 22.04 benchmark policy​

Secure critical Ubuntu 22.04 systems with the latest CIS Ubuntu benchmark version 2.0 policy. This updated policy includes 488 changes including dozens of all-new checks to keep your systems secure against the latest threats.

Expanded AWS serverless integration region support​

The Mondoo AWS serverless integration has always supported scanning your AWS resources in any region. Now you have additional options for where the scanner itself runs. Mondoo now supports installing the integration into the following new regions:

• ca-central-1
• eu-north-1
• eu-west-2
• eu-west-3
• ap-south-1

Expanded platform support​

Ensure systems are supported and secured with expanded vulnerability and end of life detection:

• Windows 11 24H2
• Google COS 117
• macOS Monterey (12)

View exception count on check pages​

Exception counts on individual check pages let you quickly see how many exceptions are set for an individual check.

🐛 BUG FIXES AND UPDATES​

• Improve score accuracy for CVEs and checks.
• Open links from the AWS integration page in new tabs.
• Improve form validation and formatting in the AWS integration setup form.
• Fix incorrectly clipped log messages in the AWS integration page.
• Make single account installs the default option during AWS serverless integration setup.
• Improve auditd checks in CIS Linux benchmark policies to better support container image and filesystem snapshot scans.
• Redirect to the spaces list page after deleting a space.
• Support sending very large scan results to Mondoo Platform.
• Fix returning an incorrect platform family for Dockerfiles.
• Improve scan reliability in the AWS serverless integration.
• Expand and improve help in cnquery and cnspec.
• Update CIS Google Cloud Foundations policy to version 3.0 to match the check content.

🥳 Mondoo 11.24 is out! This release includes an all-new AWS serverless integration, macOS Sequoia support, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container

🎉 NEW FEATURES​

All-new AWS serverless integration experience​

Over the past few months, our engineers have been hard at work on a complete rewrite of our AWS serverless integration. This new release builds on our previous design and incorporates valuable insights we've gained from securing AWS accounts at scale. What can you expect from this new release?

• Enhanced security - Our new design drastically reduces the number of privileges required to run in your environment so you can gather critical security insights without introducing new risks to your business.
• Expanded scalability - From the smallest dev account to enterprise-sized production accounts, Mondoo has you covered.
• Granular results - Our new approach to scanning provides resource-level granularity in more situations, giving you enhanced visibility into critical risks to your business.

macOS Sequoia support​

Is your team eager to upgrade to the latest macOS Sequoia release? Now you can keep your bleeding edge users happy and secure with Mondoo! With tested packages, EOL detection support, and new CIS benchmarks, you'll be ready to tackle early adopters on day one. For users still running Sonoma (14) or Ventura (13), updated CIS benchmark policies offer new and improved security recommendations.

🧹 IMPROVEMENTS​

Resource updates​

microsoft.policies​

• New consentPolicySettings field

🐛 BUG FIXES AND UPDATES​

• Improve the setting descriptions on the user settings page.
• Fix formatting errors on Linux integration code blocks.
• Fix false positive error messages when scanning GitHub repositories and organizations.
• Improve Windows event log entries from the Mondoo service.
• Improve resiliency of Windows system information gathering.
• Add the Shodan logo to Shodan policies.
• Improve reliability of CVE risk scores.
• Fix missing Red Hat advisories for legacy releases.

🥳 Mondoo 11.23 is out! This release includes automatic drift detection, GitHub and GitLab ticketing support, improved asset tables, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container

🎉 NEW FEATURES​

Added features in cases​

This release further expands the capabilities of cases, Mondoo's feature for tracking remediation work. Cases let you turn security findings into tasks that automatically export to your existing project management or ticket system. That way, you can track and resolve Mondoo findings in your regular workflow.

New support for GitHub Issues, GitLab Issues, and email ticketing​

Mondoo now supports creating tickets in GitHub Issues and GitLab Issues, and can also send ticket notifications via email. These options join our existing support for ticketing with Jira and Zendesk.

Create cases automatically on asset drift​

When scans go from passing to failing, you want to know quickly. Now when an asset fails a check or vulnerability scan that it previously passed, Mondoo creates a case and shares it with your ticket system so you can respond rapidly. Mondoo can even group similar drift findings in a single case.

New CIS Ubuntu 24.04 benchmark policy​

Secure your Ubuntu 24.04 servers and containers with the brand new CIS Ubuntu 24.04 level 1 & 2 benchmarks. These policies include 295 total checks to secure your critical Ubuntu systems.

🧹 IMPROVEMENTS​

Updated CIS Azure Foundations 3.0 benchmark policy​

Evaluate your Azure subscriptions against the latest CIS recommendations with the updated CIS Azure Foundations benchmark version 3.0. This updated policy includes 15 all-new checks as well as 69 updated checks.

Improved asset view in policies​

Out with the old and in with the new: Now you can view risk scores, risk factors, and last updated times for assets directly from the policy pages.

Shodan host asset overview​

Shodan host scans are now included in the "Domains and Hosts" inventory group and include helpful configuration summary information on their asset pages.

Resource updates​

github.repository​

• New codeOfConductFile field
• New supportFile field
• New securityFile field

github.file​

• New exists field

microsoft.conditionalAccess​

• New resource with namedLocations field

microsoft.conditionalAccess.ipNamedLocation​

• New resource with name and trusted fields

azure.subscription.networkservice.applicationGateway​

• New wafConfiguration field using the new azure.subscription.networkService.wafConfig resource

azure.subscription.webService.appsite​

• New functions field using the new azure.subscription.webService.function resource

🐛 BUG FIXES AND UPDATES​

• Improve the performance of EC2 instance discovery.
• Fix tag filtering in the AWS provider.
• Avoid errors in the AWS Elasticsearch, SageMaker, and SNS resources when nil values are returned.
• Ensure that the AWS KMS resource returns all keys.
• Improve performance of data exports.
• Improve performance loading vulnerability data.
• Show risk scores for each CVE displayed on advisory pages.
• Improve asset category names in the inventory page.
• Improve performance of checks in the CIS GitHub benchmark policy.
• Improve the overall reliability of multiple checks in CIS Linux benchmarks.
• Fix invalid Kubernetes operator installation code in the Kubernetes integration.
• Improve reliability of inactive asset cleanup in large spaces.
• Fix some Red Hat advisories with CVSS v3 data incorrectly identifying as CVSS v2 format.
• Improve the display of data query results in command line scans.
• Improve cnspec logging when running as a service.
• When searching for spaces, show the name not the ID.

🥳 Mondoo 11.22 is out! This release includes the new case overview, Zendesk ticket support, a Microsoft Entra ID security policy, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container

🎉 NEW FEATURES​

Cases and ticket system integrations!​

Mondoo users can now group security findings into cases and assign those cases to external ticket systems for efficient tracking and resolution. Cases ship today with out-of-the-box support for Jira and Zendesk, with more to come.

Key highlights:

• Group findings into cases for better organization and management.
• Delegate cases to external teams using your existing ticketing systems.
• Automatically update issues as your team remediates findings, ensuring real-time progress tracking.
• Auto-close cases and corresponding tickets when all findings within a case are resolved.

This feature enhances collaboration and simplifies the remediation process, helping teams stay focused on securing your environment.

Microsoft Entra ID policy​

Secure your Microsoft Entra ID (previously Active Directory) with our new Mondoo Microsoft Entra ID Security policy. This policy includes essential checks to keep your directory data secure.

🧹 IMPROVEMENTS​

New checks in the CIS Azure Foundations benchmark policy​

Harden your Microsoft Azure subscriptions with expanded checks in the CIS Azure Foundations Benchmark policy. This policy now ensures that Azure Key Vault rotation is configured and AppService HTTP logs are enabled.

🐛 BUG FIXES AND UPDATES​

• Improve rendering of complex remediation text in CIS policies.
• Fix the alignment of the Start Scanning and Browse Integration buttons in new spaces.
• Improve handling of SMBIOS data on Windows to prevent errors displaying in the asset overview.
• Fix failures to scan more than 100 S3 buckets at a time.
• Resolve an AWS serverless integration error shown in the console integration details page.
• Improve the rendering of some CVE descriptions.
• Update AWS policies to use the latest RDS MQL resources.
• Install cnspec from install.mondoo.com instead of mondoo.com during Azure VM scans.
• Fix false negatives when checking bootloader config on Linux distributions based on RHEL 9.
• Skip GDM and firewalld checks when those packages aren't installed on Linux distributions based on RHEL 9.
• Fix policy pages in the registry to display all checks when policies include duplicate check names.
• Don't include asset, policies, or checks counts in ticket system integration pages.
• Improve consistency of letter score calculations.
• Add EOL detection support for FreeBSD 13.4.
• Fix auto-closing of Jira tickets when all Mondoo assets have been deleted.

🥳 Mondoo 11.21 is out! This release includes improved vulnerability views, policy and resource additions, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container

🧹 IMPROVEMENTS​

Risk summaries for software​

Quickly understand the risk of software versions deployed throughout your infrastructure with new risk summary boxes on software pages. The risk, CVSS score, EPSS score, risk factors, and blast radius help you make informed decisions when it comes to prioritizing software updates in your infrastructure.

Discover advisories for CVEs​

CVE pages now show whether the CVE has a related advisory. Now you can dive deeper into specific vendor recommendations when evaluating the impact of CVEs on your infrastructure.

New checks in the CIS Azure Foundations benchmark policy​

Harden your Microsoft Azure subscriptions with expanded checks in the CIS Azure Foundations Benchmark policy. This policy now ensures that guest users in Entra ID are further restricted and that storage accounts have logging.

Resource updates​

azure.subscription.keyVaultService.vault​

• New autorotation field using the new azure.subscription.keyVaultService.key.autorotation resource

🐛 BUG FIXES AND UPDATES​

• Truncate long control names in compliance report filenames.
• Rename the TLS/SSL Security policy to Mondoo TLS/SSL Security to match other Mondoo policies.
• Fix asset search at the organization level not returning results.
• Improve colorblind mode display.
• Show space names instead of space IDs in organization-level search results.
• Add EOL detection for FreeBSD 13.2 and 14.1.
• Update EOL dates for AlmaLinux 8 and Ubuntu 24.04 to match the latest vendor dates.
• Fix false positive CVEs in packages on Red Hat Enterprise Linux and UBI container images.
• Fix MRNs displaying in top security findings list instead of names.
• Provide a helpful error message if the cnquery/cnspec GCP provider fails to authenticate with Google Cloud.
• Fix mapping of checks to compliance frameworks when a policy includes variants.
• Update integration setup flow to mention both recommended query packs and policies.
• Show an unknown risk score when no risk is known for a CVE or advisory.
• Don't show findings with a blast radius of 0 in the top security findings list.
• Ensure the vulnerabilities page lists only CVEs that impact the space.
• Improve rendering of risk rank numbers above 999.