The update is related to the Countercept Agent’s Sensor component. The Sensor component gathers data to be analyzed in the WithSecure backend to identify any malicious activity.

Product Name: Countercept Agent for Linux – Sensor Component

Version: 2025.2.168

Pilot Availability: 30/09/2025

General Availability: 14/10/2025

Predecessor: 2025.1.198

Release Purpose:

• New Features and Enhancements
• Generic Maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• sensor

New Features and Enhancements:

• Faster initial forwarding of telemetry 
• EPP scan and tamper events are included in new detections 
• New detections and detection improvements 

Generic Maintenance:

• Dependency updates and bug fixes

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

Please note that CentOS 6 and RHEL 6 are not supported. The Countercept Agent will break with this update, on endpoints where these operating systems are in use. WithSecure recommends upgrading these endpoints to the supported versions of the operating system, or switching clients to managed updates in collaboration with the WithSecure Engagement team.

The update is related to the Countercept Agent’s Response Engine (RE) Common Response Actions Module (CRAM) components. The Response Engine and Common Response Actions Module components of the Countercept Agent enable the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment. 

Product Name: Countercept Agent for Linux – CRAM and RE

Version:

• CRAM 1.24.112
• Response Engine 3.3.2

Pilot Availability: 22/09/2025

General Availability: 24/09/2025

Predecessor:

• CRAM 1.24.110
• Respone Engine 3.1

Release Purpose:

• Generic Maintenance

Customer Action Required

• N/A

Name Changes:

• Third-party libraries got newer versions with corresponding name changes.
• No changes to process, or service names.

Files Updated:

• Numerous files are updated with this release.

New Features and Enhancements:

• N/A

Generic Maintenance:

• Openssl and python components are updated to address recently discovered vulnerabilities.
• Bug fixes and performance improvements.

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15 SP1 – SP3
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

Please note that CentOS 6 and RHEL 6 are not supported. The Countercept Agent might break with this update, on endpoints where these operating systems are in use. WithSecure recommends upgrading these endpoints to the supported operating system versions, or switching clients to managed updates in collaboration with the WithSecure Engagement team.

The update is related to the Countercept Agent’s FSBG components. The FSBG component is responsible for the core functionality (e.g. settings management and updates) of the Countercept Agent and does not affect the components responsible for telemetry collection or response.

Product Name: Countercept Agent for Linux – FSBG

Version: 1.0.921

Pilot Availability: 13/05/2025

General Availability: 20/05/2025

Predecessor: 1.0.918

Release Purpose:

• Generic Maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• Most files are updated with this release.

New Features and Enhancements:

• N/A

Generic Maintenance:

• Fixes for issues identified during 1.0.920 Pilot.
• Fixed a possible deadlock issue in case of temporary update installation failures.
• The renewed corporate OpenPGP key is taken in use for the Critical security patching capability.
• Minor bug fixes and improvements.

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15 SP1 – SP3
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

Please note that CentOS 6 and RHEL 6 are not supported. The Countercept Agent might break with this update, on endpoints where these operating systems are in use. WithSecure recommends upgrading these endpoints to the supported operating system versions, or switching clients to managed updates in collaboration with the WithSecure Engagement team.

This is a notification that the update to our Countercept Agent for Linux, containing general maintenance improvements for the Linux Agent’s FSBG component and released to Pilot group endpoints on the 5th of May 2025, has been cancelled.

Due to issues identified during the Pilot phase, the General Availability release for this FSBG component update has been cancelled and a new release will be prepared. We will advise on the release schedule for the new update shortly.

As always, please don’t hesitate to contact us if you have any questions.

The update is related to the Countercept Agent’s FSBG components. The FSBG component is responsible for the core functionality (e.g. settings management and updates) of the Countercept Agent and does not affect the components responsible for telemetry collection or response.

Product Name: Countercept Agent for Linux – FSBG

Version: 1.0.920

Pilot Availability: 05/05/2025

General Availability: 12/05/2025

Predecessor: 1.0.918

Release Purpose:

• Generic Maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• Most files are updated with this release.

New Features and Enhancements:

• N/A

Generic Maintenance:

• Fixed a possible deadlock issue in case of temporary update installation failures.
• The renewed corporate OpenPGP key is taken in use for the Critical security patching capability.
• Minor bug fixes and improvements.

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15 SP1 – SP3
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

Please note that CentOS 6 and RHEL 6 are not supported. The Countercept Agent might break with this update, on endpoints where these operating systems are in use. WithSecure recommends upgrading these endpoints to the supported operating system versions, or switching clients to managed updates in collaboration with the WithSecure Engagement team.

The update is related to the Countercept Agent’s Sensor component. The Sensor component gathers data to be analyzed in the WithSecure backend to identify any malicious activity.

Product Name: Countercept Agent for Linux – Sensor Component

Version: 2025.1.198

Pilot Availability: 29/04/2025

General Availability: 06/05/2025

Predecessor: 2024.2.132

Release Purpose:

• New Features and Enhancements
• Generic Maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• sensor

New Features and Enhancements:

• Performance improvements to file event gathering in Kernel 5.10 and newer.
• Detection improvements.
  • Changes to firewall rules are now monitored.
  • Shared library loadings are now monitored.
  • Shebang script information is now included in process details.
• SELinux file context is now handled by sensor’s installer.

Generic Maintenance:

• Fixes for issues identified during 2025.1.186 Pilot.
• Changes to sensor event handling and data storage to improve disk I/O, CPU and memory usage on high load systems.

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15 SP1 – SP3
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

Please note that CentOS 6 and RHEL 6 are not supported. The Countercept Agent will break with this update, on endpoints where these operating systems are in use. WithSecure recommends upgrading these endpoints to the supported versions of the operating system, or switching clients to managed updates in collaboration with the WithSecure Engagement team.