Tech Docs: 3 New Features in the Latest Traps Management Service Release

The June release of the Traps management service is now available and introduces the following key features and capabilities:

Quarantine by Verdict Source

On Windows endpoints, you can now quarantine malware based on the verdict source. This enables you to define different quarantine policies for files that have a malware verdict issued by WildFire or an administrative hash control policy versus files that have a malware verdict issued by Traps local analysis.

Uninstall Password Enforcement

On new tenants created in June 2018 or later, the Traps management service now enforces the best practice recommendation to change the uninstall password to a new password which meets the Traps management service security standards. Before you can create a new installation package or a new profile in the Traps management service, you must define the uninstall password. If you later need to change the uninstall password, you can do so in an Agent Settings Profile.

New Security Event Search Criteria

You can now use new search criteria to filter security events that occur on one or more endpoints or are associated with one or more users.

The new search filters enable you to search events by:

• Endpoint Name—Endpoints that match a full or partial endpoint name or alias.
• Endpoint ID—Endpoints that match the full endpoint ID assigned by the Traps agent.
• Username—Users that match a full or partial string and optionally include the user’s domain in the format domain\username.

For more details on the new features available in this release, please refer to the following resources:

• Traps Management Service Release Notes
• Traps Management Service Administrator’s Guide

Happy reading!
Your friendly Technical Documentation team

Have questions? Contact us at documentation@paloaltonetworks.com.