What's New, Halcyon? Enterprise Web UI March 2024 Release Notes

Halcyon is excited to announce that a new Enterprise Web UI is available for use at console.halcyon.ai. This enhanced interface is designed to provide a more robust and user-friendly experience.

Please note that the current console interface will continue to be accessible at manage.halcyon.ai until April 30th, 2024. After this date, access to the console via manage.halcyon.ai will be retired and all users will be transitioned to the new Enterprise Web UI.  

We look forward to your feedback on our new interface and thank you for your continued support.

Required SSO Changes:

Existing Halcyon customers that have already integrated manage.halcyon.ai Web UI access with their SSO will need to make minor changes to their SSO configuration to use the new Enterprise Web UI. These changes are essential for keeping seamless access and navigation for users within your organization.

Updating Okta OIDC Configuration

For integrating with Okta's OpenID Connect (OIDC), update the following configuration:

• Homepage URL: Change this URL from ‘https://manage.halcyon.ai/...’ to ‘https://console.halcyon.ai/...’ This adjustment redirects users to the new console homepage after authentication.

Adjusting SAML Settings

When configuring Single Sign-On (SSO) with SAML, you need to make a single change:

• Default Relay State URL: Update this setting from ‘https://manage.halcyon.ai/...’ to ‘https://console.halcyon.ai/...’. This modification ensures users are redirected to the correct console landing page post-login.

What's New:

The latest update to the Halcyon Enterprise Web UI Preview mode introduces an enhanced Data Export feature, empowering users to generate comprehensive reports across diverse data sets within the Halcyon platform.

Data Export:

The Data Export screen allows users to create reports with different types of data in the Halcyon platform. These reports offer flexibility, allowing users to include either the complete dataset or a refined subset tailored to their specific needs.

Export Alerts: from the Alerts screen, simply click on the Export button and choose either to export all entries or the top (specified number) values.

Export Assets: from the Assets screen, simply click on the Export button and choose either to export all entries or the top (specified number) values.

Export Overrides: from the Overrides screen, simply click on the Export button and choose either to export all entries or the top (specified number) values.

The report type currently only supports CSV format. Once the file is created and uploaded, users will receive an email notification.

Alert Mutability:

The Alert Mutability feature in Halcyon Platform enables users to review, triage, add notes, and toggle alerts between visible or hidden states. Three new columns, "Display Status", "Triage Status" and "Actions", are introduced to the Alerts screen offered quick visibility into each alert's current state.  

• Display Status (Visible/Hidden) - indicates whether the alert is currently visible or hidden from view. Users can choose this status based on preferences or alert severity.
• Triage Status (New/Reviewed) - represents the triage progress of each alert, showing whether it’s been reviewed or needs further action. This status helps tracking the triage process and ensuring all alerts are appropriately addressed.
• Actions - enables users to drill down to view detailed Alert information and quickly change the alert’s visibility or its triage statuses.

Artifact info - facilitates users with a centralized overview of critical details such as Offending Hash/Module, Alert Type, Default Response, Configured Response, Display Status, and Triage Status, prominently positioned at the top of the Alert Detail page.

Alert Note - enables user to add, edit, or delete relevant notes for each Alert. Users can effortlessly manage and view notes associated with each alert by simply clicking on the alert detail.

Assets Mode:

The Assets Mode feature in the Halcyon Platform empowers users to effortlessly switch a device's mode between Learning and Blocking, providing the flexibility to promptly adjust and monitor the device's behaviors.

From the Assets screen, select a device to view Device detail. Users will have a dropdown option to select Blocking or Learning mode.

Events Screen:

The Events screen, formerly referred to as "Events," enables users to access the same detailed event information from the top tenant level view and ability to drill down to each event.

Halcyon.ai is the leading anti-ransomware company. Global 2000 companies rely on the Halcyon platform defeat ransomware with minimal business disruption through built-in bypass and evasion protection, key material capture, automated decryption, and data exfiltration and extortion prevention – talk to a Halcyon expert today to find out more. Halcyon also publishes a quarterly RaaS (Ransomware as a Service) and extortion group reference guide, Power Rankings: Ransomware Malicious Quartile, and check out the Recent Ransomware Attacks resource site.