ET Ducky changelog, October 18, 2026

These changes cover service and event log health on Windows and Linux agents, alerts for agents that stop reporting, the MCP server and read-only API, the Offline Windows Update card, and the Agents page. Items marked with an agent version reach a machine when it runs that agent release or a later one.

New

• Agents report services that crashed or failed to start in the last 24 hours, with a crash count for each service and the latest crash records. On Windows these come from Service Control Manager events, and on Linux from systemd services in the failed state. This needs agent 2.8.4.0 (see the Alerts documentation).
• Agents report the number of event log errors in the last hour. On Windows that is Error and Critical entries in the Application and System logs, and on Linux it is journal entries at error priority or more severe. Event log collection is on by default from agent 2.8.4.0, and upgrading turns it on once for agents that had it off.
• Alert rules can use lowest drive free across all drives, recently failed services, and event log errors in the last hour as conditions (see the Alerts documentation).
• Rules on seconds since last contact and days since last sample now fire for agents that have stopped reporting. The server checks silent agents every 2 minutes, and a rule fires no sooner than 5 minutes after the agent's last contact.
• ET Ducky has an MCP server and a read-only public API. An organization API token lets an AI assistant or a script read your agents, alerts, and a fleet summary (see Query your fleet from an AI assistant with ET Ducky's MCP server and the API documentation).
• Members holding the new API editor privilege can create and revoke organization API tokens, as organization admins and owners can.
• The Offline Windows Update card shows whether your Distribution Hub's copy of Microsoft's offline catalog (wsusscn2.cab) is current, with Microsoft's download link and steps to verify the file and copy it to the hub (see Offline catalog status on the Offline Windows Update card).
• Organization admins can set the Agent Telemetry Directive and turn off optional heartbeat blocks under Heartbeat Detail. Every save is recorded in the audit log (see the Configuration documentation).
• Automated Troubleshooting results ask "Was this run useful?" with Helpful and Not helpful, and any member of the organization can rate a run (see the AI Diagnostics documentation).

Improved

• MCP directories can list the server's four read-only tools without a token. Calling a tool still needs an organization API token.
• The dashboard loads its scripts in bundles, so a cold load of a dashboard page makes 38 script requests instead of 158.
• An agent that has sent no health sample for 7 days shows "No health data in 7 days" in the Agents list. Hover over it to see whether the agent is online and when its last heartbeat arrived (see the Agents documentation).
• Agent configuration presets and reset to defaults include event log collection.
• A troubleshooting run that stops because the server restarted, or makes no progress for 35 minutes, ends with a message that says so and no longer stays in a running state (see the Troubleshooting documentation).

Fixed

• An agent counts as online when its last heartbeat arrived within the last 5 minutes, on every page and in the API. The Active Now card and the Agents list now show the same online count, and an agent shows offline within 6 minutes of its last heartbeat.
• The Agents list refreshes after you save an agent's configuration.
• Workspace cards no longer reload when you click inside them, which erased their save messages.
• The alert rule builder handles quotes in attribute values.