ET Ducky changelog, October 22, 2026

These changes cover the ET Ducky desktop app, remote control from a phone, Automated Troubleshooting, and kernel event capture on the agents. Items marked with a desktop app or agent version reach a computer when it runs that release or a later one. Both installers are on the downloads page.

New

• Answers in the desktop app cite the events they are based on. Each citation links to the Events page, which shows only the cited events and highlights them. This needs desktop app 2.8.2.
• When event context is on, desktop app answers about the computer include its OS build, memory, disks, CPU load, antivirus product, domain, and uptime. This needs desktop app 2.8.2.
• The System Analysis page in the desktop app records a baseline of an app's activity and compares a later run against it. You can send the comparison to chat and ask about it. This needs desktop app 2.8.2.
• The System Analysis page runs a 60 second file I/O latency capture and shows the files and processes with the slowest file I/O. Live monitoring pauses during the capture and resumes afterward. This needs desktop app 2.8.2.
• Phone keyboards offer predictive text and autocorrect when you type into a remote machine from a phone. Turn off the Predictive text switch under Settings in the session to type passwords. The choice is kept for that browser (see the Remote Desktop documentation).

Improved

• A new remote desktop session opens on the remote machine's primary display when it has more than one, even if the last session ended on another display.
• Automated Troubleshooting continues as soon as the agent answers a query, without waiting for the next 5 second check. A query the agent is already running is no longer sent to it again (see the Troubleshooting documentation).
• An agent that reconnects receives the configuration changes saved while it was disconnected.
• Agents restart kernel event capture on their own when the capture session stops, and keep retrying until it runs again. This needs agent 2.8.4.3.
• The behavioral rule engine does less work for each kernel event and releases a process's rule state when the process exits. This needs agent 2.8.4.3 (see the Behavioral Detections documentation).
• The desktop app keeps at least the most recent 250,000 captured events, and its Events page refreshes only when new events arrive. This needs desktop app 2.8.2.
• The desktop app restarts live monitoring once when Windows ends its capture session, keeps the events it already captured, and shows a message on the Events page if it happens again. This needs desktop app 2.8.2.

Fixed

• On a computer that runs both the desktop app and the agent, live monitoring in the desktop app no longer stops the agent's capture, and the desktop app's event list no longer freezes while monitoring shows as on. This needs desktop app 2.8.2 and agent 2.8.4.3.
• Documentation recorders no longer stop each other's capture.
• Symbols typed from a phone keyboard, such as ? and :, reach the remote machine, and latched Ctrl, Alt, and Shift keys apply to typed text.
• Opening the phone keyboard during a remote session no longer scrolls the view to the bottom or turns the screen black for a moment.
• Ask Ducky answers in the remote session tools panel are readable when the dashboard uses the Light theme.