ET Ducky changelog, October 29, 2026

These changes cover the ET Ducky desktop app, remote control, agent health data, automations, and Data Explorer. Items marked with a version reach a machine when it runs that release or a later one. The agent release is 2.8.5.0 and the desktop app release is 2.8.5, and both installers are on the downloads page. The desktop app now has its own documentation page.

New

• The Security tab for an agent in the desktop app shows each detection's evidence, including the process, its parent, the session, the signer, and the surrounding events. Ask about this starts a question about the detection in Ducky Chat or in a live session on that agent. The list reaches back as far as your plan's data retention, and 14 days without a paid retention plan. This needs desktop app 2.8.5 (see Behavioral Detections).
• The desktop app keeps the evidence behind each chat answer on the computer. Export evidence saves a zip with the record as JSON and as a Word document, and Attach to ticket adds the record to an ET Ducky ticket as a note. This needs desktop app 2.8.5 (see AI Diagnostics).
• The Timeline tab for an agent in the desktop app shows CPU, memory, and free disk space on one time axis, with lanes for detections, metric changes, patch jobs, configuration changes, alerts, tickets, and troubleshooting runs. This needs desktop app 2.8.5 (see Health Monitoring).
• When you also have an active subscription, an Answer with selector in the Ducky Chat header lets you choose between your own API key and your ET Ducky subscription. The desktop app encrypts saved API keys for your Windows account and removes them when you sign out. This needs desktop app 2.8.4 (see Desktop App).
• The desktop app asks you to choose an organization when your account belongs to more than one, and an organization picker sits above the Dashboard. This needs desktop app 2.8.4.
• The Ticket Submitted trigger has a Source condition with the values contact form, status page, device, dashboard, and automation. The Automations documentation has an example that emails you when the contact form files a ticket (see Automations).
• The Events data source in Data Explorer has new fields for the result the agent reports, such as ACCESS_DENIED, along with file name, registry path, image path, source and destination address and port, parent process ID, session ID, user SID, and signer. Events stored before this release show these fields empty (see Data Explorer).
• A Troubleshooting Jobs data source in Smart Reports and Data Explorer lists each troubleshooting run with its status, start and end time, run length, and ticket.
• Agents report uptime, time sync offset, DNS resolve time, and gateway round trip with every health sample. They also report the reasons for a pending reboot, the time of the last installed update, the count of pending updates from the last patch scan, and how long the last boot took. This needs agent 2.8.4.9 (see Health Monitoring).
• Windows agents report the health of each physical disk, including temperature, wear, read and write errors, and the drive's failure prediction. They also report the last bug check, WHEA hardware errors in the last 24 hours, and unclean shutdowns in the last 7 days. This needs agent 2.8.4.9.

Improved

• When a remote control connection drops on the way, for example during a network drop, the page reconnects to the same session and keeps the last picture until frames arrive again (see Remote Desktop).
• Wake display and Retry get the current picture and display information from the remote machine with remote desktop helper 2.8.4.7 or later.
• A UAC prompt or sign-in screen can be reached from whichever display is selected in a multi-display session. Capture returns to the normal display capture after the prompt is answered. This needs a remote desktop helper later than 2.8.4.7.
• Keyboard Grab is on when a remote control session starts, so browser shortcuts go to the remote system.
• Pausing event collection from the remote control toolbar stops the agent from sending events to the session until you resume. This needs agent 2.8.4.6.
• Once a remote desktop helper is cached, agents check for a newer one every hour, retry a failed check after fifteen minutes, and check when a remote desktop session starts. This needs agent 2.8.4.8 (see Recovery and Repair).
• A shell command sent while the agent's shell slots are busy shows as queued and starts in the order sent. Each command runs once. This needs agent 2.8.4.9 (see Live Sessions).
• Anomaly-triggered diagnostics check every health sample, and sustained conditions are measured in seconds. This needs agent 2.8.4.9.
• A security posture check that worked before and now fails is listed as a posture probe failure. This needs agent 2.8.4.9.
• Agents hold a smaller backlog of captured events in memory on busy hosts. This needs agent 2.8.4.6.

Fixed

• The FPS and KB/s counters in remote control show the stream on every codec, and the toolbar buttons no longer cover them.
• Events an agent kept while it could not reach ET Ducky are sent again in batches the server accepts. This needs agent 2.8.5.0.