ET Ducky changelog, November 1, 2026

These changes cover alert rules, configuration imports, behavioral detections, the agent support bundle, the shells, and the remote desktop viewer. Items marked with a version reach a machine when it runs that release or a later one. The current agent release is 2.8.5.2.

New

• An alert rule can watch one named service with the Service running metric. When you pick a metric that needs a target, the Rule Builder shows a target box with a hint below it (see Alerts).
• Alert rules can fire on Windows Event Log entries by log, event ID, and source, on the size of a file or folder, and on ping loss or round trip to a host. Each agent gets a watch list built from the rules that apply to it and sends back only the readings, never event message text, file names, or file contents. This needs agent 2.8.5.1, and Event Log entries need a Windows agent.
• Two patch metrics are available in alert rules. One counts patch jobs that failed, regressed, or rolled back in the last 24 hours, and the other counts security and critical updates pending from the last patch scan.
• Each detection from agent 2.8.5.2 carries evidence context with up to 60 events from the 15 seconds before to the 5 seconds after the firing. It also carries the SHA-256 of the program's file when the agent could read it (see Behavioral Detections).
• Agent 2.8.5.2 can write a support bundle on the host when you run it with --diag. The zip holds the agent's configuration with credentials removed, its recent logs, and environment details. Nothing in it is sent anywhere (see Troubleshooting).

Improved

• A rule that keeps firing for the same program is reported on a ladder of 1, 5, and 30 minutes, with the number of held firings shown as Suppressed count. A critical firing is always reported, and held firings still count toward the ransomware kill-chain rule. This needs agent 2.8.5.2.
• AI import drafts map antivirus, Windows Update, pending update, stopped service, and patch age monitors to alert metrics, and map monitor priorities to critical, warning, or info. Event Log, Ping, and File/Folder size monitors map to the new watch list metrics. A monitor's response becomes an Alert Fired automation that uses your organization's own channels and scripts (see Configuration Export and Import).
• When an AI import draft can't carry everything over, Request review asks ET Ducky to add what is missing. Uploaded files go with the request only when you tick the box.
• An Alert Fired automation runs once each time an alert rule opens a new alert on a device (see Automations).
• The Multi-Agent Session and Fleet Tools shells show the reason a command was blocked or refused, in the same words as the Live Session shell. A script run names each target it was not sent to.
• All four shells (Live Session, Multi-Agent Session, Fleet Tools, and remote desktop) stop waiting on a command that was blocked, failed, or cancelled and show the reason. The Multi-Agent Session and Fleet Tools shells wait for a result until a minute past the command's own timeout (see Live Sessions).
• In the remote desktop viewer, Ctrl+wheel zooms the view between Fit and 400% around the pointer. When the view is larger than the window, Ctrl+drag or the scroll thumbs at the right and bottom edges move around it. A high-DPI screen scales the picture once, so text is sharper (see Remote Desktop).
• The Data Retention page lists what each tier keeps, the records with a fixed window on every tier, and the records kept for the life of the organization (see Data Retention).
• The Automations page has an example that alerts you when a scheduled script exits with a code other than 0, using the Shell Commands data source.

Fixed

• The remote desktop viewer keeps the picture when the agent sends its display information again after a reconnect or a display switch. Long sessions no longer flash black, and an idle desktop no longer stays black until the mouse moves.
• The View Responses From filter in a Multi-Agent Session shows only in the Query tab and no longer covers the Shell input. The Automated Troubleshooting hosts note lists only the hosts in the session (see Multi-Agent Sessions).
• A Smart Reports question that returns a list of rows shows a table for every question type.
• An imported multi-step automation takes the action of its first step.
• A file transfer runs once and no longer starts again while it is in progress. This needs agent 2.8.5.1.