- The client now correctly stores reputation information in the local cache so it doesn’t have to perform a lookup multiple times.
- The client now records the following items in the Activity Log, instead of the Debug Log:
- Local reputation
- JTI content rule that was matched
- Event type
- Reputation responses from Advanced Threat Defense now correctly report Allow or Would Block events when the client is set to Observe Mode.
- Reputation responses from Advanced Threat Defense now correctly report Allow events when the client is set to Enforce Mode.
- The client no longer logs reputation lookup entries to the Activity Log, improving responsiveness to driver callbacks and overall application launch performance.
- The client now extends the timeout for the file system filter driver’s event before submitting a file to Advanced Threat Defense.
For a full list of changes, see the Release Notes in PD26824:
For a list of Known Issues, see KB82450: