Depot 0.6.0

Depot 0.6.0 helps IT teams and MSPs prioritize vulnerabilities, verify script policy delivery, and keep retired endpoints out of the active alert queue. These improvements are based on evaluator feedback.

Highlights

• Vulnerability priorities. Distribution security data recognizes backported fixes. Unverified matches and findings without a distribution fix have separate counts.
• Policy evidence. See whether an agent received its script settings, and preview a site’s policy before enrolling an endpoint.
• Alert ownership. Unresolved includes open and acknowledged alerts. Retirement closes both with a reason that preserves their meaning.

Added

Policy and remote terminals

• Preview policy for new endpoints on site and enrollment pages shows what an endpoint of a chosen operating system would receive. The result is marked as a preview, with no endpoint evidence. See Preview before enrollment.
• Remote shell policy controls interactive terminal access independently of scripts, including AI and MCP terminal access. See Remote shell settings.

Windows device management (preview)

• Enroll PCs in bulk with a provisioning package, or from the Outpost agent already on a PC.
• Deliver security, management, kiosk and shared-PC settings, Wi-Fi and VPN profiles, device certificates, and ADMX-backed policies. Outpost reads each setting back to confirm it applied.
• Run Fresh Start, wipe, locate, and diagnostics actions. Fresh Start needs a second person’s approval by default.
• Use Windows build and device health attestation results in compliance.

See Windows.

Endpoint visibility

• Linux, macOS, and BSD security views show Host firewall with the detected firewall. Not reported means no firewall tooling answered. The disabled-firewall alert explicitly states that upstream protection is not assessed. See Endpoint security.
• Agent capabilities on the endpoint overview lists supported, report-only, and unavailable capabilities, with reasons. Missing evidence is identified as not reported. See Endpoint capabilities.

Changed

Vulnerability assessment

• Linux packages use distribution security data from the Debian security tracker and OSV, with native package version comparisons. Feed families include Debian, Ubuntu, AlmaLinux, Rocky Linux, Red Hat, SUSE, and Alpine. Verification requires exact release coverage, including the exact product for Red Hat and SUSE.
• Findings show their source. Upstream match, not distro-verified and No distro fix available remain visible for awareness and are counted separately from critical and high findings.
• Distribution severity ratings take precedence when assigned; otherwise NVD supplies the severity. Outpost checks for newly reported distribution releases about every 15 minutes. Findings refresh on the next scan.

See Vulnerabilities for source labels, coverage, and how to review findings.

Script settings

• Effective config identifies script delivery as Agent (script environment), with Applied, Pending, or Not reported evidence.
• Profile edits, assignments, site moves, and server-role tag changes send updated settings to connected endpoints right away.

See Script delivery.

Alerts and retirement

• Retiring an endpoint resolves open and acknowledged alerts as Endpoint retired and stops pending escalations.
• Alert views default to current endpoints. Include retired endpoints includes their alert history.
• Unresolved totals include open and acknowledged alerts, because acknowledgment does not mean remediation.
• The queue warns when no notification rules are active.

See Alerts and Retire an endpoint.

Console

Lists, page headers and dialogs name users, technicians, endpoints, clients, profiles and other records instead of showing internal IDs. A record with no name reads Unknown.

Fixed

Vulnerability matching

NVD matches respect applicability conditions. Add-ins and plug-ins are assessed as separate products from their hosts.

Security

The agent enforces script settings and refuses one-off, scheduled, library, and AI or MCP script runs when scripts are off. Outpost and the agent also enforce the separate interactive terminal setting.

Upgrade notes

Outpost manages the hosted service update. Use agent 0.3.0 or later for distribution package identity and script delivery reporting. Older agents’ Linux package findings remain not distro-verified.

After the agent updates, check Effective config for script delivery evidence and review vulnerability findings after the next scan. See Agent 0.3.0 and Agent updates.