v0.8.0

Upgrade notes (action required)

• Fleet EDR is now RawTrail, at github.com/rawtrail/rawtrail. The images are ghcr.io/rawtrail/rawtrail-server and ghcr.io/rawtrail/rawtrail-demo-seed; point your compose file or manifests at them before upgrading, since the old image names receive no further releases. The ingest and migrate binaries are now rawtrail-ingest and rawtrail-migrate. Existing alerts credited to Fleet EDR are re-credited to RawTrail.
• Verify release signatures against the new identity. Releases are signed by https://github.com/RawTrail/RawTrail/.github/workflows/release.yml (see docs/install-agent-manual.md), and gh attestation verify needs --owner rawtrail. Releases through v0.7.0 keep the getvictor/fleet-edr identity and their ghcr.io/getvictor/fleet-edr-server image; verify those with the docs at their release tag.
• Telemetry reports as rawtrail-server. Update any dashboard, alert or saved query that filters on service.name = 'fleet-edr-server'; the shipped SigNoz dashboards and alert rules already use the new name, so re-import them.
• Webhook deliveries send User-Agent: rawtrail-webhook/1. Update any receiver or firewall rule that matches the old fleet-edr-webhook/1.
• The break-glass account is now admin@rawtrail.local. The upgrade moves the existing account, with its passkey and role, so sign in with the new address.
• Reinstall the agent on every Mac: remove Fleet EDR first. The agent, app and extensions have new names and bundle IDs (RawTrail.app, io.rawtrail.*), so the RawTrail package does not upgrade Fleet EDR in place. On MDM-managed Macs, remove the com.fleetdm.edr.profile.* profiles first: macOS refuses to remove the old extensions while their System Extensions profile is installed. Then run sudo "/Library/Application Support/com.fleetdm.edr/uninstall.sh" and confirm systemextensionsctl list shows no active com.fleetdm.edr extension, rebooting if removal is pending, before installing rawtrail-<version>.pkg. Each Mac enrolls again with the enroll secret and keeps its host record, since hosts are keyed by hardware UUID.
• Deploy the new configuration profiles. Push the System Extensions, Full Disk Access and Background Items profiles (io.rawtrail.profile.*) before the package.
• The agent's settings file is /etc/rawtrail.conf (%ProgramData%\RawTrail\rawtrail.conf on Windows). Move the enroll secret and server URL from /etc/fleet-edr.conf before installing, leaving out any EDR_XPC_SERVICE or EDR_NET_XPC_SERVICE line (those name the old extensions), and update any install script or MDM payload that writes it.
• Update exclusions in other security tools. The agent runs from /usr/local/bin/rawtrail-agent, the app from /Applications/RawTrail.app, and its telemetry reports as rawtrail-agent; see docs/recommended-exclusions.md.
• The agent requires macOS 26 (Tahoe) or later. The installer now refuses older Macs and says so. Earlier packages installed on macOS 13 to 26.1 but could not run there, so upgrade any such Mac to macOS 26 first.

Added

• LaunchAgent and LaunchDaemon loads are recorded. When anything runs launchctl load or launchctl bootstrap, the agent reads each plist it names, and the plists in a directory it names (only those the user who ran it could read) and records the job's label, program and arguments. Process detail lists the jobs a command loaded, and the process tree links the command to each job launchd starts. Update the agent to collect them.
• AI agent sessions. A new Agent sessions page lists each Claude Code session the agents saw: its project, when it ran, and how many processes and alerts it produced, filterable by host, agent and recent activity. GET /api/agent-sessions serves the same list.
• See what a session did. The Commands view lists each command the agent ran with everything it started beneath it, including background processes, apps opened with open -a, and jobs started through launchctl. Each command shows the Bash tool call the agent reported in its transcript, labelled as the agent's own account; prompts and tool output are never read. The Processes view shows the whole session as one tree, and an optional toggle adds the agent's internal housekeeping. Alerts and privilege changes are badged where they happened.
• Session activity. An Activity view totals the files, network destinations, DNS names and Unix sockets a session touched, naming the process behind each; process detail shows the same for a process or its subtree (GET /api/hosts/{host_id}/activity). It counts only events from when the scope's processes started, so a process from before a reboot that reused a pid and pidversion is left out. A long file path is shortened from its start, keeping the file name, with the full path on hover. A connection to a well-known daemon's socket, such as 1Password's SSH agent or Docker, is tagged with the daemon's name. File changes and socket connections are collected for agent sessions only. A session started with /fork links to its parent.
• Process search by agent and session. Filter by agent, agent session, story, descendant of a process and argument over a time window, so every curl any Claude Code session ran this week is one search.
• SigNoz alert rules. Nine ready-made rules cover a silent server, stalled ingest, audit write failures, skipped detection rules, withdrawn event batches, failed maintenance sweeps and break-glass guessing. Apply them with tools/signoz-alerts.sh; see docs/operations.md.
• SigNoz and Datadog users: set OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE=delta. Without it those backends miss the first increment of each counter, so a rarely-moving counter such as audit write failures can increase without alerting. The quickstart compose now forwards this variable and OTEL_EXPORTER_OTLP_COMPRESSION.

Changed

• Much lower trace volume. Detection batches are now sampled with agent ingest traffic, and database queries outside a request or batch no longer produce spans. One host exported about 500,000 spans an hour, almost all from this background work. Metrics are unchanged.

Fixed

• No application-control rule can block the agent itself. The extensions and the app were already exempt, but the agent was not, so a block on the RawTrail signing team or certificate would have stopped it from restarting.
• A command containing a single quote now shows as the agent ran it in an agent session, with its "Reported by agent" label, instead of garbled.
• The agent session view's Commands, Processes and Activity switcher no longer moves when switching views.
• The server now works out the alert timeline's process chain. With the alert-chain focus on, the timeline no longer stops at what the graph had loaded, and still narrows when the graph cannot load. When it reaches only part of the chain, it says so and why.
• The process tree no longer misplaces a process whose parent's pid was reused. The server now records which process created each one, so a child appears under its real parent rather than a later process with the same pid, and a daemon stays under the process that launched it after launchd adopts it. This needs an agent from this release; older agents' processes are placed as before.
• Routine events no longer log as faults. A clean server stop no longer logs three gauge warnings and now exports their final values. An agent that disconnects mid-upload, as on a restart or sleep, is logged at INFO rather than ERROR; the agent resends the batch.

v0.8.0-rc.4

Upgrade notes (action required)

• Fleet EDR is now RawTrail, at github.com/rawtrail/rawtrail. The images are ghcr.io/rawtrail/rawtrail-server and ghcr.io/rawtrail/rawtrail-demo-seed; point your compose file or manifests at them before upgrading, since the old image names receive no further releases. The ingest and migrate binaries are now rawtrail-ingest and rawtrail-migrate. Existing alerts credited to Fleet EDR are re-credited to RawTrail.
• Verify release signatures against the new identity. Releases are signed by https://github.com/RawTrail/RawTrail/.github/workflows/release.yml (see docs/install-agent-manual.md), and gh attestation verify needs --owner rawtrail. Releases through v0.7.0 keep the getvictor/fleet-edr identity and their ghcr.io/getvictor/fleet-edr-server image; verify those with the docs at their release tag.
• Telemetry reports as rawtrail-server. Update any dashboard, alert or saved query that filters on service.name = 'fleet-edr-server'; the shipped SigNoz dashboards and alert rules already use the new name, so re-import them.
• Webhook deliveries send User-Agent: rawtrail-webhook/1. Update any receiver or firewall rule that matches the old fleet-edr-webhook/1.
• The break-glass account is now admin@rawtrail.local. The upgrade moves the existing account, with its passkey and role, so sign in with the new address.
• Reinstall the agent on every Mac: remove Fleet EDR first. The agent, app and extensions have new names and bundle IDs (RawTrail.app, io.rawtrail.*), so the RawTrail package does not upgrade Fleet EDR in place. On MDM-managed Macs, remove the com.fleetdm.edr.profile.* profiles first: macOS refuses to remove the old extensions while their System Extensions profile is installed. Then run sudo "/Library/Application Support/com.fleetdm.edr/uninstall.sh" and confirm systemextensionsctl list shows no active com.fleetdm.edr extension, rebooting if removal is pending, before installing rawtrail-<version>.pkg. Each Mac enrolls again with the enroll secret and keeps its host record, since hosts are keyed by hardware UUID.
• Deploy the new configuration profiles. Push the System Extensions, Full Disk Access and Background Items profiles (io.rawtrail.profile.*) before the package.
• The agent's settings file is /etc/rawtrail.conf (%ProgramData%\RawTrail\rawtrail.conf on Windows). Move the enroll secret and server URL from /etc/fleet-edr.conf before installing, leaving out any EDR_XPC_SERVICE or EDR_NET_XPC_SERVICE line (those name the old extensions), and update any install script or MDM payload that writes it.
• Update exclusions in other security tools. The agent runs from /usr/local/bin/rawtrail-agent, the app from /Applications/RawTrail.app, and its telemetry reports as rawtrail-agent; see docs/recommended-exclusions.md.
• The agent requires macOS 26 (Tahoe) or later. The installer now refuses older Macs and says so. Earlier packages installed on macOS 13 to 26.1 but could not run there, so upgrade any such Mac to macOS 26 first.

Added

• LaunchAgent and LaunchDaemon loads are recorded. When anything runs launchctl load or launchctl bootstrap, the agent reads each plist it names, and the plists in a directory it names (only those the user who ran it could read) and records the job's label, program and arguments. Process detail lists the jobs a command loaded, and the process tree links the command to each job launchd starts. Update the agent to collect them.
• AI agent sessions. A new Agent sessions page lists each Claude Code session the agents saw: its project, when it ran, and how many processes and alerts it produced, filterable by host, agent and recent activity. GET /api/agent-sessions serves the same list.
• See what a session did. The Commands view lists each command the agent ran with everything it started beneath it, including background processes, apps opened with open -a, and jobs started through launchctl. Each command shows the Bash tool call the agent reported in its transcript, labelled as the agent's own account; prompts and tool output are never read. The Processes view shows the whole session as one tree, and an optional toggle adds the agent's internal housekeeping. Alerts and privilege changes are badged where they happened.
• Session activity. An Activity view totals the files, network destinations, DNS names and Unix sockets a session touched, naming the process behind each; process detail shows the same for a process or its subtree (GET /api/hosts/{host_id}/activity). It counts only events from when the scope's processes started, so a process from before a reboot that reused a pid and pidversion is left out. A long file path is shortened from its start, keeping the file name, with the full path on hover. A connection to a well-known daemon's socket, such as 1Password's SSH agent or Docker, is tagged with the daemon's name. File changes and socket connections are collected for agent sessions only. A session started with /fork links to its parent.
• Process search by agent and session. Filter by agent, agent session, story, descendant of a process and argument over a time window, so every curl any Claude Code session ran this week is one search.
• SigNoz alert rules. Nine ready-made rules cover a silent server, stalled ingest, audit write failures, skipped detection rules, withdrawn event batches, failed maintenance sweeps and break-glass guessing. Apply them with tools/signoz-alerts.sh; see docs/operations.md.
• SigNoz and Datadog users: set OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE=delta. Without it those backends miss the first increment of each counter, so a rarely-moving counter such as audit write failures can increase without alerting. The quickstart compose now forwards this variable and OTEL_EXPORTER_OTLP_COMPRESSION.

Changed

• Much lower trace volume. Detection batches are now sampled with agent ingest traffic, and database queries outside a request or batch no longer produce spans. One host exported about 500,000 spans an hour, almost all from this background work. Metrics are unchanged.

Fixed

• No application-control rule can block the agent itself. The extensions and the app were already exempt, but the agent was not, so a block on the RawTrail signing team or certificate would have stopped it from restarting.
• A command containing a single quote now shows as the agent ran it in an agent session, with its "Reported by agent" label, instead of garbled.
• The agent session view's Commands, Processes and Activity switcher no longer moves when switching views.
• The server now works out the alert timeline's process chain. With the alert-chain focus on, the timeline no longer stops at what the graph had loaded, and still narrows when the graph cannot load. When it reaches only part of the chain, it says so and why.
• The process tree no longer misplaces a process whose parent's pid was reused. The server now records which process created each one, so a child appears under its real parent rather than a later process with the same pid, and a daemon stays under the process that launched it after launchd adopts it. This needs an agent from this release; older agents' processes are placed as before.
• Routine events no longer log as faults. A clean server stop no longer logs three gauge warnings and now exports their final values. An agent that disconnects mid-upload, as on a restart or sleep, is logged at INFO rather than ERROR; the agent resends the batch.

v0.8.0-rc.3

Upgrade notes (action required)

• Fleet EDR is now RawTrail, at github.com/rawtrail/rawtrail. The images are ghcr.io/rawtrail/rawtrail-server and ghcr.io/rawtrail/rawtrail-demo-seed; point your compose file or manifests at them before upgrading, since the old image names receive no further releases. The ingest and migrate binaries are now rawtrail-ingest and rawtrail-migrate. Existing alerts credited to Fleet EDR are re-credited to RawTrail.
• Verify release signatures against the new identity. Releases are signed by https://github.com/RawTrail/RawTrail/.github/workflows/release.yml (see docs/install-agent-manual.md), and gh attestation verify needs --owner rawtrail. Releases through v0.7.0 keep the getvictor/fleet-edr identity and their ghcr.io/getvictor/fleet-edr-server image; verify those with the docs at their release tag.
• Telemetry reports as rawtrail-server. Update any dashboard, alert or saved query that filters on service.name = 'fleet-edr-server'; the shipped SigNoz dashboards and alert rules already use the new name, so re-import them.
• Webhook deliveries send User-Agent: rawtrail-webhook/1. Update any receiver or firewall rule that matches the old fleet-edr-webhook/1.
• The break-glass account is now admin@rawtrail.local. The upgrade moves the existing account, with its passkey and role, so sign in with the new address.
• Reinstall the agent on every Mac: remove Fleet EDR first. The agent, app and extensions have new names and bundle IDs (RawTrail.app, io.rawtrail.*), so the RawTrail package does not upgrade Fleet EDR in place. On MDM-managed Macs, remove the com.fleetdm.edr.profile.* profiles first: macOS refuses to remove the old extensions while their System Extensions profile is installed. Then run sudo "/Library/Application Support/com.fleetdm.edr/uninstall.sh" and confirm systemextensionsctl list shows no active com.fleetdm.edr extension, rebooting if removal is pending, before installing rawtrail-<version>.pkg. Each Mac enrolls again with the enroll secret and keeps its host record, since hosts are keyed by hardware UUID.
• Deploy the new configuration profiles. Push the System Extensions, Full Disk Access and Background Items profiles (io.rawtrail.profile.*) before the package.
• The agent's settings file is /etc/rawtrail.conf (%ProgramData%\RawTrail\rawtrail.conf on Windows). Move the enroll secret and server URL from /etc/fleet-edr.conf before installing, leaving out any EDR_XPC_SERVICE or EDR_NET_XPC_SERVICE line (those name the old extensions), and update any install script or MDM payload that writes it.
• Update exclusions in other security tools. The agent runs from /usr/local/bin/rawtrail-agent, the app from /Applications/RawTrail.app, and its telemetry reports as rawtrail-agent; see docs/recommended-exclusions.md.
• The agent requires macOS 26 (Tahoe) or later. The installer now refuses older Macs and says so. Earlier packages installed on macOS 13 to 26.1 but could not run there, so upgrade any such Mac to macOS 26 first.

Added

• LaunchAgent and LaunchDaemon loads are recorded. When anything runs launchctl load or launchctl bootstrap, the agent reads each plist it names, and the plists in a directory it names (only those the user who ran it could read) and records the job's label, program and arguments. Process detail lists the jobs a command loaded, and the process tree links the command to each job launchd starts. Update the agent to collect them.
• AI agent sessions. A new Agent sessions page lists each Claude Code session the agents saw: its project, when it ran, and how many processes and alerts it produced, filterable by host, agent and recent activity. GET /api/agent-sessions serves the same list.
• See what a session did. The Commands view lists each command the agent ran with everything it started beneath it, including background processes, apps opened with open -a, and jobs started through launchctl. Each command shows the Bash tool call the agent reported in its transcript, labelled as the agent's own account; prompts and tool output are never read. The Processes view shows the whole session as one tree, and an optional toggle adds the agent's internal housekeeping. Alerts and privilege changes are badged where they happened.
• Session activity. An Activity view totals the files, network destinations, DNS names and Unix sockets a session touched, naming the process behind each; process detail shows the same for a process or its subtree (GET /api/hosts/{host_id}/activity). It counts only events from when the scope's processes started, so a process from before a reboot that reused a pid and pidversion is left out. A long file path is shortened from its start, keeping the file name, with the full path on hover. File changes and socket connections are collected for agent sessions only. A session started with /fork links to its parent.
• Process search by agent and session. Filter by agent, agent session, story, descendant of a process and argument over a time window, so every curl any Claude Code session ran this week is one search.
• SigNoz alert rules. Nine ready-made rules cover a silent server, stalled ingest, audit write failures, skipped detection rules, withdrawn event batches, failed maintenance sweeps and break-glass guessing. Apply them with tools/signoz-alerts.sh; see docs/operations.md.
• SigNoz and Datadog users: set OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE=delta. Without it those backends miss the first increment of each counter, so a rarely-moving counter such as audit write failures can increase without alerting. The quickstart compose now forwards this variable and OTEL_EXPORTER_OTLP_COMPRESSION.

Changed

• Much lower trace volume. Detection batches are now sampled with agent ingest traffic, and database queries outside a request or batch no longer produce spans. One host exported about 500,000 spans an hour, almost all from this background work. Metrics are unchanged.

Fixed

• No application-control rule can block the agent itself. The extensions and the app were already exempt, but the agent was not, so a block on the RawTrail signing team or certificate would have stopped it from restarting.
• A command containing a single quote now shows as the agent ran it in an agent session, with its "Reported by agent" label, instead of garbled.
• The agent session view's Commands, Processes and Activity switcher no longer moves when switching views.
• The server now works out the alert timeline's process chain. With the alert-chain focus on, the timeline no longer stops at what the graph had loaded, and still narrows when the graph cannot load. When it reaches only part of the chain, it says so and why.
• The process tree no longer misplaces a process whose parent's pid was reused. The server now records which process created each one, so a child appears under its real parent rather than a later process with the same pid, and a daemon stays under the process that launched it after launchd adopts it. This needs an agent from this release; older agents' processes are placed as before.
• Routine events no longer log as faults. A clean server stop no longer logs three gauge warnings and now exports their final values. An agent that disconnects mid-upload, as on a restart or sleep, is logged at INFO rather than ERROR; the agent resends the batch.

v0.8.0-rc.2

Upgrade notes (action required)

• Fleet EDR is now RawTrail, at github.com/rawtrail/rawtrail. The images are ghcr.io/rawtrail/rawtrail-server and ghcr.io/rawtrail/rawtrail-demo-seed; point your compose file or manifests at them before upgrading, since the old image names receive no further releases. The ingest and migrate binaries are now rawtrail-ingest and rawtrail-migrate. Existing alerts credited to Fleet EDR are re-credited to RawTrail.
• Verify release signatures against the new identity. Releases are signed by https://github.com/RawTrail/RawTrail/.github/workflows/release.yml (see docs/install-agent-manual.md), and gh attestation verify needs --owner rawtrail. Releases through v0.7.0 keep the getvictor/fleet-edr identity and their ghcr.io/getvictor/fleet-edr-server image; verify those with the docs at their release tag.
• Telemetry reports as rawtrail-server. Update any dashboard, alert or saved query that filters on service.name = 'fleet-edr-server'; the shipped SigNoz dashboards and alert rules already use the new name, so re-import them.
• Webhook deliveries send User-Agent: rawtrail-webhook/1. Update any receiver or firewall rule that matches the old fleet-edr-webhook/1.
• The break-glass account is now admin@rawtrail.local. The upgrade moves the existing account, with its passkey and role, so sign in with the new address.
• Reinstall the agent on every Mac: remove Fleet EDR first. The agent, app and extensions have new names and bundle IDs (RawTrail.app, io.rawtrail.*), so the RawTrail package does not upgrade Fleet EDR in place. On MDM-managed Macs, remove the com.fleetdm.edr.profile.* profiles first: macOS refuses to remove the old extensions while their System Extensions profile is installed. Then run sudo "/Library/Application Support/com.fleetdm.edr/uninstall.sh" and confirm systemextensionsctl list shows no active com.fleetdm.edr extension, rebooting if removal is pending, before installing rawtrail-<version>.pkg. Each Mac enrolls again with the enroll secret and keeps its host record, since hosts are keyed by hardware UUID.
• Deploy the new configuration profiles. Push the System Extensions, Full Disk Access and Background Items profiles (io.rawtrail.profile.*) before the package.
• The agent's settings file is /etc/rawtrail.conf (%ProgramData%\RawTrail\rawtrail.conf on Windows). Move the enroll secret and server URL from /etc/fleet-edr.conf before installing, leaving out any EDR_XPC_SERVICE or EDR_NET_XPC_SERVICE line (those name the old extensions), and update any install script or MDM payload that writes it.
• Update exclusions in other security tools. The agent runs from /usr/local/bin/rawtrail-agent, the app from /Applications/RawTrail.app, and its telemetry reports as rawtrail-agent; see docs/recommended-exclusions.md.
• The agent requires macOS 26 (Tahoe) or later. The installer now refuses older Macs and says so. Earlier packages installed on macOS 13 to 26.1 but could not run there, so upgrade any such Mac to macOS 26 first.

Added

• LaunchAgent and LaunchDaemon loads are recorded. When anything runs launchctl load or launchctl bootstrap, the agent reads each plist it names, and the plists in a directory it names (only those the user who ran it could read) and records the job's label, program and arguments. Process detail lists the jobs a command loaded, and the process tree links the command to each job launchd starts. Update the agent to collect them.
• AI agent sessions. A new Agent sessions page lists each Claude Code session the agents saw: its project, when it ran, and how many processes and alerts it produced, filterable by host, agent and recent activity. GET /api/agent-sessions serves the same list.
• See what a session did. The Commands view lists each command the agent ran with everything it started beneath it, including background processes, apps opened with open -a, and jobs started through launchctl. Each command shows the Bash tool call the agent reported in its transcript, labelled as the agent's own account; prompts and tool output are never read. The Processes view shows the whole session as one tree, and an optional toggle adds the agent's internal housekeeping. Alerts and privilege changes are badged where they happened.
• Session activity. An Activity view totals the files, network destinations, DNS names and Unix sockets a session touched, naming the process behind each; process detail shows the same for a process or its subtree (GET /api/hosts/{host_id}/activity). File changes and socket connections are collected for agent sessions only. A session started with /fork links to its parent.
• Process search by agent and session. Filter by agent, agent session, story, descendant of a process and argument over a time window, so every curl any Claude Code session ran this week is one search.
• SigNoz alert rules. Nine ready-made rules cover a silent server, stalled ingest, audit write failures, skipped detection rules, withdrawn event batches, failed maintenance sweeps and break-glass guessing. Apply them with tools/signoz-alerts.sh; see docs/operations.md.
• SigNoz and Datadog users: set OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE=delta. Without it those backends miss the first increment of each counter, so a rarely-moving counter such as audit write failures can increase without alerting. The quickstart compose now forwards this variable and OTEL_EXPORTER_OTLP_COMPRESSION.

Changed

• Much lower trace volume. Detection batches are now sampled with agent ingest traffic, and database queries outside a request or batch no longer produce spans. One host exported about 500,000 spans an hour, almost all from this background work. Metrics are unchanged.

Fixed

• No application-control rule can block the agent itself. The extensions and the app were already exempt, but the agent was not, so a block on the RawTrail signing team or certificate would have stopped it from restarting.
• A command containing a single quote now shows as the agent ran it in an agent session, with its "Reported by agent" label, instead of garbled.
• The agent session view's Commands, Processes and Activity switcher no longer moves when switching views.
• The server now works out the alert timeline's process chain. With the alert-chain focus on, the timeline no longer stops at what the graph had loaded, and still narrows when the graph cannot load. When it reaches only part of the chain, it says so and why.
• The process tree no longer misplaces a process whose parent's pid was reused. The server now records which process created each one, so a child appears under its real parent rather than a later process with the same pid, and a daemon stays under the process that launched it after launchd adopts it. This needs an agent from this release; older agents' processes are placed as before.
• Routine events no longer log as faults. A clean server stop no longer logs three gauge warnings and now exports their final values. An agent that disconnects mid-upload, as on a restart or sleep, is logged at INFO rather than ERROR; the agent resends the batch.

v0.8.0-rc.1

Upgrade notes (action required)

• Fleet EDR is now RawTrail, at github.com/rawtrail/rawtrail. The images are ghcr.io/rawtrail/rawtrail-server and ghcr.io/rawtrail/rawtrail-demo-seed; point your compose file or manifests at them before upgrading, since the old image names receive no further releases. The ingest and migrate binaries are now rawtrail-ingest and rawtrail-migrate. Existing alerts credited to Fleet EDR are re-credited to RawTrail.
• Verify release signatures against the new identity. Releases are signed by https://github.com/RawTrail/RawTrail/.github/workflows/release.yml (see docs/install-agent-manual.md), and gh attestation verify needs --owner rawtrail. Releases through v0.7.0 keep the getvictor/fleet-edr identity and their ghcr.io/getvictor/fleet-edr-server image; verify those with the docs at their release tag.
• Telemetry reports as rawtrail-server. Update any dashboard, alert or saved query that filters on service.name = 'fleet-edr-server'; the shipped SigNoz dashboards and alert rules already use the new name, so re-import them.
• Webhook deliveries send User-Agent: rawtrail-webhook/1. Update any receiver or firewall rule that matches the old fleet-edr-webhook/1.
• The break-glass account is now admin@rawtrail.local. The upgrade moves the existing account, with its passkey and role, so sign in with the new address.
• Reinstall the agent on every Mac: remove Fleet EDR first. The agent, app and extensions have new names and bundle IDs (RawTrail.app, io.rawtrail.*), so the RawTrail package does not upgrade Fleet EDR in place. On MDM-managed Macs, remove the com.fleetdm.edr.profile.* profiles first: macOS refuses to remove the old extensions while their System Extensions profile is installed. Then run sudo "/Library/Application Support/com.fleetdm.edr/uninstall.sh" and confirm systemextensionsctl list shows no active com.fleetdm.edr extension, rebooting if removal is pending, before installing rawtrail-<version>.pkg. Each Mac enrolls again with the enroll secret and keeps its host record, since hosts are keyed by hardware UUID.
• Deploy the new configuration profiles. Push the System Extensions, Full Disk Access and Background Items profiles (io.rawtrail.profile.*) before the package.
• The agent's settings file is /etc/rawtrail.conf (%ProgramData%\RawTrail\rawtrail.conf on Windows). Move the enroll secret and server URL from /etc/fleet-edr.conf before installing, leaving out any EDR_XPC_SERVICE or EDR_NET_XPC_SERVICE line (those name the old extensions), and update any install script or MDM payload that writes it.
• Update exclusions in other security tools. The agent runs from /usr/local/bin/rawtrail-agent, the app from /Applications/RawTrail.app, and its telemetry reports as rawtrail-agent; see docs/recommended-exclusions.md.
• The agent requires macOS 26 (Tahoe) or later. The installer now refuses older Macs and says so. Earlier packages installed on macOS 13 to 26.1 but could not run there, so upgrade any such Mac to macOS 26 first.

Added

• LaunchAgent and LaunchDaemon loads are recorded. When anything runs launchctl load or launchctl bootstrap, the agent reads each plist it names, and the plists in a directory it names (only those the user who ran it could read) and records the job's label, program and arguments. Process detail lists the jobs a command loaded, and the process tree links the command to each job launchd starts. Update the agent to collect them.
• AI agent sessions. A new Agent sessions page lists each Claude Code session the agents saw: its project, when it ran, and how many processes and alerts it produced, filterable by host, agent and recent activity. GET /api/agent-sessions serves the same list.
• See what a session did. The Commands view lists each command the agent ran with everything it started beneath it, including background processes, apps opened with open -a, and jobs started through launchctl. Each command shows the Bash tool call the agent reported in its transcript, labelled as the agent's own account; prompts and tool output are never read. The Processes view shows the whole session as one tree, and an optional toggle adds the agent's internal housekeeping. Alerts and privilege changes are badged where they happened.
• Session activity. An Activity view totals the files, network destinations, DNS names and Unix sockets a session touched, naming the process behind each; process detail shows the same for a process or its subtree (GET /api/hosts/{host_id}/activity). File changes and socket connections are collected for agent sessions only. A session started with /fork links to its parent.
• Process search by agent and session. Filter by agent, agent session, story, descendant of a process and argument over a time window, so every curl any Claude Code session ran this week is one search.
• SigNoz alert rules. Nine ready-made rules cover a silent server, stalled ingest, audit write failures, skipped detection rules, withdrawn event batches, failed maintenance sweeps and break-glass guessing. Apply them with tools/signoz-alerts.sh; see docs/operations.md.
• SigNoz and Datadog users: set OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE=delta. Without it those backends miss the first increment of each counter, so a rarely-moving counter such as audit write failures can increase without alerting. The quickstart compose now forwards this variable and OTEL_EXPORTER_OTLP_COMPRESSION.

Changed

• Much lower trace volume. Detection batches are now sampled with agent ingest traffic, and database queries outside a request or batch no longer produce spans. One host exported about 500,000 spans an hour, almost all from this background work. Metrics are unchanged.

Fixed

• No application-control rule can block the agent itself. The extensions and the app were already exempt, but the agent was not, so a block on the RawTrail signing team or certificate would have stopped it from restarting.
• A command containing a single quote now shows as the agent ran it in an agent session, with its "Reported by agent" label, instead of garbled.
• The agent session view's Commands, Processes and Activity switcher no longer moves when switching views.
• The server now works out the alert timeline's process chain. With the alert-chain focus on, the timeline no longer stops at what the graph had loaded, and still narrows when the graph cannot load. When it reaches only part of the chain, it says so and why.
• The process tree no longer misplaces a process whose parent's pid was reused. The server now records which process created each one, so a child appears under its real parent rather than a later process with the same pid, and a daemon stays under the process that launched it after launchd adopts it. This needs an agent from this release; older agents' processes are placed as before.
• Routine events no longer log as faults. A clean server stop no longer logs three gauge warnings and now exports their final values. An agent that disconnects mid-upload, as on a restart or sleep, is logged at INFO rather than ERROR; the agent resends the batch.

v0.7.0

Upgrade notes (action required)

• The quickstart keeps the process graph for 30 days, not 7. This matches the event timeline, so an old alert's graph no longer shows its process alone. Expect the MySQL process table to grow to about four times its size; set EDR_RETENTION_DAYS=7 in .env to keep the old window.

Added

• Sensitive privacy permissions granted to third-party apps are detected. tcc_sensitive_grant alerts when an app that is not Apple's is granted Full Disk Access, Accessibility, Screen Recording or Input Monitoring (T1548.006). Grants deployed by MDM profiles are not reported. Exclude a vendor by team_id. Needs this release's agent.
• Browser credential theft is detected. credential_browser_store_read alerts when a program other than the browser opens Chrome's, Brave's, Edge's, Arc's, Vivaldi's or Firefox's saved passwords, cookies or their key material, the core behavior of infostealers (T1555.003). Exclude a backup or security tool by its team_id. Needs this release's agent.
• SSH key persistence is detected. persistence_ssh_authorized_keys alerts when a user's or root's ~/.ssh/authorized_keys is written or replaced (T1098.004). Every host now watches those files in every home. Exclude a configuration-management agent by its path.
• Watched file paths can name every user's home folder. Start a path with ~/, such as ~/.ssh/authorized_keys, and each host watches it for root and every user account, including accounts added later. Needs this release's agent; older hosts skip the path.
• Root certificates trusted from the command line are detected. trusted_root_certificate alerts when security add-trusted-cert makes a host trust a certificate, or trust-settings-import imports trust settings (T1553.004). Certificates deployed by MDM profiles are not reported.
• Unsigned installer packages are detected. installer_unsigned_package alerts once per package when a package that is unsigned, or whose signature macOS does not trust, runs an install script (T1546.016). Exclude an in-house package by its path.
• Login item persistence is detected. persistence_login_item alerts when a login item launches an app that is not Apple's or MDM-managed (T1547.015), whether it is an app's background helper or an app added to the user's login items. Exclude a vendor by the app's team_id or signing_id. Needs this release's agent, which reports the app's signature.
• Emond and startup-item persistence are detected. Every host now also watches /etc/emond.d/rules/, /private/var/db/emondClients/ and /Library/StartupItems/, which lets two SigmaHQ rules the product already carried run: Emond launch rules and new startup items. Like other imported rules they start in monitor mode.
• Detection tuning counts the processes a rule gave up on. When a rule needs a process record that never arrived, it now counts that process as abandoned, shown in the Cost column beside the undecided evaluations it retried. A rule failing to decide no longer looks the same as a rule with nothing to report. Rules that cannot yet count this, and days before the upgrade, show no figure rather than zero.
• A known-good phone-home can be waived. dns_c2_beacon alerts can now be excluded by the domain the program looked up, which covers its subdomains, or by the program's path, team, signing identifier or cdhash. Until now the rule could only be silenced as a whole. See recommended exclusions.

Changed

• A built-in rule's page shows its rule file, including the values the rule reads, instead of saying there is no document. Every rule's file can be downloaded from its page.
• Upgrading the agent no longer needs a reboot. The new extensions take over when the install finishes, or at the next login if no one is logged in, and network and DNS events resume within about 30 seconds. The agent itself restarts during the install. Earlier notes asked for a reboot after every upgrade.
• Package installs can be excluded by who signed the package. Installing a .pkg raises a suspicious-exec alert for each of its install scripts. Exclude a vendor's installers with a package_team_id exclusion, the team that signed the package; an unsigned package cannot be excluded this way. The alert now names the package and its signer.
• Login item registrations say where the item is and who signed it. A login item was recorded with no signature, and a background helper with a path relative to its app. Hosts now record the item's full path, the app that added a helper, and the signature of the app that will launch. Requires the updated agent.
• LaunchAgent persistence is judged on the program it registers. The rule now watches LaunchAgent registrations rather than launchctl, so it also catches a plist that becomes active at the next login, and skips Apple's own and MDM-managed agents. Vendor agents can be excluded by team_id or signing_id, which a planted file cannot defeat; existing plist path exclusions keep working. If the background items profile is not installed, exclude team FDG8Q7N4CC for this rule so the EDR's own LaunchAgent is not reported.

Fixed

• Signature exclusions and built-in skips now apply to processes running before the agent started. A process already running at boot or across an agent upgrade had no signature on record until it exited, so team_id and signing_id exclusions missed it and Spotlight's indexer could be reported as browser credential theft.
• An osascript download-and-run chain is no longer missed when its last step is recorded late. The rule now waits for that step's record, as the other rules do, rather than giving up on the chain.
• The process graph says when its window predates retention. A window reaching back past process retention now shows a notice, rather than an alert's process alone with nothing around it.
• Sigma rules no longer drop an exec whose own record arrives late. A rule that checks the parent program now waits for the record it is found from, instead of reading the parent as missing. Detection tuning now also counts the events Sigma rules give up on.
• A rule that runs in monitor mode links to what it has matched. Those records were reachable only from the Observed count in Detection tuning, which needs a permission the analyst role does not hold, so the records were readable in principle and unreachable in practice for the people who investigate. A rule's own page now offers them.

v0.7.0-rc.4

What's Changed

• ci: review with gpt-6-sol and pin the pr-agent image by digest by @getvictor in #1210
• ci: review with GPT-6.1 Sol by @getvictor in #1212
• extension, detection: give processes running before the extension their code signature by @getvictor in #1213
• Release prep for v0.7.0-rc.3: archive the snapshot-signing change and fold its note by @getvictor in #1214

Full Changelog: v0.7.0-rc.2...v0.7.0-rc.4

v0.7.0-rc.3

Incomplete: superseded by v0.7.0-rc.4. The release job failed while installing cosign (a GitHub 500 on the download), so these assets carry no Sigstore bundles. Use rc.4, built from the same commit.

What's Changed

• ci: review with gpt-6-sol and pin the pr-agent image by digest by @getvictor in #1210
• ci: review with GPT-6.1 Sol by @getvictor in #1212
• extension, detection: give processes running before the extension their code signature by @getvictor in #1213
• Release prep for v0.7.0-rc.3: archive the snapshot-signing change and fold its note by @getvictor in #1214

Full Changelog: v0.7.0-rc.2...v0.7.0-rc.3

v0.7.0-rc.2

What's Changed

• ui: show a built-in rule's rule file and let every rule file be downloaded by @getvictor in #1209
• Release prep for v0.7.0-rc.2: archive the rule-page change and fold its note by @getvictor in #1211

Full Changelog: v0.7.0-rc.1...v0.7.0-rc.2

v0.7.0-rc.1

What's Changed

• Review pull requests with the open-source agent instead of a metered one by @getvictor in #1159
• ci: re-review on demand, and record who checks what by @getvictor in #1160
• ui: link a monitor rule to what it has matched by @getvictor in #1168
• detection: count the evaluations a rule abandons by @getvictor in #1171
• rules: let an operator waive a known-good dns_c2_beacon alert by @getvictor in #1172
• rules: judge LaunchAgent persistence on the program it registers by @getvictor in #1173
• detection: osascript_network_exec waits for the temp exec it judges by @getvictor in #1175
• agent: report the signature of the package an installer script belongs to by @getvictor in #1174
• detection: say where retained process records begin by @getvictor in #1176
• rules: charge a Sigma rule's abandon to the rule that read the process by @getvictor in #1178
• rules: waive an installer script by the team that signed its package by @getvictor in #1177
• rules: push default watched paths, and import file rules by their paths by @getvictor in #1179
• agent: report where a login item is and who signed it by @getvictor in #1180
• rules: detect login item persistence (T1547.015) by @getvictor in #1181
• rules: judge an app added to the login items, not only a helper by @getvictor in #1182
• rules: detect an unsigned installer package (T1546.016) by @getvictor in #1183
• extension: let a watched path name every user's home by @getvictor in #1184
• ui: raise the undici override to 7.29.1 [no-docs-change] by @getvictor in #1190
• rules: detect a root certificate trusted from the command line (T1553.004) by @getvictor in #1188
• rules: detect SSH key persistence (T1098.004) by @getvictor in #1189
• docs: an extension upgrade no longer needs a reboot by @getvictor in #1193
• extension: report other programs opening a browser's saved passwords and cookies by @getvictor in #1194
• rules: detect browser credential theft (T1555.003) by @getvictor in #1195
• extension: report TCC permission changes (T1548.006) by @getvictor in #1196
• ui: raise brace-expansion to 5.0.12 [no-docs-change] by @getvictor in #1198
• rules: detect a sensitive TCC permission granted to a third-party app (T1548.006) by @getvictor in #1197
• deps(ui): bump the ui-minor-and-patch group across 1 directory with 9 updates by @dependabot[bot] in #1191
• deps(ci): bump the actions-all group with 10 updates by @dependabot[bot] in #1164
• deps(go): bump the Go minor and patch group and move agent HTTP/2 config to net/http [no-behavior-change] [no-docs-change] by @getvictor in #1200
• extension: watch a browser directory whole once it holds more profiles than the bound by @getvictor in #1201
• Release prep for v0.7.0: archive the spec changes and cut the release notes by @getvictor in #1199

Full Changelog: v0.6.0...v0.7.0-rc.1