TotalCloud Release 2.17

June 11, 2025

TotalCloud 2.17 brings updates to supported integrations, insights, inventory, and controls.

ServiceNow Integration with TotalCloud CSPM for ITSM

With this release, we have introduced an integration between TotalCloud (CSPM application) and ServiceNow ITSM. This integration enhances cloud security operations by seamlessly managing cloud configuration issues through ITSM workflows.

The ServiceNow ITSM integration introduces the following enhancements:

CMDB Synchronization

• Cloud inventory data collected by TotalCloud is automatically pushed into the ServiceNow CMDB.
• Ensures real-time visibility of cloud assets within the ITSM ecosystem.

Misconfiguration Ticket Management

• Misconfigurations identified by TotalCloud are raised as ServiceNow Incidents or Change Requests.
• Allows organizations to track, triage, and resolve configuration issues within standard ITSM processes.

Ticket Mapping to Resolver Groups

• Misconfiguration tickets are intelligently mapped to the respective resolver groups in ServiceNow.
• Supports faster remediation through correct ticket routing based on asset ownership or domain.

Benefits

• Streamlines security operations by integrating cloud risk posture into ITSM workflows.
• Enhances visibility and accountability for cloud misconfigurations across IT and security teams.
• Reduces manual effort and context switching between CSPM tools and ITSM platforms.

Prerequisites

• The ServiceNow instance with ITSM and CMDB modules is enabled.
• TotalCloud setup with active cloud connectors and misconfiguration detection.

Supported Platforms

• AWS, Azure, GCP (via TotalCloud)
• ServiceNow (Tokyo, San Diego, and Vancouver versions supported)

Introduced an Attack Path Icon to Supported Insights

With previous releases, we had delivered the Attack Path visualization, which provided you with a clear view of the attack trajectory, its steps and how you can remediate it. 

With this release, we are improving the accessibility of these attack paths with a new  icon next to any insight that supports an Attack Path visualization.

Introduced Attack Path Insights for Azure and AWS Cloud

With this release, we are supporting Attack Path visualization for the following Azure and AWS insights. Now, you can have a comprehensive view of your cloud account's attack surface.

Microsoft Azure

The following sections describe the enhancements made to the TotalCloud environment in this release for Azure. 

Extended Inventory Support to Azure AI Services

TotalCloud is now adding a new resource to its Azure inventory base. The Azure AI Services provide a detailed view of the AI services running in your Azure environment. 

The inventory can identify and report the following Kind of Azure AI Services:

• AIServices
• SpeechServices
• CustomVision.Prediction
• CustomVision.Training
• TextAnalytics
• FormRecognizer
• ImmersiveReader
• ContentSafety
• ComputerVision
• TextTranslation
• OpenAI
• Face
• HealthInsights
• CognitiveServices

We have introduced a new api parameter and a new token to help with accessibility of these resource findings.

Read about the token here.

Read about the API parameter here.

Enhanced Searchability and Accuracy in Policy Selection of CSPM Reports

With this release, we have enhanced the count of policies retrieved when selecting policies for a CSPM report. Previously, TotalCloud had a hardcoded pagination limit which restricted policy retrieval to the first 100 entries, resulting in missing policies across cloud providers.

With TotalCloud 2.17, we have enhanced the policy selection mechanism to ensure all available policies are retrieved, removing the 100-policy limit. As part of this enhancement, we have also introduced a search bar in the Create CSPM Report workflow.

Now, you can use the Qualys Query Logic (QQL) while selecting policies to narrow down the count of policies to match your desired specifications. 

Benefits

• Ensures complete and accurate listing of all applicable RUN_TIME policies across all cloud providers.
• Improves searchability during report creation by enabling policy search and comprehensive selection

Control Updates

New Runtime Controls

New runtime controls introduced to the cloud posture analysis.

New Controls in Amazon Web Services 

Runtime controls introduced in AWS.

New Controls in Microsoft Azure 

Runtime controls introduced in Azure.

Control Title Changes

Changes to control titles.

Controls Deprecated for Azure Best Practices Policy (Advanced Notification)

We are deprecating the following 5 controls for the Azure Best Practices Policy in the upcoming release 2.18.

New Tokens

The following section describes the new tokens introduced as part of TotalCloud 2.17.0

Azure AI Services Token

This new Azure token is introduced with TotalCloud 2.17.0.

TotalCloud Insights Token

This new Insight token is introduced with TotalCloud 2.17.0.

Cloud Detection and Response (CDR)

The following sections describe the enhancements made to the CDR environment in the upcoming CDR release. 

These CDR enhancements will be available starting in July. 

IPv6 Support Added for AWS 

With this release, we have added IPv6 addressing support for AWS to the previously supported IPv4 addressing. This enhancement allows you to view findings for AWS and Azure resources with IPv6 addresses in the Investigate tab.

Currently, IPv6 addresses do not have the option to redirect to their respective details page when selected. This feature will be available in future releases.

Integrated Container Security Runtime Process Events

With this release, we have integrated the Container Runtime Security (CRS) Process-Events logs with the CDR Investigate menu. The CRS process event logs are analysed based on a predefined set of rules. When a CRS process event meets the criteria, a corresponding alert is generated in CDR Investigate corresponding to that CRS event.

Additionally, we have added MITRE information for the CRS process-based alerts. You can use the QQL tokens to filter the findings based on their MITRE information, such as rule name, tactic ID, tactic name, technique ID, and technique name.

Prerequisites

• Container Security version 1.39.0
• Runtime Sensor build 1.2.0
• Helm Chart version 2.5.0

Benefits

• Provides streamlined access to real-time CRS process-level monitoring for live containers, improving visibility and response efficiency.
• Monitors unusual behaviour and suspicious activities within containers by establishing behavioural baselines.
• Allows for continuous monitoring, detection, and response to threats in real-time, assisting in prioritizing high-risk containers and reducing attack surfaces in dynamic cloud-native environments.

Navigate to Investigate and select Container from the Findings Type drop-down menu to view all the CS related process-based alerts.

The MITRE column shows the MITRE Tactic Name and Tactic ID information for each alert.

New Tokens

Starting in July, these new Tokens will be available to help search for specific findings in Investigate.

'tc.findings.nodeName: ip-10-**-10-2**'

'tc.findings.clusterName: ip-10-**-9-**02'

`tc.findings.namespace: defaultname`

`tc.findings.pod: xen`

`tc.findings.containerName: ubuntu-container`

`tc.findings.procesName: /usr/bin/cat`

`tc.findings.mitre.attack.technique.name: Indicator Removal`

`tc.findings.mitre.attack.technique.id: TXXXX.XX5`

`tc.findings.mitre.attack.tactic.id: TXXXX5`

`tc.findings.mitre.attack.tactic.name: Unsecured Credentials`

`tc.findings.mitre.attack.rule.name: Cloud Credentials Accessed`

Issues Addressed

The following reported and notable customer issues are fixed in this release: