TotalCloud Release 2.29

With this release, you can generate AI-powered remediation code for any failed system-defined control directly from the Posture section. Previously, when a cloud resource failed a system-defined control, you only had one path forward: follow a set of manual remediation steps. That still works today, but now you also get a faster option.

Open the control evaluation's evidence details section of any failed resource, and you will now see two ways to remediate it:

• AI Powered - instantly generates a recommended remediation plan for the resource.
• Manual Remediation - the step-by-step guide you're used to, still available as before.

Choosing AI-Powered gives you working code to fix the issue, available in the format that fits your workflow: 

Each plan includes:

• Code scoped to the specific resource that failed the control.
• Clear, numbered steps for applying the fix.
• A verification step so you can confirm the remediation actually worked.

 The AI-generated remediation code might not always be perfect, especially for more complex remediation. It's advisable to review and test the code carefully before live deployment.

Previously, you had to select a specific cloud provider to review compliance against your controls. With this release, TotalCloud gives you a global view of posture across all your connected clouds, so you can spot where to focus first and drill down from there.

Key Features

• Security & Compliance Posture panel - A new panel on the right side of the Cloud Inventory Overview page shows your overall compliance percentage, the number of controls passing and failing, CSPM coverage, and your top compliance frameworks (such as CIS, NIST, PCI, and ISO) with their passed and failed counts. Use the cloud drop-down to view the panel for all clouds or a single cloud provider.
• New All tab on the Posture page - The All tab lists the control evaluations from every cloud provider in a single view. It shows total evaluations (passed and failed), failures by criticality, and remediable failed evaluations.

The Security & Compliance Posture panel is not affected by the inventory search filter on the Inventory Overview page. It always shows posture for all connected clouds, or for the cloud you select in the panel's drop-down.

Benefits

• See compliance for your whole multi-cloud environment without switching between clouds.
• Quickly identify the frameworks and clouds with the most failing controls.

Navigate to Inventory > Overview to view the panel, or to Posture > Cloud Posture > All. For more information, see Cloud Inventory Overview and Cloud Posture.

The Inventory now offers a CSV download from the Cloud > All tab. Download builds a Summary Report in CSV format, with optional sections for Provider, Resource Category and Type, Account ID, Region, Last Discovered On, Deleted from Cloud, and others, plus a timezone selector for report dates. Each download supports a maximum of 10,000 records.

TotalCloud now provides end-to-end discovery, vulnerability coverage, and lifecycle reconciliation support for Azure Virtual Machine Scale Set (VMSS) resources across both Uniform and Flexible orchestration modes. Previously, Uniform-mode VMSS VMs could go undetected by AV, creating gaps in vulnerability coverage and asset records. With this release, Azure VMSS workloads gain complete visibility into vulnerabilities across Uniform and Flexible VMSS deployments.

Key Features

• VMSS instances are reconciled during normal connector scans, keeping asset state up to date as scale sets change.
• VMSS resources that have been deleted in Azure are now automatically marked as TERMINATED.

Previously, dashboard widgets could only pull data from one cloud-specific data source at a time, such as AWS Inventory or Azure Inventory. With this release, TotalCloud introduces two new multi-cloud data sources, Multicloud Inventory and MulticloudPosture, that aggregate data across AWS, Azure, GCP, and OCI. This lets you track resource distribution, control failures, and compliance across your entire cloud estate without switching between cloud-specific views.

Key Features

• New multicloud data sources - Select Multicloud inventory (inventory data for all clouds) or Multicloud Posture (posture data for all clouds) when you configure a widget. These data sources apply to runtime controls only.
• Multicloud data by default - The new data sources are selected by default in the following widgets: Failures By Control Criticality, Resource Distribution by Type, Top 5 Accounts by Failed Controls, Top 5 Failed Controls, Policy Compliance, and Mandate Compliance.
• Drill down from widgets - Click a widget to go directly to the All Inventory or All Posture page, depending on the data source the widget uses.

Currently, trending is not supported for multi-cloud data sources. The data sources are not applicable to build-time controls.

In release 2.28, TotalCloud provided the option to choose which sections and columns appear in your CSPM reports. This release adds more columns to the Report Display step. Your CSV reports can now include control details, tags and the organization name, so you no longer have to look this information up in other parts of the product.

New columns are available in two sections:

• Control Level Statistics - Along with the Control ID (CID), you can now add Control Name, Remediation Steps, Specification and Rationale. These columns work for both system-defined and custom controls.
• Details - You can now add Resource Tags, Connector Tags, Account Tags, Dynamic Tags and Organization Name.

Organization Name is supported only for AWS, Azure and GCP accounts that have an organization connector. OCI isn't supported. Reports are available as CSV and for runtime scans, PDF and build-time reports are currently not supported.

TotalCloud now provides detailed inventory support for 17 additional resource types across Oracle Cloud Infrastructure (OCI) and Google Cloud Platform (GCP). With OCI, you gain visibility into your AI and machine learning workloads, including Data Science, AI Vision, and AI Speech. On GCP, coverage extends to BigQuery, API keys, and Vertex AI resources, so you can discover, inventory, and assess the security posture of these services from a single place.

The resources are as follows:

Additionally, you get more visibility into your Azure AI workloads. AI Foundry Inventory now includes a New Foundry Agents tab that lists agents created in the new Azure AI Foundry experience, and the existing Agents tab is renamed to Classic Agents.

Navigate to TotalCloud > Inventory, and filter by cloud provider to view the new resources and their details.

TotalCloud now records audit logs for key configuration changes, giving you a clear trail for security reviews and compliance audits. Each log entry shows the action performed, the user and user role, the name and type of the item that was changed, and the module, so you can quickly see what changed and who changed it.

Key Features

• Reports - Logs when scheduled reports and on-screen reports are created, updated, or deleted.
• Exceptions - Logs when exceptions are created, updated, or deleted.
• Alert rules and alert actions - Logs when alert rules and alert actions (such as PagerDuty and Slack) are created, updated, or deleted.
• Source of the change - Shows whether the change was made from the UI or through the public API.
• Change details - For updates, view details to see the fields that changed, with the old and new values. You can also download the details.

Benefits

• Get visibility into who changed your reports, exceptions, alert rules, and alert actions, and when.
• Support security reviews and compliance audits with a record of configuration changes.
• Troubleshoot failed changes faster by seeing the reason a request failed.

Navigate to Administration > Activity Logs. Entries for TotalCloud appear with the TC module.

With this release, we have introduced an improved user experience across all TotalCloud pages. You can see updates across fonts, colors, and buttons, making the interface more intuitive and easier to use. This release features User Interface and design system enhancements that improve visual consistency, readability, and usability across the application, resulting in a cleaner, more intuitive user experience.

Key benefits of the new interface include:

• Cleaner, more consistent screens
• Easier-to-read and understandable text
• Important information stands out better, with less clutter
• Faster comprehension of risk, status, and numbers

User Interface Consistency and Clarity

Introducing the new and improved User Interface with the following key upgrades:

• Easier-to-read labels and text, with ALL CAPS replaced by sentence-style text.
• Consistent text style for status and source names across the application.
• Uniform text colors in tables, filters, page numbers, and tabs.
• Aligned colors and text styles for tabs and page navigation throughout the application.
• Clear visual indicators for buttons and options, showing active, inactive, or secondary states.
• Better emphasis on important information, with subtle styling for less critical details to help users focus.

Charts, Metrics, and Data Presentation

You can view the following updates:

• Updated chart color schemes for improved clarity and accessibility.
• Compact, more readable numeric formats for better visibility.
• Refined color gradients for risk scores and meters to enhance interpretation.

Changes made in Azure, such as deleting resources or opening access paths to virtual machines, are often early signs of an attack or misconfiguration. CDR now evaluates Azure Activity Log events from your connected subscriptions against predefined detection rules. When an operation matches a rule, CDR raises a threat alert alongside your existing CDR detections, so you can investigate Azure activity in the same place as the rest of your cloud threats.

Key Features

• Near real-time detection - Azure Activity Log events are analyzed as they arrive, so suspicious operations surface quickly.
• Prioritized alerts - Each alert includes a severity and a risk score to help you decide what to investigate first.
• MITRE ATT&CK context - Alerts are mapped to the relevant MITRE ATT&CK tactics and techniques, for example, Persistence (TA0003) and Account Manipulation: Additional Cloud Credentials (T1098.001).
• Investigation details - Each alert shows the operation performed, the affected resource, subscription and tenant, source IP address, and event time.
• Built-in rules - Detections cover risky Azure operations, such as creating a shareable link for Azure Bastion that can expose VM access to untrusted networks.