What's new in Athena

The agent checks the new build's hash before it swaps it in, tests the new build, and rolls back by itself if it fails, on Windows, Linux and macOS. A build that failed on a machine is never retried there, and an amber Update rolled back badge shows it in the console.

• Each step is logged as Event Log / syslog events 102–105.
• Works with Tamper Protection on, on all three systems.

The Install agent button on the Agents page has its own permission, included in the Helpdesk role. The macOS installer runs without prompts when a registration token is supplied.

The server moves to .NET 10. Remote control gets reconnect, cursor and consent fixes, with consent enforced by the server. New installs start from the 0.9.1 appliance images; existing appliances apply the 0.9.1 update bundle from the web console.

The hardened Athena appliance for VMware (OVA) and Hyper-V (VHDX) is on the Downloads page, with a built-in trial licence. New installs use the 0.7.0 image and apply the 0.8.1 update bundle from the web console. The Beginner Guide walks through every step with a short video.

Manage desktop, Start menu and link shortcuts from Policies → Shortcuts on Windows (.lnk/.url), Linux (.desktop) and macOS (Dock/alias).

• Create, Replace, Update or Delete, for all users, every profile, or at sign-in.
• One policy wins per agent, and the agent removes only shortcuts Athena created.
• PowerShell cmdlets in module 2.17.0.

Set, change or remove the BIOS administrator password from an agent's BIOS tab on Dell, HP and Lenovo. The password is held in a Secret credential and the agent records which one, so BIOS Remediate uses it by default.

A Control Panel item on each Windows endpoint shows the agent's status, the policies applied to the machine and its local cache, with local actions. Every local action is audited on the server.

With the new credentials.reveal permission, an eye button shows a Secret credential for 30 seconds, after a confirmation. Every reveal is audited, and it is refused if the audit cannot be written. Local and Domain passwords stay write-only.

The Athena server moves to ASP.NET Core runtime 8.0.32, fixing two Critical advisories (GHSA-fpq8-4vhr-rcxx, GHSA-rv87-ccxw-8ggf).

• Commands sent to an offline agent, or targeting only a tag, now finish instead of staying "Running".
• The agent update badge clears when the update completes, names the target version and survives a reload.
• Appliance: updates deliver the bundled agents even after the admin password was changed, and the PowerShell module and HermesCLI downloads work again.

Athena now supports OpenID Connect single sign-on via Keycloak, alongside the existing local accounts and LDAP / Active Directory options.

• A new role-mapping editor maps Keycloak (and LDAP) groups to Athena roles, with provider-scoped mappings.
• The Sign in with Keycloak button appears only when the provider is actually reachable.
• A new Login & Authentication help page covers all three methods — local, LDAP/AD, and Keycloak OIDC.

The PowerShell module (2.5.0) can now roll the Athena agent out across your AD estate directly over PowerShell Remoting — replacing the old standalone push tool.

• Install-AthenaAgent auto-mints a registration token, so passing one is now optional.
• A fast liveness pre-check reports unreachable machines cleanly before deployment.
• 32 additional cmdlets, and Get-AthenaAgent gained an -OS filter.

Install-AthenaAgent now validates TLS and verifies the downloaded agent's hash by default. Use -SkipCertificateCheck to trust a self-signed Athena server on closed networks.

Spin up your own fully-provisioned Athena instance straight from the website. Each trial comes pre-populated with a sample fleet, so the console isn't empty while you explore.

• Compliance actions now dispatch correctly when a machine joins a dynamic collection.
• Alignment fixes to the Execute Command panels.