New in Version 11.0 SP1

CPM 11.0 SP1 provides the following enhancements over previous versions.

Table 1. Enhancements for Version 11.0 SP1
Feature	Description
Behavior Monitoring	Behavior Monitoring works in conjunction with Web Reputation Services to verify the prevalence of files downloaded through HTTP channels or email applications. After detecting a "newly encountered" file, administrators can choose to prompt users before executing the file. Trend Micro classifies a program as newly encountered based on the number of file detections or historical age of the file as determined by the Smart Protection Network. For details, see Configure Behavior Monitoring Settings.
Smart Protection Server enhancement	This version of CPM supports the standalone version of the upgraded Smart Protection Server 3.0. The upgraded Smart Protection Server includes File Reputation Services pattern enhancements. The pattern files have been redesigned to provide the following benefits: Reduced memory consumption Incremental pattern updates and enhanced File Reputation Services pattern detection, which greatly reduce bandwidth consumption
Global Intelligence C&C server lists	CPM can automatically detect any known Command and Control (C&C) server through use of the Trend Micro Smart Protection Network Global Intelligence list. Trend Micro Smart Protection Network compiles the Global Intelligence list from sources all over the world and tests and evaluates the risk level of each C&C callback address. Web Reputation Services uses the Global Intelligence list in conjunction with the reputation scores for malicious websites to provide enhanced security against advanced threats. The web reputation security level determines the action taken on malicious websites or C&C servers based on assigned risk levels.
C&C IP list	The C&C IP list works in conjunction with the Network Content Inspection Engine (NCIE) to detect network connections with known C&C servers. NCIE detects C&C server contact through any network channel. CPM logs all connection information to servers in the C&C IP list for evaluation.
Suspicious Connection Settings enhancement	Command & Control (C&C) Contact Alert Services has been updated to include the following: Global User-defined Approved and Blocked IP lists Granular action configuration when suspicious connections are detected
Platform and browser support	CPM agent supports Windows 10 (Home, Pro, Education, and Enterprise editions). CPM supports Microsoft Edge. For a list of system requirements, refer to Core Protection Module System Requirements.