Arctic Wolf Agent Containment Driver Release Notes

If the Arctic Wolf® Agent Containment Driver was installed during early access, updates do not occur automatically. In the Arctic Wolf Unified Portal, you can control how the Agent Containment Driver is installed on endpoints. Contact your Arctic Wolf Concierge Security® Team (CST) at security@arcticwolf.com for self-managed deployment options, questions, or feedback. For Agent release notes, see Agent Release Notes.

Version 1.3.51

Release Date: October 14, 2025

Features or Enhancements

  • Restricted DNS queries to only use the host's configured DNS server IP addresses during containment.

Bug Fixes

  • Resolved an issue that caused the deletion of install and uninstall log files.
  • Resolved an issue during installation that caused system reboots.
  • Resolved an issue where a failed upgrade resulted in the uninstallation of the previously installed version.
  • Resolved an issue where uninstallation details were briefly displayed on the console during the uninstall process.

Version 1.2.17

Release Date: February 18, 2025

Features or Enhancements

  • Improved Agent logging to include Agent containment service startup events.
  • Improved the uninstall process of the Agent containment service to completely remove any remaining filters.
  • Added support for Windows Server 2025.

Bug Fixes

  • Resolved an Agent containment issue where the containment user mode service didn't set the permit filter correctly.
  • Resolved an Agent containment issue affecting Windows 10 2015 LTSB that caused a blue screen error.
  • Resolved an Agent containment interoperability issue with Mimecast Security Agent.
  • Resolved an Agent containment integration issue where network connections to localhost were being blocked.

Version 1.2.5

Release Date: March 20, 2023

Features or Enhancements

  • Windows Kernel Containment Driver — Arctic Wolf can now perform host containment at the kernel level. This improves our existing host containment ability, to result in quick, reliable, host isolation. This feature includes the following changes:
    • Added a new directory for the kernel containment files:
      • Directory: C:\Program Files (x86)\Arctic Wolf Networks\Agent\modules\containment
      • Files:
        • AwnAgentService.exe
        • AwnWfpCallouts.cat
        • AwnWfpCallouts.inf
        • AwnWfpCallouts.sys
    • Added the kernel driver:
      • Service Name: AwnWfpCallouts
      • Driver path: C:\Windows\System32\drivers\AwnWfpCallouts.sys
    • Added an automatic startup service to Windows services:
      • Display name: Arctic Wolf Agent Containment
      • Service Name: AwWfpService
      • Executable Path: C:\Program Files (x86)\Arctic Wolf Networks\Agent\modules\containment\AwnAgentService.exe
    • Added support for additional 32-bit and 64-bit Windows versions:
      • Windows 10 and 11
      • Windows Server 2012 R2+ - 2022

Bug Fixes

  • Fixed a driver issue that resulted in Windows Server 2012 R2 boot failures.