In this article, we will walk through the key developments and innovations introduced in the Heimdal platform, covering the evolution from version 5.0.5 up to the latest 5.4.3 Version.

During this period, Heimdal has consistently expanded its capabilities across multiple areas, including endpoint protection, compliance, patch management, and unified security visibility. Each release has contributed to a more mature, integrated, and scalable cybersecurity platform.

This overview serves as a structured introduction to the most important improvements, which will be presented in detail in the following sections, release by release.

5.0.5 PROD

The 5.0.5 PROD release marks an important milestone in the evolution of the Heimdal platform, introducing several foundational capabilities that significantly enhance endpoint security, operational control, and deployment flexibility.

This version focuses on strengthening core defenses, simplifying infrastructure management, and improving the overall usability and scalability of the platform.

Remote Access Protection – A New Layer of RDP Security

One of the most impactful additions in this release is the introduction of Remote Access Protection (RAP), designed to address one of the most common attack vectors: exposed RDP services.

This feature provides full visibility and control over incoming Remote Desktop connections by:

• Monitoring all inbound RDP traffic
• Blocking connections by default unless explicitly allowlisted
• Logging every connection attempt directly in the dashboard
• Allowing granular control over permitted IPs and ranges

By default-denying unauthorized connections and enforcing policy-based access, RAP significantly reduces the attack surface and strengthens endpoint protection against brute-force and unauthorized access attempts.

Ransomware Encryption Protection X – Advanced Threat Detection Engine

Another major enhancement is the introduction of the Ransomware Encryption Protection X (REP X) engine, which delivers improved detection and prevention capabilities against ransomware threats.

This new engine is built on a kernel-level architecture and combines multiple detection mechanisms:

• Encryption activity monitoring
• Suspicious file rename detection
• Protection of Volume Shadow Copies
• Canary file-based detection techniques

These combined engines allow Heimdal to detect and stop a wide range of ransomware behaviors in real time, significantly improving both speed and accuracy of detection.

Network OS Deployment (PXE) – Scalable Infrastructure Management

The Network OS Deployment (PXE) module has been significantly enhanced in this release, making operating system deployment across networks more efficient and scalable.

Key capabilities include:

• Centralized management of OS image repositories
• Upload and distribution of ISO images via the cloud
• Ability to promote endpoints into PXE deployment servers
• Support for larger and more complex deployment scenarios

This functionality simplifies the provisioning of new devices and enables faster rollout of operating systems across enterprise environments.

Application Control – Performance and Usability Improvements

The Application Control module has undergone a significant backend refactoring, improving both performance and user experience. 

Main improvements include:

• Faster data processing and improved stability
• Simplified dashboard views (Standard and Raw Data)
• Enhanced filtering and visualization of application activity
• Better handling of large data volumes

These changes make it easier for administrators to monitor and control application execution across endpoints while maintaining high performance. 

Heimdal Agent Co-Branding – MSP Customization

The Heimdal Agent now supports extended co-branding capabilities, allowing resellers and corporate customers to customize the visual identity of the agent.

Supported options include:

• Large and small logo configurations
• Branding across dashboard, reports, and the agent UI
• Reseller-level distribution of branding settings

This feature is particularly useful for MSPs who want to deliver a fully branded experience to their customers.

Email Security – Improved Threat Categorization

The Email Security module has been enhanced with improved threat categorization, including support for Botnet detection within quarantine reports.

This ensures:

• Better visibility into malicious email activity
• More accurate classification of spam and malware-related threats
• Improved reporting and incident handling workflows

Additional Improvements

Beyond the major features, the 5.0.5 release also introduces several smaller but valuable improvements:

• NFR (Not for Resale) license handling for better reporting separation
• Improved pagination options in the dashboard
• Enhanced forensic export capabilities (CSV export of file metadata)
• Improved PSA integrations with hostname matching

These refinements contribute to a more polished and efficient user experience across the platform. 

Summary of 5.0.5

The 5.0.5 PROD release lays the groundwork for the next generation of Heimdal capabilities by:

• Introducing stronger endpoint protection (RAP, REP X)
• Enhancing deployment and infrastructure management (PXE)
• Improving usability and performance (Application Control)
• Expanding customization and reporting features

Overall, this version establishes a solid baseline for the more advanced compliance, visibility, and automation features introduced in subsequent releases.

Reference: https://support.heimdalsecurity.com/hc/en-us/articles/30055843941021-5-0-5-PROD

5.1.1 PROD

Building on the strong foundations established in version 5.0.5, the 5.1.1 PROD release introduces a significant shift towards compliance visibility, centralized management, and operational efficiency across the Heimdal platform.

This version focuses on enhancing transparency into security posture while giving administrators more control over endpoints and user activity.

Cyber Essentials Compliance – Unified Security Visibility

One of the most notable additions in this release is the introduction of Cyber Essentials compliance reporting and dedicated dashboard views, designed to provide a structured overview of organizational security posture. 

The feature includes:

• A unified dashboard for both device-level and user-level compliance
• Real-time visibility into key security controls:
  • Next-Gen Antivirus (NGAV)
  • Firewall
  • Patch management
  • Administrator privilege handling
• A dedicated Cyber Essentials report, available on-demand or scheduled

This allows organizations to quickly identify non-compliant endpoints and users, ensuring alignment with industry security standards and simplifying audit preparation

Heimdal Scripting Repository – Automation at Scale

The introduction of the Heimdal Scripting Repository marks a major step towards automation and centralized endpoint management.

This feature provides:

• A curated collection of predefined scripts (PowerShell and BAT)
• Secure import into a personal repository
• Support for:
  • Scheduled execution
  • Trigger-based automation
  • On-demand execution

Additionally, the repository includes access control mechanisms, ensuring that only authorized users can view, import, or modify scripts

This enables organizations to standardize operations, reduce manual tasks, and enforce consistency across environments.

Advanced Script Management – Variables and Flexibility

A key enhancement to scripting is the introduction of script variables, allowing dynamic parameterization. 

Supported variable types include:

• String
• Boolean
• Date
• Selection lists

This makes scripts more reusable and adaptable, reducing the need for hardcoded values and improving operational flexibility in real-world scenarios.

Endpoint Control – On-Demand Actions and GP Visibility

The 5.1.1 release introduces several important endpoint management capabilities:

On-demand agent uninstall

Administrators can now remotely uninstall the Heimdal agent directly from the dashboard with full traceability.

• Command execution is tracked via server commands
• Status updates are visible in real time
• Actions can be cancelled while pending

GP Switches view

A new Group Policy change tracking view provides visibility into policy assignment changes across endpoints.

This includes:

• Current and previous Group Policies
• Associated users
• Timestamp of changes

These features improve operational control and provide better audit tracking across environments.

Patch & Asset Management – Software Lifecycle Improvements

The release enhances software management capabilities with the ability to:

• Uninstall individual 3rd party applications directly from the dashboard
• Execute uninstall commands across multiple endpoints
• Track all actions via logs and server commands

This brings more flexibility and control to the software lifecycle management process. 

Application Control – Simplified Onboarding

A new feature called Default allowlist based on publisher simplifies the onboarding of Application Control.

This allows:

• Automatic trust for known software publishers
• Faster deployment of application control policies
• Reduced need for manual rule creation

Administrators can still override these defaults by explicitly blocking selected publishers when necessary.

Identity & M365 Security Enhancements

Several improvements were introduced in the M365 User Security module, focusing on identity protection:

Email forwarding rules detection

The platform can now identify email forwarding and redirection rules, a common indicator of compromised accounts.

• Visible in the User Anomaly Detection module
• Contributes to user risk score
• Fully actionable (acknowledge, delete, investigate)

Geo-based login restrictions

Administrators can block logins from specific countries via integration with Microsoft Entra Conditional Access.

This introduces an additional layer of identity protection against unauthorized access.

Demo Environment for Resellers

The release introduces a fully functional demo customer environment, designed to help resellers showcase Heimdal capabilities.

• Pre-configured with realistic data
• Automatically refreshed
• Supports multiple module demonstrations

This greatly improves the sales and onboarding experience for partners.

Summary of 5.1.1

The 5.1.1 PROD release represents a major step forward in transforming Heimdal into a compliance-aware and automation-driven platform by:

• Introducing structured compliance reporting (Cyber Essentials)
• Expanding automation capabilities (Scripting Repository)
• Improving endpoint control and auditability
• Strengthening identity and user-level security
• Simplifying operational workflows

Overall, this version shifts the platform from pure protection towards visibility, governance, and scalable management, preparing the ground for the advanced integrations and unified data models introduced in later releases.

Reference: https://support.heimdalsecurity.com/hc/en-us/articles/31420893947037-5-1-1-PROD

Heimdal 5.2.2 PROD & 5.2.0 RC

With the 5.2.0 RC and 5.2.2 PROD releases, Heimdal takes a major step forward towards becoming a truly unified cybersecurity platform, extending beyond endpoint and identity into network-level intelligence, advanced reporting, and integrated threat visibility.

These releases introduce new dimensions to the Threat-Hunting & Action Center (TAC), enhanced reporting capabilities, and deeper integration with external systems, significantly improving both detection and response workflows.

Threat-Hunting & Action Center – External Firewall Integration

One of the most significant innovations is the introduction of External Firewall integration into TAC, adding a completely new data source to the platform. 

Previously, Heimdal focused on:

• Endpoint telemetry
• User (M365) security data

With this update, a third dimension is introduced:

• External Firewall (e.g., Meraki)

This allows:

• Ingesting firewall alerts directly into TAC
• Correlating network-level events with endpoint and user activity
• Converting raw alerts into actionable MXDR intelligence

The goal is not just visibility, but reducing alert fatigue by centralizing and contextualizing security signals across multiple layers.

Unified Action Center – Single Pane of Glass

To support this broader visibility, Heimdal introduces a fully unified Action Center experience.

This includes:

• Consolidation of Devices, M365, and External Firewall views
• Dynamic switching between data contexts
• Unified workflows for:
  • Investigation
  • Resolution
  • Exclusion

This significantly improves analyst efficiency by removing fragmentation and enabling a single, coherent interface for security operations.

External Firewall – Advanced Visualization and Risk Scoring

The new External Firewall integration brings advanced visualization capabilities:

• Globe and map-based views
• Device-level and customer-level aggregation
• Risk-based prioritization and alert visibility

Users can:

• View risk scores across devices and environments
• Drill down into specific alerts
• Filter based on severity and resolution status

This provides a better contextual understanding of security risks, especially in distributed networks.

Unified Reporting – Expanded Coverage and Improved UX

The reporting system has been completely redesigned and expanded.

Key improvements include:

• Coverage across a broader set of product modules
• Improved report generation flow
• Enhanced filtering and customization options
• Ability to:
  • Generate on-demand or scheduled reports
  • Export in PDF format
  • Select preferred currency for financial reports

The redesigned reporting interface brings more clarity, consistency, and usability, making it easier to extract insights from large datasets.

USB Management – Improved Usability and Control

The USB Management module receives several enhancements aimed at simplifying device control:

• Predefined Class GUID dropdown for allowlisting
• Introduction of friendly names for USB devices
• Full editability of USB allowlist entries

These improvements reduce configuration complexity and enable better tracking and identification of USB devices across environments.

Incident Response Logs – Enhanced Forensics

A new Incident Response Logs feature has been introduced, providing deeper forensic visibility at endpoint level.

This includes access to:

• PowerShell command history
• Prefetch files
• Jump list traces

These logs help analysts perform more detailed investigations and improve incident response capabilities.

Privilege Management – Cloud AV Scanning

The PEDM module is enhanced with cloud-based antivirus scanning, adding an extra layer of security before privilege elevation.

Capabilities include:

• Pre-elevation file scanning
• Risk score-based decision making
• Automatic blocking of high-risk files
• Session-level monitoring during elevated privileges

This significantly strengthens protection against compromised or malicious executions with administrative rights.

Email Security – M365 Integration Enhancements

The Email Security module is further integrated with Microsoft 365 through the introduction of:

M365 Exchange Connector

A new routing option that:

• Handles both inbound and outbound email flows
• Eliminates dependency on traditional MX record setups
• Simplifies deployment in M365 environments

M365 Users View

A new dashboard view that:

• Displays active Microsoft 365 users
• Supports automated license tracking
• Improves billing accuracy and visibility

Threat Visibility – Expanded Notification System

The TAC notification system is extended with:

• New operational alerts (e.g., agent removal, endpoint isolation)
• Expanded M365 security alerts (MFA, password issues)
• Improved correlation and visibility

This ensures that all relevant security events are:

• Easily accessible
• Actionable
• Properly categorized

Summary of 5.2.x Releases

The 5.2.0 RC and 5.2.2 PROD releases represent a turning point in Heimdal’s evolution, transitioning the platform towards a multi-layered, unified security ecosystem by:

• Introducing External Firewall telemetry into TAC
• Consolidating all security views into a unified interface
• Expanding reporting and forensic capabilities
• Enhancing identity, email, and privilege security
• Improving usability across multiple modules

These releases lay the foundation for the fully integrated, compliance-driven and data-rich platform that continues to evolve in later versions.

Reference:  https://support.heimdalsecurity.com/hc/en-us/articles/34079699653021-5-2-2-PROD , 

https://support.heimdalsecurity.com/hc/en-us/articles/33322517852189-5-2-0-RC

Heimdal 5.3.3 PROD

The 5.3.3 PROD release represents a major milestone in Heimdal’s platform evolution, with a strong focus on compliance maturity, DNS Security redesign, and operational workflow improvements.

This version significantly enhances visibility, usability, and administrative control, particularly in the areas of Cyber Essentials compliance and DNS Security management.

Cyber Essentials Enhancements – From Visibility to Maturity

Building on the initial compliance features introduced in earlier versions, Heimdal upgrades its Cyber Essentials framework with more advanced logic and reporting capabilities.

Key improvements include:

• Introduction of a new compliance state:
  • Compliant
  • Non-Compliant
  • Undetermined
• Enhanced compliance evaluation logic across modules
• Expanded dashboard statistics and filtering options
• Improved reporting with full visibility across all compliance states

This allows organizations not only to identify issues but also to understand why compliance cannot be evaluated, which is critical in complex environments.

Device and User Compliance – Unified Evaluation Model

The compliance system now evaluates both devices and users using multiple criteria:

• Device-level checks:
  • NGAV status
  • Firewall status
  • Patch management activity
  • Privileged access configuration
• User-level checks:
  • MFA enforcement
  • Password strength compliance
  • M365 configuration alignment

This unified model helps ensure that both infrastructure and identity layers are aligned with security standards.

DNS Security – Major Functional and UX Redesign

The DNS Security module undergoes one of the most significant transformations in this release, introducing new workflows and improved usability.

Internal Approval Workflow

A completely new internal allowlist approval flow is introduced:

• End users can submit allowlist requests directly from block pages
• Requests can be routed either:
  • To Heimdal Support
  • Or to internal IT administrators
• Optional justification can be enforced for each request

This enables organizations to create structured workflows for false positive handling and domain management.

Allowlist Requests Dashboard

To support this new workflow, a dedicated “Allowlist Requests” dashboard tab has been introduced.

Features include:

• Pending requests view (awaiting approval)
• History view (approved/denied requests)
• Bulk approval/denial actions
• Group Policy-based allowlisting

This provides full traceability and governance over domain access decisions.

Domain Reanalysis – End-User Interaction Improvement

End users now have a direct mechanism to:

• Request domain reanalysis
• Submit allowlist requests from the block page

Depending on policy configuration:

• Requests go directly to Heimdal Support
• Or are handled internally by administrators

This significantly reduces friction and speeds up handling of blocked legitimate domains.

Unified DNS Security Views

Multiple DNS Security dashboard views have been consolidated into a single unified interface, including:

• Threat type views
• Hostname-related views
• Forensic views
• Latest threats data

This reduces complexity and improves navigation across large datasets.

New DNS Security Insights and Views

Several new analytical views have been introduced:

• Domain / Hits (Blocks) – shows most frequently blocked domains
• Manual Blocklists view – separates manually blocked domains from detected threats

These improvements enhance visibility into threat patterns and administrative actions.

DNS Security Usability Enhancements

Additional improvements include:

• CSV import/export for allowlists and blocklists
• Alphabetical sorting for category filtering
• Improved category relevance (top domains per category)

These refinements make daily administration faster and more efficient.

Patch & Asset Management – Security-Driven Decisions

The release introduces a new File Risk Score functionality in patch management.

Key capabilities:

• Cloud-based multi-engine AV scanning of uploaded files
• Risk scoring based on threat intelligence
• Visibility across:
  • Private patch storage
  • Application definitions
  • Patch configuration flows

This ensures that administrators can make informed decisions before deploying software, reducing the risk of distributing compromised files.

OS and Patch Management Improvements

Several enhancements improve update management:

Microsoft 365 Click-to-Run Updates

• Automatic detection and management of M365 Click-to-Run installations
• Integration into existing update workflows
• Unified visibility alongside OS updates

CVE Visibility in Patch Management

• New CVE column in 3rd party patch grids
• Direct visibility of vulnerabilities affecting applications

Deployment Sequencing

• Ability to define priority order for application deployment
• Ensures controlled and predictable installations

Infrastructure Enhancements – PXE Improvements

The PXE deployment feature now includes:

• Configurable network interface selection
• Better control over deployment traffic
• Improved segmentation and security

This allows administrators to target deployments more precisely within network environments.

Summary of 5.3.3

The 5.3.3 PROD release represents a critical evolution towards:

• More mature compliance tracking (Cyber Essentials)
• Fully redesigned DNS Security workflows
• Enhanced operational efficiency and usability
• Security-first patch management decisions

Overall, this version significantly strengthens Heimdal’s position as a compliance-aware, workflow-driven, and highly integrated security platform, paving the way for the deeper automation, visibility, and integrations seen in later releases.

Reference:  https://support.heimdalsecurity.com/hc/en-us/articles/34250419230877-5-3-3-PROD

Heimdal 5.4.3 PROD

The 5.4.3 PROD release expands Heimdal’s focus on operational efficiency, compliance automation, and remediation speed, while also refining how administrators deliver updates, manage Microsoft 365-related security workflows, and interact with product data across the platform.

This release introduces major improvements in Priority Update Server behavior, compliance enforcement, email remediation, PSA integrations, and API extensibility, making the platform more practical for large-scale operations and more consistent for day-to-day administration.

Priority Update Server Enhancements – Better Control Over Local Update Distribution

One of the most important additions in this version is the enhancement of the Priority Update Server (PUS) functionality used by 3rd Party Patch Management for peer-to-peer software delivery across Windows endpoints in the same network.

The release adds a new P2P Settings section under Group Policy configuration, including options such as P2P transfer, P2P port, Use Priority update servers, PUS Devices, PUS Retry Count, Keep cached files indefinitely, and Additional check interval for normal computers.

A key change is the introduction of a more explicit PUS Devices flow, where administrators can directly assign one or more endpoints as Priority Update Servers instead of relying only on dynamic discovery. In this model, clients actively target the configured PUS devices when retrieving applications, software packages, or updates.

The source also states that the PUS Devices grid supports adding devices through a selection modal and allows administrators to manage the order of listed devices, while a maximum of 10 devices can be added.

These changes improve predictability, scalability, and bandwidth efficiency for software deployment within distributed environments.

PSA Integrations – Expanded M365 Alert Coverage

The 5.4.3 PROD release significantly expands PSA integration capabilities by adding support for Microsoft 365 User Security notifications and LAD alerts across ConnectWise PSA, Halo PSA, and Autotask.

The release introduces a new M365 alert set and redesigns matching settings so that Device and M365 alerts are separated into dedicated tabs for better clarity. Within the new M365 tab, administrators can configure categories such as LAD Alerts, REP Cloud Alerts, Forwarding Rules Alerts, and User Compliance Alerts.

The mapping experience has also been expanded through a new Configure M365 Notifications section, which supports mapping options such as board, ticket type, status, and—where applicable—additional alert-specific fields like sub types and sub issue types.

According to the source, these updates are designed to enable automated ticket creation for Microsoft 365-related events while increasing flexibility and control over PSA workflows.

Customer Overview Improvements for Partners

The Customer Overview page for Distributors and Resellers also receives enhancements in this release. A new search by End User field has been added to help reseller and distributor accounts identify and triage their end users more efficiently.

In addition to visible interface changes, the source states that backend optimizations were implemented to improve the performance and stability of the Customer Overview page, especially when handling larger customer portfolios.

Compliance Settings – Automatic Session Locking

A major compliance-focused addition in 5.4.3 PROD is the introduction of Automatic Session Locking under a new Compliance Settings section in the Windows Group Policy configuration.

This option allows administrators to enforce automatic screen locking after a defined period of inactivity, with a configurable timeout ranging from 1 to 30 minutes, and a default value of 15 minutes.

The release explicitly positions this feature as support for security best practices and compliance requirements, including references to CIS 18 Controls recommendations related to session timeouts and workstation locking. The source also notes that changes to this setting take effect only after a system restart or user sign-out.

Compliance Settings – Automatic Security Logs Retrieval

The same Compliance Settings area introduces Automatic Security Logs Retrieval, which automates the collection of Windows Security Event Logs from endpoints.

When enabled, the Heimdal Agent retrieves the Security logs from Windows Event Viewer every 24 hours and stores them for compliance and auditing purposes. If a device is offline during a scheduled retrieval, the platform retrieves the missing logs retroactively based on the timestamp of the last successful retrieval.

The source specifies that collected logs are retained for 90 days and can be downloaded from Unified Management → Device Info → hostname → UEM → Logs → Windows Event Viewer Logs, where a new Type column helps differentiate between Full Event Viewer Logs and Security Logs.

OS Updates – Per-Category Delay Control

Patch management receives a practical improvement through the introduction of per-category delay settings for Windows Updates.

Instead of relying only on a single global delay, administrators can now define installation delays for individual update categories through a table-based configuration. The available delay values range from 1 to 31 days, or Off, which means no delay is applied and updates install immediately once available.

The source also makes it explicit that the per-category delay takes precedence over the general delay configured in “Delay update installation (days)”, while preserving existing Group Policy behavior through automatic inheritance when predefined conditions are met.

PEDM – Better Filtering and Search

The Privilege Elevation and Delegation Management (PEDM) module is improved with new filtering and search capabilities across several views.

New filters are added to Pending Approvals, and the filters in History are refined for better usability, including the renaming of the OS filter from Devices to Devices OS, enabling all elevation types by default, and adding an All option. The client-specific PEDM views in Unified Management → Device Info also gain filtering and search based on values such as Active username, Reason given, Executed Process, and Handled By.

These refinements improve traceability and help administrators work more efficiently with elevation-related records.

Email Security – Deleting Emails Directly from Microsoft 365 Inboxes

One of the standout practical additions in this release is the ability to perform email deletion directly from Microsoft 365 inboxes through Heimdal Email Security.

The source states that, after configuring the required Microsoft Entra Tenant ID, providing Unified Grant Consent, and granting the Microsoft application permission Mail.ReadWrite, administrators can access new actions from the Email Security details view: Delete from Inbox, Permanently Delete from Inbox, and Delete from ESEC / Delete from EFP repository.

The release also adds a Delete Type advanced filter to distinguish remediation actions, and a new Audit Logs tab that records who performed the deletion, which delete type was used, and the exact timestamp of the action.

This significantly strengthens remediation capabilities by enabling direct mailbox-level response without leaving the Heimdal workflow.

Additional Improvements and Fixes

The release also includes multiple smaller but valuable enhancements across the platform. The source explicitly mentions that Pre-approved publishers allowlist in Application Control now works in Reporting only Ruleset Mode with the default file action set to Block, and that CSV export is now available for both Standard and Raw Data views in Application Control.

For Remote Access Protection, the Heimdal Agent now automatically enforces the RAP firewall rule on the local GPO when synchronization gaps are detected.

In Threat-Hunting & Action Center, a new User Browsers tab has been introduced under User Anomaly Detection, displaying browser-related visibility such as username, browser name, popularity, and successful login count, with an available Delete Browser action.

The dashboard also gains a floating RD Connect button for faster access to Remote Desktop connection flows.

For PXE / Network OS Deployment, the service can now start as soon as at least one ISO image has been downloaded, and the product now displays more granular statuses such as Downloading, Completed, and Pending for ISO image handling.

Finally, the source states that the Heimdal API has been extended with four new TAC-related endpoints: TAC M365 Notifications API, TAC M365 Risk Score API, TAC External Firewall Notifications API, and TAC External Firewall Risk Score API.

Summary of 5.4.3 PROD

The 5.4.3 PROD release strengthens Heimdal in several strategically important areas by improving peer-to-peer update delivery, extending PSA automation, introducing compliance-oriented endpoint controls, and enabling faster email remediation inside Microsoft 365.

At the same time, the release continues the platform’s broader direction toward better visibility, stronger administrative control, and more integrated workflows across endpoint, email, compliance, and response operations.

Reference:  https://support.heimdalsecurity.com/hc/en-us/articles/35417992909853-5-4-3-PROD