# Release Notes - New Features & Bug Fixes

# 🛡️ EDR (Endpoint Detection & Response)

**✨ Enhancement**

- Add time filter support for alerts and threats across EDR providers, including CrowdStrike, Microsoft Defender, Malwarebytes, ESET, Sophos, SentinelOne, Tanium, and Trellix.


**🐛 Bug Fix**

- Remove unsupported `gt`/`gte`/`lt`/`lte` operators from string filters on Microsoft Defender `QueryEdrEvents`.
- Remove incorrect Tanium EDR `computerName` → `metadata.tenant_uid` mapping from alerts and threats.


## 👤 Identity Management

**✨ Enhancement**

- Include non-interactive Microsoft Entra ID sign-ins in Query Audit Log, with `logon_type` mapping and filtering for Interactive and Non-Interactive events.
- Improve Microsoft Entra ID premium license error handling so licensing issues are not reported as authentication failures.


**🐛 Bug Fix**

- Retry transient Google Workspace Reports API 401 responses.
- Fix Workday HTTP client usage for token refresh, tracing, and error handling.


# 🔍 Vulnerability Management

**🐛 Bug Fix**

- Fix Qualys QDS parameter handling on retry after provider error 1901.
- Improve Tenable API client retry behavior for rate-limited POST requests.


# 🎫 Ticketing

**🐛 Bug Fix**

- Correct ServiceNow ticketing field error messages for issue type, summary, and priority.


# 📊 SIEM & Sink

**🐛 Bug Fix**

- Stop emitting unnecessary Problem messages for Generic HTTP Sink array response handling.


# ⚙️ Core

**✨ Enhancement**

- Add OAuth 2.0 client credentials authentication support for ServiceNow integrations.
- Allow `*` wildcards in integration point mapping templates so mappings can apply across providers.
- Add configurable Azure Key Vault URL support for government cloud KMS deployments.
- Improve OAuth error handling and logging for gateway timeout and bad gateway responses.


**🐛 Bug Fix**

- Map provider config schema and serialization failures to server errors instead of client configuration errors.


# 📚 SDK Releases

Please note that 2.x SDK versions are now released. 2.x and later SDK versions now include meta function support for all operations and much improved memory utilization (Python import times substantially reduced).

Some customers may need to implement some minor migration changes to support the 2.x SDK versions (see below). Older SDK's are still supported.

**Latest Versions**

- Released Synqly SDK versions: `1.0.163`, `1.0.164`, `1.0.165`, `1.0.166`, `2.0.1`, `2.0.2`, `2.0.3`, `2.0.4`, `2.0.5`


# 🚢 Synqly Embedded

**Latest Release: `v0.1.144`**

- **Service Image Tag**: `embedded-2026.07.24`
- **Service Image Tag (NO FIPS)**: `embedded-2026.07.24-no-fips`
- **Release Date**: July 24, 2026


# SDK 2.x Migration Guides

## Golang SDK

# Migrating your Go integration to the `meta`-enabled Synqly SDK

This Synqly SDK release adds the `meta` query parameter (Synqly [meta
functions](https://docs.synqly.com/api-reference/meta-functions)) to **every**
engine endpoint, so meta functions work uniformly across the API.

Go cannot express optional positional arguments, so adding `meta` is a breaking
signature change on the affected endpoints. The good news: **the Go compiler
flags every call site that needs updating** — there are no silent behavior
changes, so a build-fix-rebuild loop reliably gets you to a clean state.

There are two change shapes. Adopting `meta` itself is always optional.

## Shape 1 — endpoints that gained a `request` argument

Endpoints that previously took **no request object** (reads, single-resource
gets, and action endpoints) now take a positional
`request *engine.<Op>Request`. Pass `nil` when you aren't using meta:


```go
// before
ep, err := client.Edr.GetEndpoint(ctx, id)
// after
ep, err := client.Edr.GetEndpoint(ctx, id, nil)

// opting in to meta:
m := "count"
ep, err := client.Edr.GetEndpoint(ctx, id, &engine.GetEndpointRequest{Meta: []*string{&m}})
```

This affects read/get/query/action endpoints across the connectors — for
example `Edr.GetEndpoint`, `EndpointManagement.GetDevice`,
`Identity.GetGroup` / `EnableUser` / `DisableUser`,
`Notifications.GetMessage` / `ClearMessage`, `Ticketing.GetTicket` /
`ListComments` / `DeleteComment`, `Vulnerabilities.GetScanStatus`,
`Storage.DeleteFile`, `Assets.GetLabels` / `QueryAlerts`, and `Custom.Delete`.
The compiler reports each one as "not enough arguments"; insert `nil` (before any
`option.RequestOption` arguments).

## Shape 2 — create/update/post endpoints: body moves under `.Body`

Endpoints that took a request **body** (or a list/map body) now take a request
**wrapper** that carries `meta` alongside the body under a `.Body` field. The
wire format is unchanged — only the Go construction changes:


```go
// before
client.Ticketing.CreateTicket(ctx, &engine.CreateTicketRequest{Name: "Bug", ...})
// after
client.Ticketing.CreateTicket(ctx, &engine.CreateTicketRequestInput{
    Body: &engine.CreateTicketRequest{Name: "Bug", ...},
})

// list/map bodies wrap the same way:
client.Siem.PostEvents(ctx, events)
//  ->
client.Siem.PostEvents(ctx, &engine.PostSiemEventRequest{Body: events})
```

### Affected endpoints and their new request type

| Connector | Method | New request type (`.Body` holds the old argument) |
|  --- | --- | --- |
| `assets` | `CreateAsset` | `CreateDeviceRequestInput` |
| `assets` | `CreateDevices` | `CreateDevicesRequestInput` |
| `assets` | `CreateSoftware` | `CreateSoftwareInventoryRequestInput` |
| `assets` | `UpdateDeviceProperties` | `BulkUpdateDevicePropertiesRequestInput` |
| `edr` | `CreateIocs` | `CreateIocsRequestInput` |
| `edr` | `CreateThreatNote` | `CreateThreatNoteRequestInput` |
| `edr` | `ExecuteCommand` | `ExecuteCommandRequestInput` |
| `edr` | `NetworkQuarantine` | `NetworkQuarantineRequestInput` |
| `endpointmanagement` | `RemediateDevice` | `RemediationRequestInput` |
| `notifications` | `CreateMessage` | `CreateNotificationRequestInput` |
| `ticketing` | `CreateTicket` | `CreateTicketRequestInput` |
| `ticketing` | `CreateAttachment` | `CreateAttachmentRequestInput` |
| `ticketing` | `CreateComment` | `CreateCommentRequestInput` |
| `ticketing` | `CreateNote` | `CreateNoteRequestInput` |
| `ticketing` | `PatchTicket` | `PatchTicketRequestInput` |
| `ticketing` | `PatchNote` | `PatchNoteRequestInput` |
| `siem` | `PatchInvestigation` | `PatchInvestigationRequestInput` |
| `siem` | `PostEvents` | `PostSiemEventRequest` |
| `sink` | `PostEvents` | `PostSinkEventRequest` |
| `custom` | `Patch` | `PatchCustomRequestInput` |
| `custom` | `Post` | `PostCustomRequest` |
| `custom` | `PostBatch` | `PostBatchCustomRequest` |
| `vulnerabilities` | `CreateAsset` | `CreateAssetRequestInput` |
| `vulnerabilities` | `CreateFindings` | `CreateFindingsRequestInput` |
| `vulnerabilities` | `UpdateAsset` | `UpdateAssetRequestInput` |
| `vulnerabilities` | `UpdateFinding` | `UpdateFindingRequestInput` |
| `vulnerabilities` | `UploadScan` | `UploadScanRequestInput` |


In every case, wrap the value you used to pass in `&engine.<NewType>{Body: <old value>}`.
To opt into meta, set `Meta: []*string{...}` on the wrapper. Note
`vulnerabilities.CreateAsset` and `vulnerabilities.UpdateAsset` share the
`CreateAssetRequest` body but use **different** wrappers (`CreateAssetRequestInput`
vs `UpdateAssetRequestInput`); `assets.CreateAsset` is distinct again
(`CreateDeviceRequestInput`).

## Recommended migration steps

1. **Upgrade the SDK and build.** `go build ./...` (and `go vet` / `go test` to
include test files) flags every affected call site precisely.
2. **Apply the two patterns above** to each flagged site — insert `nil` for
Shape 1, wrap the body for Shape 2 — and rebuild until green.
3. **Optional — use a coding agent.** Hand it this guide plus your repository and
have it apply the changes, using your `go build` / tests as the completeness
gate. The compiler catching every site makes this reliable.


We deliberately do not ship an automated codemod: a pattern-matching script
mis-fires on identically-named methods (e.g. `slices.Delete`, other clients'
`PostEvents`) and misses requests built into variables, whereas the compiler —
or a compiler-guided coding agent — handles every case correctly.

## Python SDK

# Migrating your Python integration to the `meta`-enabled Synqly SDK

This Synqly SDK release adds the `meta` query parameter (Synqly [meta
functions](https://docs.synqly.com/api-reference/meta-functions)) to **every**
engine endpoint, so meta functions work uniformly across the API.

For the typed Python SDK this is **additive almost everywhere**. A small set of
create/update operations have a breaking signature change. This guide is the
complete list of what changed and how to update.

> This guide covers the **typed Python SDK** (`synqly`). If you use the
**typeless** SDK (`synqly-typeless`), no changes are required — meta is added
as an optional keyword argument and nothing else changes.


#### Scope at a glance

- **No change needed** for the vast majority of endpoints — reads, queries,
single-resource gets, actions, and the JSON-patch endpoints. They gain an
optional `meta=` keyword argument you can ignore or adopt.
- **No change needed** if you already call create/update endpoints with
flattened keyword arguments, or by spreading a request object's fields
(`client.ticketing.create_ticket(**my_request.dict())`).
- **Breaking** only for the create/update operations listed below, and only if
you pass a **request object** (`request=SomeRequest(...)`).


If your integration only reads data, upgrading is a no-op.

#### The breaking change: request objects become keyword arguments

Adding `meta` changed these requests so the body is passed as **flattened
keyword arguments** instead of a request object:


```python
# BEFORE
client.ticketing.create_ticket(request=CreateTicketRequest(name="Bug", summary="x"))

# AFTER — body fields become direct keyword arguments (plus an optional meta=)
client.ticketing.create_ticket(name="Bug", summary="x")
client.ticketing.create_ticket(name="Bug", summary="x", meta=["count"])
```

**To migrate:** drop the `request=SomeRequest(...)` wrapper and pass its fields
directly as keyword arguments. Equivalently, `request=SomeRequest(**fields)`
becomes `**fields`.

### Affected operations

| Connector | Operations |
|  --- | --- |
| `ticketing` | `create_ticket`, `create_attachment`, `create_comment`, `create_note` |
| `vulnerabilities` | `create_asset`, `update_asset`, `create_findings`, `update_finding` |
| `edr` | `create_iocs`, `network_quarantine` |
| `assets` | `create_asset` |
| `notifications` | `create_message` |


The JSON-patch operations (`patch_ticket`, `patch_note`, `patch_investigation`)
keep their `request=` parameter and are **not** affected.

#### Call styles that already work (no change)


```python
# flattened keyword arguments — already correct
client.ticketing.create_ticket(name="Bug", summary="x")
# spreading a request object's fields
client.ticketing.create_ticket(**my_ticket.dict())
# list-body / JSON-patch endpoints keep request=
client.siem.post_events(request=[event])
client.ticketing.patch_ticket(ticket_id, request=[{"op": "replace", ...}])
```

#### Recommended migration steps

1. **Upgrade the SDK** and run your test suite and type checker (mypy / pyright).
Each breaking call surfaces as a clear type error pointing at the exact line;
there are no silent behavior changes.
2. **Update the flagged calls** using the pattern above — at most the handful of
operations in the table, most projects use only a few.
3. **Optional — use a coding agent.** Because the change is a uniform, well-
scoped flatten on a known operation list, you can hand this guide and your
repository to a coding assistant and have it apply the changes, using your
test/type-check run as the completeness gate.


Adopting `meta` itself is always optional — every affected call also accepts an
optional `meta=` argument when you want to invoke meta functions.