✨ Enhancement

• Add time filter support for alerts and threats across EDR providers, including CrowdStrike, Microsoft Defender, Malwarebytes, ESET, Sophos, SentinelOne, Tanium, and Trellix.

🐛 Bug Fix

• Remove unsupported gt/gte/lt/lte operators from string filters on Microsoft Defender QueryEdrEvents.

• Remove incorrect Tanium EDR computerName → metadata.tenant_uid mapping from alerts and threats.

✨ Enhancement

• Include non-interactive Microsoft Entra ID sign-ins in Query Audit Log, with logon_type mapping and filtering for Interactive and Non-Interactive events.

• Improve Microsoft Entra ID premium license error handling so licensing issues are not reported as authentication failures.

🐛 Bug Fix

• Retry transient Google Workspace Reports API 401 responses.

• Fix Workday HTTP client usage for token refresh, tracing, and error handling.

🐛 Bug Fix

• Fix Qualys QDS parameter handling on retry after provider error 1901.

• Improve Tenable API client retry behavior for rate-limited POST requests.

🐛 Bug Fix

• Correct ServiceNow ticketing field error messages for issue type, summary, and priority.

🐛 Bug Fix

• Stop emitting unnecessary Problem messages for Generic HTTP Sink array response handling.

✨ Enhancement

• Add OAuth 2.0 client credentials authentication support for ServiceNow integrations.

• Allow * wildcards in integration point mapping templates so mappings can apply across providers.

• Add configurable Azure Key Vault URL support for government cloud KMS deployments.

• Improve OAuth error handling and logging for gateway timeout and bad gateway responses.

🐛 Bug Fix

• Map provider config schema and serialization failures to server errors instead of client configuration errors.

Please note that 2.x SDK versions are now released. 2.x and later SDK versions now include meta function support for all operations and much improved memory utilization (Python import times substantially reduced).

Some customers may need to implement some minor migration changes to support the 2.x SDK versions (see below). Older SDK's are still supported.

Latest Versions

• Released Synqly SDK versions: 1.0.163, 1.0.164, 1.0.165, 1.0.166, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5

Latest Release: v0.1.144

• Service Image Tag: embedded-2026.07.24
• Service Image Tag (NO FIPS): embedded-2026.07.24-no-fips
• Release Date: July 24, 2026

This Synqly SDK release adds the meta query parameter (Synqly meta functions) to every engine endpoint, so meta functions work uniformly across the API.

Go cannot express optional positional arguments, so adding meta is a breaking signature change on the affected endpoints. The good news: the Go compiler flags every call site that needs updating — there are no silent behavior changes, so a build-fix-rebuild loop reliably gets you to a clean state.

There are two change shapes. Adopting meta itself is always optional.

Endpoints that previously took no request object (reads, single-resource gets, and action endpoints) now take a positional request *engine.<Op>Request. Pass nil when you aren't using meta:

// before
ep, err := client.Edr.GetEndpoint(ctx, id)
// after
ep, err := client.Edr.GetEndpoint(ctx, id, nil)

// opting in to meta:
m := "count"
ep, err := client.Edr.GetEndpoint(ctx, id, &engine.GetEndpointRequest{Meta: []*string{&m}})

This affects read/get/query/action endpoints across the connectors — for example Edr.GetEndpoint, EndpointManagement.GetDevice, Identity.GetGroup / EnableUser / DisableUser, Notifications.GetMessage / ClearMessage, Ticketing.GetTicket / ListComments / DeleteComment, Vulnerabilities.GetScanStatus, Storage.DeleteFile, Assets.GetLabels / QueryAlerts, and Custom.Delete. The compiler reports each one as "not enough arguments"; insert nil (before any option.RequestOption arguments).

Endpoints that took a request body (or a list/map body) now take a request wrapper that carries meta alongside the body under a .Body field. The wire format is unchanged — only the Go construction changes:

// before
client.Ticketing.CreateTicket(ctx, &engine.CreateTicketRequest{Name: "Bug", ...})
// after
client.Ticketing.CreateTicket(ctx, &engine.CreateTicketRequestInput{
    Body: &engine.CreateTicketRequest{Name: "Bug", ...},
})

// list/map bodies wrap the same way:
client.Siem.PostEvents(ctx, events)
//  ->
client.Siem.PostEvents(ctx, &engine.PostSiemEventRequest{Body: events})

In every case, wrap the value you used to pass in &engine.<NewType>{Body: <old value>}. To opt into meta, set Meta: []*string{...} on the wrapper. Note vulnerabilities.CreateAsset and vulnerabilities.UpdateAsset share the CreateAssetRequest body but use different wrappers (CreateAssetRequestInput vs UpdateAssetRequestInput); assets.CreateAsset is distinct again (CreateDeviceRequestInput).

1. Upgrade the SDK and build. go build ./... (and go vet / go test to include test files) flags every affected call site precisely.
2. Apply the two patterns above to each flagged site — insert nil for Shape 1, wrap the body for Shape 2 — and rebuild until green.
3. Optional — use a coding agent. Hand it this guide plus your repository and have it apply the changes, using your go build / tests as the completeness gate. The compiler catching every site makes this reliable.

We deliberately do not ship an automated codemod: a pattern-matching script mis-fires on identically-named methods (e.g. slices.Delete, other clients' PostEvents) and misses requests built into variables, whereas the compiler — or a compiler-guided coding agent — handles every case correctly.

This Synqly SDK release adds the meta query parameter (Synqly meta functions) to every engine endpoint, so meta functions work uniformly across the API.

For the typed Python SDK this is additive almost everywhere. A small set of create/update operations have a breaking signature change. This guide is the complete list of what changed and how to update.

This guide covers the typed Python SDK (synqly). If you use the typeless SDK (synqly-typeless), no changes are required — meta is added as an optional keyword argument and nothing else changes.

• No change needed for the vast majority of endpoints — reads, queries, single-resource gets, actions, and the JSON-patch endpoints. They gain an optional meta= keyword argument you can ignore or adopt.
• No change needed if you already call create/update endpoints with flattened keyword arguments, or by spreading a request object's fields (client.ticketing.create_ticket(**my_request.dict())).
• Breaking only for the create/update operations listed below, and only if you pass a request object (request=SomeRequest(...)).

If your integration only reads data, upgrading is a no-op.

Adding meta changed these requests so the body is passed as flattened keyword arguments instead of a request object:

# BEFORE
client.ticketing.create_ticket(request=CreateTicketRequest(name="Bug", summary="x"))

# AFTER — body fields become direct keyword arguments (plus an optional meta=)
client.ticketing.create_ticket(name="Bug", summary="x")
client.ticketing.create_ticket(name="Bug", summary="x", meta=["count"])

To migrate: drop the request=SomeRequest(...) wrapper and pass its fields directly as keyword arguments. Equivalently, request=SomeRequest(**fields) becomes **fields.

The JSON-patch operations (patch_ticket, patch_note, patch_investigation) keep their request= parameter and are not affected.

# flattened keyword arguments — already correct
client.ticketing.create_ticket(name="Bug", summary="x")
# spreading a request object's fields
client.ticketing.create_ticket(**my_ticket.dict())
# list-body / JSON-patch endpoints keep request=
client.siem.post_events(request=[event])
client.ticketing.patch_ticket(ticket_id, request=[{"op": "replace", ...}])

1. Upgrade the SDK and run your test suite and type checker (mypy / pyright). Each breaking call surfaces as a clear type error pointing at the exact line; there are no silent behavior changes.
2. Update the flagged calls using the pattern above — at most the handful of operations in the table, most projects use only a few.
3. Optional — use a coding agent. Because the change is a uniform, well- scoped flatten on a known operation list, you can hand this guide and your repository to a coding assistant and have it apply the changes, using your test/type-check run as the completeness gate.

Adopting meta itself is always optional — every affected call also accepts an optional meta= argument when you want to invoke meta functions.