Release Notes - New Features & Bug Fixes

🛡️ EDR (Endpoint Detection & Response)

✨ Enhancement

Query EDR Events is no longer marked in-development. The operation has been stable and in production use for some time, and the In Development notice has been removed from the documentation.
Add query_alerts support to the Kandji (IRU) EDR provider, mapping Kandji threat details to OCSF Detection Findings.
Add time filtering (gt, gte, lt) and server-side time ordering (asc, desc) to Tanium query_edr_events. Requests that omit an order now default to time[desc] for stable pagination.
Publish server-side time ordering (asc, desc) for Microsoft Defender query_edr_events, so ordering is now reflected in the capabilities API and documentation.

🐛 Bug Fix

Narrow the advertised Microsoft Defender query_edr_events time filter operators to gte and lte. The gt and lt operators were declared but never honored at runtime.

🐛 Bug Fix

Fix Nozomi Vantage asset queries failing when a device reports a numeric VLAN identifier. A single VLAN-bearing device previously caused the entire page of assets to fail.

✨ New Provider

Add Wiz Vulnerability Management Provider, with query_findings and query_assets support.
Add Microsoft Defender External Attack Surface Management (EASM) Vulnerability Management Provider, with asset and finding queries mapped to OCSF, and filtering on severity, confidence, state, and device fields.

✨ Enhancement

Clamp over-limit Query Findings requests to the maximum page size instead of returning a 400, matching existing Query Assets and scan behavior.
Lower the maximum vulnerabilities page size to 1000 to reduce peak memory usage across vulnerability providers.

🐛 Bug Fix

Fix a Horizon3 Query Findings cursor edge condition where an internal operation deadline could return no results and no cursor, incorrectly indicating that no findings were available.

✨ New Provider

Add SonarQube Server Application Security Provider, with query_applications, query_findings, query_application_findings, and get_application_finding_details support.

✨ Enhancement

Add time-based filtering to GitLab findings. finding.first_seen_time and finding.modified_time (gte/lte) are now supported on query_findings and query_application_findings, including across pagination.

🐛 Bug Fix

Restore the Ashby Identity connector. Creating an Ashby identity integration previously failed with an invalid provider type ashby error.

✨ Enhancement

Declare time ordering (asc, desc) support that was already applied server-side, so it is now reported by the capabilities API and documentation: query_events for Splunk, Microsoft Sentinel, QRadar, Rapid7, OpenSearch, and Panther; query_alerts for QRadar, Rapid7, and Panther.

🐛 Bug Fix

Fix Splunk event pagination advancing the page offset by the number of events fetched rather than returned, which could skip an event between pages.
Improve Microsoft Sentinel event identity calculation so events sharing a timestamp are not incorrectly detected as duplicates during pagination.

✨ Enhancement

Add integration-level scheduled operations. Integrations can now declare their own scheduled_operations through the management API and SDK, or inherit the template from their integration point, and can be configured in Connect. Editing one entry in a schedule leaves the cursors and incremental watermarks of the other operations untouched.
Improve Safe Dialer error reporting so an allow-listed address that misses on the port is reported distinctly instead of as "not a public address".

Latest Versions

Latest Release: v0.1.150