# Release Notes - New Features & Bug Fixes

# 🛡️ EDR (Endpoint Detection & Response)

**✨ Enhancement**

- Query EDR Events is no longer marked `in-development`. The operation has been stable and in production use for some time, and the In Development notice has been removed from the documentation.
- Add `query_alerts` support to the Kandji (IRU) EDR provider, mapping Kandji threat details to OCSF Detection Findings.
- Add `time` filtering (`gt`, `gte`, `lt`) and server-side `time` ordering (`asc`, `desc`) to Tanium `query_edr_events`. Requests that omit an order now default to `time[desc]` for stable pagination.
- Publish server-side `time` ordering (`asc`, `desc`) for Microsoft Defender `query_edr_events`, so ordering is now reflected in the capabilities API and documentation.


**🐛 Bug Fix**

- Narrow the advertised Microsoft Defender `query_edr_events` `time` filter operators to `gte` and `lte`. The `gt` and `lt` operators were declared but never honored at runtime.


# 📦 Asset Management

**🐛 Bug Fix**

- Fix Nozomi Vantage asset queries failing when a device reports a numeric VLAN identifier. A single VLAN-bearing device previously caused the entire page of assets to fail.


# 🔍 Vulnerability Management

**✨ New Provider**

- Add Wiz Vulnerability Management Provider, with `query_findings` and `query_assets` support.
- Add Microsoft Defender External Attack Surface Management (EASM) Vulnerability Management Provider, with asset and finding queries mapped to OCSF, and filtering on severity, confidence, state, and device fields.


**✨ Enhancement**

- Clamp over-limit Query Findings requests to the maximum page size instead of returning a `400`, matching existing Query Assets and scan behavior.
- Lower the maximum vulnerabilities page size to 1000 to reduce peak memory usage across vulnerability providers.


**🐛 Bug Fix**

- Fix a Horizon3 Query Findings cursor edge condition where an internal operation deadline could return no results and no cursor, incorrectly indicating that no findings were available.


# 🔐 Application Security

**✨ New Provider**

- Add SonarQube Server Application Security Provider, with `query_applications`, `query_findings`, `query_application_findings`, and `get_application_finding_details` support.


**✨ Enhancement**

- Add time-based filtering to GitLab findings. `finding.first_seen_time` and `finding.modified_time` (`gte`/`lte`) are now supported on `query_findings` and `query_application_findings`, including across pagination.


# 👤 Identity Management

**🐛 Bug Fix**

- Restore the Ashby Identity connector. Creating an Ashby identity integration previously failed with an `invalid provider type ashby` error.


# 📊 SIEM & Sink

**✨ Enhancement**

- Declare `time` ordering (`asc`, `desc`) support that was already applied server-side, so it is now reported by the capabilities API and documentation: `query_events` for Splunk, Microsoft Sentinel, QRadar, Rapid7, OpenSearch, and Panther; `query_alerts` for QRadar, Rapid7, and Panther.


**🐛 Bug Fix**

- Fix Splunk event pagination advancing the page offset by the number of events fetched rather than returned, which could skip an event between pages.
- Improve Microsoft Sentinel event identity calculation so events sharing a timestamp are not incorrectly detected as duplicates during pagination.


# ⚙️ Core

**✨ Enhancement**

- Add integration-level scheduled operations. Integrations can now declare their own `scheduled_operations` through the management API and SDK, or inherit the template from their integration point, and can be configured in Connect. Editing one entry in a schedule leaves the cursors and incremental watermarks of the other operations untouched.
- Improve Safe Dialer error reporting so an allow-listed address that misses on the port is reported distinctly instead of as "not a public address".


# 📚 SDK Releases

**Latest Versions**

- Released Synqly SDK versions: `2.0.27`, `2.0.28`, `2.0.29`, `2.0.30`


# 🚢 Synqly Embedded

**Latest Release: `v0.1.150`**

- **Service Image Tag**: `embedded-2026.08.14`
- **Service Image Tag (NO FIPS)**: `embedded-2026.08.14-no-fips`
- **Release Date**: August 14, 2026