# Release Notes - New Features & Bug Fixes # 🛡️ EDR (Endpoint Detection & Response) **✨ Enhancement** - Expand OCSF Device Inventory (class `5001`) mapping across the EDR connectors. `query_endpoints` and `get_endpoint` now populate `device.agent_list`, `device.groups`, `device.domain`, `device.is_managed`, `device.model`, `device.hw_info.vendor_name`, and IP and MAC address lists wherever the vendor payload has a source, for CrowdStrike, SentinelOne, Sophos, Microsoft Defender, ESET, Bitdefender GravityZone, Tanium, Malwarebytes, and Kandji (IRU). - Return unused vendor fields in an `unmapped` block on device inventory instead of dropping them, so provider-specific detail stays available alongside the normalized OCSF fields. **🐛 Bug Fix** - Fix `os.type` and `os.type_id` detection on device inventory. Ubuntu and other Linux distributions on ESET, Windows Server and macOS on Microsoft Defender, macOS on Malwarebytes and Kandji (IRU), and the operating system and device type enums on SentinelOne previously resolved to the wrong value or to `Unknown`. - Fix Tanium device inventory dropping network interfaces. Class `5001` has no root `network_interfaces` field, so adapter data was discarded; interfaces are now emitted at `device.network_interfaces`. - Fix Bitdefender GravityZone `query_endpoints` stamping `time` with the request time rather than the endpoint's last-seen time, and endpoint detail emitting a non-OCSF `device.agent` field in place of `device.agent_list`. - Stop deriving `device.network_status` from agent health on ESET and Bitdefender GravityZone. Agent functionality status is not a network isolation signal; on ESET it remains available as `status_id` and `status_detail`. # 📦 Endpoint Management **✨ New Provider** - Add NinjaOne Endpoint Management Provider, with device, software, and compliance finding queries mapped to OCSF, including region support and server-side filtering. **✨ Enhancement** - Accept inclusive `gte` and `lte` bounds on Automox `device.first_seen_time` and `device.last_seen_time`, in addition to the exclusive `gt` and `lt` already supported. Scheduled operations inject an inclusive bound, so a schedule pointed at an Automox integration previously failed on every run. # 👤 Identity Management **✨ Enhancement** - Publish the GitHub Identity provider configuration guide. - Document the Microsoft Entra ID `region` field and Microsoft Graph government cloud support. Setting `region` to `gcc_high` or `dod` derives the correct Graph URL, OAuth scope, and login endpoint automatically, so no manual `url` or `token_url` override is needed; `us` maps to commercial Graph and is not the correct value for a government tenant. - Add the exclusive `gt` and `lt` operators to Okta time filters, alongside the inclusive `gte` and `lte` already supported. **🐛 Bug Fix** - Remove `time` ordering support from GitHub Identity `query_audit_log`. GitHub orders on a different timestamp field than it filters on, so ordered results were unreliable. Query Audit Log now behaves consistently with the other identity providers that support it. # 🎫 Ticketing **✨ Enhancement** - Add `parent` support to Linear tickets. `parent` can be set on Create Ticket, changed or cleared with Patch Ticket, and is returned by Get Ticket, accepting either an issue identifier such as `ENG-42` or a UUID. **🐛 Bug Fix** - Fix Jira `query_tickets` rejecting order-only requests. Sorting without a filter returned a `400` from Atlassian reading "Unbounded JQL queries are not allowed here"; the default one-year bound is now applied to unfiltered queries regardless of ordering, so every declared sortable field works with `order` alone. - Return `400` instead of `500` when a Jira ticket query names an unknown filter field, and `404` instead of `500` when List Attachments Metadata is called with an unknown ticket ID. - Return `400` instead of a confusing provider error when Jira Patch Ticket is sent a non-string `parent`, `assignee`, `priority`, component, or version value, and `400` instead of `500` for an unrecognized priority string. # ☁️ Cloud Security **🐛 Bug Fix** - Fix Wiz compliance `resource.name[eq]` returning partial matches. Wiz's own filter is a substring match, so a query for `annam-instance-group` also returned `annam-instance-group-3q2d`. The filter is now re-checked after transform, including on pages reached through a cursor. # 🔔 Notifications **✨ Enhancement** - Publish the Slack Webhook provider configuration guide, and link it from the provider's configuration metadata. # 📊 SIEM & Sink **✨ Enhancement** - Add `get_alert` support to the CrowdStrike SIEM provider, returning a single alert by `finding_info.uid` as an OCSF Detection Finding. - Move Google SecOps `query_events` to Google's asynchronous search API. Pagination is now stable up to one million events, `time` ordering is supported, and a long-running search no longer risks exceeding the request timeout — continuation cursors let callers resume waiting for a result set. Async search requires different Google SecOps role permissions; see the updated provider configuration guide. **🐛 Bug Fix** - Fix Splunk event queries silently stopping at Splunk's default 10,000-result sort cap. Queries now use an explicit sort limit, detect the end of a result set from the job's own result count, and walk the time window past full batches, so callers can page through the full matching set. - Fix CrowdStrike NGSIEM returning the same event on two pages. `@timestamp` carries only millisecond resolution, so a burst of events shared one value and each page's search job was free to order that tie differently. Queries now sort on `@timestamp` and `@id` together and resume from the last event ID rather than a row count. - Fix the HTTP sink hanging when a destination returns success headers and then never sends a response body. The body read error was swallowed and the body silently became empty; it is now surfaced to the caller instead of blocking. # ⚙️ Core **✨ Enhancement** - Add scheduled operation support for the Email Security and Endpoint Management connectors: `emailsecurity_query_threats`, `emailsecurity_query_email_events`, `endpointmanagement_query_devices`, and `endpointmanagement_query_compliance_findings`. Integrations in these categories previously received no schedules and never synced. - Add `cursor_advanced_to` to scheduled operation execution history. The field carries the newest data timestamp a run persisted and is omitted when the run did not advance, so a run that completed and a run that made progress are now distinguishable. - Accept `backfill_from_time: "max"` on scheduled operations, resolving to the maximum one-year backfill window relative to the operation's creation, so callers do not have to compute the boundary themselves. - Publish a scheduled operations guide covering cursors, backfill, and incremental configuration. **🐛 Bug Fix** - Fix scheduled operations failing on every run after the first for Qualys Cloud, Rapid7 Insight Cloud, Tanium Cloud, and Kandji (IRU). The injected incremental filter used an exclusive `gt` bound that those connectors reject, affecting `vulnerabilities_query_findings`, `vulnerabilities_query_assets`, and `assets_query_vulnerabilities`. Each operation now injects an operator the receiving connector accepts. - Fall back to a full snapshot instead of returning `400` when a scheduled operation's timestamp filter is not offered by the target provider. `edr_query_applications` on SentinelOne, Microsoft Defender, Sophos, Malwarebytes, and Tanium, and `edr_query_endpoints` on Bitdefender, ESET, Kandji (IRU), and Tanium were affected. The fallback is reported on the run rather than applied silently. - Fix `edr_query_iocs` re-delivering its entire backfill window on every run. IOC transforms emit STIX 2.1 timestamps as RFC 3339 strings, which the cursor extractor could not read, so the cursor never advanced while runs reported `COMPLETE`. The operation is now correctly declared a full snapshot. - Retry abrupt disconnects on bridge-routed HTTP calls, including OAuth token fetches. Transient connection resets on a bridge deployment previously surfaced as hard failures, and exhausted retries now return a connectivity error rather than a credential or configuration error. - Fix six provider configuration guide links returned in provider metadata that did not resolve. - Fix broken links in the asynchronous operations guide. # 📚 SDK Releases **Latest Versions** - Released Synqly SDK versions: `2.0.39`, `2.0.40`, `2.0.41`, `2.0.42`, `2.0.43`, `2.0.44`, `2.0.45` # 🚢 Synqly Embedded **Latest Release: `v0.1.152`** - **Service Image Tag**: `embedded-2026.08.28` - **Service Image Tag (NO FIPS)**: `embedded-2026.08.28-no-fips` - **Release Date**: August 28, 2026