Skip to content
/
2026-08-28

Release Notes - New Features & Bug Fixes

🛡️ EDR (Endpoint Detection & Response)

✨ Enhancement

  • Expand OCSF Device Inventory (class 5001) mapping across the EDR connectors. query_endpoints and get_endpoint now populate device.agent_list, device.groups, device.domain, device.is_managed, device.model, device.hw_info.vendor_name, and IP and MAC address lists wherever the vendor payload has a source, for CrowdStrike, SentinelOne, Sophos, Microsoft Defender, ESET, Bitdefender GravityZone, Tanium, Malwarebytes, and Kandji (IRU).

  • Return unused vendor fields in an unmapped block on device inventory instead of dropping them, so provider-specific detail stays available alongside the normalized OCSF fields.

🐛 Bug Fix

  • Fix os.type and os.type_id detection on device inventory. Ubuntu and other Linux distributions on ESET, Windows Server and macOS on Microsoft Defender, macOS on Malwarebytes and Kandji (IRU), and the operating system and device type enums on SentinelOne previously resolved to the wrong value or to Unknown.

  • Fix Tanium device inventory dropping network interfaces. Class 5001 has no root network_interfaces field, so adapter data was discarded; interfaces are now emitted at device.network_interfaces.

  • Fix Bitdefender GravityZone query_endpoints stamping time with the request time rather than the endpoint's last-seen time, and endpoint detail emitting a non-OCSF device.agent field in place of device.agent_list.

  • Stop deriving device.network_status from agent health on ESET and Bitdefender GravityZone. Agent functionality status is not a network isolation signal; on ESET it remains available as status_id and status_detail.

📦 Endpoint Management

✨ New Provider

  • Add NinjaOne Endpoint Management Provider, with device, software, and compliance finding queries mapped to OCSF, including region support and server-side filtering.

✨ Enhancement

  • Accept inclusive gte and lte bounds on Automox device.first_seen_time and device.last_seen_time, in addition to the exclusive gt and lt already supported. Scheduled operations inject an inclusive bound, so a schedule pointed at an Automox integration previously failed on every run.

👤 Identity Management

✨ Enhancement

  • Publish the GitHub Identity provider configuration guide.

  • Document the Microsoft Entra ID region field and Microsoft Graph government cloud support. Setting region to gcc_high or dod derives the correct Graph URL, OAuth scope, and login endpoint automatically, so no manual url or token_url override is needed; us maps to commercial Graph and is not the correct value for a government tenant.

  • Add the exclusive gt and lt operators to Okta time filters, alongside the inclusive gte and lte already supported.

🐛 Bug Fix

  • Remove time ordering support from GitHub Identity query_audit_log. GitHub orders on a different timestamp field than it filters on, so ordered results were unreliable. Query Audit Log now behaves consistently with the other identity providers that support it.

🎫 Ticketing

✨ Enhancement

  • Add parent support to Linear tickets. parent can be set on Create Ticket, changed or cleared with Patch Ticket, and is returned by Get Ticket, accepting either an issue identifier such as ENG-42 or a UUID.

🐛 Bug Fix

  • Fix Jira query_tickets rejecting order-only requests. Sorting without a filter returned a 400 from Atlassian reading "Unbounded JQL queries are not allowed here"; the default one-year bound is now applied to unfiltered queries regardless of ordering, so every declared sortable field works with order alone.

  • Return 400 instead of 500 when a Jira ticket query names an unknown filter field, and 404 instead of 500 when List Attachments Metadata is called with an unknown ticket ID.

  • Return 400 instead of a confusing provider error when Jira Patch Ticket is sent a non-string parent, assignee, priority, component, or version value, and 400 instead of 500 for an unrecognized priority string.

☁️ Cloud Security

🐛 Bug Fix

  • Fix Wiz compliance resource.name[eq] returning partial matches. Wiz's own filter is a substring match, so a query for annam-instance-group also returned annam-instance-group-3q2d. The filter is now re-checked after transform, including on pages reached through a cursor.

🔔 Notifications

✨ Enhancement

  • Publish the Slack Webhook provider configuration guide, and link it from the provider's configuration metadata.

📊 SIEM & Sink

✨ Enhancement

  • Add get_alert support to the CrowdStrike SIEM provider, returning a single alert by finding_info.uid as an OCSF Detection Finding.

  • Move Google SecOps query_events to Google's asynchronous search API. Pagination is now stable up to one million events, time ordering is supported, and a long-running search no longer risks exceeding the request timeout — continuation cursors let callers resume waiting for a result set. Async search requires different Google SecOps role permissions; see the updated provider configuration guide.

🐛 Bug Fix

  • Fix Splunk event queries silently stopping at Splunk's default 10,000-result sort cap. Queries now use an explicit sort limit, detect the end of a result set from the job's own result count, and walk the time window past full batches, so callers can page through the full matching set.

  • Fix CrowdStrike NGSIEM returning the same event on two pages. @timestamp carries only millisecond resolution, so a burst of events shared one value and each page's search job was free to order that tie differently. Queries now sort on @timestamp and @id together and resume from the last event ID rather than a row count.

  • Fix the HTTP sink hanging when a destination returns success headers and then never sends a response body. The body read error was swallowed and the body silently became empty; it is now surfaced to the caller instead of blocking.

⚙️ Core

✨ Enhancement

  • Add scheduled operation support for the Email Security and Endpoint Management connectors: emailsecurity_query_threats, emailsecurity_query_email_events, endpointmanagement_query_devices, and endpointmanagement_query_compliance_findings. Integrations in these categories previously received no schedules and never synced.

  • Add cursor_advanced_to to scheduled operation execution history. The field carries the newest data timestamp a run persisted and is omitted when the run did not advance, so a run that completed and a run that made progress are now distinguishable.

  • Accept backfill_from_time: "max" on scheduled operations, resolving to the maximum one-year backfill window relative to the operation's creation, so callers do not have to compute the boundary themselves.

  • Publish a scheduled operations guide covering cursors, backfill, and incremental configuration.

🐛 Bug Fix

  • Fix scheduled operations failing on every run after the first for Qualys Cloud, Rapid7 Insight Cloud, Tanium Cloud, and Kandji (IRU). The injected incremental filter used an exclusive gt bound that those connectors reject, affecting vulnerabilities_query_findings, vulnerabilities_query_assets, and assets_query_vulnerabilities. Each operation now injects an operator the receiving connector accepts.

  • Fall back to a full snapshot instead of returning 400 when a scheduled operation's timestamp filter is not offered by the target provider. edr_query_applications on SentinelOne, Microsoft Defender, Sophos, Malwarebytes, and Tanium, and edr_query_endpoints on Bitdefender, ESET, Kandji (IRU), and Tanium were affected. The fallback is reported on the run rather than applied silently.

  • Fix edr_query_iocs re-delivering its entire backfill window on every run. IOC transforms emit STIX 2.1 timestamps as RFC 3339 strings, which the cursor extractor could not read, so the cursor never advanced while runs reported COMPLETE. The operation is now correctly declared a full snapshot.

  • Retry abrupt disconnects on bridge-routed HTTP calls, including OAuth token fetches. Transient connection resets on a bridge deployment previously surfaced as hard failures, and exhausted retries now return a connectivity error rather than a credential or configuration error.

  • Fix six provider configuration guide links returned in provider metadata that did not resolve.

  • Fix broken links in the asynchronous operations guide.

📚 SDK Releases

Latest Versions

  • Released Synqly SDK versions: 2.0.39, 2.0.40, 2.0.41, 2.0.42, 2.0.43, 2.0.44, 2.0.45

🚢 Synqly Embedded

Latest Release: v0.1.152

  • Service Image Tag: embedded-2026.08.28
  • Service Image Tag (NO FIPS): embedded-2026.08.28-no-fips
  • Release Date: August 28, 2026
Previous page
Next page