# Release Notes - New Features & Bug Fixes

# 🛡️ EDR (Endpoint Detection & Response)

**✨ Enhancement**

- Add `execute_command` and `retrieve_file` support to the SentinelOne EDR provider, backed by SentinelOne's Remote Script Orchestration. The supported commands match the CrowdStrike out-of-box set — `cat`, `ls`, `mount`, `ps`, and `pwd` — and retrieved archives can be fetched with a password. Note that SentinelOne executes remote commands slowly; expect seven to nine minutes per command.
- Align Microsoft Defender `query_applications` filters with what Microsoft's API actually supports. `product.name`, `product.vendor_name`, and `product.version` accept `eq`, `in`, and `like`, and `device.uid` and `device.hostname` are supported, with resumable pagination so a cursor picks up where the previous page left off.


**🐛 Bug Fix**

- Fix Microsoft Defender `query_applications` advertising filters and ordering that never took effect. Defender's software inventory API ignores server-side filtering, so `product.uid` filtering and `product.name` ordering have been removed rather than silently returning unfiltered results; the remaining filters are applied by Synqly.
- Fix Microsoft Defender `query_alerts` advertising an `actor.user.name` filter that matched the wrong field. It filtered on the alert assignee while responses carried the logged-on user, and Defender cannot filter on the logged-on user at all. The filter has been removed, the assignee remains available as `unmapped.assignedTo`, and alert modification time now maps correctly.


# 📦 Asset Management

**✨ Enhancement**

- Publish the CrowdStrike provider configuration guide for the Asset Management connector.


# 🔍 Vulnerability Management

**✨ New Provider**

- Add ServiceNow Unified Security Event Management (USEM) Vulnerability Provider, with findings query, asset query, create, and update, label lookup, and finding create and update, backed by ServiceNow's USEM vulnerability response tables. Filters are supported on findings, assets, and tickets.


# 👤 Identity Management

**✨ Enhancement**

- Add `entity.uid[eq]` and `entity.uid[in]` (and the equivalent `entity.user.uid`) to GitHub Identity `query_users`, and `class_uid[eq]` to `query_audit_log`, for parity with the Okta provider. Both are pushed down to GitHub rather than filtered after the fact, so a filtered user lookup now costs a single request instead of one per user, and every returned user carries a real `created_at`.
- Expand the ATT&CK mapping on Microsoft Entra ID Protection risk detections. `newCountry`, `riskyIPAddress`, `anomalousToken`, `tokenIssuerAnomaly`, `suspiciousAPITraffic`, `suspiciousInboxForwarding`, and `suspiciousSendingPatterns` now resolve to a technique instead of going unmapped.
- Document that Query Risk Events on the Ping Identity provider requires PingOne Protect on the environment. Directory, user, group, and audit log operations remain available without it, and `organization_id` is documented as the environment ID used for Protect risk queries.


**🐛 Bug Fix**

- Fix GitHub Identity audit log time filters losing sub-second precision. GitHub bounds its audit log on whole seconds, so `time[gt]` silently dropped every event sharing the bound's second and `time[lt]` did the same at the other end, while `time[gte]` and `time[lte]` admitted events from the wrong side of the bound. A caller polling `time[gt]` on a previous high-water mark lost those events permanently. Bounds are now widened for GitHub and the exact millisecond comparison is re-applied by Synqly.
- Fix Microsoft Entra ID Protection risk detections with `riskState: remediated` reporting a status of `Unknown` instead of `Resolved`.


# 🎫 Ticketing

**✨ Enhancement**

- Add `parent` filtering to Jira and Jira Service Management `query_tickets`, supporting `eq`, `ne`, `in`, and `not_in`. `parent` accepts either a ticket key or a numeric ID, matching the value already returned by Get Ticket.
- Support Jira service accounts with granular API tokens for Jira Ticketing, Jira Service Management, and Jira Notifications. Set the new `use_gateway` flag on the provider configuration and Synqly resolves the tenant's cloud ID and routes requests through the Atlassian gateway; the credential stays the existing Basic shape, with the service account email as `username` and the granular token as `secret`.


# ☁️ Cloud Security

**✨ Enhancement**

- Update the Palo Alto Cortex provider configuration guide to match the current Cortex console wording for tenant and API key setup.


# 📊 SIEM & Sink

**✨ Enhancement**

- Raise the maximum number of events accepted in a single SIEM write from 25 to 2,500, matching the Sink batch size the same pipelines already use.
- Pack a full page of events into one SQS message on the `aws_sqs` sink, controlled by a new `events_per_message` setting (`single_event` or `page_of_events`). Integrations created before this setting existed, and any integration that sets `single_event`, keep the original one-event-per-message wire format, so no existing consumer changes; newly created integrations default to `page_of_events`. Per-event error reporting is unchanged in both modes — an oversize or invalid event is reported on its own while its siblings deliver.


**🐛 Bug Fix**

- Fix Elasticsearch and OpenSearch writes corrupting millisecond timestamps. About one value in three lost a millisecond on conversion, so the written `@timestamp` disagreed with the OCSF `time` it came from, reordering events and destabilizing sort-based pagination. Trailing zeros are also preserved now, and OpenSearch no longer rejects documents with pre-1970 timestamps.


# ⚙️ Core

**✨ Enhancement**

- Enforce a 12-hour minimum frequency on scheduled operations that can only run as a full snapshot — those explicitly set to `full_snapshot` mode, and those whose operation or provider offers no timestamp filter to page on. A shorter requested frequency is raised to 12 hours rather than rejected, and the adjustment is reported on the integration create, `PUT`, and `PATCH` response in a new `messages` field. Existing schedules below the floor are corrected automatically. Incremental schedules are never affected.


**🐛 Bug Fix**

- Stop returning OAuth token exchange bodies in `api/response` metadata. A caller requesting response metadata on a data call could receive the provider's live access token alongside it, observed on Microsoft Defender and CrowdStrike. Token exchanges are now excluded from collection across every provider that authenticates this way; primary responses, `stats/count`, and `mapping/chains` metadata are unaffected.


# 📚 SDK Releases

**Latest Versions**

- Released Synqly SDK versions: `2.0.46`, `2.0.47`, `2.0.48`, `2.0.49`


# 🚢 Synqly Embedded

**Latest Release: `v0.1.153`**

- **Service Image Tag**: `embedded-2026.09.04`
- **Service Image Tag (NO FIPS)**: `embedded-2026.09.04-no-fips`
- **Release Date**: September 4, 2026