Skip to content
/
2026-09-04

Release Notes - New Features & Bug Fixes

🛡️ EDR (Endpoint Detection & Response)

✨ Enhancement

  • Add execute_command and retrieve_file support to the SentinelOne EDR provider, backed by SentinelOne's Remote Script Orchestration. The supported commands match the CrowdStrike out-of-box set — cat, ls, mount, ps, and pwd — and retrieved archives can be fetched with a password. Note that SentinelOne executes remote commands slowly; expect seven to nine minutes per command.

  • Align Microsoft Defender query_applications filters with what Microsoft's API actually supports. product.name, product.vendor_name, and product.version accept eq, in, and like, and device.uid and device.hostname are supported, with resumable pagination so a cursor picks up where the previous page left off.

🐛 Bug Fix

  • Fix Microsoft Defender query_applications advertising filters and ordering that never took effect. Defender's software inventory API ignores server-side filtering, so product.uid filtering and product.name ordering have been removed rather than silently returning unfiltered results; the remaining filters are applied by Synqly.

  • Fix Microsoft Defender query_alerts advertising an actor.user.name filter that matched the wrong field. It filtered on the alert assignee while responses carried the logged-on user, and Defender cannot filter on the logged-on user at all. The filter has been removed, the assignee remains available as unmapped.assignedTo, and alert modification time now maps correctly.

📦 Asset Management

✨ Enhancement

  • Publish the CrowdStrike provider configuration guide for the Asset Management connector.

🔍 Vulnerability Management

✨ New Provider

  • Add ServiceNow Unified Security Event Management (USEM) Vulnerability Provider, with findings query, asset query, create, and update, label lookup, and finding create and update, backed by ServiceNow's USEM vulnerability response tables. Filters are supported on findings, assets, and tickets.

👤 Identity Management

✨ Enhancement

  • Add entity.uid[eq] and entity.uid[in] (and the equivalent entity.user.uid) to GitHub Identity query_users, and class_uid[eq] to query_audit_log, for parity with the Okta provider. Both are pushed down to GitHub rather than filtered after the fact, so a filtered user lookup now costs a single request instead of one per user, and every returned user carries a real created_at.

  • Expand the ATT&CK mapping on Microsoft Entra ID Protection risk detections. newCountry, riskyIPAddress, anomalousToken, tokenIssuerAnomaly, suspiciousAPITraffic, suspiciousInboxForwarding, and suspiciousSendingPatterns now resolve to a technique instead of going unmapped.

  • Document that Query Risk Events on the Ping Identity provider requires PingOne Protect on the environment. Directory, user, group, and audit log operations remain available without it, and organization_id is documented as the environment ID used for Protect risk queries.

🐛 Bug Fix

  • Fix GitHub Identity audit log time filters losing sub-second precision. GitHub bounds its audit log on whole seconds, so time[gt] silently dropped every event sharing the bound's second and time[lt] did the same at the other end, while time[gte] and time[lte] admitted events from the wrong side of the bound. A caller polling time[gt] on a previous high-water mark lost those events permanently. Bounds are now widened for GitHub and the exact millisecond comparison is re-applied by Synqly.

  • Fix Microsoft Entra ID Protection risk detections with riskState: remediated reporting a status of Unknown instead of Resolved.

🎫 Ticketing

✨ Enhancement

  • Add parent filtering to Jira and Jira Service Management query_tickets, supporting eq, ne, in, and not_in. parent accepts either a ticket key or a numeric ID, matching the value already returned by Get Ticket.

  • Support Jira service accounts with granular API tokens for Jira Ticketing, Jira Service Management, and Jira Notifications. Set the new use_gateway flag on the provider configuration and Synqly resolves the tenant's cloud ID and routes requests through the Atlassian gateway; the credential stays the existing Basic shape, with the service account email as username and the granular token as secret.

☁️ Cloud Security

✨ Enhancement

  • Update the Palo Alto Cortex provider configuration guide to match the current Cortex console wording for tenant and API key setup.

📊 SIEM & Sink

✨ Enhancement

  • Raise the maximum number of events accepted in a single SIEM write from 25 to 2,500, matching the Sink batch size the same pipelines already use.

  • Pack a full page of events into one SQS message on the aws_sqs sink, controlled by a new events_per_message setting (single_event or page_of_events). Integrations created before this setting existed, and any integration that sets single_event, keep the original one-event-per-message wire format, so no existing consumer changes; newly created integrations default to page_of_events. Per-event error reporting is unchanged in both modes — an oversize or invalid event is reported on its own while its siblings deliver.

🐛 Bug Fix

  • Fix Elasticsearch and OpenSearch writes corrupting millisecond timestamps. About one value in three lost a millisecond on conversion, so the written @timestamp disagreed with the OCSF time it came from, reordering events and destabilizing sort-based pagination. Trailing zeros are also preserved now, and OpenSearch no longer rejects documents with pre-1970 timestamps.

⚙️ Core

✨ Enhancement

  • Enforce a 12-hour minimum frequency on scheduled operations that can only run as a full snapshot — those explicitly set to full_snapshot mode, and those whose operation or provider offers no timestamp filter to page on. A shorter requested frequency is raised to 12 hours rather than rejected, and the adjustment is reported on the integration create, PUT, and PATCH response in a new messages field. Existing schedules below the floor are corrected automatically. Incremental schedules are never affected.

🐛 Bug Fix

  • Stop returning OAuth token exchange bodies in api/response metadata. A caller requesting response metadata on a data call could receive the provider's live access token alongside it, observed on Microsoft Defender and CrowdStrike. Token exchanges are now excluded from collection across every provider that authenticates this way; primary responses, stats/count, and mapping/chains metadata are unaffected.

📚 SDK Releases

Latest Versions

  • Released Synqly SDK versions: 2.0.46, 2.0.47, 2.0.48, 2.0.49

🚢 Synqly Embedded

Latest Release: v0.1.153

  • Service Image Tag: embedded-2026.09.04
  • Service Image Tag (NO FIPS): embedded-2026.09.04-no-fips
  • Release Date: September 4, 2026
Previous page
Next page