# Release Notes - New Features & Bug Fixes

# New "GRC" Connector!

We have released support for a new GRC (Governance, Risk, and Compliance) connector, giving integrators one normalized API over a customer's compliance program — frameworks, controls, tests, evidence, and the compliance posture of devices and personnel — regardless of vendor.

**✨ New Provider - Secureframe**

- Add the Secureframe GRC Provider with six query operations and four get-by-id operations, covering compliance frameworks, controls, tests, evidence, and device and personnel compliance posture, with cursor pagination and server-side filtering and ordering scoped to what Secureframe supports.
- Catalog data is returned as OCSF Inventory Info events under Synqly's `989` extension, and per-entity compliance posture as OCSF Compliance Finding (class `2003`). Standard identifiers are passed through unmodified rather than remapped, since OCSF defines no canonical compliance vocabulary.


# New "Security Awareness" Connector!

We have released support for a new Security Awareness connector, covering security awareness training programs and phishing simulation campaigns. Additional provider support coming soon!

**✨ New Provider - KnowBe4 Security Awareness Training (KSAT)**

- Add the KnowBe4 Security Awareness Training (KSAT) Provider with `query_training_campaigns`, `query_phishing_simulations`, `query_users`, `get_training_campaign_details`, `get_phishing_simulation_details`, and `get_user_details`.
- Training campaigns and phishing simulations are returned as new OCSF 1.8.0 Inventory Info event classes, and users carry their campaign enrollments under a new Security Awareness profile.
- Publish the KnowBe4 Security Awareness Training (KSAT) provider configuration guide.


# New "Threat Intelligence" Connector!

We have released support for a new Threat Intelligence connector, giving integrators a single reputation lookup API across multiple intel sources. Every lookup returns an OCSF OSINT Inventory Info event (class `5021`).

**✨ New Provider - VirusTotal**

- Add the VirusTotal Threat Intelligence Provider with `lookup_hash`, `lookup_url`, `lookup_domain`, and `lookup_ip`.


**✨ New Provider - ThreatFox**

- Add the ThreatFox (abuse.ch) Threat Intelligence Provider with `lookup_hash`, `lookup_url`, `lookup_domain`, and `lookup_ip`.


**✨ New Provider - AbuseIPDB**

- Add the AbuseIPDB Threat Intelligence Provider with `lookup_ip`. The remaining lookups return `501`.


**✨ Enhancement**

- Normalize reputation scoring across every threat intel provider. `reputation.base_score` keeps each provider's own evidence — VirusTotal's detection ratio, AbuseIPDB's abuse confidence, ThreatFox's reporter confidence — while `osint.risk_score` is derived from the verdict through a band table shared by all three, so filtering on `risk_score` compares like with like across sources.
- Treat a documented "not found" as a successful lookup with an empty `osint` array rather than an error, so a clean miss is distinguishable from a broken integration.


# 🛡️ EDR (Endpoint Detection & Response)

**✨ Enhancement**

- Add `execute_command` and `retrieve_file` support to the Microsoft Defender EDR provider, backed by Defender's Live Response. The supported commands match the shared out-of-box set — `cat`, `ls`, `mount`, `ps`, and `pwd` — on both Windows and Linux endpoints, and `retrieve_file` returns the endpoint file as a gzip archive. Long-running actions resume polling instead of restarting the request.
- Map the remaining OCSF Device Inventory (class `5001`) fields on Sophos and SentinelOne endpoints. Sophos now populates `device.os.build` and `device.first_seen_time`, and SentinelOne populates `device.os.build` from its OS revision. `device.os.version` on SentinelOne is unchanged, so existing `device.os.version[like]` filters keep working.


**🐛 Bug Fix**

- Fix Microsoft Defender `query_edr_events` never returning a next-page cursor. The operation advertised cursor pagination but always returned an empty cursor, capping every caller at a single page. Paging now works with `time[asc]` and `time[desc]` without duplicating events across pages.


# 👤 Identity Management

**✨ New Provider**

- Add CrowdStrike Falcon Identity Protection as an Identity Provider, with `query_risky_users` and `query_risk_events` backed by Falcon Identity Protection, including filtering, sorting, and pagination. Entity filters are validated as a UUID or email, and Test Connection now fails on license and permission errors instead of reporting an empty result as success. This provider requires an ITDR license; the standard user, group, session, and activity operations are not supported.


**✨ Enhancement**

- Publish the CrowdStrike Falcon Identity Protection provider configuration guide for the Identity connector.
- Publish the Ashby provider configuration guide for the Identity connector.
- Publish the Greenhouse provider configuration guide for the Identity connector, covering the Harvest v3 OAuth setup.


**🐛 Bug Fix**

- Fix Workday requests failing after a `401` instead of refreshing. The retry cleared only the provider's token source while a cached copy of the rejected token survived one layer up, so the retry replayed the same dead token and the request failed on the consecutive-`401` cap. Both caches are now cleared before the retry.


# 📦 Asset Management

**✨ Enhancement**

- Publish the Qualys provider configuration guide for the Asset Management connector.
- Send a JupiterOne-specific `User-Agent` naming the operation behind each request (for example `Synqly/1.0.0 assets-query-devices`), so JupiterOne administrators can attribute API traffic to Synqly and to the operation that drove it. No other provider's outbound traffic changes.


# 🎫 Ticketing

**✨ Enhancement**

- Publish the Xurrent provider configuration guide for the Ticketing connector.
- Publish the BMC Helix ITSM provider configuration guide for the Ticketing connector.


**🐛 Bug Fix**

- Stop returning BMC Helix session tokens in `api/response` metadata. BMC Helix authenticated on the data path rather than through the shared authorizer, so its login was collected like any other call and `api/response(list)` on a BMC ticketing call could hand back a live credential. The login now runs in the authentication phase and is excluded from response metadata, completing the fix shipped last week for the providers that already authenticated through the authorizer.
- Fix BMC Helix reporting an identity endpoint `503` as a bad-credential failure, so an upstream outage is no longer mistaken for a wrong password. Rejected credentials now carry a cause and a suggested fix, a login returning `200` with an empty body is an error instead of a cached empty token, and the secondary login endpoint is used only when the primary is not configured.
- Fix concurrent BMC Helix requests each performing a full login, and an older session token overwriting a newer one.


# 💬 Chat

**✨ Enhancement**

- Add `query_messages` to the Chat connector, returning every message across every conversation in the connected workspace or tenant in one paginated call, supported on Microsoft Copilot, Microsoft Teams, and Slack. An optional `time[gte]`/`time[lte]` window is supported for providers whose message APIs offer time filtering, and applied by Synqly for those that do not.
- Add `include_raw_data` to every Chat query operation, returning the provider's original payload alongside the normalized result. It defaults to `false`.
- Standardize Chat page-size limits across providers. Every query operation defaults to 100 with a maximum of 1,000, and a provider with a lower ceiling of its own is capped at that instead.


# 📊 SIEM & Sink

**✨ Enhancement**

- Enforce a 100 MiB request body limit on SIEM and Sink batch event posting, alongside the existing per-request event count limit. Oversized requests are rejected with a clear "request too large" error and remediation before the payload is fully buffered, and both connectors now apply the two limits identically.


# ⚙️ Core

**✨ Enhancement**

- Update the billing export guide for the `--org` flag. The export authenticates on username, password, and organization, so the root token instructions are gone, Quick Start shows one runnable command, and troubleshooting now covers the errors the script actually prints.


**🐛 Bug Fix**

- Fix OAuth token caching so a token is fetched once and reused until it expires on every authorization path. Armis, Okta, Jamf, Horizon3, HCL, and the Trimedx sink previously paid a token exchange on every data request — two round trips for every one. Token invalidation after a `401` also now takes effect on all three paths rather than only one, so a refresh retry no longer replays a token the provider just rejected.


# 📚 SDK Releases

**Latest Versions**

- Released Synqly SDK versions: `2.0.50`, `2.0.51`, `2.0.52`, `2.0.53`, `2.0.54`, `2.0.55`


# 🚢 Synqly Embedded

**Latest Release: `v0.1.155`**

- **Service Image Tag**: `embedded-2026.09.11`
- **Service Image Tag (NO FIPS)**: `embedded-2026.09.11-no-fips`
- **Release Date**: September 11, 2026