We have released support for a new GRC (Governance, Risk, and Compliance) connector, giving integrators one normalized API over a customer's compliance program — frameworks, controls, tests, evidence, and the compliance posture of devices and personnel — regardless of vendor.
✨ New Provider - Secureframe
Add the Secureframe GRC Provider with six query operations and four get-by-id operations, covering compliance frameworks, controls, tests, evidence, and device and personnel compliance posture, with cursor pagination and server-side filtering and ordering scoped to what Secureframe supports.
Catalog data is returned as OCSF Inventory Info events under Synqly's
989extension, and per-entity compliance posture as OCSF Compliance Finding (class2003). Standard identifiers are passed through unmodified rather than remapped, since OCSF defines no canonical compliance vocabulary.
We have released support for a new Security Awareness connector, covering security awareness training programs and phishing simulation campaigns. Additional provider support coming soon!
✨ New Provider - KnowBe4 Security Awareness Training (KSAT)
Add the KnowBe4 Security Awareness Training (KSAT) Provider with
query_training_campaigns,query_phishing_simulations,query_users,get_training_campaign_details,get_phishing_simulation_details, andget_user_details.Training campaigns and phishing simulations are returned as new OCSF 1.8.0 Inventory Info event classes, and users carry their campaign enrollments under a new Security Awareness profile.
Publish the KnowBe4 Security Awareness Training (KSAT) provider configuration guide.
We have released support for a new Threat Intelligence connector, giving integrators a single reputation lookup API across multiple intel sources. Every lookup returns an OCSF OSINT Inventory Info event (class 5021).
✨ New Provider - VirusTotal
- Add the VirusTotal Threat Intelligence Provider with
lookup_hash,lookup_url,lookup_domain, andlookup_ip.
✨ New Provider - ThreatFox
- Add the ThreatFox (abuse.ch) Threat Intelligence Provider with
lookup_hash,lookup_url,lookup_domain, andlookup_ip.
✨ New Provider - AbuseIPDB
- Add the AbuseIPDB Threat Intelligence Provider with
lookup_ip. The remaining lookups return501.
✨ Enhancement
Normalize reputation scoring across every threat intel provider.
reputation.base_scorekeeps each provider's own evidence — VirusTotal's detection ratio, AbuseIPDB's abuse confidence, ThreatFox's reporter confidence — whileosint.risk_scoreis derived from the verdict through a band table shared by all three, so filtering onrisk_scorecompares like with like across sources.Treat a documented "not found" as a successful lookup with an empty
osintarray rather than an error, so a clean miss is distinguishable from a broken integration.
✨ Enhancement
Add
execute_commandandretrieve_filesupport to the Microsoft Defender EDR provider, backed by Defender's Live Response. The supported commands match the shared out-of-box set —cat,ls,mount,ps, andpwd— on both Windows and Linux endpoints, andretrieve_filereturns the endpoint file as a gzip archive. Long-running actions resume polling instead of restarting the request.Map the remaining OCSF Device Inventory (class
5001) fields on Sophos and SentinelOne endpoints. Sophos now populatesdevice.os.buildanddevice.first_seen_time, and SentinelOne populatesdevice.os.buildfrom its OS revision.device.os.versionon SentinelOne is unchanged, so existingdevice.os.version[like]filters keep working.
🐛 Bug Fix
- Fix Microsoft Defender
query_edr_eventsnever returning a next-page cursor. The operation advertised cursor pagination but always returned an empty cursor, capping every caller at a single page. Paging now works withtime[asc]andtime[desc]without duplicating events across pages.
✨ New Provider
- Add CrowdStrike Falcon Identity Protection as an Identity Provider, with
query_risky_usersandquery_risk_eventsbacked by Falcon Identity Protection, including filtering, sorting, and pagination. Entity filters are validated as a UUID or email, and Test Connection now fails on license and permission errors instead of reporting an empty result as success. This provider requires an ITDR license; the standard user, group, session, and activity operations are not supported.
✨ Enhancement
Publish the CrowdStrike Falcon Identity Protection provider configuration guide for the Identity connector.
Publish the Ashby provider configuration guide for the Identity connector.
Publish the Greenhouse provider configuration guide for the Identity connector, covering the Harvest v3 OAuth setup.
🐛 Bug Fix
- Fix Workday requests failing after a
401instead of refreshing. The retry cleared only the provider's token source while a cached copy of the rejected token survived one layer up, so the retry replayed the same dead token and the request failed on the consecutive-401cap. Both caches are now cleared before the retry.
✨ Enhancement
Publish the Qualys provider configuration guide for the Asset Management connector.
Send a JupiterOne-specific
User-Agentnaming the operation behind each request (for exampleSynqly/1.0.0 assets-query-devices), so JupiterOne administrators can attribute API traffic to Synqly and to the operation that drove it. No other provider's outbound traffic changes.
✨ Enhancement
Publish the Xurrent provider configuration guide for the Ticketing connector.
Publish the BMC Helix ITSM provider configuration guide for the Ticketing connector.
🐛 Bug Fix
Stop returning BMC Helix session tokens in
api/responsemetadata. BMC Helix authenticated on the data path rather than through the shared authorizer, so its login was collected like any other call andapi/response(list)on a BMC ticketing call could hand back a live credential. The login now runs in the authentication phase and is excluded from response metadata, completing the fix shipped last week for the providers that already authenticated through the authorizer.Fix BMC Helix reporting an identity endpoint
503as a bad-credential failure, so an upstream outage is no longer mistaken for a wrong password. Rejected credentials now carry a cause and a suggested fix, a login returning200with an empty body is an error instead of a cached empty token, and the secondary login endpoint is used only when the primary is not configured.Fix concurrent BMC Helix requests each performing a full login, and an older session token overwriting a newer one.
✨ Enhancement
Add
query_messagesto the Chat connector, returning every message across every conversation in the connected workspace or tenant in one paginated call, supported on Microsoft Copilot, Microsoft Teams, and Slack. An optionaltime[gte]/time[lte]window is supported for providers whose message APIs offer time filtering, and applied by Synqly for those that do not.Add
include_raw_datato every Chat query operation, returning the provider's original payload alongside the normalized result. It defaults tofalse.Standardize Chat page-size limits across providers. Every query operation defaults to 100 with a maximum of 1,000, and a provider with a lower ceiling of its own is capped at that instead.
✨ Enhancement
- Enforce a 100 MiB request body limit on SIEM and Sink batch event posting, alongside the existing per-request event count limit. Oversized requests are rejected with a clear "request too large" error and remediation before the payload is fully buffered, and both connectors now apply the two limits identically.
✨ Enhancement
- Update the billing export guide for the
--orgflag. The export authenticates on username, password, and organization, so the root token instructions are gone, Quick Start shows one runnable command, and troubleshooting now covers the errors the script actually prints.
🐛 Bug Fix
- Fix OAuth token caching so a token is fetched once and reused until it expires on every authorization path. Armis, Okta, Jamf, Horizon3, HCL, and the Trimedx sink previously paid a token exchange on every data request — two round trips for every one. Token invalidation after a
401also now takes effect on all three paths rather than only one, so a refresh retry no longer replays a token the provider just rejected.
Latest Versions
- Released Synqly SDK versions:
2.0.50,2.0.51,2.0.52,2.0.53,2.0.54,2.0.55
Latest Release: v0.1.155
- Service Image Tag:
embedded-2026.09.11 - Service Image Tag (NO FIPS):
embedded-2026.09.11-no-fips - Release Date: September 11, 2026