Skip to content
/
2026-10-09

Release Notes - New Features & Bug Fixes

🛡️ EDR (Endpoint Detection & Response)

✨ New Provider

  • Add the Huntress EDR Provider, supporting query_endpoints, get_endpoint, query_threatevents, query_alerts, and network_quarantine, with endpoints returned as OCSF Device Inventory Info and alerts and incident reports as OCSF Detection Finding. Authentication uses a Huntress API key and secret. The provider is marked in-development while alert, threat event, and quarantine coverage is validated against live data.

✨ Enhancement

  • Add two new EDR operations, query_policies and query_exclusions, implemented for SentinelOne. Policies are returned as OCSF Compliance Findings, one per scope at the requested level of the policy tree, and exclusions as one Compliance Finding per exclusion rule with its pattern, type, platform, owner, and scope. By default only admin-created exclusions are returned; filter resource.owner.type[in]Admin,System to include vendor-managed rules. Both operations are marked in-development pending customer feedback.

  • Map device.mac from the analyzer MAC address on Trellix ENS query_threatevents and query_edr_events, normalized to colon-delimited form, and populate unmapped with every source field the transform does not consume, so raw values such as an undocumented severity code or a malformed MAC are no longer silently dropped.

  • Make scheduled query_applications pulls incremental on Malwarebytes and Tanium by filtering time server-side. Malwarebytes time and created_at now accept gt, gte, lt, and lte. On Tanium, time is the endpoint's last check-in, so an active fleet still re-sends most of its inventory each run.

🐛 Bug Fix

  • Fix Microsoft Defender for Endpoint alerts reporting every status and severity as Other (99). Status, severity, and classification now map to the correct OCSF IDs, with classification mapped to disposition_id and determination to status_detail. An absent value maps to Unknown (0), and the status and severity filters now accept OCSF captions such as In Progress.

  • Fix Iru query_alerts accepting a time[gt] filter and then silently dropping it, so scheduled runs fetched the vendor's default window while the cursor advanced. time now accepts gt, gte, lt, and lte, severity[eq] is now actually applied, and unsupported operators return a 400 instead of being ignored.

📦 Endpoint Management

✨ New Provider

  • Add the HCL BigFix Endpoint Management Provider, supporting device inventory (query_devices), software inventory, and compliance findings through BigFix's REST and relevance API, with basic authentication.

✨ Enhancement

  • Return the device organization name as device.org.name on NinjaOne devices, and add a device.org.name filter (eq, in, like, case-insensitive) to query_devices. The device location name is also now returned at unmapped.location_name.

🔍 Vulnerability Management

✨ New Provider

  • Add the Tenable Attack Surface Management (ASM) Vulnerabilities Provider, supporting query_assets (OCSF Device Inventory Info), query_findings (one finding per asset and CVE), and get_labels. Tenable ASM does not expose severity or CVSS, so findings carry a severity of Unknown.

✨ Enhancement

  • Make scheduled query_findings and query_assets pulls incremental on more providers by filtering on the timestamp each vendor API actually supports: Nucleus findings on finding.last_seen_time, Wiz assets on a new device.modified_time filter (gte, lte), and Axonius assets on a new device.last_seen_time filter (gte, gt). Previously these fell back to a full re-pull on every run.

🐛 Bug Fix

  • Fix Wiz query_assets returning a 400 for every device.hostname[eq] filter, which was declared but never translated. The filter is now applied and carried in the pagination cursor.

  • Fix Nucleus flooring sub-second time bounds to the whole second, which made gte and lt filters include or exclude up to one extra second of findings.

  • Reject undeclared operators on Pentera datetime filters with a 400 instead of accepting them.

👤 Identity Management

✨ New Provider

  • Add the Duo Security Identity Provider, built on the Duo Admin API, supporting user and group queries, enabling and disabling users, and audit log queries covering both administrator and authentication logs. Requests are signed with Duo's HMAC-SHA512 scheme, so the provider works in FIPS mode.

✨ Enhancement

  • Add Okta Identity Threat Protection support to the Okta Identity Provider: query_risk_events (OCSF Detection Finding), query_risky_users (OCSF Entity Management), and user risk enrichment on get_user.

🐛 Bug Fix

  • Retry Workday token requests with exponential backoff for up to 30 seconds, so transient Workday token failures no longer fail the operation.

🎫 Ticketing

✨ Enhancement

  • Return Jira's own field-level error details when create_ticket fails, for example parent: Could not find issue: PRO-99999, with Jira's error envelope in context.provider_details. Previously every failed create returned the same fixed message.

  • Read a Jira ticket's parent from parent.id when parent.key is absent, such as on some Jira Server and Data Center payloads, instead of dropping the parent from the response. Applies to Jira and Jira Service Management.

🐛 Bug Fix

  • Reject an empty parent on Jira create_ticket with a 400, matching patch. An empty string was previously dropped silently and the ticket created with no parent. To create a ticket without a parent, omit the field or send null.

  • Reject Linear ticket priorities that Linear cannot store on create and patch. Only URGENT, HIGH, MEDIUM, and LOW are accepted (in any letter case); CRITICAL, MODERATE, and PLANNING previously were stored as a different priority, and unknown values were silently dropped. A null priority on patch now clears the priority instead of failing.

  • Fix Linear priority range filters returning tickets with no priority as if they were more severe than URGENT; for example, priority[gt]HIGH now returns only URGENT tickets. Range operators with NONE now return a 400.

  • Fix ServiceNow ticket filters on created_at, updated_at, due_date, and completion_date being silently ignored for eq and ne, returning unfiltered results. All date operators are now translated to exact comparisons, an empty date never matches, an unparseable value returns a 400, and a date filter accepts at most 50 values.

  • Fix ServiceNow ticket filters on priority returning no rows for every documented priority value. Canonical values such as URGENT or high are now translated to ServiceNow's numeric priorities for both ITSM and Security Incident Response, matching how tickets read back. Numeric values continue to work, and values the variant never reads back now return a 400 instead of an empty result.

☁️ Cloud Security

✨ New Provider

  • Add the Orca Security Cloud Security Provider, supporting query_ioms, query_threats, query_cloud_resource_inventory, query_events, and query_compliance_findings. Events are merged across AWS CloudTrail, Azure Activity Log, and GCP Audit Log. The Orca region is a required configuration field.

  • Add the SentinelOne Cloud Security Provider, supporting compliance findings, cloud resource inventory, IOMs, and threats. query_events is not supported.

✨ Enhancement

  • Make scheduled cloud security pulls incremental on AWS (via time), Wiz inventory, and Google IOMs, which previously re-pulled everything on every run. Wiz datetime filters now accept gt and lt in addition to gte and lte.

🐛 Bug Fix

  • Fix Wiz scheduled operations failing on every run after the first, because the injected time[gt] filter was rejected with a 400.

🌐 Network Security

✨ Enhancement

  • Add Azure DNS log support to the Network Security Connector through GET /v1/network-security/dns/log-configurations and GET /v1/network-security/dns/log-events. Set the optional dns_log_configuration_ids configuration field to limit both operations to specific configurations.

  • Scope the Azure Network Security integration to the whole subscription. The Resource Group and Network Watcher configuration fields are removed, and flow log discovery now covers every Network Watcher in the subscription. traffic_log_configuration_ids now takes full ARM resource IDs rather than bare flow log names, and configured IDs are validated when the integration is created instead of at query time.

📊 SIEM & Sink

✨ Enhancement

  • Paginate CrowdStrike Falcon LogScale query_events within a single search job instead of starting a new job for every page, moving to a new job only when a batch is exhausted or expires, without skipping or duplicating events.

  • Restore the Microsoft Sentinel query_events default table list to all 13 ASIM unifying schemas. Queries whose expanded KQL exceeds Kusto's length limit are now split into groups that run in parallel and are merged, with the grouping kept stable across pages. Multi-table queries use union isfuzzy=true, so a workspace missing an ASIM parser returns results from the others instead of failing.

  • Verify that a generic HTTP sink endpoint is reachable when the integration is verified. Any HTTP response passes; a DNS, connection, or TLS failure is reported as a 400 configuration error. Previously verification always reported success.

  • Default Datadog SIEM alert queries to newest first when no order is given, matching event queries.

🐛 Bug Fix

  • Accept OAuth client credentials on Elasticsearch SIEM and Sink integrations, which were previously rejected so an OAuth-only connection could not be saved. token_url is required and must be https.

⚙️ Core

✨ Enhancement

  • Add an account-provisioner permission set that can only create accounts, and allow account creation to optionally return a token pair scoped to the new account, with a caller-chosen permission set. Onboarding flows can now hand a tenant an account token without holding a credential that can mint tokens for every account.

🐛 Bug Fix

  • Reject /v1/credentials requests where the credential owner in the request body does not match the one in the URL. Previously a mismatch could re-parent the credential under the URL's owner. A credential's owner cannot be changed.

📚 SDK Releases

Latest Versions

  • Released Synqly SDK versions: 2.0.71, 2.0.72, 2.0.73, 2.0.74, 2.0.75, 2.0.76, 2.0.77, 2.0.78, 2.0.79, 2.0.80, 2.0.81

🚢 Synqly Embedded

✨ Enhancement

  • Add secretRef support for HashiCorp Vault credentials in the Embedded Helm chart, so Vault credentials can be supplied from an existing Kubernetes secret.

  • Make the database idle_in_transaction session setting configurable in the Embedded Helm chart, for deployments behind proxies such as AWS RDS Proxy that reject it. If the database rejects the setting, Embedded now retries the connection without it.

Latest Release: v0.1.163

  • Service Image Tag: embedded-2026.10.09
  • Service Image Tag (NO FIPS): embedded-2026.10.09-no-fips
  • Release Date: October 9, 2026
Previous page
Next page