# Release Notes - New Features & Bug Fixes

# 🛡️ EDR (Endpoint Detection & Response)

**✨ New Provider**

- Add the Huntress EDR Provider, supporting `query_endpoints`, `get_endpoint`, `query_threatevents`, `query_alerts`, and `network_quarantine`, with endpoints returned as OCSF Device Inventory Info and alerts and incident reports as OCSF Detection Finding. Authentication uses a Huntress API key and secret. The provider is marked `in-development` while alert, threat event, and quarantine coverage is validated against live data.


**✨ Enhancement**

- Add two new EDR operations, `query_policies` and `query_exclusions`, implemented for SentinelOne. Policies are returned as OCSF Compliance Findings, one per scope at the requested level of the policy tree, and exclusions as one Compliance Finding per exclusion rule with its pattern, type, platform, owner, and scope. By default only admin-created exclusions are returned; filter `resource.owner.type[in]Admin,System` to include vendor-managed rules. Both operations are marked `in-development` pending customer feedback.
- Map `device.mac` from the analyzer MAC address on Trellix ENS `query_threatevents` and `query_edr_events`, normalized to colon-delimited form, and populate `unmapped` with every source field the transform does not consume, so raw values such as an undocumented severity code or a malformed MAC are no longer silently dropped.
- Make scheduled `query_applications` pulls incremental on Malwarebytes and Tanium by filtering `time` server-side. Malwarebytes `time` and `created_at` now accept `gt`, `gte`, `lt`, and `lte`. On Tanium, `time` is the endpoint's last check-in, so an active fleet still re-sends most of its inventory each run.


**🐛 Bug Fix**

- Fix Microsoft Defender for Endpoint alerts reporting every `status` and `severity` as Other (`99`). Status, severity, and classification now map to the correct OCSF IDs, with `classification` mapped to `disposition_id` and `determination` to `status_detail`. An absent value maps to Unknown (`0`), and the `status` and `severity` filters now accept OCSF captions such as `In Progress`.
- Fix Iru `query_alerts` accepting a `time[gt]` filter and then silently dropping it, so scheduled runs fetched the vendor's default window while the cursor advanced. `time` now accepts `gt`, `gte`, `lt`, and `lte`, `severity[eq]` is now actually applied, and unsupported operators return a `400` instead of being ignored.


# 📦 Endpoint Management

**✨ New Provider**

- Add the HCL BigFix Endpoint Management Provider, supporting device inventory (`query_devices`), software inventory, and compliance findings through BigFix's REST and relevance API, with basic authentication.


**✨ Enhancement**

- Return the device organization name as `device.org.name` on NinjaOne devices, and add a `device.org.name` filter (`eq`, `in`, `like`, case-insensitive) to `query_devices`. The device location name is also now returned at `unmapped.location_name`.


# 🔍 Vulnerability Management

**✨ New Provider**

- Add the Tenable Attack Surface Management (ASM) Vulnerabilities Provider, supporting `query_assets` (OCSF Device Inventory Info), `query_findings` (one finding per asset and CVE), and `get_labels`. Tenable ASM does not expose severity or CVSS, so findings carry a severity of Unknown.


**✨ Enhancement**

- Make scheduled `query_findings` and `query_assets` pulls incremental on more providers by filtering on the timestamp each vendor API actually supports: Nucleus findings on `finding.last_seen_time`, Wiz assets on a new `device.modified_time` filter (`gte`, `lte`), and Axonius assets on a new `device.last_seen_time` filter (`gte`, `gt`). Previously these fell back to a full re-pull on every run.


**🐛 Bug Fix**

- Fix Wiz `query_assets` returning a `400` for every `device.hostname[eq]` filter, which was declared but never translated. The filter is now applied and carried in the pagination cursor.
- Fix Nucleus flooring sub-second time bounds to the whole second, which made `gte` and `lt` filters include or exclude up to one extra second of findings.
- Reject undeclared operators on Pentera datetime filters with a `400` instead of accepting them.


# 👤 Identity Management

**✨ New Provider**

- Add the Duo Security Identity Provider, built on the Duo Admin API, supporting user and group queries, enabling and disabling users, and audit log queries covering both administrator and authentication logs. Requests are signed with Duo's HMAC-SHA512 scheme, so the provider works in FIPS mode.


**✨ Enhancement**

- Add Okta Identity Threat Protection support to the Okta Identity Provider: `query_risk_events` (OCSF Detection Finding), `query_risky_users` (OCSF Entity Management), and user risk enrichment on `get_user`.


**🐛 Bug Fix**

- Retry Workday token requests with exponential backoff for up to 30 seconds, so transient Workday token failures no longer fail the operation.


# 🎫 Ticketing

**✨ Enhancement**

- Return Jira's own field-level error details when `create_ticket` fails, for example `parent: Could not find issue: PRO-99999`, with Jira's error envelope in `context.provider_details`. Previously every failed create returned the same fixed message.
- Read a Jira ticket's parent from `parent.id` when `parent.key` is absent, such as on some Jira Server and Data Center payloads, instead of dropping the parent from the response. Applies to Jira and Jira Service Management.


**🐛 Bug Fix**

- Reject an empty `parent` on Jira `create_ticket` with a `400`, matching patch. An empty string was previously dropped silently and the ticket created with no parent. To create a ticket without a parent, omit the field or send `null`.
- Reject Linear ticket priorities that Linear cannot store on create and patch. Only `URGENT`, `HIGH`, `MEDIUM`, and `LOW` are accepted (in any letter case); `CRITICAL`, `MODERATE`, and `PLANNING` previously were stored as a different priority, and unknown values were silently dropped. A `null` priority on patch now clears the priority instead of failing.
- Fix Linear priority range filters returning tickets with no priority as if they were more severe than `URGENT`; for example, `priority[gt]HIGH` now returns only `URGENT` tickets. Range operators with `NONE` now return a `400`.
- Fix ServiceNow ticket filters on `created_at`, `updated_at`, `due_date`, and `completion_date` being silently ignored for `eq` and `ne`, returning unfiltered results. All date operators are now translated to exact comparisons, an empty date never matches, an unparseable value returns a `400`, and a date filter accepts at most 50 values.
- Fix ServiceNow ticket filters on `priority` returning no rows for every documented priority value. Canonical values such as `URGENT` or `high` are now translated to ServiceNow's numeric priorities for both ITSM and Security Incident Response, matching how tickets read back. Numeric values continue to work, and values the variant never reads back now return a `400` instead of an empty result.


# ☁️ Cloud Security

**✨ New Provider**

- Add the Orca Security Cloud Security Provider, supporting `query_ioms`, `query_threats`, `query_cloud_resource_inventory`, `query_events`, and `query_compliance_findings`. Events are merged across AWS CloudTrail, Azure Activity Log, and GCP Audit Log. The Orca region is a required configuration field.
- Add the SentinelOne Cloud Security Provider, supporting compliance findings, cloud resource inventory, IOMs, and threats. `query_events` is not supported.


**✨ Enhancement**

- Make scheduled cloud security pulls incremental on AWS (via `time`), Wiz inventory, and Google IOMs, which previously re-pulled everything on every run. Wiz datetime filters now accept `gt` and `lt` in addition to `gte` and `lte`.


**🐛 Bug Fix**

- Fix Wiz scheduled operations failing on every run after the first, because the injected `time[gt]` filter was rejected with a `400`.


# 🌐 Network Security

**✨ Enhancement**

- Add Azure DNS log support to the Network Security Connector through `GET /v1/network-security/dns/log-configurations` and `GET /v1/network-security/dns/log-events`. Set the optional `dns_log_configuration_ids` configuration field to limit both operations to specific configurations.
- Scope the Azure Network Security integration to the whole subscription. The Resource Group and Network Watcher configuration fields are removed, and flow log discovery now covers every Network Watcher in the subscription. `traffic_log_configuration_ids` now takes full ARM resource IDs rather than bare flow log names, and configured IDs are validated when the integration is created instead of at query time.


# 📊 SIEM & Sink

**✨ Enhancement**

- Paginate CrowdStrike Falcon LogScale `query_events` within a single search job instead of starting a new job for every page, moving to a new job only when a batch is exhausted or expires, without skipping or duplicating events.
- Restore the Microsoft Sentinel `query_events` default table list to all 13 ASIM unifying schemas. Queries whose expanded KQL exceeds Kusto's length limit are now split into groups that run in parallel and are merged, with the grouping kept stable across pages. Multi-table queries use `union isfuzzy=true`, so a workspace missing an ASIM parser returns results from the others instead of failing.
- Verify that a generic HTTP sink endpoint is reachable when the integration is verified. Any HTTP response passes; a DNS, connection, or TLS failure is reported as a `400` configuration error. Previously verification always reported success.
- Default Datadog SIEM alert queries to newest first when no order is given, matching event queries.


**🐛 Bug Fix**

- Accept OAuth client credentials on Elasticsearch SIEM and Sink integrations, which were previously rejected so an OAuth-only connection could not be saved. `token_url` is required and must be `https`.


# ⚙️ Core

**✨ Enhancement**

- Add an `account-provisioner` permission set that can only create accounts, and allow account creation to optionally return a token pair scoped to the new account, with a caller-chosen permission set. Onboarding flows can now hand a tenant an account token without holding a credential that can mint tokens for every account.


**🐛 Bug Fix**

- Reject `/v1/credentials` requests where the credential owner in the request body does not match the one in the URL. Previously a mismatch could re-parent the credential under the URL's owner. A credential's owner cannot be changed.


# 📚 SDK Releases

**Latest Versions**

- Released Synqly SDK versions: `2.0.71`, `2.0.72`, `2.0.73`, `2.0.74`, `2.0.75`, `2.0.76`, `2.0.77`, `2.0.78`, `2.0.79`, `2.0.80`, `2.0.81`


# 🚢 Synqly Embedded

**✨ Enhancement**

- Add `secretRef` support for HashiCorp Vault credentials in the Embedded Helm chart, so Vault credentials can be supplied from an existing Kubernetes secret.
- Make the database `idle_in_transaction` session setting configurable in the Embedded Helm chart, for deployments behind proxies such as AWS RDS Proxy that reject it. If the database rejects the setting, Embedded now retries the connection without it.


**Latest Release: `v0.1.163`**

- **Service Image Tag**: `embedded-2026.10.09`
- **Service Image Tag (NO FIPS)**: `embedded-2026.10.09-no-fips`
- **Release Date**: October 9, 2026