Skip to content
/
2026-10-19

Release Notes - New Features & Bug Fixes

🛡️ EDR (Endpoint Detection & Response)

✨ Enhancement

  • Add query_policies and query_exclusions support to the CrowdStrike EDR Provider. Exclusions are selected with resource.type: path (the default, covering Sensor Visibility and ML exclusions) or process (IOA exclusions). The integration's API client needs the Sensor Visibility Exclusions, ML Exclusions, IOA Exclusions, and Prevention Policies scopes.

  • Make scheduled query_threatevents pulls incremental on time for CrowdStrike, Sophos, Bitdefender, ESET, and the other EDR providers that declare it, instead of re-pulling a full snapshot on every run. Defender and SentinelOne keep their update-time cursor, so status changes on known threats still flow.

  • Make scheduled query_endpoints pulls incremental on Defender, Tanium, ESET, Iru, and Sophos by accepting time as an alias of the endpoint's last-seen time. Tanium device.last_seen_time now also accepts gt.

  • Map agent version, managed state, network interfaces, model, vendor, CPU details, and group on Trellix and Trellix ENS query_endpoints and get_endpoint, derive os.type_id from the OS name, and populate unmapped with every source field the transform does not consume.

  • Populate unmapped on Sophos applications, posture score, and threat events, so source fields the transform does not consume are passed through instead of dropped.

🐛 Bug Fix

  • Fix CrowdStrike filters combining an in filter with another filter, such as status_id[in]1,2 with device.uid[eq]…, matching records outside the other filter. Applies to alerts, endpoints, applications, IOAs, and policies.

  • Fix CrowdStrike scheduled query_threatevents and query_edr_events runs failing with a 400 once offset paging reached CrowdStrike's 10,000-row limit. Paging now stops at the limit, and an operation already stuck past it recovers on its next run. If more than 10,000 alerts arrive between two runs, the excess is skipped and a warning is logged.

  • Fix Sophos posture score reporting every device OS as Unknown, threat events always returning a null attacks[].tactic.name, and an empty metadata.product.version. OS is now mapped from the device platform, attacks is built from the MITRE tactics and techniques on the detection, and the product version comes from the sensor version.

  • Fix alert and threat status mappings on Tanium, Trellix EDR, ESET, and SentinelOne, which reported several vendor states as Other or Unknown. ESET CLOSED incidents now read as Resolved, and the ESET Resolved filter no longer returns a 400.

  • Fix SentinelOne alert severity being reported as Other (99). Severity now comes from the rule severity, and the analyst verdict moves to status_detail; the alert severity filter still filters on the analyst verdict.

  • Fix ESET alert severity reporting MEDIUM and HIGH detections as Unknown, and ESET alert queries intermittently failing with a 502 on slow responses.

  • Fix Malwarebytes threat events returning an empty finding_info.uid, and Iru detections colliding across devices because finding_info.uid was the file hash. Malwarebytes metadata.uid is now the record ID, and its metadata.uid filter is removed.

  • Fix Trellix query_alerts returning a 400 for a time[lt] filter older than about an hour when no lower bound is given.

  • Fix ESET last-seen filters on query_endpoints dropping every device, and Sophos endpoint time filters applying every operator as a lower bound.

  • Remove the time, time_dt, finding_info.created_time, and finding_info.created_time_dt filters from Trellix query_threatevents, which Trellix could not honor and which now return a 400. Use finding_info.modified_time_dt (gt, lt) instead.

👤 Identity Management

✨ Enhancement

  • Add get_user_picture support to the Microsoft Entra ID Identity Provider, returning a user's profile photo.

🐛 Bug Fix

  • Fix Microsoft Entra ID get_group_members returning only the first page of members. The operation now returns a cursor for the next page.

  • Return the user from Microsoft Entra ID get_user when the integration lacks the UserAuthenticationMethod.Read.All permission, with the MFA fields omitted and an advisory problem naming the missing permission, instead of failing the request.

🎫 Ticketing

🐛 Bug Fix

  • Remove eq and neq from the Jira and Jira Service Management query_tickets datetime filters (created_at, updated_at, due_date, completion_date), which returned no rows because JQL compares datetimes only to the minute. These filters now return a 400; in and not in now match the whole minute instead of failing with a 500, and the capabilities document like as JQL's case-insensitive word search rather than a substring match.

💬 Chat

✨ Enhancement

  • Identify the user on every Microsoft Copilot Chat message, mapping the user ID to actor.user.uid, the UPN to actor.user.uid_alt, and the email address to actor.user.email_addr. AI responses also carry the responding application in actor.app_name and actor.app_uid.

🌐 Network Security

✨ Enhancement

  • Add the query_firewall_rules operation (GET /v1/network-security/firewall-rules) to the Network Security Connector, implemented for Google Cloud, AWS, and Azure. Each rule is returned as an OCSF Cloud Resources Inventory Info record in the provider's evaluation order: Google Cloud VPC, global, hierarchical, and regional firewall policy rules; AWS network ACL entries followed by security group rules; and Azure network security group rules. AWS integrations need ec2:DescribeNetworkAcls, ec2:DescribeSecurityGroupRules, and ec2:DescribeSecurityGroups.

🐛 Bug Fix

  • Return the correct status for AWS errors on the Network Security Connector instead of a 500: 403 for access denied, 429 for throttling, 404 for a missing bucket or log group, and 503 when the service is unavailable. The message keeps AWS's error text, such as the denied IAM action.

📊 SIEM & Sink

🐛 Bug Fix

  • Fix Microsoft Sentinel query_events returning duplicate or missing events when a page boundary fell between events sharing the same timestamp. Large groups of events with one timestamp no longer return a 503, and cursors issued before this change continue to work.

⚙️ Core

🐛 Bug Fix

  • Prevent asynchronous operations from running against an integration of a different connector. POST /v1/operations now rejects an operation whose category does not match the integration's provider, and an integration can no longer be patched to a provider from another connector.

  • Return a 400 naming credential.type and its valid values when an integration or credential request uses an unknown credential type, instead of a 500.

🔌 MCP (Model Context Protocol)

✨ Enhancement

  • Add Security Awareness Connector support to the Synqly MCP tools.

  • Allow MCP clients to sign in to the Synqly Enterprise MCP server with OAuth, and list the applications connected this way under Settings → Connected applications.

📚 SDK Releases

Latest Versions

  • Released Synqly SDK versions: 2.0.82, 2.0.83, 2.0.84, 2.0.85, 2.0.86

🚢 Synqly Embedded

✨ Enhancement

  • Add support for bring-your-own-key (BYOK) with Google Cloud KMS in Synqly Embedded.

Latest Release: v0.1.165

  • Service Image Tag: embedded-2026.10.19
  • Service Image Tag (NO FIPS): embedded-2026.10.19-no-fips
  • Release Date: October 19, 2026
Previous page
Next page