The Cyber Toolchain — issue -020, November 30, 2024
THE CYBER TOOLCHAIN
NO. -020
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED NOVEMBER 30, 2024 · EVERY DAY
EDITIONStail|grep|head|ls|diff|uniq
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
New -ft flag to specify MIME types to filter, overriding the FILTER_MIME list in config.yml.
New -mt flag to specify MIME types to match, replacing the default FILTER_MIME filtering or -ft filtering.
New --providers flag to select URL sources (wayback, commoncrawl, otx, urlscan, virustotal) as a comma-separated list, overriding individual exclude arguments like -xwm, -xcc, etc.
Verbose mode (--verbose) now displays the names of providers being searched instead of the exclude arguments.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The default value of -lcc changes from 3 to 1, reducing Common Crawl index lookups on upgrade without explicit configuration.
!The Common Crawl HTTP adapter retry count (HTTP_ADAPTER_CC) changes from retries+20 to retries+3, which may cause more Common Crawl requests to fail faster rather than retrying.
A portable multi-tool for pentesters and geeks; this is its official firmware.
Flipper Zero 1.1.2 adds JS SDK, split BadUSB/BadBLE, new NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. parsers, and PIN on boot.
└──▷ GET THIS VERSION
$ git clone --branch 1.1.2 https://github.com/flipperdevices/flipperzero-firmware.git
# already have the repo? check out this version:$ git checkout 1.1.2
Adds BackUSB subcommand for firmware-level USB device control
Splits the legacy BadUSB app into BadUSB (local keyboard emulation) and BadBLE (wireless BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. mode)
Introduces a new v0.1 JS SDK with modules for GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands., event loop, GPIOGPIOGeneral-Purpose Input/Output pins on a microcontroller or SoC that firmware can individually control as digital signals, letting cyber tools interact directly with hardware interfaces like UART, JTAG, or SPI., and other subsystems via npm
Adds fz-sdk npm package to manage the JavaScript development toolkit
Requires a PIN on boot if one is set, enforcing device lockout at power-on
+4 moreshow less
Enables alarm functionality to wake the Flipper from shutdown mode
Adds support for direct Clock and Alarm configuration in settings
Expands SubGhz Keeloq decoding with new Monarch keys
Introduces NFC parsers for NDEF (MFUL, MFC, SLIX), Moscow social card, H World Hotel Chain Room Key, Tianjin Railway Transit, and Caltrain Clipper zones
9 details in Everything
└──▷ BREAKING ON UPGRADE
!Downgrading to firmware prior to 1.1.2 will result in the inability to show battery status unless the gauge is reset by disconnecting the battery or using the gauge tool.
!Downgrading to firmware prior to 1.1.2 will cause the alarm feature to malfunction unless it is disabled before downgrading.
Flipper Zero Unleashed Firmware, an unlocked alternative firmware.
Unleashed Firmware unlshd-079 adds Monarch and Princeton 8bit SubGHz protocols, i2c/SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. JS modules, BadUSB PIN on boot, and more NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. parsers.
└──▷ GET THIS VERSION
$ git clone --branch unlshd-079 https://github.com/DarkFlippers/unleashed-firmware.git
# already have the repo? check out this version:$ git checkout unlshd-079
Keeloq: Monarch full support with add manually option
Princeton protocol support for second button encoding type (8bit)
Hollarm protocol adds more button codes
NFC emulator parses H World Hotel Chain Room Key format
NFC emulator parses Tianjin Railway Transit format
+3 moreshow less
NFC emulator parses Moscow social card format
NFC emulator parses Caltrain zones for Clipper format
New i2c & SPI JS modules for extension board control
8 details in Everything
└──▷ BREAKING ON UPGRADE
!dialog, keyboard, and submenu JS modules removed; replaced by gui/dialog, gui/text_input, and gui/submenu respectively
!badusb.setup() parameters mfr_name, prod_name, layout_path renamed to mfrName, prodName, layoutPath
!math.is_equal() renamed to isEqual()
!storage module overhauled: use openFile() with modes instead of previous methods
!textbox module removed; replaced by gui/text_box
!Global __filepath and __dirpath renamed to __filename and __dirname
!Global to_string(), to_upper_case(), and to_lower_case() moved to string class as .toString(), .toUpperCase(), and .toLowerCase()
Feature-rich, stable and customizable Flipper Zero firmware.
Momentum Firmware mntm-008 adds Sub-GHzSub-GHzRadio frequencies below 1 GHz (typically 300–900 MHz) used by IoT devices, key fobs, garage doors, and industrial sensors; cyber tools target this band to capture, replay, or analyze those wireless signals. and NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. protocols, new JS modules (i2c, spi), and a massive JavaScript runtime overhaul with new gui and event_loop APIs.
└──▷ GET THIS VERSION
$ git clone --branch mntm-008 https://github.com/Next-Flip/Momentum-Firmware.git
# already have the repo? check out this version:$ git checkout mntm-008
Adds Cyborg Detector app for NFC scanning
Adds Radio Scanner app for Sub-GHz frequency analysis
Adds FlipperHTTP app suite (FlipLibrary, FlipSocial, FlipStore, FlipTrader, FlipWeather, FlipWiFi, Web Crawler)
Adds uPython interpreter app
Adds Umpire Indicator game app
+30 moreshow less
Adds Bresser 3CH weather station protocol support in Sub-GHz
Adds Vauno-EN8822 weather station protocol support in Sub-GHz
Adds Marantec24 static 24-bit protocol support with manual add in Sub-GHz UL
Adds GangQi static 34-bit protocol support with button parsing and manual add in Sub-GHz UL
Adds Hollarm static 42-bit protocol support with button parsing and manual add in Sub-GHz UL
Adds Hay21 dynamic 21-bit protocol support with button parsing in Sub-GHz UL
Adds Keeloq Monarch full protocol support with manual add in Sub-GHz UL
Adds Princeton custom buttons support in Sub-GHz UL
Adds accelerated dictionary attack for MIFARE ClassicMIFARE ClassicA family of contactless smart card chips made by NXP, widely used in access control and transit systems, whose weak proprietary encryption makes it a frequent target for RFID analysis and cloning tools. Key Recovery (~3500 keys/sec)
Adds nested nonce collection for MIFARE Classic to be cracked by MFKey on-device
Adds static encrypted backdoor support for MIFARE Classic key recovery on-device
Adds SmartRider tag parser for NFC
Adds API endpoint/method to enforce ISO15693 mode in NFC
Adds H World Hotel Chain Room Key parser and MFC keys in NFC
Adds Tianjin Railway Transit tag parser in NFC
Adds Bluray/DVD Universal Remote profile support for Infrared
Adds Load from Library File option for Universal Remotes in Infrared
Adds i2c module to the JavaScript runtime
Adds spi module to the JavaScript runtime
Adds new gui module replacing dialog, keyboard, submenu, and textbox modules in JS
Adds event_loop module for event-driven programming in JS
Adds illegalSymbols prop for gui/text_input view in JS
Adds ASCII event support to RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets.
Adds UnloadAssetPacks app flag to free RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. in heavy apps via FBT/SDK
Adds ByteInput ASCII input support in GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.
Adds up and down button drawing functions to GUI elements
Adds extended icon draw function to Canvas GUI element
Adds 5V GPIOGPIOGeneral-Purpose Input/Output pins on a microcontroller or SoC that firmware can individually control as digital signals, letting cyber tools interact directly with hardware interfaces like UART, JTAG, or SPI. control support for external modules via RPC
Adds proper integer parsing library strint in Toolbox
Adds FuriEventLoop support for FuriEventFlag and simplified API
35 details in Everything
└──▷ BREAKING ON UPGRADE
!The badusb module parameters mfr_name, prod_name, layout_path are renamed to mfrName, prodName, layoutPath
!The dialog JS module is removed; use gui/dialog and gui/file_picker instead
!The keyboard JS module is removed; use gui/text_input and gui/byte_input instead
!The submenu JS module is removed; use gui/submenu instead
!The textbox JS module is removed; use gui/text_box instead
!Global functions to_string(), parse_int(), to_upper_case(), to_lower_case() are removed or moved to number/string class methods (n.toString(), parseInt(), s.toUpperCase(), s.toLowerCase())
!to_hex_string() is removed; use n.toString(16) instead
!Globals __filepath and __dirpath are renamed to __filename and __dirname
!The math.is_equal() function is renamed to isEqual()
!Downgrading from this firmware to an older version requires disabling Alarm in Settings > Clock & Alarm and potentially using the Guage Tool app to unseal the battery gauge, otherwise battery percentage will be blank.
Bruce v1.7 adds PN532 BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. support, Chameleon LF/HF scanning, and new device compatibility.
└──▷ GET THIS VERSION
$ git clone --branch 1.7 https://github.com/BruceDevices/firmware.git
# already have the repo? check out this version:$ git checkout 1.7
Adds support for PN532 BLE devices to enable wireless RFID interactions.
Adds Chameleon LF scan and full scan (HF+LF) capabilities via the Chameleon module.
Adds Gen3/Gen4 Magic type check functionality on PN532 BLE devices.
Adds RC-Switch save RAW data feature for RF signal recording.
Proxmark3 Orca adds HitagS reader, AID simulation, iClass unhash, magic 14b UID writing, and dozens of new detections.
└──▷ GET THIS VERSION
$ git clone --branch v4.19552 https://github.com/RfidResearchGroup/proxmark3.git
# already have the repo? check out this version:$ git checkout v4.19552
└──▷ TRY IT
Simulate a PICC that responds to specific AIDs — useful for testing AID-based reader behavior or card emulation research.
$ hf 14a aidsim
Reverse an iClass diversified key back to its hash0 pre-images for key analysis or legacy reader research.
$ hf iclass unhash
Adds hf 14b setuid command to set UID on magic 14b tags.
Adds hf 14a aidsim command to simulate a PICC and respond to specific AIDs and getData responses.
Adds hf iclass unhash command to reverse an iClass diversified key to hash0 pre-images.
Adds lf hitag hts reader command to act as a HitagS / 82xx reader.
Adds support for all Hitag S response protocol modes.
+30 moreshow less
Adds support for 8268/8310 chipsets.
Adds --gdm flag to hf mf c* commands to write using uscuid/gdm 20/23 alt magic wakeup.
Adds detection for FM11NT021 and magic NTAG 215 cards.
Adds detection of FM1216-137 CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cards in hf 14a info and hf mf info.
Adds detection of Tiananxin cards in hf 14b info.
Adds option in hf mf sim to allow Key B to be used even if readable.
Adds data-first and nested reader attack support to hf mf sim.
Adds quick dump via backdoor auth support to hf mf ecfill.
Adds option to hf 14a reader to wait for a card.
Adds JSON dump option to pref show.
Adds spi_flash_decode.py helper script to decode JEDEC data.
Shows SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. flash JEDEC Manufacturer ID and Device ID in hw status output.
Adds support for a new KDF.
Adds Inner Range AID and MAD entries.
Adds hf iclass configcard support for generating config cards using a key other than the default k0.
Expands hf iclass configcard list of available options and functionalities.
BloodHound v6.2.0 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication support, a unified SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. admin UI, and more accurate Kerberoastable detection.
└──▷ GET THIS VERSION
$ git clone --branch v6.2.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v6.2.0
Adds OIDC provider support with login and callback handlers, enabling OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. as an authentication method alongside SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider..
New API endpoint to list OIDC providers, with backward-compatible unified ListAuthProviders endpoint covering both SAML and OIDC.
New SSO provider delete API endpoint for programmatic removal of SSO configurations.
Adds instant redirect to the identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. when only one SSO provider is configured, streamlining the login flow.
Refactors the SAML admin UI into a unified SSO admin UI supporting both SAML and OIDC providers.
+5 moreshow less
Adds audit logging for SAML authentication attempts.
New permission scope for RoleUploadOnly to restrict upload-only role access more granularly.
GMSA and MSA accounts are now correctly excluded from Kerberoastable detections, reducing false positives.
Adds a Posture page (behind a feature flag), surfacing new attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. visibility capabilities.
Adds API endpoint structure for the Posture page in the JS client.
Open Beta: Risk Factors column grouping Reachability, Exploitability and Maliciousness statuses with filterable icons.
└──▷ HOW TO FIND IT
Filter findings by risk to reduce alert fatigue in the Mend SCA dashboard.
📍In the Mend SCA web console, open a project view, locate the Risk Factors column in the dependencies table, and click the dropdown to filter by icons representing Reachability, Exploitability, or Maliciousness.
2 more releases in this issue
· 2024-11-04 → 2024-11-18
Mend SCA introduces Risk Factors (Reachability, Exploitability, Maliciousness) and Python Poetry support
Adds a filterable Risk Factors column that groups Reachability, Exploitability, and Maliciousness statuses into icon-based representations for prioritizing findings.
Extends Reachability analysis to the Poetry package manager within supported repository integrations.
Snyk PR Issue Summary Comments are now in Early Access for GitHub and Bitbucket SCMs.
Adds the Pull request experience section to Snyk SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integration settings to enable PR Issue Summary Comments
Enables PR Issue Summary Comments for GitHub OAuth, GitHub Enterprise (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.), GitHub Cloud App, Bitbucket Cloud (PAT), and Bitbucket Cloud App
2 details in Everything
5 more releases in this issue
· 2024-11-05 → 2024-11-26
Adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. service account creation and management directly in the Snyk UI
Vulnerabilities Detail Report now supports target spread indication and a customizable column picker for prioritization.
Adds affected targets count in the main table and target name when drilling down to indicate vulnerability spread across targets
Adds a column picker feature to view and prioritize vulnerabilities by NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. score, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. score and more
Veracode Fix Action for GitHub v1.0.1 adds additional CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. support and removes root folder restriction
Adds additional CWE support for single fix and batch fix actions.
Removes restriction requiring app as the root folder name in the user codebase.
2 details in Everything
2 more releases in this issue
· 2024-11-06 → 2024-11-26
Veracode adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 2021 and OWASP API Top 10 2023 training labs
Adds four new training lessons for Insufficient Entropy, The Great Referral Quest, Retrieval Without Validation, and Gift Cards at Risk.
Introduces More OWASP Vulnerabilities for APIs category for lessons not in the current API Top 10.
Checkov 3.2.300 adds Azure Synapse ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. policies and enables secrets file masking
└──▷ GET THIS VERSION
$ git clone --branch 3.2.300 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.300
EnrichedSecret class now includes the check_id field, allowing downstream processing to identify which specific policy triggered a secret detection
Added support for new security policies covering Azure Synapse ARM templates
Helm and Kustomize resources now utilize the Kubernetes graph registry for improved dependency analysis
Checkov 3.2.296 adds Fn::Sub support for CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. pseudo parameters and a Terraform resource_type attribute
└──▷ GET THIS VERSION
$ git clone --branch 3.2.296 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.296
cloudformation: Support Fn::Sub in cases of using a pseudo parameter
GitLab 17.6 adds scheduled merges, self-hosted AI models, agent selection in CI, and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scoring.
Adds merge_after date field to merge requests to schedule future merges
Adds --helm-release-values and --helm-release-values-from flags to glab cluster agent bootstrap for custom Helm values
Adds environment.kubernetes.agent syntax to select a GitLab agent in CI/CD jobs
Enables self-hosted large language modelslarge language modelsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. as the source for GitLab Duo Chat and Code Suggestions on self-managed instances
Adds support for private container registries in workspaces via image pull secrets
+30 moreshow less
Makes the extension marketplace available in workplaces (disabled by default)
Displays release notes on deployment details page for tag-triggered pipelines
Adds admin setting to enforce CI/CD job token allowlist on self-managed instances
Adds authentication log for tracking CI/CD job token authentications, downloadable as CSV
Adds vulnerability report grouping in Ultimate tier
Makes Model registry generally available with MLflow client integration and GitLab API support
Adds Switchboard capabilities for outbound private links and private hosted zones for GitLab Dedicated tenants
Adds adherence checks for SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. in the Compliance Centre
Adds project events to group webhooks for creation and deletion events
Adds filtering by assigned seat on GitLab Duo seat assignment page
Adds duo_seat_assignment_email_for_sm feature flag to disable Duo seat assignment emails
Adds EPSS support for prioritizing vulnerabilities via GraphQL in Ultimate tier
Updates application settings REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. to enable Secret Push Protection programmatically
Adds audit events for secret push protection exclusions
Automates Repository X-Ray background jobs on default branch commits
Adds advanced proxy authentication for corporate network support in GitLab Duo plugins
Adds merge_request_merged audit event type with detailed merge information
Allows disabling OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. and WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. devices independently
Adds new token information API endpoint for admin retrieval of token data
Adds city and country location info to sign-in emails from new locations
Adds approval_settings.block_group_branch_modification property to prevent group branch modification overrides
Adds optional setting for top-level group Owners to create service accounts
Adds badge to service accounts in users list
Allows using pages attribute in any CI/CD job instead of naming a job pages
Adds aiMetrics GraphQL API for GitLab Duo Pro Impact Analytics
Adds toggle to hide closed items in linked/child item lists
Adds GraphQL API for per-user Duo Enterprise usage metrics
Adds support for license data from CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence.SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in License Scanner
Adds macos-15-xcode-16 job image for macOS Sequoia 15 and Xcode 16
Makes JaCoCo test coverage visualization generally available in merge request diff view
Adds ephemeral resources: a new resource kind re-read on every evaluation phase whose values are never written to state or plan files.
Adds ephemeral input variables and outputs: mark variables or outputs as ephemeral = true to prevent them from being persisted to plan or state.
Adds ephemeralasnull function: converts any ephemeral values in a structure to non-ephemeral nulls, enabling safe use of ephemeral data where persistence is required.
S3 backend now supports S3 native state locking alongside existing DynamoDB-based locking.
Adds new authentication method for the Tencent Cloud (cos) backend.
+2 moreshow less
The element function now accepts negative indices for reverse list access.
Improves import block validation to catch more invalid cases during terraform validate.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!backend/s3: Deprecated top-level IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role assumption attributes are removed; you must now use the assume_role block instead.
!moved blocks now reserve keywords when parsing resource addresses; configurations referencing resources whose type names match top-level block keywords must prepend resource. to those references.
!HCL conditional expressions now combine marks from all values in the expression, which may cause previously-lost sensitive marks to surface, making some values sensitive where they were not before.
Throttle discovery to stay under a WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. or target server's request threshold during a sensitive engagement.
WCVS 1.3.0 adds new web cache deception techniques, a time-based detection skip flag, and Kali Linux repo availability.
└──▷ GET THIS VERSION
$ git clone --branch 1.3.0 https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner.git
# already have the repo? check out this version:$ git checkout 1.3.0
└──▷ TRY IT
Suppress time-based cache inference when scanning a target prone to slow responses, avoiding false-positive cache detections that trigger unnecessary follow-on tests.
$ wcvs -u https://example.com --stime
Adds multiple new detection techniques for web cache deception vulnerabilities.
Now checks for web cache deception even when no cache indicator is spotted beforehand, expanding coverage.
New -skiptimebased/--stime flag disables time-based cache guessing to reduce false positives and unnecessary test runs.
WCVS is now available natively in the Kali Linux (and BlackArch) package repository.
nuclei v3.3.6 adds DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. analyzers, JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. batch output, and ENV-based dynamic secrets
└──▷ GET THIS VERSION
$ git clone --branch v3.3.6 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:$ git checkout v3.3.6
└──▷ USE IT
Enable batched JSONL output to reduce disk I/O during large scans by buffering 100 records before flushing.
yaml
# In ~/.config/nuclei/config.yaml or reporter config:
jsonl:
file: "results.jsonl"
omit-raw: false
batch-size: 100
Adds analyzer support and time-based delay analyzer for DAST mode, enabling smarter detection logic during HTTP fuzzing.
Adds batch output support for JSONL format via configurable batch-size option in the JSONL exporter config.
Supports ENV variable substitution in dynamic secret files, letting secrets be pulled from environment variables or passed via -v/-env-vars flags.
Adds SDK functions for setting custom variables and improved nuclei store and workflow access.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The -enable-self-contained (or -esc) flag is now required to load self-contained templates; they are no longer enabled by default.
!The -file flag must now be explicitly used to enable loading file protocol templates; file templates are no longer loaded by default.
Caido v0.44.0 adds a variable store with environments, CA cert import, SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. overrides, and expanded plugin SDK APIs.
└──▷ GET THIS VERSION
$ git clone --branch v0.44.0 https://github.com/caido/caido.git
# already have the repo? check out this version:$ git checkout v0.44.0
New variable store lets you define named variables that auto-insert into Replay and Automate requests, with multiple environments for easy context switching.
Supports importing your own CA certificates into Caido.
Adds SNI override capability for Replay sessions, enabling testing against hosts with mismatched certificates.
Replay and Automate session tabs can now be reordered.
Backend SDK: RequestSpec getters and setters now support raw bytes (Uint8Array), enabling handling of non-UTF8 data in methods like setMethod and setPath.
+2 moreshow less
Frontend SDK: New sdk.env.getVar API lets plugins fetch variables from the variable store.
Frontend SDK: sdk.navigation.addPage gains an onEnter callback to execute custom logic when a user navigates to a plugin page.
GitGuardian SaaS adds send_email param to invite API, instance-level GitLab integration via admin token, and v2.126 secrets detection with 4 new detectors.
Adds send_email: true|false parameter to Platform API endpoints that trigger email notifications (e.g., invitation creation) to control whether an email is sent
Upgrades secrets detection engine to version 2.126, adding support for X-API Key Secret, Azure Functions App Key Header, and Azure Functions App Key Query Parameter detections
2 details in Everything
1 more release in this issue
· 2024-11-04 → 2024-11-18
Adds TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. dynamic secret provider, observability metrics via OTELOTELAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor., request ID support, and AWS Secrets Manager IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Role + Region for integrations.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.96.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.96.1-postgres
feat: added setup for production observability (metrics via OTEL)
feat: TOTP dynamic secret provider
feat: request ID support
3 details in Everything
5 more releases in this issue
· 2024-11-04 → 2024-11-25
Infisical v0.95.0 adds a TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. authenticator for MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. and fixes invite role slugs.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.95.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.95.0-postgres
feat: TOTP authenticator adds Time-based One-Time Password support for multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.
Adds tag support on secret creation, EST device enrollment without bootstrap certs, and HSMHSMA tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. support
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.94.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.94.0-postgres
Adds tags field to create-secret endpoints for grouping secrets by label
Enables adding Project Templates to organize recurring secret configurations
Adds static LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. credentials configuration for identity source binding
Adds Deployment Environment Scope support for Bitbucket integration filters
Adds support for EST (Enrollment over Secure Transport) device enrollment without requiring bootstrap certificates
Adds automatic Service Account creation for job and deployment secrets.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.93.2-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.93.2-postgres
Add support for auto creating SA for job and deployment
$ git clone --branch infisical/v0.93.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.93.0-postgres
Infisical v0.92.0 adds Snowflake dynamic secrets, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. default org, and deep search
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.92.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.92.0-postgres
Snowflake Dynamic Secrets integration for rotating Snowflake credentials
OIDC Default Org setting to route unauthenticated users to a specific organization
Secrets Dashboard Quick/Deep Search capability in the UI
Multiple auth methods support for identities allowing SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. or username/password simultaneously
OpenBao v2.1.0 adds unlimited mount tables, plugin transactional APIs, PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.CSRCSRA Certificate Signing Request is a block of encoded data submitted to a certificate authority, containing a public key and identity details, so the CA can issue a signed TLS certificate without ever seeing the private key. storage in Transit, and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. device/direct flows
└──▷ GET THIS VERSION
$ git clone --branch v2.1.0 https://github.com/openbao/openbao.git
# already have the repo? check out this version:$ git checkout v2.1.0
Removes mount table limits by splitting auth/secret mounts into separate entries, enabling hundreds of thousands of mounts
Adds physical.TransactionalBackend and logical.TransactionalStorage types for plugin developers to perform safe storage transactions
Adds PKI CSR and certificate storage alongside key material in the Transit secret engine without requiring an additional K/V mount
Adds device value to callback_mode role option in auth/oidc for OIDC device flow authentication
Adds poll_interval role option in auth/oidc to control polling frequency for device flow responses
+4 moreshow less
Adds callbackmode=device CLI option to the oidc login method for initiating device flow logins
Adds direct value to callback_mode role option in auth/oidc to direct callbacks straight to the server
Adds callbackmode=direct CLI option to the oidc login method for server-direct callback mode
Reintroduces physical/postgres storage driver with paginated list support (preview)
Syft v1.17.0 adds Rust dependency relationships and Node 6.x support to SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation.
└──▷ GET THIS VERSION
$ git clone --branch v1.17.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.17.0
Surfaces Rust dependency relationships in generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
Supports scanning Node.js 6.x package manifests.
2 details in Everything
1 more release in this issue
· 2024-11-04 → 2024-11-21
Syft v1.16.0 omits devDependencies from package-lock.json SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. by default for cleaner production inventories.
└──▷ GET THIS VERSION
$ git clone --branch v1.16.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.16.0
└──▷ BREAKING ON UPGRADE
!package-lock.json scanning no longer includes devDependencies by default; SBOMs generated from projects with devDependencies will contain fewer packages than in v1.15.0.
GCP HA support, blob store enhancements, and expanded Conan search capabilities in Nexus Repository 3.74.0.
Adds Google Cloud Platform support for highly available Nexus Repository deployments on GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. (Pro Only)
Adds native Google Cloud Blob Store support for artifact storage (Pro Only)
Enables automatic license distribution across clustered deployments via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. or UI
Allows definition of custom region lists for AWS Blob Store configuration
Supports AWS S3 failover buckets for cross-region high availability (Pro Only)
+2 moreshow less
Adds External Secrets Operator support for managing sensitive configuration in HA deployments (Pro Only)
Introduces strict base version matching and expanded search fields for Conan format
Package search now accepts PURLs and ecosystem prefixes for direct navigation.
Adds support for full and abbreviated Package URLs (e.g., pkg:npm/react@18.0.0 or npm/react@18.0.0) in the package search bar to jump directly to a package
Enables ecosystem switching by typing prefixes like pypi/ or rubygems/ followed by space and query text, with case-insensitive matching
2 details in Everything
8 more releases in this issue
· 2024-11-07 → 2024-11-27
Socket adds Per Security Policy alert filter and updates SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. dependency visualization
Adds the new Per Security Policy filter to alert management, flagging alerts as accepted or ignored based on your security policy configuration.
Updates SBOM dependency visualization so that dependencies with zero alerts or all ignored alerts are rendered as neutral white rectangles.
New GET /rest/findings/export and UI export allow programmatic and manual access to organization license policies via Socket's License Policy API
Adds the GET https://api.socket.dev/v0/orgs/{org_slug}/settings/license-policy endpoint to view an organization's license policy settings programmatically.
Adds the PATCH https://api.socket.dev/v0/orgs/{org_slug}/settings/license-policy endpoint to edit an organization's license policy settings programmatically.
Adds _EXEC_ID key for cross-report correlation and a minimal heartbeat report template.
└──▷ GET THIS VERSION
$ git clone --branch v0.4.14 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:$ git checkout v0.4.14
The _EXEC_ID key is now emitted on every command execution to uniquely identify the chalk process lifetime
Added a new heartbeat report template used as the default for heartbeat reports
Renamed configuration keys for embed attestation provider: attestation_key_embed.location is removed in favor of attestation_key_embed.filename, attestation_key_embed.save_path, and attestation_key_embed.get_paths
3 details in Everything
└──▷ BREAKING ON UPGRADE
!attestation_key_embed.location configuration key is removed; use attestation_key_embed.filename, attestation_key_embed.save_path, and attestation_key_embed.get_paths instead.
!chalk setup now requires an interactive shell to generate new key-material.
Version 1.14.0 adds the ability for the Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. Go agent to edit application response headers.
New allow_edit_response_headers capability enables the Fastly agent to modify outgoing application response headers
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.60.0 improves detection engines and updates GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. data.
Fastly CLI v10.16.0 adds Grafana Cloud Logs support, Log Explorer & Insights products, and token validity duration.
profile/token subcommand gains a parameter to specify token validity duration
logging feature adds support for Grafana Cloud Logs integration
2 details in Everything
└──▷ BREAKING ON UPGRADE
!products removes NGWAFNGWAFA next-generation web application firewall that inspects HTTP traffic at the application layer, using behavioral analysis and contextual rules rather than pure signature matching to block attacks like SQLi and XSS. product support
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds /agent-timeseries endpoint for per-agent metrics including latency and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware..
Adds the Retrieve agent timeseries metrics endpoint to the Next-Gen WAF, exposing metrics such as requests_total, agent_decision_time_50th, agent_decision_time_95th, agent_decision_time_99th, host_cpu, and host_agent_cpu for a specific agent in a workspace.
BunkerWeb v1.5.11 adds worker dict size control and API timeout settings, plus updates OWASP CRSOWASP CRSA free, community-maintained ruleset for ModSecurity and compatible WAFs that detects common web attacks like SQLi and XSS, giving cyber tools a ready-made detection baseline without writing rules from scratch. to v4.8.0 and v3.3.7.
└──▷ GET THIS VERSION
$ git clone --branch v1.5.11 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout v1.5.11
New WORKERLOCK_MEMORY_SIZE setting lets operators tune the worker dictionary memory size.
New API_TIMEOUT and API_READ_TIMEOUT settings enable fine-grained control over API timeout behaviour.
Updates OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Core Rule Set v4 to v4.8.0 and v3 to v3.3.7, bringing the latest WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. detection rules.
$ git clone --branch v9.0-preview3 https://github.com/icsharpcode/ILSpy.git
# already have the repo? check out this version:$ git checkout v9.0-preview3
Supports decompilation of C# 12 primary constructors.
Supports decompilation of C# 12 ref readonly parameters.
Supports types that provide DisposeAsync without implementing IAsyncDisposable.
Updates pattern detection to match Roslyn 4.11.0 language features.
Adds smooth scrolling to settings panels and DecompilerTextView.
+1 moreshow less
Enables collecting analyzers annotated with ExportAnalyzerAttribute.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The IsRef, IsOut, and IsIn flags are removed from IParameter in ICSharpCode.Decompiler.
!ParameterModifiers is replaced with ReferenceKind in ICSharpCode.Decompiler.
$ git clone --branch v1.5.1 https://github.com/skylot/jadx.git
# already have the repo? check out this version:$ git checkout v1.5.1
Generates Frida hooking snippets for all methods in a class directly from the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.
Adds a button to navigate directly to the Android Manifest from the GUI
Adds a button to navigate directly to the Application class from the GUI
Supports pinning tabs to keep important files accessible in the GUI
Introduces Quick Tabs for fast tab switching in the GUI
+12 moreshow less
Limits code/text search scope to a specific package in the GUI
Exports individual resources, classes, or packages from the GUI
Adds Smali code folding in the GUI editor
Moves AAB (Android App Bundle) support into a separate plugin
Allows config and cache directories to be overridden via environment variables
Allows installed plugins to be disabled individually
Adds CLI option to disable plugins
Adds JadxArgs API property to adjust XML security checks
Adds API method to retrieve decompiled method code
Adds option to always use the source file name as the class name alias
Adds support for 16-bit entry offsets, compact resource entries, and grammar inflection flag in resource decoding
Allows plugins to edit blocks before locking and to get main window reference, config/cache dirs, and declare minimum required jadx version
Frida 16.5.7 adds TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. tunnel as default backend, Android APK asset loading, MUSL Linux injector compatibility, and PowerPC build support.
TCP tunnel protocol is now the default for Fruity backend connections
FRIDA_FRUITY_TUNNEL_PROTOCOL environment variable allows reverting to QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. transport
Android Gadget supports loading assets from APKs where extractNativeLibs is false
Injector compatibility improved for Linux MUSL libc environments
Build system now supports the PowerPC architecture
+1 moreshow less
Remote call stack allocation added to improve compatibility with small-stack applications like Go
Radare2 5.9.8 adds new analysis commands, crypto plugins, search ops, and visual bit-editor enhancements.
└──▷ GET THIS VERSION
$ git clone --branch 5.9.8 https://github.com/radareorg/radare2.git
# already have the repo? check out this version:$ git checkout 5.9.8
└──▷ TRY IT
Find all recursive functions in a binary to prioritise reverse-engineering effort.
$ r2 -A /path/to/binary -c 'aflmr'
Search for loops inside the current function to locate iteration logic quickly.
$ r2 -A /path/to/binary -c 's main; /abf'
Persist a config change across sessions without manually editing r2rc.
$ r2 -c 'e+ scr.color=2' /path/to/binary
Adds aflmr command to list all recursive functions in the binary.
Adds aflmu command to list each function call exactly once (deduplication).
Adds afln command to list all function names.
Makes afvt work with a single parameter to display a variable's type.
Adds recursive-call information to afi function info output.
+26 moreshow less
Adds parse.pickle plugin for disassembly of Python pickle opcodes.
Adds gb.pseudo plugin for Game Boy pseudo-disassembly.
Adds /abf command to search for loops within the current function.
Adds /h* search variant and normalises /h behaviour to match other search commands.
Adds asm.cmt.pseudo config option to show pseudo-code in disassembly comments.
Adds asm.cmt.wrap config option to suppress right-side comment wrapping on long lines.
Adds e+ command to persistently set config variables in r2rc.
Adds -e log.level support for string-valued log levels.
Adds r2 -1 flag to redirect stderr into stdout.
Adds stdouterr directive to rarun2 for unified output capture.
Adds SipHash and bech32 encoding/decoding to the crypto plugin suite.
Adds SM4 master-key display and offset reporting on hits in search.
Adds iic subcommands for listing unique cross-references and classifying imports by category.
Improves iS table queries with sha1/sort/inc and entropy columns.
Supports table queries for strings via iz, and for classes via ic,.
Supports @% syntax for reading shell variables in expressions.
Adds yank/paste support in the visual bit editor (Vd1).
Adds endian-swap operation in the visual bit editor.
Adds Vd1! to toggle all bits in the selected byte.
Adds word-size concept and multi-byte increment/decrement (Vd1[+-]) in the visual bit editor.
Adds XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. cache directory support exposed via dir.cache for annotations.
Adds new project core plugin with save/restore of comments and prj.files support.
Adds initial LZ4 compression implementation to the util library.
Imports ImHex charset definitions into the print/pattern subsystem.
Includes calling-convention information in pdc pseudo-decompiler output.
Handles base64: prefix in #!-e scripting expressions.
Capstone 6.0.0-alpha2 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware./AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices. compatibility macros for CC/VAS enums and Tricore EA calculation
└──▷ GET THIS VERSION
$ git clone --branch 6.0.0-alpha2 https://github.com/capstone-engine/capstone.git
# already have the repo? check out this version:$ git checkout 6.0.0-alpha2
Hindsight v2024.10 adds DIPS database parsing, IndexedDB record parsing, and Windows 11 profile path support.
└──▷ GET THIS VERSION
$ git clone --branch v2024.10 https://github.com/obsidianforensics/hindsight.git
# already have the repo? check out this version:$ git checkout v2024.10
Parses the DIPS (Detect Incidental Party State) database, including new columns and the popups table, exposing Chrome's third-party cookie interaction tracking.
Parses IndexedDB records from Chromium profiles, expanding artifact recovery beyond traditional browser databases.
Switches cache parsing to use the ccl_chromium_reader library, improving cache artifact coverage.
Adds Windows 11 default Chrome profile path and a generic mechanism to locate profiles via inputs_selector.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!In a URLItem, the url_id property is replaced with visit_id; any downstream scripts or plugins referencing url_id will break.
!Login data parsing switches from the action_url column to origin_url; tooling that relied on the action_url field in Hindsight output will need to be updated.
iLEAPP v2.0.0 adds LAVA output support, new artifact parsers, redesigned HTML report structure, and a module test harness.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.0 https://github.com/abrignoni/iLEAPP.git
# already have the repo? check out this version:$ git checkout v2.0.0
Adds LAVA (Latent Evidence Analysis) structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. across modules, enabling integration with the LAVA forensic platform.
New HTML report folder structure reorganizes output for easier navigation.
New artifact parser for LinkedIn app data.
New artifact parser for Apple Wallet nano passes.
New module for WebKit storage artifacts.
+13 moreshow less
New Spotlight Search Engagements module.
Adds Apple Maps last activity camera artifact parsing.
Adds ApplicationState artifact parsing.
Adds AppConduit and TCC LAVA-compatible artifact support.
Embeds the ccl-segb library for parsing Segmented Binary format artifacts (used in Biomes and other Apple frameworks).
Adds LAVA output support for Biomes artifacts.
Adds LAVA output support for Control Center artifacts.
Adds LAVA output for Data Usage and system shutdown artifacts.
Introduces a Module Info Script for inspecting module metadata.
Introduces a Filepath Search Script for querying which modules target specific file paths.
Introduces a module test harness for validating parsers against test data.
Files processed are now logged only when running in research mode, reducing noise in standard runs.
HTML report now shows source file path as the filename and adds source file path tooltip in DeviceInfo.html.
18 details in Everything
└──▷ BREAKING ON UPGRADE
!The airtags module file is renamed from airtags.py to findMyItems.py; any external references or scripts invoking the old filename will break.
Cortex Analyzers 3.3.8 adds 10+ new analyzers and responders including EclecticIQ, QrDecode, Binalyze, DNSDumpster, Capa, AWS Lambda, and more.
└──▷ GET THIS VERSION
$ git clone --branch 3.3.8 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.3.8
Adds EclecticIQ analyzer to query the EclecticIQ threat intelligence platform.
Adds EclecticIQ responder to send case/observable data back to EclecticIQ.
Adds QrDecode analyzer to decode QR codes submitted as observables.
Adds DNSDumpster analyzer with report templates for DNS reconnaissance lookups.
Adds Capa analyzer to detect capabilities in executable files using the Capa framework.
+20 moreshow less
Adds AWS Invoke Lambda responder to trigger an AWS Lambda function from a Cortex case.
Adds JAMF Protect Prevent List responder to block indicators via JAMF Protect.
Adds Netcraft responder to submit URLs/sites to Netcraft for takedown.
Adds Ansible AWX responder to launch AWX job templates from a Cortex case.
Adds Cloudflare Account IP Access List responder to add/remove IPs from Cloudflare access lists.
Adds Telegram responder to send case information to a Telegram channel.
Adds FalconCrowdstrikeCustomIOC responder v2 for managing custom IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. in CrowdStrike Falcon.
Adds Azure Sign-In Retriever analyzer to pull Azure AD sign-in logs for an account.
Adds Azure Token Revoker responder to revoke Azure AD user tokens.
Adds Duo Account Bypass Mode responder to enable/disable Duo bypass for an account.
Adds TheHive Binalyze integration to trigger Binalyze AIR forensic acquisition from a case.
Adds Okta user-search analyzer to look up users in Okta.
Adds mail-subject as a supported dataType across analyzers.
Adds responder input forwarding to Shuffle API calls.
Updates Censys analyzer to Censys API Version 2.
Updates CrowdSec analyzer from version 1.0 to 1.1.
Updates OpenCTI analyzer filters format for OpenCTI 5.12 compatibility.
Updates AnyRun Sandbox analyzer to v1.1.
Renames and reworks existing Azure AD analyzer and responder to reflect Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. naming, adjusting folder structure and naming conventions.
Updates Triage analyzer.
25 details in Everything
└──▷ BREAKING ON UPGRADE
!The Azure AD analyzer and responder have been renamed and restructured for Microsoft Entra ID; folder paths and naming conventions have changed, which may break existing Cortex analyzer configurations pointing to the old paths.
Adds intelligent load balancing that distributes work to GPUsGPUsA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. and CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. based on their estimated performance metrics rather than equal splits
Dissect 3.17 adds dissect.fve for LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations./BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. volumes, BSD Vinum support, and target-shell -c / rc file options
└──▷ GET THIS VERSION
$ git clone --branch 3.17 https://github.com/fox-it/dissect.git
# already have the repo? check out this version:$ git checkout 3.17
Adds dissect.fve new project to access encrypted LUKS and Microsoft Bitlocker volumes
Supports BSD Vinum volumes in dissect.volume via the new container
Adds new MacOS network interface plugin for macOS disk images
Adds new Windows network interface plugin for Windows disk images
Registry plugin now searches paths used by legacy Windows versions for registry files
Hayabusa v2.19.0 adds a new log-metrics command, comparison field modifiers, UTF-16 base64 chaining, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. logon visibility, and abbreviation control.
└──▷ GET THIS VERSION
$ git clone --branch v2.19.0 https://github.com/Yamato-Security/hayabusa.git
# already have the repo? check out this version:$ git checkout v2.19.0
└──▷ TRY IT
Quickly profile a collection of EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. files to understand their time range, event counts, and sources before running a full timeline.
$ hayabusa log-metrics -d /mnt/evidence/evtx
Generate a CSV timeline without abbreviated Channel/Provider names so SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion or manual review sees the canonical field values.
New log-metrics command retrieves per-file .evtx metadata: computer names, event count, first/last timestamps, channels, and providers.
New -b, --disable-abbreviations option for csv-timeline, json-timeline, eid-metrics, log-metrics, and search commands to output raw Channel and Provider values instead of abbreviated forms.
Supports gt, gte, lt, lte field modifiers in detection rules for numeric/string comparisons.
Supports chaining utf16, utf16be, utf16le, and wide field modifiers with base64offset|contains for encoded content detection.
logon-summary command now surfaces logon information from RDP events, with additional detail when saving to a file.
+1 moreshow less
windash characters are now dynamically loaded from rules/config/windash_characters.txt, allowing customization without rebuilding.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The --timeline-offset option has been renamed to --time-offset; any scripts or workflows using --timeline-offset will break.
Timesketch 20241129 adds AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. tagger rules, a new Sigma mapping, actionable search error messages, and a next-gen frontend scaffold.
└──▷ GET THIS VERSION
$ git clone --branch 20241129 https://github.com/google/timesketch.git
# already have the repo? check out this version:$ git checkout 20241129
Adds AWS CloudTrail configuration for the Tagger Analyzer, enabling automated tagging of CloudTrail events.
Adds Sigma mapping for certificateservicesclient-lifecycle-system events, expanding Windows detection coverage.
Adds document/page title for sketches, improving browser tab identification and bookmarking.
Adds actionable error messages for complex search queries, surfacing guidance when queries fail.
Scaffolds the next-generation Frontend v3, laying groundwork for an updated UI.
+2 moreshow less
Adds a warning snackbar notification component for surfacing non-fatal alerts in the UI.
Updates getTimelineFields to return the union of all timeline fields across a sketch.
Adds scanning support for Red Hat UBI micro-images (v7-9) and improved GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure./OCP vulnerability detection.
Expands Google Kubernetes Engine (GKE) cluster vulnerability detection to include Autopilot mode and integrates with Google security bulletins.
Cortex Analytics adds new detection rules for cloud identity anomalies, subdomain fuzzing, and Okta/SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. honeypot user activities.
Adds A cloud identity performed multiple unusual activities Medium Analytics Alert to detect anomalous cloud identity behavior
Adds Subdomain Fuzzing Low Analytics Alert to identify DNS subdomain enumeration attempts
Adds 7 new Low Analytics BIOCs including Abnormal Communication to a Rare IP, Login attempt by a honey user, and SSO authentication attempt by a honey user
Adds 5 new Informational Analytics BIOCs covering AWS database password changes, Linux network share discovery, Okta session impersonation, and device assignment events
Adds Okta device assignment Informational Analytics Alert to track when devices are assigned to Okta users
Cortex Analytics adds new low/info alerts/BIOCs for Okta, Azure, cloud metadata, and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. activity.
Adds a new Low Analytics Alert: 'Logs were not collected from a data source for an abnormally long time'
Adds four new Informational Analytics BIOCs: A user accessed Okta's admin application, 'An Azure application reached a throttling API rate', Uncommon cloud CLI tool usage, and Unusual resource access by Azure application
Adds six new Informational Analytics Alerts: 'A user observed and reported unusual activity in Okta', 'An Azure identity performed multiple actions that were denied', 'Azure enumeration activity using Microsoft Graph APIMicrosoft Graph APIA unified REST API maintained by Microsoft that exposes data and actions across Microsoft 365 services, letting cyber tools query users, emails, files, and sign-in logs through a single authenticated endpoint.', Mailbox enumeration activity by Azure application, Microsoft SharePoint enumeration activity, and Microsoft Teams enumeration activity
Adds detection for Cloud Unusual Instance Metadata Service (IMDS) access
Adds detection for Network traffic to a crypto miner related domain detected
+1 moreshow less
Adds detection for Penetration testing tool attempt
New All Users page in Prisma Access 5.2 for centralized visibility into user connection status, location, and access mode across NGFWs and cloud services.
Adds the All Users page to provide comprehensive, centralized visibility of user connections across Next-Generation Firewalls (NGFWs) and Prisma Access.
Enables viewing total unique users currently connected to Palo Alto Networks security solutions via the new centralized dashboard.
Provides breakdown of users connected through NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. and Prisma Access during specific time ranges.
Prisma Access 5.2 adds Privileged Remote Access (PRA) for browser-based RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely./SSH/VNC.
Enables clientless browser-based access to nonweb applications like RDP, SSH, and VNC through the Privileged Remote Access (PRA) capability.
Integrates PRA with Cloud Identity Engine for authentication.
Prisma Cloud adds asset relationship APIs, DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. docs, GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. Autopilot scanning, UBI micro-image support, and Azure VM disk public access policy.
Adds POST /audit/api/v1/log endpoint for paginated audit log retrieval
Adds resource.type query parameter to GET /v2/policy and resource.type in response to filter policies by asset type
Introduces aws-msk-vpc-connection, aws-servicecatalog-portfolio-share, and aws-lake-formation-* API ingesters for AWS resources
Adds azure-active-directory-authentication-methods-registration-campaign Azure policy ingest with updated Policy.Read.All permission requirement
Introduces new configuration policies including 'Azure VM disk configured with public network access' and 'GCP BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. Table not encrypted with CMEK'
+7 moreshow less
Adds two new IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies: 'VM/Serverless can impersonate an Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. application...' and 'System/User-assigned managed identity with critical Entra ID permissions'
Enables scanning of Red Hat UBI Micro-images (versions 7, 8, and 9) in Secure the Runtime
Adds expanded GKE vulnerability detection for Autopilot mode with Google security bulletin integration
Introduces Asset Relationship Type Management APIs (get-asset-relationship-type-definitions, get-asset-relationship-definitions)
Adds DSPM API documentation site at pan.dev/prisma-cloud/api/dspm/
Supports MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v15.1, IRDAI, and updated CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline./NIST compliance standards
Increases SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login failure display from 5 to 10 messages in the UI
PAN-OS 12.1 adds unified IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. geolocation support for country-based Security, Decryption, and DoS policies
Enables global IPv6 geolocation mapping to apply country-based Security, Decryption, and DoS Protection policies across dual-stack and IPv6-only environments
Allows creation of custom IPv6 address-to-region mappings that take precedence over default global content file mappings
Sophos Central 2024.42 adds AP6 firmware/MIB downloads, voucher cloning, and new local UI.
└──▷ HOW TO FIND IT
Download SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. MIB files for monitoring AP6 devices via the Central installers page.
📍Navigate to Sophos Central › Installers › Download SNMP MIB
Clone an existing voucher to quickly generate a new one with the same parameters.
📍In Vouchers list, click Clone next to a voucher
Adds download links for AP6 firmware and SNMP MIB files from the Sophos Central installers page
Adds a Clone button to open the voucher creation dialog with pre-filled details from a selected voucher (bypassing the 100 voucher limit)
Aviatrix CoPilot 4.15 adds Microsoft SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. external connections, Azure ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. spoke peering, and GCP Global VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. for FireNet egress.
Adds Microsoft SSE Solution to the External Connections To dropdown under Networking > Connectivity > External Connections (S2C)
Supports Azure ARM Spoke attachment through Native Peering on CoPilot
Enables configuring GCP Global VPC on Gateways > Settings for FireNet Egress
Adds Enable Local Egress on VPC/VNets button on Security > Egress > Egress VPC/VNets
Allows accepting auto-resizing recommendations in Cloud Fabric > Scaling to immediately implement gateway right-sizing
+1 moreshow less
Automatically selects the single available cloud account in the Upgrade Controller Wizard when only one is accessible
New UI navigation path to disable MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools./XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. log integration for Sophos Firewall.
└──▷ HOW TO FIND IT
Prevent firewall logs from being forwarded to the managed detection and responsemanaged detection and responseManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. team.
📍In Threat Analysis Center - Marketplace, click Sophos Firewall, turn off Enable/Disable Integration, and click Save.
Adds a UI path in Threat Analysis Center - Marketplace to control whether firewall logs (ATP, Sandbox, IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., Anti-Virus, Anti-Spam) are sent to the MDR team.
ssldump v1.9 adds TLS 1.3 support, raw IP capture, and original PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. timestamp preservation.
└──▷ GET THIS VERSION
$ git clone --branch v1.9 https://github.com/adulau/ssldump.git
# already have the repo? check out this version:$ git checkout v1.9
Supports TLS 1.3 traffic analysis.
Supports raw IP captures (packets without Layer 2 headers), enabling use with tunnel interfaces and similar sources.
Preserves original PCAP timestamps instead of substituting live timeofday values, improving accuracy when replaying captures.
Adds live list and purge functionality to the connection tracker for better session management.
Adds USR1 and USR2 signal handlers for runtime control.
CSET v12.2.1.0 adds NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 and CMMC 2.0 assessment frameworks with governance and supply chain coverage.
└──▷ GET THIS VERSION
$ git clone --branch v12.2.1.0 https://github.com/cisagov/cset.git
# already have the repo? check out this version:$ git checkout v12.2.1.0
Adds the NIST Cybersecurity FrameworkNIST Cybersecurity FrameworkThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. (CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals.) 2.0 assessment, covering new governance and supply chain outcomes introduced in CSF 2.0.
Adds the Cybersecurity Maturity Model Certification (CMMC) 2.0 assessment, measuring implementation of NIST SP 800-171 Rev 2 and a subset of NIST SP 800-172 requirements across three certification levels.
Malcolm v24.11.0 adds Mandiant Threat Intel integration, Kafka log forwarding, two new APIs, and OPCUA-Binary write subscription parsing.
└──▷ GET THIS VERSION
$ git clone --branch v24.11.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v24.11.0
└──▷ USE IT
Forward all Zeek logs to a Kafka broker for downstream SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or stream processing ingestion.
Adds ZEEK_KAFKA_ENABLED, ZEEK_KAFKA_BROKERS, and ZEEK_KAFKA_TOPIC to ./config/zeek.env (and control_vars.conf for Hedgehog Linux) to enable forwarding Zeek logs to Kafka via the SeisoLLC/zeek-kafka plugin.
Adds ZEEK_DISABLE_DETECT_ROUTERS (default: true) to ./config/zeek.env and control_vars.conf, enabling an experimental Zeek script that detects routers by packet TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. and logs them to known_routers.log.
Adds the dashboard-export API endpoint to the Malcolm API surface.
Adds the ingest-stats API endpoint to the Malcolm API surface.
Adds support for pulling from the Mandiant Threat Intelligence service to feed the Zeek intelligence framework, using the google/mandiant-ti-client Python library.
+5 moreshow less
Adds the NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. HealthCheck plugin as a default NetBox plugin and integrates it into the Malcolm services readiness status API for reporting NetBox state.
Implements paging for the extracted files download dialog.
Improves normalization of Zeek's intel.log to the ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. threat fields.
Improves the Zeek Intel dashboard.
Changes the non-live Zeek container to become available for processing uploaded PCAPsPCAPsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. before an intelligence feed pull completes.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!ZEEK_INTEL_REFRESH_ON_ENTRYPOINT is renamed to ZEEK_INTEL_REFRESH_ON_STARTUP in both ./config/zeek.env and control_vars.conf — any configuration or automation referencing the old name will break.
Abnormal AI adds Okta identity remediation: auto-suspend accounts and force password resets for high-severity incidents.
Enables automatic suspension of Okta access and forced password resets for high-severity account takeover incidents via the existing Okta API key integration
Adds single-click account blocking in PeopleBase for suspicious users during threat hunting
Snort3 3.5.2.0 adds FTP extraction with aggregated event logging, ZIP central directory decompression, and full SIPSIPSession Initiation Protocol, an IETF signaling standard for setting up and tearing down real-time voice and video calls over IP networks, giving cyber tools a structured way to intercept, fuzz, or analyze VoIP traffic. method parsing.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.2.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.5.2.0
Adds FTP service implementation to the extractor subsystem, including aggregated event logging and a user field in extracted data.
Introduces imaginary transaction events for FTP in the extractor, enabling richer FTP session reconstruction.
Supports decompression of ZIP central directory structures.
Parses all SIP methods defined in the SIP standard, expanding SIP protocol coverage.
Introduces flow data support in the extractor subsystem.
+1 moreshow less
Adds helper methods to the file API for unsetting filename and resetting SHA hash state.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!get_relative_instance_number now returns a zero-based index instead of one-based, which will break any code or config that assumes a one-based thread instance number.
1 more release in this issue
· 2024-11-11 → 2024-11-20
Snort3 3.5.1.0 adds QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. service detection API, TLS version capture, new flow allowlist LRU, and cross-PDU PDF token reassembly.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.1.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.5.1.0
New AppID API to check whether a detected service is running over QUIC.
Adds TLS version capture in AppID sessions for richer protocol metadata.
New API allowing users to specify values for data items used in Lua detectors.
New allowlist LRU cache for flow management.
HTTP/2 inspector now handles multiple Cookie header fields in a single request.
+2 moreshow less
JavaScript normalizer adds cross-PDU PDF token reassembly for improved inspection across packet boundaries.
Thread instance number now included in dump_flows control command output for easier per-thread flow debugging.
CrowdSec v1.6.4 adds HTTP datasource ingestion, AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. alert context, EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. replay, and bouncer API key sharing.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.4 https://github.com/crowdsecurity/crowdsec.git
# already have the repo? check out this version:$ git checkout v1.6.4
New HTTP datasource enables CrowdSec to ingest logs from HTTP endpoints such as Datadog or Vector.
Alert context is now available when using the AppSec component, enriching alerts with request-level context.
Windows users can replay WinEvent EVTX files for historical log analysis.
Bouncers on different machines can share the same API key without interference; each appears as bouncer_name@IP in the bouncer list.
Inspektor Gadget v0.34.0 adds headless Kubernetes mode, OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools.-gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. metrics export, kubeipresolver for image-based gadgets, and container PID enrichment.
└──▷ GET THIS VERSION
$ git clone --branch v0.34.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.34.0
└──▷ TRY IT
Print build logs while building a gadget image to diagnose compile-time issues during development.
$ ig image build --verbose <path>
Introduces headless mode for Kubernetes deployments, enabling Inspektor Gadget to run without a dedicated UI/CLI consumer.
Adds support for named metric exporters and OTLP-gRPC in the otel-metrics operator, enabling direct export to OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. collectors.
Adds kubeipresolver operator for image-based gadgets, enriching network events with Kubernetes endpoint metadata.
Enriches container events with container PID, providing an additional identifier for process-level correlation.
Protocol name now included in L4 endpoint proto field formatting, improving readability of network event output.
+3 moreshow less
Image build logs are now printed when using verbose mode (--verbose), aiding gadget development and debugging.
Gadgets automatically add annotations based on field types, reducing manual metadata effort for gadget authors.
authfile and pull-secret parameters promoted to GlobalParams, making registry authentication available across all commands.
Grype v0.84.0 adds CLI support for scanning a single package by PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously..
└──▷ GET THIS VERSION
$ git clone --branch v0.84.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.84.0
└──▷ TRY IT
Scan one specific package version for vulnerabilities using its PURL instead of an image or lockfile.
$ grype 'pkg:pypi/requests@2.28.0'
Supports scanning a single PURL directly from the CLI, enabling targeted vulnerability lookups without a full image or SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
ThreatMapper v2.5.0 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching./CVE-KIV scoring to vuln API, zipped report downloads, and proxy support for cyber tooling
└──▷ GET THIS VERSION
$ git clone --branch v2.5.0 https://github.com/deepfence/ThreatMapper.git
# already have the repo? check out this version:$ git checkout v2.5.0
lookup vulnerabilities api now includes epss_score and description fields in responses.
UI adds a Zipped report download option for exporting scan results.
ThreatMapper cyber tool now supports proxy server configuration for outbound connections.
Adds CDI support in kata-agent and basic boilerplate for remote hypervisor
└──▷ GET THIS VERSION
$ git clone --branch 3.11.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.11.0
kata-agent gains CDI support (pull #9584)
runtime-rs adds basic boilerplate for remote hypervisor (pull #10225)
Gatekeeper v3.18.0-rc.0 promotes CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. engine to GA, adds config pod status, gator sync/expansion test support, and new Helm observability options.
└──▷ GET THIS VERSION
$ git clone --branch v3.18.0-rc.0 https://github.com/open-policy-agent/gatekeeper.git
# already have the repo? check out this version:$ git checkout v3.18.0-rc.0
Promotes the CEL constraint engine to General Availability (GA), removing its experimental status.
Adds logStatsAdmission and logStatsAudit configuration options to the Helm chart for per-webhook stats logging.
Implements Config pod status reporting, surfacing sync configuration health in the cluster.
Adds a generate operation and wait-for-VAPB-generation support for ValidatingAdmissionPolicyBinding workflows.
Adds sync resource testing support to gator (gator sync test).
+3 moreshow less
Adds expansion template testing support to gator verify.
Adds commonLabels support for Gatekeeper Deployments via Helm chart.
Container images are now also published to ghcr.io in addition to existing registries.
Prowler 4.6.0 adds 13 new AWS checks, 6 auto-remediation fixers, Jira integration, Azure AI Search coverage, and ENS RD2022 compliance for Azure and GCP.
└──▷ GET THIS VERSION
$ git clone --branch 4.6.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 4.6.0
└──▷ TRY IT
Verify that AWS Organizations centralized root credentials management is enabled across your account.
Adds iam_root_credentials_management_enabled check to verify AWS Organizations centralized root credentials management is enabled.
Adds 13 new AWS checks across AppSync, DMS, Firehose, Glue, Kinesis, MemoryDB, MQ, Neptune, RDS, Service Catalog, and Storage Gateway services.
Adds 6 new auto-remediation fixers for DocumentDB, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves., Neptune, and RDS misconfigurations (run with --fixer flag).
Adds Jira integration for finding notifications and ticketing.
Adds Azure AI Search check aisearch_service_not_publicly_accessible to detect publicly exposed AI Search services.
+3 moreshow less
Adds ENS RD2022 compliance framework support for both Azure and GCP.
Introduces standardized Unknown ARN and ID patterns (arn:<partition>:<service>:<region>:<account-id>:resource-type/unknown) for non-existent resources instead of mocked values.
Adds ProwlerChecKreator first version, a tool to assist in creating new Prowler checks.
8 details in Everything
1 more release in this issue
· 2024-11-05 → 2024-11-25
Prowler 4.5.0 adds 104 new AWS checks, LLMJacking detection, GCP org scoping, Azure Container Registry checks, and OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. v1.3.0 output.
└──▷ GET THIS VERSION
$ git clone --branch 4.5.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 4.5.0
└──▷ TRY IT
Scope a GCP scan to only projects within a specific organization to avoid scanning unrelated projects.
$ prowler gcp --organization-id <organization-id>
Scan all Azure Container Registry resources for public exposure and missing private link configurations.
$ prowler azure --service containerregistry
Adds 5 new AWS Bedrock checks to detect LLMJacking threats: bedrock_model_invocation_logging_enabled, cloudtrail_threat_detection_llm_jacking, bedrock_agent_guardrail_enabled, bedrock_guardrail_prompt_attack_filter_enabled, and bedrock_guardrail_sensitive_information_filter_enabled.
Adds 4 new checks to close IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Access Analyzer public-exposure gaps: cloudwatch_log_group_not_publicly_accessible, ses_identities_not_publicly_accessible, glue_data_catalogs_not_publicly_accessible, and secretsmanager_not_publicly_accessible.
Adds 104 new AWS checks across 42 services including Bedrock, DMS, FSx, GuardDuty, SES, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., AutoScaling, DirectConnect, CodeBuild, Network Firewall, and more.
Adds CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions.-based threat detection checks for enumeration and privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources.: cloudtrail_threat_detection_enumeration and cloudtrail_threat_detection_privilege_escalation.
Adds new --organization-id flag for GCP scans to limit scope to projects within a specific Google Cloud organization.
+5 moreshow less
Adds 2 new Azure Container Registry checks: containerregistry_uses_private_link and containerregistry_not_publicly_accessible.
Updates OCSF output format to v1.3.0, adding finding_info.created_time_dt, finding_info.name, finding_info.types, time_dt, metadata.product.uid, and metadata.profiles fields.
Adds support for AWS static credentials authentication.
Adds new transfer AWS service support with transfer_server_in_transit_encryption_enabled check.
Adds cloudwatch_log_group_no_critical_pii_in_logs check to detect PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. leakage in CloudWatch log groups.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The OCSF output field event_time is renamed to time and its format changes from a timestamp to a unix timestamp.
!The OCSF output field finding_info.created_time changes format from a timestamp to a unix timestamp.
Cloud Custodian 0.9.42 adds Global Accelerator, ElastiCache User, Step Functions Activities, and dozens of new filters across AWS and Azure resources.
└──▷ GET THIS VERSION
$ git clone --branch 0.9.42.0 https://github.com/cloud-custodian/cloud-custodian.git
# already have the repo? check out this version:$ git checkout 0.9.42.0
└──▷ TRY IT
Detect DynamoDB tables with cross-account access or overly permissive resource policies in a single policy sweep.
$ custodian run --output-dir=out policy-dynamodb-cross-account.yml
Audit AWS account-level EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance metadata defaults (e.g., IMDSv2 enforcement) and enforce compliant defaults.
Find Lambda functions with public function URLs that are not restricted to IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. authentication.
Adds aws.globalaccelerator resource with attribute filter support for managing AWS Global Accelerator endpoints.
Adds aws.elasticache-user resource for managing ElastiCache users.
Adds aws.log-destination resource for managing CloudWatch Logs destinations.
Adds aws.sfn-activity resource with tagging and encryption support for Step Functions activities.
Adds azure.app-service-environment resource for managing Azure App Service Environments.
+11 moreshow less
Adds ec2-metadata-defaults filter and set-ec2-metadata-defaults action on aws.account to audit and enforce EC2 instance metadata defaults.
Adds cross-account and has-statement filters to aws.dynamodb-table for detecting cross-account access and IAM policy statements.
Adds cross-account filter to aws.kinesis for detecting Kinesis streams exposed to other accounts.
Adds has-statement filter to aws.rest-api for auditing API Gateway resource policies.
Adds kms-key filter to aws.event-bus for checking EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. bus encryption.
Adds kms-key filter to aws.step-machine for auditing Step Functions state machine encryption.
Adds url-config filter to aws.lambda for inspecting Lambda function URL configurations.
Adds ldap, settings, and trust filters to aws.directory for auditing Directory Service LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. settings and trust relationships.
Adds delete action to aws.ses-configuration-set for removing SES configuration sets.
Adds terraform._ resource support for Terraform shift-left policy evaluation.
Adds c7n-org run-script shell passthrough improvement using shlex parsing for more robust argument handling.
ScubaGear v1.4.0 adds policy toggling, action-plan CSV output, new M365 assessment checks, and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mappings across all baselines.
└──▷ GET THIS VERSION
$ git clone --branch v1.4.0 https://github.com/cisagov/ScubaGear.git
# already have the repo? check out this version:$ git checkout v1.4.0
Adds policy check toggling via config file, allowing specific policies to be omitted from assessments.
New -OutActionPlanFileName parameter generates a dedicated remediation action-plan CSV output.
Consolidates results into a single ScubaResults.json by default, with a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. appended to the filename for uniqueness.
New assessment check for MS.DEFENDER.6.2v1 (Defender policy coverage expanded).
New policy check for MS.AAD.3.7v1 with support for exclusions.
+7 moreshow less
New policy check for MS.SHAREPOINT.3.2v1 when running as a service principal.
Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. mappings to all M365 secure configuration baselines.
Updates MS.AAD.6.1v1 check to account for federated domains.
Realigns MS.EXO.2.1v1 and MS.EXO.2.2v2 SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders. assessment checks with updated policies.
Enhances CSV output to be consistent with data shown in HTML reports.
Adds a backup path to locate the OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. executable in the current directory.
Bumps minimum and acceptable OPA version to v0.69.0.
12 details in Everything
└──▷ BREAKING ON UPGRADE
!Individual per-product JSON files are no longer produced by default; output is now a single ScubaResults.json (with UUID in filename). Use -KeepIndividualJSON to restore the previous behavior.
!The MS.SHAREPOINT.4.1v1 policy is removed entirely; any config or workflow referencing it will no longer find that check.
!MS.SHAREPOINT.1.4v1 check is now set to not-implemented due to a deprecated field, so it will no longer return a pass/fail result.
!Minimum accepted OPA version is raised to v0.69.0; older OPA executables will no longer be accepted.
osctrl v0.4.1 adds Kafka backend, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. for backend connections, Prometheus metrics to osctrl-tls, and expiration support for distributed queries/carves.
└──▷ GET THIS VERSION
$ git clone --branch v0.4.1 https://github.com/jmpsec/osctrl.git
# already have the repo? check out this version:$ git checkout v0.4.1
Adding flag to utilize the SSL support for the backend connection
Run queries and carves via osctrl-api with expiration
Trend Vision One adds configurable CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage control for Linux agent scans and monitoring.
Enables configuration of CPU limits to control the impact of Anti-Malware Scans and Activity Monitoring on Linux agents
Requires agents version 20.0.1-4540 or later to access the feature
2 details in Everything
17 more releases in this issue
· 2024-11-06 → 2024-11-29
TrendVision One XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. for Cloud extends detection to Amazon Security Lake via new integration
Trend Vision One ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. Gateway 1.0.56 adds SPN Proxy integration and Anthropic Claude inspection
Adds support for on-premises gateway integration with SPN Proxy to reduce firewall FQDN exceptions.
Enables Anthropic/Claude public AI Service for advanced content inspection.
Allows re-creating access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. for Box, Dropbox, and Google Drive with a different admin user
Enables Cloud Email and Collaboration Protection to recreate access tokens for Box, Dropbox, and Google Drive using an administrator account different from the one currently associated with the service account.
Provides workflow guidance for transferring quarantined files from the original administrator's folder to the new administrator's folder after admin swap.
Cloud Email and Collaboration Protection adds automatic recovery of false positive emails in Exchange Online and Gmail inline modes.
Enables automatic identification and reversal of Quarantine actions for false positive emails in Exchange Online (inline mode) and Gmail (inline mode), delivering them directly to end users’ inboxes.
Hunters Pathfinder AI adds Juniper, OpenStack, Databricks, CloudSEK, Keycloak, Wiz EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Runtime integrations and Nozomi detector.
Adds integration with Juniper Networks for Switch Logs and Firewall Logs, including ingestion to the data lake and mapping to IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search and Hunters Login Schema.
Adds integration with Microsoft Defender Advanced Hunting logs, replacing Defender for Endpoint and Defender XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Identity Query logs, with ingestion to the data lake and mapping to IOC Search.
Adds integration with OpenStack IaaS platform for log ingestion to the data lake and mapping to IOC Search.
Adds integration with Databricks cloud analytics platform for log ingestion to the data lake and mapping to IOC Search.
Adds integration with CloudSEK predictive threat intelligence for log ingestion to the data lake and mapping to IOC Search.
+3 moreshow less
Adds integration with Keycloak IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. solution, including ingestion to the data lake, mapping to IOC Search, and mapping to Hunters Login Schema.
Adds integration with Wiz EKS Runtime logs for Amazon Elastic Kubernetes Service (EKS) workloads, including ingestion to the data lake and mapping to IOC Search.
Adds new nozomi_alerts detector for Nozomi alerts that filters out posture-like alerts and known vulnerability scanner noise.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Microsoft Defender Advanced Hunting logs replace the following: Some data types under Defender for Endpoint (see here) and Defender XDR Identity Query logs.
Adds emergency workspace login with Databricks credentials + MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. when unified login is disabled.
Databricks expands pay-per-token billing for Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. to all supported Mosaic AI Model Serving regions.
Google SecOps adds parsers for Azure AD, AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./GuardDuty/RDS, Cloudflare, FortiWeb, F5 BIG-IP, and many others.
└──▷ HOW TO FIND IT
Ingest Azure AD and AWS VPC Flow logs using the new parser capabilities.
📍Configure the Chronicle ingestion pipeline to select Microsoft Azure AD and AWS VPC Flow logs parsers for your data source connectors.
Adds parsers to collect Microsoft Azure AD logs
Adds parsers to collect AWS VPC Flow logs
Adds parsers to collect AWS GuardDuty logs
Adds parsers to collect Cisco Meraki logs
Adds parsers to collect Cisco Secure Email Gateway logs
+34 moreshow less
Adds parsers to collect Cisco ISE logs
Adds parsers to collect Cisco Secure ACS logs
Adds parsers to collect Amazon CloudFront logs
Adds parsers to collect AWS RDS logs
Adds parsers to collect Cloudflare WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. logs
Adds parsers to collect Forcepoint DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. logs
Adds parsers to collect FortiWeb WAF logs
Adds parsers to collect F5 BIG-IP APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. logs
Adds parsers to collect F5 BIG-IP LTM logs
Adds parsers to collect CrowdStrike EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. logs
Adds parsers to collect the General Dynamics Fidelis XPS logs
Adds parsers to collect CyberX logs
Adds parsers to collect Imperva Incapsula Web Application Firewall logs
Adds parsers to collect Infoblox logs
Adds parsers to collect Juniper Junos logs
Adds parsers to collect Microsoft Intune logs
Adds parsers to collect Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. security API alert logs
Adds parsers to collect Kemp Load Balancer logs
Adds parsers to collect Mimecast Secure Email Gateway logs
Adds parsers to collect Netgate pfSense logs
Adds parsers to collect NetScaler logs
Adds parsers to collect Proofpoint TAP alerts logs
Adds parsers to collect Pulse Secure logs
Adds parsers to collect Qualys scan logs
Adds parsers to collect RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. Authentication Manager logs
Adds parsers to collect SentinelOne EDR logs
Adds parsers to collect SonicWall logs
Adds parsers to collect Sophos UTM logs
Adds parsers to collect Symantec Event Export logs
Adds parsers to collect Tripwire logs
Adds parsers to collect Palo Alto Prisma Cloud logs
Adds parsers to collect Okta logs
Adds parsers to collect Palo Alto Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. alerts logs
Adds parsers to collect CrowdStrike Detection logs
Sekoia Defend adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. visualization with filters for configured intakes and detection gap identification.
Shuffle 2.0.0-nightly adds Sigma detection UI, app hotloading endpoint, window swapping, and branch direction flipping.
└──▷ GET THIS VERSION
$ git clone --branch 2.0.0-nightly-02112024 https://github.com/Shuffle/Shuffle.git
# already have the repo? check out this version:$ git checkout 2.0.0-nightly-02112024
Adds Sigma detection UI for building and managing Sigma rules directly in the workflow interface.
New API endpoint for hotloading specific applications without restarting the service.
Adds window swapping capability in the workflow editor.
Adds branch direction flipping in the workflow canvas.
Variable fields in action parameters now update dynamically.
+4 moreshow less
Adds tip-section support in in-product documentation.
Cloudmersive Cloud Virus API v9-7-4 adds multi-blob scanning for Azure Blob Advanced via scanMultipartFile.
Adds scanMultipartFile option to the Scan Azure Blob Advanced endpoint, enabling a single request to target multiple blobPath values separated by a ; delimiter.
TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Dashboard gets Threats Targeting Country filter; CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. autocomplete improves
OpenCTI 6.4 adds Tenable vulnerability management, danger zone protections, conditional CSV mapping, and bulk case actions.
└──▷ GET THIS VERSION
$ git clone --branch 6.4.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.4.0
└──▷ HOW TO FIND IT
Map confidence scores from a TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. feed to the OpenCTI score field using the new ingestion option.
📍In the TAXII Feed connector configuration, enable map_confidence_to_x_opencti_score for Indicators/Observables.
Revoke a potentially leaked user token and generate a new one via the management interface.
📍In User Management, select the user and use Revoke & Recreate Token to invalidate old credentials.
Direct in-UI bulk operations for updating creator, assignee, priority, severity, and type on cases via list view
Playbook step Available for manual enrollment / trigger to allow specific entity enrollment into automated workflows
Graph layout persistence when forces are disabled, allowing static manipulation of knowledge graphsknowledge graphsA representation of entities and the relationships between them. Software can follow those connections to answer questions or combine information from different sources.
Bulk removal of relationships from a container by selecting parent or child nodes in the graph UI
Conditional mapping capability in CSV mappers to map columns based on specific data conditions
+12 moreshow less
Duplicate feature for CSV mappers and feeds across ingestion and data sharing
x_opencti_score confidence level mapping option in TAXII feed ingestion config
New system has vulnerability relationship type and knowledge view for System entities
Tenable Vulnerability Management connector for asset vulnerability monitoring
RiskIQ Passive Total enrichment connector
GreyNoise Vulnerability enrichment connector
Filter on system user in activity logs to trace platform actions
"Can use web interface export functions (PDF, PNG, etc.)" capability controlling dashboard/knowledge graphknowledge graphA representation of entities and the relationships between them. Software can follow those connections to answer questions or combine information from different sources. image downloads
Static disable_trash parameter to globally disable the trash functionality
Cloud of Words widget for dashboards
Opinion distribution widgets based on average entity opinions
Clickable opinions across all entities with comment dialog
MISP v2.5.2 adds ad-hoc & scheduled workflows, private custom galaxies, PDF export for event reports, and a RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9.4 installer.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.2 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.2
└──▷ HOW TO FIND IT
Reuse analyst boilerplate (e.g. author name, TLP header) across all Event Reports without retyping it.
📍In the MISP console, go to Global Actions › My Profile › User Settings, define a template variable (e.g. author: Jane Doe), then reference it in any Event Report body as {{ author }}.
Export a finished Event Report as a properly formatted PDF for sharing outside MISP.
📍Open the Event Report, click the Download menu, and select Download as PDF (requires the convert_markdown_to_pdf.py misp-module and its dependencies: Pandoc, wkhtmltopdf, mermaid-cli).
Adds Ad-Hoc Workflows that run independently of application triggers, executable manually or on a schedule.
New run_workflow action module enables workflows to chain and launch other workflows.
Enables running a workflow directly against a specific event, similar to running an enrichment.
All available galaxy matrices are now selectable in the event view, including user-created matrices.
MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. matrix gains an attack-enterprise unfiltered tab showing all techniques together, opened by default.
+11 moreshow less
Supports creating and editing Private Custom Galaxies with ownership and distribution levels for access control.
New MISP.hide_unknown_cluster setting (enabled by default) hides unknown clusters from the tag list after synchronization.
New diagnostic widget on the Galaxy index page warns about unknown default and custom clusters.
Allows attaching global and local tags to Event Reports for improved classification and sorting.
Template variables (handlebars-style {{ var_name }}) can now be defined in user-settings and auto-substituted in Event Reports on visualization or export.
New Download as PDF option for Event Reports using Pandoc via the convert_markdown_to_pdf.py misp-module (requires Pandoc, wkhtmltopdf, and mermaid-cli).
Enables pasting pictures directly into the Event Report editor, saving images to disk or as event attachments.
Site admins can manage imported (pasted) pictures and assign aliases for reuse in reports via  syntax.
Extended event view adds a reverse merged view where the parent event's data is merged into the child event.
Releases first iteration of a native RHEL installer (minimum RHEL 9.4) as part of MISP 2.5.x.
MISP Galaxy, Taxonomies, and Objects now versioned independently using %Y%m%d00 format, decoupled from MISP core releases.
MISP v2.4.200 adds Ad-Hoc Workflows, private custom galaxies, Event Report PDF export/image pasting, and a RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9.4 installer.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.200 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.200
└──▷ HOW TO FIND IT
Suppress unknown cluster tags that arrive via synchronisation so analysts aren't confused by unrecognised galaxy tags.
📍In the MISP admin console, go to Administration › Server Settings & Maintenance › MISP, find MISP.hide_unknown_cluster and set it to true.
Reuse analyst-specific boilerplate (e.g. analyst name, TLP caveat) across all Event Reports without retyping.
📍In your user profile settings, define a template variable (e.g. analyst_name = Jane Doe), then reference it inside any Event Report as {{ analyst_name }} — it will be substituted automatically when the report is viewed or exported.
Export a finished Event Report as a polished PDF for stakeholder distribution, using Pandoc rather than the browser print dialog.
📍Open the Event Report, click the download icon and select Download as PDF — requires convert_markdown_to_pdf.py from misp-modules and Pandoc, wkhtmltopdf, and mermaid-cli installed on the MISP server.
Adds Ad-Hoc Workflows that execute independently of application triggers — run manually or on a schedule without waiting for a MISP event.
New run_workflow action module lets workflows chain into other workflows, enabling multi-stage automation pipelines.
Enables running a workflow directly against a single event, similar to running an enrichment module.
Adds private Custom Galaxies with ownership and distribution levels so clusters can be selectively hidden from other users.
New MISP.hide_unknown_cluster setting (enabled by default) hides unknown clusters from the tags list after synchronisation.
+11 moreshow less
Adds a diagnostic widget on the Galaxy index page to warn about misconfigured hidden default and custom clusters.
Any galaxy matrix can now be selected and viewed from the Event view, including user-defined matrices.
MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. matrix gains an attack-enterprise tab showing all techniques unfiltered, and opens by default.
Tags (global and local) can now be attached to Event Reports for classification and sorting.
Template variables defined in user-settings are now supported in Event Reports using {{ var_name }} handlebars-style notation, substituted automatically on visualisation or export.
New Download as PDF option in Event Reports converts markdown (GFM) to PDF via Pandoc, wkhtmltopdf, and mermaid-cli through the convert_markdown_to_pdf.py misp-module.
Users can now paste images directly into the Event Report editor, saving them to disk or as event attachments.
Site admins can manage pasted images, assign aliases, and reference them in reports with  syntax.
Extended event view adds a reverse merged view where the parent event's data is merged into the child event.
First iteration of a native RHEL 9.4+ installer released, bringing MISP 2.5.x to the RHEL community.
MISP Galaxy, Taxonomies, and Objects now version independently using %Y%m%d00 format, making currency checks straightforward.
Tenzer v4.23 introduces universal hash functions, Splunk sink, and TQL2 list support
Adds hash_md5, hash_sha1, hash_sha224, hash_sha256, hash_sha384, hash_sha512, and hash_xxh3 functions to compute message digests directly in queries.
Implements in relational operator for list_type to check element existence within lists.
Adds to_splunk sink operator to write data to a Splunk HECSplunk HECAn HTTP endpoint built into Splunk that accepts JSON-formatted log and event data pushed directly from applications or agents over HTTPS, letting cyber tools ship telemetry to Splunk without requiring a forwarder agent on the sending host. endpoint.
Adds load_balance operator to distribute events across subpipelines.
Ports Kafka connector to TQL2 with new load_kafka and save_kafka operators.
+3 moreshow less
Adds floor and ceil functions for rounding numbers, durations, and timestamps.
Enables spread syntax ...expr inside lists to expand one list into another.
Introduces universal function call syntax allowing methods to be called as functions and vice versa in TQL.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The azure_log_analytics operator is renamed to to_azure_log_analytics.
!The velociraptor operator is renamed to from_velociraptor.
Sigma r2024-11-10 adds 17 new detection rules covering IIS tampering, GPO abuse, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. phishing, and BTunnels C2.
└──▷ GET THIS VERSION
$ git clone --branch r2024-11-10 https://github.com/SigmaHQ/sigma.git
# already have the repo? check out this version:$ git checkout r2024-11-10
New rule: Detects .RDP files created by the Outlook process — catching RDP-based phishing via email clients.
New rule: Detects access to browser credential files by uncommon applications via Security event log.
New rule: Detects commands executed via the Windows Run dialog box using registry artifacts.
New rule: Detects DNS requests originating from Windows Script Host (wscript/cscript).
New rule: Detects ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. logging or processing options being disabled on IIS servers.
+18 moreshow less
New rule: Detects Group Policy abuse for privilege addition.
New rule: Detects HTTP logging being disabled on IIS servers.
New rule: Detects network connections initiated to BTunnels domains — a covert tunneling service.
New rule: Detects new modules added to an IIS server.
New rule: Detects potential Python DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. sideloading.
New rule: Detects potentially suspicious commands executed via the Windows Run dialog box using registry artifacts.
New rule: Detects PowerShell Web Access feature being enabled via DISM.
New rule: Detects PowerShell Web Access installation via PowerShell script.
New rule: Detects removal of previously installed IIS modules.
New rule: Detects a process deleting its own executable — a common malware self-cleanup technique.
New rule: Detects Remote Access Tool MeshAgent command execution via MeshCentral.
New rule: Detects startup or logon scripts added to a Group Policy Object.
Updated file-sharing domain rules now include pixeldrain.com across BITS, curl, wget, PowerShell, and network connection detections.
Updated Certipy detection adds new flags cert, template, and ptt for broader coverage.
Updated LSASS dump file rule adds patterns for RustiveDump and NativeDump.
Updated DNS query rule for remote access software adds Tailscale, Twingate, and Microsoft Remote Assistance domains.
Updated JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. token CLI search rule adds the eyJhbGciOi string to detect {"alg": JWT header lookups.
Updated GPO scheduled task persistence rule adds coverage for Event ID 5136.
Adds 13 new detection rules including DeviceCode auth and Hex payload execution, plus Crowdstrike FDR support.
└──▷ GET THIS VERSION
$ git clone --branch dev-v0.2.0 https://github.com/elastic/detection-rules.git
# already have the repo? check out this version:$ git checkout dev-v0.2.0
[New] First Time Seen User Auth via DeviceCode Protocol
[New Rule] Potential Hex Payload Execution
[New Rule] Memory Swap Modification
[New Rule] Unusual Interactive Shell Launched from System User
[New Rule] Web Server Spawned via Python
+9 moreshow less
[New Rule] Directory Creation in /bin directory
[New Rule] Hidden Directory Creation via Unusual Parent
[New Rule] Security File Access via Common Utilities
[New Rule] Potential Data Splitting Detected
[New Rule] Private Key Searching Activity
[New Rule] IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. Forwarding Activity
[New Rule] Curl SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. Proxy Activity from Unusual Parent
3rd Party EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. - Add Crowdstrike FDR support
Splunk Security Content v4.43.0 adds 9 new detections including Braodo Stealer and Critical Alerts, plus drilldowns across all TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind./Anomaly rules.
└──▷ GET THIS VERSION
$ git clone --branch v4.43.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v4.43.0
New analytic Detect Critical Alerts from Security Tools identifies high-priority alerts from any vendor mapped to the Alerts data model, tested with MS365 Defender and Windows Defender.
New Internal Horizontal Port Scan NMAP Top 20 detection identifies internal network reconnaissance targeting the top 20 NMAP ports.
New High Volume of Bytes Out to Url and Plain HTTP POST Exfiltrated Data analytics detect data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. over web channels.
All TTP, Anomaly, and Correlation detections now include two default drilldowns — one scoped to a specific risk object and one surfacing risk events from the past 7 days — to accelerate investigation workflows.
New datasource testing in contentctl v4.4.5 validates detection compatibility when new Technology Add-ons (TAs) are introduced.
+1 moreshow less
Automatic version enforcement in contentctl v4.4.5 increments search versions whenever a detection's YAML is modified.
Cribl Stream 4.9.1 adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. Trap Serialize Function, custom region endpoints for Sources/Destinations, and Cloud admin Git message customization
Adds SNMP Trap Serialize Function to serialize events into SNMP traps for sending via SNMP Trap Destinations.
Enables custom region endpoints for AWS, Google Cloud, and New Relic Sources and Destinations to support new cloud regions without release updates.
Allows Cribl.Cloud administrators to customize the default Git commit message when deploying changes, matching on-prem capabilities.
Adds HTTP response code labels to EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. investigation filtering
Adds Windows Server 2025 functional level to Domain IoE; prevents container switching on license upload
Domains with an Outdated Functional Level IoE now integrates the new Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. functional level for Windows Server 2025
Prevents switching Tenable One containers when uploading a new license file
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Uploading a new license file now prevents switching to a different Tenable One container
8 more releases in this issue
· 2024-11-04 → 2024-11-29
Tenable One adds quick filter buttons to the Attack Path Discover page and improves performance on Inventory and Attack Path pages.
Adds quick filter buttons to the Discover page in Attack Path to automatically filter the top attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. list in one click.
Improves performance on the Tenable Inventory Asset Details page, the Attack Path Findings page, the Discover page Top Attack Paths section, and the Discover page Node Search section.
Tenable One Identity Exposure 3.82 adds Five Eyes dashboard template and new Service Accounts misconfigurations IoE
Adds a Dashboard template for Five Eyes alliance guidance on Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. compromises
Introduces a new Service Accounts Misconfigurations Indicator of Exposure (IoE) for domain service account bad practices
Tenable One ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. now supports AWS Route 53 and OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. sources, plus RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. assignment during user creation.
Adds Amazon Route 53 as a supported source for asset inventories
Adds Amazon OpenSearch / ElasticSearch as a supported source for asset inventories
Enables assigning Tenable-provided roles to ASM users at creation time in Vulnerability Management
Tenable One adds Zero Day filter and column in Vulnerability Intelligence
Adds a Zero Day filter to the Vulnerability Intelligence Overview page
Adds a Zero Day column to the Vulnerability Intelligence Overview table
Adds a Vulnerability Profile field indicating zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. status in the Risk Profile section
Tenable One Identity Exposure 3.77.3 adds Shadow Credentials and Managed Service Account IoEs, proxy support, and new LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. validation.
Adds Shadow Credentials Indicator of Exposure to detect backdoors in Windows HelloWindows HelloA Microsoft authentication framework built into Windows 10 and later that lets users sign in via biometrics or PIN instead of passwords, giving cyber tools a phishing-resistant credential layer to build on. for Business key credentials.
Adds Managed Service Accounts Dangerous Misconfigurations Indicator of Exposure to verify proper deployment and configuration.
Adds proxy connection capability during installation or upgrade to enable on-premises environments to work with Tenable One features.
Supports the krbtgt_AzureAD account in Windows Hello for Business (Cloud Trust deployment) for Last Password Change on KRBTGT Account IoE.
Adds validation for reversible passwords defined by PSO with attribute msDS-PasswordReversibleEncryptionEnabled.
+4 moreshow less
Adds LAPS version installed option to validate Local Administrative Account Management configuration.
Adds Privileged Authentication Silo Configuration Indicator of Exposure to assist AD administrators in setting up authentication silos for Tier-0 accounts.
Adds Property Sets Integrity Indicator of Exposure to check for misconfigurations within Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Property Set objects and attributes.
Adds Privileged AD User Accounts Synchronized to Microsoft Entra ID Indicator of Exposure to check synchronization status.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!Email alerting now only supports TLS 1.2 and TLS 1.3; overrides using deprecated SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. encryption standards like SSLv3 must be removed, otherwise the relay will fail to start.
Tenable ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adds manual TXT record entry and improved public list API docs.
Allows users to add missing TXT records manually to extend discovery capabilities when auto-detection fails
Adds extensive documentation to the public list API endpoint for more comprehensive usage instructions
Adds RLBA vulnerability ID support in settings for broader vuln tracking coverage.
Updates audit log to display actual requested reviewers for improved change accountability.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 3000 support is dropped from the Helm chart; any configuration or firewall rules relying on port 3000 will break on upgrade.
4 more releases in this issue
· 2024-11-04 → 2024-11-25
DefectDojo 2.40.2 adds Trivy Operator all-findings JSON, DSA vuln IDs, RLSA vuln ID support, and Helm initializer retention.
└──▷ GET THIS VERSION
$ git clone --branch 2.40.2 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.40.2
Consolidates all Trivy Operator findings into a single JSON import, simplifying bulk ingestion.
Adds DSA vulnerability ID support for Debian Security Announcements in finding enrichment.
Adds RLSA (Red Hat Linux Security Advisory) as a recognized vulnerability ID type.
Makes Trivy Operator Kubernetes vulnerability IDs consistent across findings and UI.
Adds Helm chart option to retain the initializer job after completion (keepInitializer).
+2 moreshow less
Adds validation checker for DD_DEDUPLICATION_ALGORITHM_PER_PARSER and DD_HASHCODE_FIELDS_PER_SCANNER settings to catch misconfiguration at startup.
Reworks the Kubescape parser with updated field mappings reflected in both the parser and UI.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The Prowler v4 parser now expects the time_dt key instead of event_time — existing Prowler v4 import pipelines using the old key will fail to parse event timestamps.
Brinqa 11.29.19 adds scheduled exports with email notifications and SDM attribute transforms for Date, Number, and Boolean.
Adds the ability to schedule an export and send notifications via email
Added support for Double and Long as connector properties
Added a required header (--header 'X-Requested-With: XMLHttpRequest') when retrieving API tokens
Added the Connector version and Update available columns to the data integrations page that allows admins to understand when new connector versions are available
Added a connector update available filter to the data sources page, so that users can understand which integrations can be updated
+9 moreshow less
Added ability to configure role strategy (add to existing or replace) in the Create people from roles and Add roles to user action
Created an Analytics Source trend for average age in days
Added Launch flowACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. to the Data Exporter role
Added the ability for a user to transform an SDM attribute using string replacement and regular expressions
Added the ability for a user to transform an SDM attribute to a Boolean
Added the ability for a user to transform an SDM attribute to a Date
Added the ability for a user to transform an SDM attribute to a Number
Added the ability for a user to transform a relationship type SDM attribute
Added the ability for a user to transform multi-value attributes
14 details in Everything
└──▷ BREAKING ON UPGRADE
!The NIST NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. connector is no longer supported in Brinqa Platform version 11.28 or later.
Artemis v3.4.0 adds SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. detection improvements, UI task views, and Nuclei template sampling.
└──▷ GET THIS VERSION
$ git clone --branch v3.4.0 https://github.com/CERT-Polska/Artemis.git
# already have the repo? check out this version:$ git checkout v3.4.0
└──▷ HOW TO FIND IT
View pending tasks for a specific target in the UI to monitor scan progress.
📍Navigate to the target dashboard and select Pending Tasks tab
improved.sql_injection detection capabilities for enhanced identification of SQL injection vulnerabilities
UI updates enabling viewing pending tasks for a specific target and displaying enabled modules during scans
Ability to run Nuclei templates on a percentage of websites using the sampling mechanism
NodeZero adds Kubernetes pentesting, Insider Threat scenarios, Azure MA privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., Slack token compromise, and new RAT access methods in November 2024 release.
Adds Kubernetes pentesting capability via the NodeZero K8s Operator for testing pods, nodes, clusters, and namespaces
Introduces the Insider Threat Pentest operational scenario allowing Windows AD credential injection during test setup
Adds privilege escalation within Azure environments using Automation Account Managed Identities with PowerShell runbook TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind.
Enables Slack token compromise upon endpoint breach, visible as H3-2024-0050 - Slack User Compromise with new impact type Third-Party SaaS User Compromise
Adds four new Remote Access Tool (RAT) implant access methods: Windows Management Instrumentation RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., Windows Remote Management RCE, PAN-OS-CVE-2024-0012, and PAN-OS-CVE-2024-9474
runZero v4.0.241101.2 adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. interface alias reporting and fixes TLS ECDH enumeration failures.
The scanner now reports SNMP interface aliases in addition to names.
Fleet 4.60.0 adds YARA-over-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. for agents, include any label profiles, Linux disk encryption UI, and zstd deb support.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.60.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.60.0
└──▷ TRY IT
Skip expensive vulnerability description lookups when fetching the hosts list — useful for large fleets where the endpoint was timing out.
Enable include any label targeting for an MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. configuration profile so it deploys to hosts matching at least one of several labels.
yaml
# In your GitOps YAML profile definition:
profiles:
- path: profiles/baseline.mobileconfig
labels_include_any:
- Contractors
- Remote Workers
Adds support for labels_include_any in GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. configuration.
Adds capability for Fleet to serve YARA rules to agents over HTTPS authenticated via node key (requires osquery 5.14+).
Adds activity item for fleetd enrollment showing host serial and display name.
Adds a query to let users toggle automations on/off while surfacing the current log destination.
Enables viewing scripts inline in the UI (from the scripts page and host details page) without downloading them.
+9 moreshow less
Adds activity feed entries when activity automations are enabled, edited, or disabled.
Cancels pending script executions when a script is edited or deleted.
Adds team_identifier signature information for Apple macOS applications to the /api/latest/fleet/hosts/:id/software endpoint.
Adds a freshness indicator for software title host and version counts on the title's details page.
Adds UI for installing custom profiles on hosts matching any of the defined labels (include any label targeting).
Adds UI features supporting disk encryption for Ubuntu and Fedora Linux.
Adds support for deb packages compressed with zstd.
Adds populate_software=without_vulnerability_descriptions parameter to GET /api/latest/fleet/hosts (Fleet Premium) to skip computationally heavy vulnerability detail population.
Adds info banner for cloud customers to assist with Windows auto-enrollment setup.
14 details in Everything
└──▷ BREAKING ON UPGRADE
!GitOps now returns an error if the deprecated apple_bm_default_team key is used and there are more than 1 ABM tokens in Fleet.
!GitOps path resolution for installer queries and scripts is now always relative to where the query file or script is referenced — existing YAML files that worked around the previous inconsistent behavior will break.
2 more releases in this issue
· 2024-11-12 → 2024-11-27
Fleet 4.59.0 adds macOS Setup Experience UI, SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention./NDES proxy for Windows cert enrollment, and expanded GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control.MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. support.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.59.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.59.0
Adds UI for configuring a setup experience script to run on macOS hosts during automated enrollment.
Adds UI for selecting software to install as part of the macOS setup experience.
Adds support in fleetctl gitops for specifying a setup experience script and software installs for a team or no team.
Adds Orbit endpoint POST /orbit/setup_experience/status for checking the status of a macOS host's setup experience steps.
Adds SCEP proxy for Windows NDES (Network Device Enrollment Service) AD CS server, enabling devices to request certificates.
+11 moreshow less
Adds ability to connect a SCEP NDES proxy in Fleet.
Adds validation preventing removal of a software package or VPP app from a team if it is selected for setup experience installation.
Adds filtering in the Software OS view to show only OSes from a specific platform (Windows, macOS, Linux, etc.).
Adds a config field in the UI for specifying a custom MDM URL.
Adds error message on the My Device page when MDM is off for the host.
Allows FLEET_REDIS_ADDRESS to include a redis:// prefix (accepted formats: redis://host:port or host:port).
Grants GitOps users permission to run MDM commands.
Adds created_at/updated_at timestamps to the user create endpoint response.
Updates software install activities from policy automations to be authored by Fleet and store policy ID and name on each activity.
Adds capability for fleetd to report vital errors (such as Fleet Desktop startup failures) to the Fleet server.
Updates OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. support to log MySQL spans outside of HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. transactions and rename spans to include the query for easier tracking.
Adds enableSixels and progressBar settings to the visual section in .winget/settings.json to display icons and progress visualization via sixel-compatible terminals.
Adds configureSelfElevate experimental feature in .winget/settings.json to allow DSC configurations with elevated resources to trigger a single UAC prompt instead of failing or requiring pre-elevation.
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager November 2024 introduces redesigned Contracts area with AI PDF upload and License Optimization views.
Adds a dedicated Contracts repository accessible from the main menu for managing renewals, terms, and contract values
Enables synchronization of contracts from Ironclad or Coupa integrations in addition to spreadsheet imports
Introduces AI-powered PDF upload via the New button on the Contracts page to extract and prefillprefillThe first phase of inference, where the model reads the whole prompt in parallel before producing its first token. It drives time-to-first-token; decode is the token-by-token phase after it. contract details
Allows creation of custom Contract fields visible on the contract Details tab through Settings > Contracts
Adds an Optimization section to the app Overview tab displaying license entitlements, assignments, and utilization metrics
Passbolt v4.10 adds beta v5 resource type support and metadata management APIs with PASSBOLT_V5_ENABLED flag
Adds the PASSBOLT_V5_ENABLED environment variable to enable beta support for the v5 resource type format in the v4 user interface.
Introduces new REST endpoints for metadata management: GET /metadata/settings.json, POST /metadata/settings.json, GET /metadata/keys.json, POST /metadata/keys.json, GET /metadata/session-keys.json, POST /metadata/session-keys.json, and DELETE /metadata/session-keys/<uuid>.json.
Nudge Security is a SaaS security platform that discovers shadow IT assets, manages identity governance, and hardens security posture.
Nudge Security adds Okta SaaS security posture managementSaaS security posture managementSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. via a new connected app integration.
1 more release in this issue
· 2024-11-06 → 2024-11-13
New Tines story automates creation of Jira tickets from Nudge Security SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. security posture findings.
Adds configurable grace period for refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. rotation in Ory OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. and Hydra
4 more releases in this issue
· 2024-11-08 → 2024-11-21
Ory adds form_post response mode to the .well-known/openid-configuration discovery endpoint
OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. discovery at .well-known/openid-configuration now advertises existing form_post support.
Enables account recovery for users who joined a B2B SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. org after creating their initial personal password account
Enables account recovery flow for users with personal passwords who later join a B2B SSO organization, even if their email domain is managed by the SSO org
ROPC grant now includes Ory Identity ID in sub claim and executes token hooks on refresh.
Adds Ory Identity ID to the sub claim for ROPC flows
Stores username in the ext.username claim when available
Executes token hooks during both initial and refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. issuance for ROPC
Ory Console now supports selecting hybrid OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. flows in client configuration.
Adds GitHub as a B2B OAuth provider with JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. provisioning and B2B sandbox test values
Enables GitHub as an official OAuth provider for B2B authentication, supporting Just-in-Time (JIT) Provisioning and Discovery.
Adds sandbox values to the B2B API, including sandbox@stytch.com email and sample organization IDs for testing in the Test environment.
JumpCloud adds manual SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. app configuration and a new Windows App Catalog with 10 apps
Adds the ability to manually add applications in SaaS ManagementSaaS ManagementA category of software that tracks, governs, and optimises an organisation's portfolio of SaaS subscriptions, covering spend, access, and licence utilisation from a single control plane. for tracking, warning, and blocking access
Introduces the JumpCloud App Catalog for Windows with auto-update support for 10 pre-configured desktop applications
Acronis Cyber Protect combines backup, disaster recovery, and endpoint protection in one platform for businesses and managed service providers.
Acronis Cyber Protect 2024-11 adds M365 monitoring, project management, Hyper-V Gen 2 support, and ConnectWise integration
└──▷ HOW TO FIND IT
Schedule a test failover for Disaster Recovery infrastructure directly from the ConnectWise Asio console
📍In the Cyber Protect console, go to Cloud Integrations › ConnectWise Asio and configure the connection. In Asio, select DR infrastructure and click Schedule Test Failover.
Monitor Microsoft 365 tenant posture using baseline templates
📍In the Cyber Protect service console, navigate to Advanced Management › Microsoft 365 Security. Select Scan to apply baseline templates and view risks on the multi-tenant dashboard.
Adds Microsoft 365 security monitoring, baseline template scanning, and multi-tenant posture management for partners via the Cyber Protect console
Introduces Advanced Automation project management with Gantt charts, time tracking, and billing options to the service console
Enables Antimalware scan of Microsoft 365 mailbox backups for customers with the Advanced Security + XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. pack
Adds default protection against Cyber Protection Agent uninstallation via maintenance period controls
Adds self-service release of quarantined spam by mailbox owner link in the Advanced Email Security options
+4 moreshow less
Generates AI-based explanations for email attacks in the Advanced Email Security options
Adds support for Hyper-V Generation 2 virtual machines for cross-platform restores and Instant Restore
Adds ConnectWise Asio integration to schedule and perform test failovers from the Asio console
Removes legacy Username/Password authentication for ConnectWise Automate integration, requiring API client instead
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The /api/ams/REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. is deprecated with one year notice; integrations using it will stop being supported after Phase 1.
!ConnectWise Automate integration no longer supports legacy Username and Password authentication; partners must use an API client.
Acronis November 2024 adds project management module, M365 anti-malware scans, agent uninstall protection and AI quarantine explanations
Adds a new Project Management module in Acronis Automation for planning projects with phases, Gantt charts, budgets and expense tracking
Extends backup scanning to Microsoft 365 by performing anti-malware scans with aggressive heuristics directly on M365 backups during recovery
Adds agent uninstallation protection to prevent ransomware from removing the security agent before execution
Introduces AI-driven explanations for quarantined emails in Acronis Email Security to clarify blocking reasons
Enables mailbox self-service spam release, allowing owners to unblock specific spam messages directly from digest reports
+1 moreshow less
Adds automated DR testing integration with ConnectWise Asio, allowing MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. to schedule and execute test failovers to Acronis Cloud
Enable read-only backupPVC mounting to accelerate Ceph-backed data mover expose, with SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root. override for environments that require it.
Adds a new repository maintenance configuration configMap to control which nodes run repository maintenance jobs, replacing hard-coded node-agent pod scheduling.
Adds a new backup PVC configuration configMap to configure read-only mounting of backupPVCs (accelerating expose for Ceph and similar storage) and storage class selection for data mover backupPods.
Adds no-relabeling option to the backup PVC configMap to run backupPod containers as super-privileged containers and disable SELinux access control for read-only PVC compatibility.
Adds a new backup repository configuration configMap supporting cacheLimit configuration for Kopia repositories to prevent pod eviction from ephemeral storage exhaustion.
Adds node-agent-configmap server parameter to make the node-agent configuration configMap name configurable instead of fixed.
+9 moreshow less
Adds --uploader-type=restic deprecation warnings when Restic path is used for fs-backup during Velero installation or backup/restore creation.
Introduces the ItemBlockAction (IBA) plugin type for categorizing correlated resources into item blocks, enabling future multi-threaded backup processing; built-in IBAs for pods and PVCs are included.
Data transfer for CSICSIAn ambiguous acronym spanning Container Storage Interface, Crime Scene Investigation, and other expansions — without more context about which domain this tool operates in, a reliable definition cannot be given. Snapshot Data Movement is moved from node-agent pods to dedicated backupPods and restorePods (data mover micro-service architecture), eliminating privileged host path access.
Propagates client-burst and client-qps Velero server parameters automatically to plugins to accelerate plugin execution under high API server load.
Adds resource modifier display to velero restore describe CLI output.
Makes PVPatchMaximumDuration timeout configurable.
Adds labels to repository maintenance job pods.
Adds the Carvel package related resources to the restore priority list.
Exposes VolumeHelper to third-party plugins.
14 details in Everything
└──▷ BREAKING ON UPGRADE
!Using --uploader-type=restic in Velero installation or creating fs-backup with the Restic path now emits deprecation warnings; Restic path support is entering the deprecation process and will be removed in a future release.
!The node-agent configuration configMap name is no longer fixed; operators must now specify the name via the node-agent-configmap node-agent server parameter or the previously assumed name will not be found.
!Repository maintenance job settings --keep-latest-maintenance-jobs, --maintenance-job-cpu-request, --maintenance-job-mem-request, --maintenance-job-cpu-limit, and --maintenance-job-mem-limit are moved to the repository maintenance job configuration configMap; if both the configMap and server parameters are set, the configMap values take precedence.
!The Changing PVC selected-node restore feature enters deprecation and will be removed in a future release; its use is no longer recommended.
Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.
inSync Client 5.9.5 adds support for Ubuntu 24.04 (64-bit) and RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence.
Updates inSync Client 5.9.5 availability for RHEL with minor infrastructure enhancements
1 detail in Everything
4 more releases in this issue
· 2024-11-14 → 2024-11-25
Druva Enterprise Workloads adds support for Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. and proxies in AWS GovCloud (US) us-gov-west-1.
Adds Nutanix AHV platform support with agent/proxy version 6.3.6-562844.
Enables deployment of Nutanix AHV proxies in AWS GovCloud (US) us-gov-west-1 region for government and non-government agencies.
Druva Enterprise Workloads adds Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. support for AWS GovCloud (US us-gov-west-1) regions
└──▷ HOW TO FIND IT
Deploy proxies in the GovCloud storage region for compliant data migration
📍Manually deploy the Nutanix AHV backup proxy using Prism Console
Druva MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. adds an isDeleted filter to its reporting APIs, allowing users to refine Last Backup Status, User Provisioning, and User Rollout reports by exclusion of deleted entities.
Enables usage of VBR location profile in FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. mode.
Kopia is an open-source backup tool for Windows, macOS, and Linux with incremental snapshots, client-side end-to-end encryption, compression, and deduplication, with both a CLI and a GUI.
Kopia v0.18.2 adds symlink support for .kopiaignore in a hotfix release restoring server client compatibility.
└──▷ GET THIS VERSION
$ git clone --branch v0.18.2 https://github.com/kopia/kopia.git
# already have the repo? check out this version:$ git checkout v0.18.2
Adds symlink support for .kopiaignore files, allowing symlinked ignore files to be respected during snapshot exclusion.
Adds a JSON marshaler helper for time.Duration values.
2 details in Everything
1 more release in this issue
· 2024-11-16 → 2024-11-21
Kopia v0.18.0 adds notification profiles, policy import/export, GCS immutability, and new server password-hashing commands.
└──▷ GET THIS VERSION
$ git clone --branch v0.18.0 https://github.com/kopia/kopia.git
# already have the repo? check out this version:$ git checkout v0.18.0
└──▷ TRY IT
Specify the password-hashing algorithm when adding a new server user, e.g. to enforce a stronger KDF.
$ kopia server user add alice@myhost --user-password-hashing-algorithm=scrypt
Adds server user set-password-hash command to set pre-hashed passwords for server users.
Adds user add set user-password-hashing-algorithm CLI option to control the hashing algorithm used for user passwords.
Adds policy import/export commands to serialize and deserialize policies from/to JSON.
Adds support for defining notification profiles and templates via CLI to alert on errors and send snapshot reports.
Adds per-directory splitter overrides in policies.
+10 moreshow less
Adds metadata compression config support for directory and indirect content in policies.
Adds cache hard limits flags.
Adds GCS immutability support for the Google Cloud Storage provider.
Adds key derivation algorithm selection for cache encryption.
Adds allow setting key derivation algorithm for format blob option.
Adds API to manipulate notification profiles (not yet surfaced in UI).
Adds B2 S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. endpoint information to the B2 provider.
Supports epoch maintenance in quick maintenance runs, improving large-repository maintenance.
Allows extending blob retentions.
Introduces adaptive estimation mechanism for snapshot/restore progress reporting.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!Support for the HTTP-based repository API has been removed; clients relying on it must migrate to the gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication.-based API.
STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against.-hardened images now enforce 60-day password expiration; recovery requires redeployment if the password expires without being disabled.
26 more releases in this issue
· 2024-11-01 → 2024-11-26
ZPA PRA Portal adds per-session keyboard layout, resolution, quality, and timezone configuration.
Adds Settings dialog in the Privileged Remote Access (PRA) Portal to configure keyboard language, display resolution (default Fit to Bounds), display quality (High for Windows), and time zone for assigned privileged consoles
Adds a collapsible post-login menu on privileged consoles showing favicon, console name, Recording/Participants/Keyboard/Full Screen/Copy/Clipboard icons, session duration, and an End option to terminate the live session
ZIA adds extensive Cloud Service API endpoints for policy management and EUNs; Gen AI support in Data at Rest Scanning.
Adds traceId field to the /auditlogEntryReport endpoint's AuditLogEntryRequest model and Audit Logs UI
Adds GET /eun and PUT /eun endpoints for managing end-user notifications configuration
Adds programmatic access endpoints for Malware Protection, ATP, File Type Control, Sandbox, URL Filtering, DNS/IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, Cloud Apps, Proxy Gateways, Auth Settings, NSS Feeds, Organization details, Remote Assistance, and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection
Specifically adds CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. endpoints for firewall rules: GET|POST|PUT|DELETE /firewallDnsRules and GET|POST|PUT|DELETE /firewallIpsRules
Specifically adds CRUD endpoints for file type rules: GET|GET /lite|POST|GET/{ruleId}|PUT/{ruleId}|DELETE /fileTypeRules variants
+9 moreshow less
Specifically adds CRUD endpoints for sandbox rules: GET|POST|PUT|DELETE /sandboxRules variants
Adds endpoint group for SSL Inspection rules: GET|POST|PUT|DELETE /sslInspectionRules variants
Adds NSS Feed management endpoints including validation and connectivity testing: GET|POST|PUT|DELETE /nssFeeds, /feedOutputDefaults, /testConnectivity/{feedId}, /validateFeedFormat
Adds organization and subscription info endpoints: GET /orgInformation, /orgInformation/lite, GET /subscriptions
Adds proxy gateway info endpoints: GET /proxyGateways, /proxyGateways/lite
Adds authentication settings endpoints: GET /authSettings, /authSettings/lite, PUT /authSettings
ZIA adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. info to Remediation tab, CSA STAR to Compliance tab in Advanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications., and GitHub tenant profiles
Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. tactic and technique information to the Remediation tab in Advanced SSPM's Control Panel
Adds CSA STAR compliance framework to the Compliance tab in Advanced SSPM's Control Panel
Extends Tenant Profiles support to the GitHub application for specifying enterprise slugs
ZIA adds GitHub Tenant Profile support and a custom Box connector for granular SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. access.
Extends Tenant Profiles to the GitHub application to provide access to specific enterprise slugs
Adds Box Custom Connector support in Administration > SaaS Application Tenants to configure private key JSON files
ZPA PRA Portal adds keyboard language, display, and timezone settings for privileged consoles
Adds keyboard language, display resolution, display quality, and time zone options in the PRA Portal Settings icon to control privileged console properties
Adds a collapsible session menu in the Privileged Console with favicon, name, recording, participants, keyboard, full screen, copy, clipboard icons and an End option to terminate the live session
ZIA release includes updated Executive Insights Mobile App and new Box SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. integration.
Zscaler Workflow Automation adds resume/retry for CSV imports and improved Property dropdown UI
Adds Resume icon on User Attributes page to restart partial CSV user attribute imports
Adds Retry icon on User Attributes page to restart failed CSV user attribute imports (max 3 attempts)
Introduces email notifications for CSV import completion, partial completion, and failure statuses
Redesigns Property drop-down menu in Workflow, Incident Group, and Event Group Mappings with hierarchy lines, shortened alphabetical names, and frozen header
ZIA adds DICOMDICOMAn open standard for storing and transmitting medical imaging data, maintained by NEMA, that defines both the file format and network protocol used to exchange scans between clinical systems.DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. inspection, GCP NSS support, new DNS record types, and expanded EDM formats.
Adds %s{edevicehostname} field in NSS/Cloud NSS feeds for Web, Firewall, DNS, and Endpoint DLP logs to output hex-encoded device hostnames
Adds %s{app_status} field in NSS/Cloud NSS feeds for web logs to include application status
Adds SVCB-compatible type filter option in DNS Logs to match HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. record type transactions
Updates WebDlpRule model in /webDlpRules endpoints with FTCATEGORY_JSON, FTCATEGORY_XML, FTCATEGORY_HTTP, and FTCATEGORY_UNK_TXT file types for the fileTypes attribute
Adds support for CSYNC, HTTPS, SVCB, and ZONEMD DNS record types in DNS Control policy criteria
+17 moreshow less
Adds new failure behavior to DNS Gateways to forward requests to Zscaler Trusted DNS Resolver over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. or UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. when the service is unavailable
Expands DLP Exact Data Match (EDM) popular format checks with support for ABA Bank Routing, Aadhaar, CPF, and other international identifiers
Enables text extraction and inspection for DICOM files in DLP policies
Adds Open Office Presentation (.odp, .otp) and Spreadsheet (.ods, .ots) file type support to DLP policies
Expands File Type Control and DLP support to include Outlook Mac (.olm), Publisher (.pub), TNEF (.tnef), OST, PST, LZH, CPIO, Binhex, QuarkXPress, AutoCAD, EXE, DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls., ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code., and Domino Database files
Enables deployment of NSS virtual machine on Google Cloud Platform (GCP)
Adds Advanced SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications.) scan capability for Box, Dropbox, and GitLab tenants via the SSPM Scan checkbox during onboarding
Adds Gen AI as a new SaaS application category for Data at Rest Scanning DLP and Malware Detection policies, including ChatGPT support
Adds Exceptions page for Collaboration applications under Policy > SaaS Security > Data at Rest Scanning to bypass DLP content inspection for specific users/groups/departments
Allows admin scope editing for other admins in Authentication Service-enabled tenants via Administration > Administrator Management > Administrators
Adds support for Client ID, Client Secret, and Tenant ID configuration in Custom SaaS Connectors for Microsoft SharePoint onboarding
Enables specification of file extension (e.g., GZIP) for log data stored in Amazon S3 buckets via Cloud NSS integration
Updates Incident Receiver JSON metadata for Endpoint DLP with the department field
Updates Incident Receiver JSON metadata for Inline Web DLP with referrerUrl and department fields
Updates Incident Receiver JSON metadata for Saas Security DLP with fileModification, collaborationScope, department, numberOfCollaborators, numberOfExternalCollaborators, numberOfRecipients, numberOfExternalRecipients, filePath, fileSize, fileType, documentType, and dlpMD5 fields
Adds Application Status filter and column to Web Insights Logs
Adds ability to enable End User Notifications for ATP blocks via Show Notification for ATP Blocks under Policy > SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection
Risk360 adds Threat Category, Name, URL details to asset risk events and CSV export.
Adds Threat Category, Threat Name, URL Category, and URL Name columns to the Events Contributing to Risk Score for Last 7 Days section in the Asset Details UI
Enables exporting all events contributing to risk score changes directly as a CSV file via the Asset Details page
ZIA adds support for Box Custom Connector using private key JSON and expands File Type Control DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. coverage to new formats.
Expands File Type Control and DLP policies to support Microsoft Outlook Mac Data (.olm), Publisher (.pub), TNEF (.tnef), LZH/CPIO archives, Binhex (.hqx), QuarkXPress (.qxd/.qxp), AutoCAD (.dxf/.dwg), and Domino Server Database (.dxl) file types.
Client Connector 3.7.1 adds TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake. 2.0 support, RPM package management, Maya OS compatibility, and self-signed RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. certs for Linux.
Adds Trusted Platform Module (TPM) version 2.0 support
Adds RPM Package Manager to install, update, and remove software packages
Supports Maya OS platform
Supports a self-signed certificate to verify signatures for the RPC protocol
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Upgrades to Linux 3.7.1 must be done with a fresh install for versions of Linux 1.5.0 and earlier.
ZIA adds Gen AI DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. scanning, PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file management API, GCP NSS support, DICOMDICOMAn open standard for storing and transmitting medical imaging data, maintained by NEMA, that defines both the file format and network protocol used to exchange scans between clinical systems. DLP extraction, and Standard Firewall DNS insights.
Adds Gen AI as a new SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application category for Data at Rest Scanning DLP and Malware Detection policies.
Introduces Cloud Service API endpoints (GET /pacFiles, POST /pacFiles, POST /pacFiles/validate, POST /pacFiles/{pacId}/version/{clonedPacVersion}, GET /pacFiles/{pacId}/version, GET /pacFiles/{pacId}/version/{pacVersion}, DELETE /pacFiles/{pacId}) to manage Zscaler-hosted PAC files.
Enables configuration of the SSPM Scan checkbox when onboarding Box, Dropbox, and GitLab tenants for Advanced SaaS Security Posture Management.
Adds support for DNS Gateway failure behavior to forward requests to Zscaler Trusted DNS Resolver over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. or UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery..
Adds new DNS record types (CSYNC, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate., SVCB, ZONEMD) to DNS Control policy criteria and a SVCB-compatible type filter in DNS Logs.
+13 moreshow less
Expands DLP File Type support for DICOM files with text extraction of sensitive patient and provider fields.
Adds NSS Feeds support for Google Cloud Platform deployment of the NSS virtual machine.
Adds %s{edevicehostname} field to NSS/Cloud NSS feeds for Web, Firewall, DNS, and Endpoint DLP logs to output hex-encoded device hostname.
Adds Application Status filter and column to Web Insights Logs and %s{app_status} field to NSS Feeds for web logs.
Allows configuration of Custom SaaS Connector using Client ID, Client Secret, and Tenant ID (in addition to private key JSON) when onboarding Microsoft SharePoint tenants.
Adds ABA Bank Routing Numbers, Austria Social Security Number (ATSSN), Brazil CNPJ, India Aadhaar Card Number, UK National Insurance Number (NINO), and other popular formats as configurable checks in DLP Exact Data Match (EDM).
Enables specification of file extension (e.g., GZIP) for log data stored in configured Amazon S3 buckets via Cloud NSS integration.
Adds File Type Control and DLP support for new file types: .olm, .pub, .tnef, .ost, .pst, .lha, .cpio, .odp, .ods, .hqx, .qxd/.qxp, .dxf, .dwg, .exe, .dll, .elf, .dxl.
Adds File Type Control and DLP support for JSON (.json), XML (.xml), and text files with unknown extensions via FTCATEGORY_JSON, FTCATEGORY_XML, FTCATEGORY_HTTP, FTCATEGORY_UNK_TXT in the /webDlpRules API.
Allows Standard Firewall users to view DNS dashboards, insights, and logs within the ZIA Admin Portal.
Enables admin editing of other admins' scopes for Authentication Service-enabled tenants via Administration > Administrator Management > Administrators.
Adds Exceptions page under Policy > SaaS Security > Data at Rest Scanning for Collaboration applications to bypass content inspection for specific users/groups.
Updates UI labels in ZIA Admin Portal for Advanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. (e.g., SaaS Security API to SaaS Security, 3rd Party Applications to 3rd-Party App Governance).
Zscaler Client Connector for VDIVDIVirtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. now supports granular IP address protocol ranges in forwarding profiles
Enables granularity in inclusion and exclusion policies by allowing you to enter an IP address:port range or an IP address protocol range.
ZIA adds Box custom SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connector support and DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. trigger context in notifications.
Adds private key JSON configuration for Box SaaS Application Tenants to grant minimal permissions instead of full administrator privileges
Adds 15-byte prefix and suffix context to DLP triggers in Incident Receiver, Zscaler Workflow Automation, and Email Notifications
Zscaler Workflow Automation adds CSV user attribute imports, new AWS DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. parameters, and incident detail enhancements.
Adds a User Attributes page in the Admin Portal to import end user attributes via CSV file
Adds Primary User Data Source (SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. or CSV) and Unique Identifier options to Account Settings for fetching user attributes
Adds an Additional Information section to the Incident Details page to display end user, manager, and address data from the primary source
Expands Property lists on Incident Group Mapping and Workflow Mapping pages with userInfo, managerInfo, and userInfo.Skip Level Managers properties
Adds support for creating AWS DLP integration resources via a CloudFormation stack template
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds malware detection policies, region-scoped onboarding, EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. scan caching, and investigation predicates.
Adds Malware Predicates (Malware Name, Malware Category, Detection Accuracy Level) to investigation queries for checking resource presence of malware
Adds Resource Property Predicate using the And operator to check multiple attributes in a metadata array
Adds new AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. role resource types: IAM Role, IAM Unmanaged Role, and IAM External Role as queryable resource types
Adds support for Predefined Lists of regions and vulnerabilities in policy predicates
Enables specifying monitored regions during cloud account onboarding to limit scanner instance deployment and role creation
+3 moreshow less
Enhances dashboard with Risk and Data Discovery tabs, including Risk Score trend chart
Updates data inventory table layout for focused object viewing
Adds new data posture policies for AWS (S3, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware.), Azure (VM, Storage, SQL, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.), and GCP (Storage Bucket)
ZIA adds DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. trigger context, GCP NSS support, DICOMDICOMAn open standard for storing and transmitting medical imaging data, maintained by NEMA, that defines both the file format and network protocol used to exchange scans between clinical systems./DLP file types, Advanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. for Box/Dropbox/GitLab, PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file APIs, and DNS TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. fallback.
Adds %s{edevicehostname} field to NSS/Cloud NSS feeds (Web, Firewall, DNS, Endpoint DLP) for hex-encoded device hostnames
Adds NSS support for Google Cloud Platform (GCP) deployment
Adds Application Status filter and column to Web Insights Logs in the ZIA Admin Portal
Adds %s{app_status} field to NSS Feeds for web logs
Adds SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) Advanced Scan support for Box, Dropbox, and GitLab tenants via onboarding checkbox
+8 moreshow less
Expands DLP Exact Data Match (EDM) Popular Format Check with new supported data types including international tax IDs, passport numbers, and credit cards
Adds new file type support for DLP/FTC: .olm, .pub, .tnef, .ost, .pst, .lha, .cpio, .odp, .ods, .hqx, .qxd, .qxp, .dxf, .dwg, .exe, .dll, .elf, .dxl, .otp, .ots, and DICOM with text extraction
Adds new endpoints to the Cloud Service API for Zscaler-hosted PAC files: GET /pacFiles, POST /pacFiles, POST /pacFiles/validate, POST /pacFiles/{pacId}/version/{clonedPacVersion}, GET /pacFiles/{pacId}/version, GET /pacFiles/{pacId}/version/{pacVersion}, DELETE /pacFiles/{pacId}
Adds new file types to the fileTypes attribute in WebDlpRule model via /webDlpRules endpoints: FTCATEGORY_JSON, FTCATEGORY_XML, FTCATEGORY_HTTP, FTCATEGORY_UNK_TXT
Enables DNS Gateway to forward requests to Zscaler Trusted DNS Resolver over TCP or UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. when the configured DNS service is unavailable or unhealthy
Adds CSYNC, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate., SVCB, and ZONEMD record types to DNS Control policy criteria and a new SVCB-compatible filter option in DNS Logs
Adds Web Insights Isolation Policy Reason filter and Policy Reason widget in Browser Isolation Consumption Reports
Enables admin scope editing for Authentication Service-enabled tenants via Administration > Administrator Management > Administrators page
Private Access introduces Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. rule action to replace Require Approval for privileged access
Cloud & Branch Connector adds IP protocol granularity to VDIVDIVirtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. forwarding inclusion and exclusion policies
Enables entry of an IP address:port range or IP address:port:protocol range in VDI forwarding inclusion and exclusion policies
Netskope 121.0.7 adds HTTP GET auth, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. non-web blocking on macOS, and GSLB fallback in China
GET Method Authentication Support added to allow IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. enrollments to bypass Safari's redundant WebAuth.html dialog
Protect Client configuration and resources enabled as the default option in Client Configuration for new tenants
Block IPv6 non-web traffic in Cloud Firewall mode now supported on macOS (previously Windows only)
3 details in Everything
2 more releases in this issue
· 2024-11-04 → 2024-11-20
Netskope Cloud Exchange 5.1.0 introduces CRE V2 unified risk exchange, Docker Compose support, and Quorum queue migration.
Adds Docker-Compose support for deployment with strict CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed./disk profile checks (medium or large) on RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 8/9 and Ubuntu 20.04/22.04
Introduces CRE V2 unifying URE and ARE modules with Schema Editor, Records page, Actions page, and calculated fields for risk scores
Adds Action to update UCI scores and allows sending user risk updates to Okta when Netskope score bucket classification changes
Adds Tag Application action in CRE V2 allowing users to tag applications on Netskope with support for List type fields for filtering
Adds initial_range parameter support in CLS, CTE, CTO, and CRE plugins to control historical data fetching (0 disables pulling)
+5 moreshow less
Adds UTF-8 encoding switch in Log shipper settings page for CLS data export to resolve invalid character issues
Adds IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. retraction functionality in CTE with configurable retraction interval, source labeling, and button to mark indicators as retracted
Adds CTO support for Endpoint and Incidents events with updated queue configuration validation and autocomplete features
Adds tenant configuration via Tenant plugin instead of Settings > Tenants > Add Tenant, moving alert configs to individual plugins
Updates SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. to support password-less authentication methods like Push notification and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for Netskope tenants
10 details in Everything
└──▷ BREAKING ON UPGRADE
!RabbitMQ data migration from Classic queue to Quorum queue is not supported; users must reconfigure or migrate data manually
!Deprecated v1 API usages (like /api/v1/alerts) and SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. v1 api usage are removed
Netskope v121 adds Cloud TAP GA, Multi-IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Browser Access, Swagger API v2 for Quarantine/Legal Hold, and Okta SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. API Token auth
Cloud TAP is now Generally Available, capturing traffic from managed endpoints/branch offices to customer AWS, Azure, or GCP object stores with session keys for decryption.
Netskope Private Access (NPA) Browser Access supports multiple SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. IdPs (up to 10) for domain-based authentication selection.
Quarantine and Legal Hold actions are now available via REST API v2 endpoints for Next Generation API Data Protection.
Cloud Explicit Proxy HTTPS is a new Beta steering method available via API that encapsulates HTTP Proxy flow into a TLS tunnel.
x-c-timezone field added to Transaction Event Format 4 to display GMT offsets during GEOinfo and policy evaluation.
+2 moreshow less
Okta SSPM integration now uses API Token authentication instead of OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs., eliminating the 90-day refresh requirement.
Netskope URL Lookup API allows retrieving categorization for one or multiple URLs including custom categories and list matches.
Bytebase 3.1.0 adds PostgreSQL role selection, SQL Review Rules, SQL permission refactoring, and environment color customization.
└──▷ GET THIS VERSION
$ git clone --branch 3.1.0 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.1.0
bb.sql.select, bb.sql.dml, bb.sql.ddl, bb.sql.explain, bb.sql.info, bb.sql.export, and bb.sql.admin permissions replace the old bb.databases.* permission keys for SQL Editor access control.
roles/projectQuerier role renamed to roles/sqlEditorUser
Support PostgreSQL role selection in DDL/DML issues, defaulting to instance connection user unless database tenant mode is on.
PostgreSQL database tenant mode option added to project settings to manage multitenancy for PostgreSQL databases.
New SQL Review Rules available for MySQL: Prohibit DDL on specific tables and Prohibit DML on specific tables.
+1 moreshow less
Ability to set custom colors for environments to improve visual distinction in the UI.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Permission key bb.databases.query is renamed to bb.sql.select
!Permission key bb.databases.queryDML is renamed to bb.sql.dml
!Permission key bb.databases.queryDDL is renamed to bb.sql.ddl
!Permission key bb.databases.queryExplain is renamed to bb.sql.explain
!Permission key bb.databases.queryInfo is renamed to bb.sql.info
!Permission key bb.databases.export is renamed to bb.sql.export
!Permission key bb.instances.adminExecute is renamed to bb.sql.admin
!Role roles/projectQuerier is renamed to roles/sqlEditorUser
!The database field of sheet in SheetService API is removed
1 more release in this issue
· 2024-11-07 → 2024-11-21
Bytebase 3.0.1 adds environment policies for DDL/DML execution, BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. data masking, and SQL review upsert API
└──▷ GET THIS VERSION
$ git clone --branch 3.0.1 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.0.1
└──▷ TRY IT
Upsert a SQL review configuration using the new PATCH endpoint.
SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications. rule now evaluates risk by usage context (RNG, HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it., signature) rather than uniform severity.
└──▷ HOW TO FIND IT
Verify how AQtive Guard now classifies SHA-1 usage in your codebase to distinguish between risky signatures and safer RNG/HMAC patterns.
📍In the console, navigate to the Java application analysis view and check the SHA-1 rule results for updated severity ratings.
Modifies SHA-1 rule severity logic to evaluate context, changing ratings from static Medium to Pass for RNG, Low for HMAC, High for digital signatures, and Medium for other uses.
Teleport v17.0.2 adds SSH session text search, Bitbucket Pipelines joining, and GitHub JWKSJWKSA JSON Web Key Set, a published collection of cryptographic keys. Applications use it to find the public key needed to verify a token's signature. config
└──▷ GET THIS VERSION
$ git clone --branch v17.0.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.0.2
└──▷ HOW TO FIND IT
Search the text output of a live SSH session for specific commands or errors in the Web UI.
📍Use the search box in the Teleport Web UI during an active SSH session.
Support delegated joining for Bitbucket Pipelines in Machine ID
You can now search text within SSH sessions in the Web UI and Teleport Connect
Added support for directly configuring JWKS for GitHub joining
3 details in Everything
4 more releases in this issue
· 2024-11-12 → 2024-11-25
Adds Azure subscription-agnostic VM joining, GHES JWKSJWKSA JSON Web Key Set, a published collection of cryptographic keys. Applications use it to find the public key needed to verify a token's signature. config, web terminal image protocols, and proxy peering health checks.
└──▷ GET THIS VERSION
$ git clone --branch v16.4.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.4.8
Allow Azure VMs to join from a different subscription than their managed identity
Added support for directly configuring JWKS for GitHub joining for circumstances where the GHES is not reachable by the Teleport Auth Service
The web terminal now supports SIXEL and IIP image protocols
Added periodic health checks between proxies in proxy peering
Teleport v17.0.1 adds AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. IC integration, nested access lists, dynamic Windows desktop registration, and tbot start CLI commands.
└──▷ GET THIS VERSION
$ git clone --branch v17.0.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.0.1
└──▷ TRY IT
List existing bot instances to inspect onboarding status
$ tctl bots instances list
Adds tbot start <mode> family of subcommands to launch services directly from the command line
Adds tctl bots instances add and tctl bots instances list subcommands for bot instance management
Adds AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Identity Center integration to sync group members via Access Lists
Adds dynamic registration capability for Windows desktops without static config file updates
Enables nested access lists where an access list can be a member of another access list
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The teleport.pkg macOS installer no longer includes a separate tsh.pkg; tsh.app is now bundled inside teleport.pkg
!Hostnames are now strictly validated (<=257 chars, alphanumeric + .-); invalid hostnames are replaced with UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. and stored in teleport.internal/invalid-hostname label
Adds resolve subcommand to tsh, -- delimiter support for tsh ssh, and TBOT_USE_PROXY_ADDR env var
└──▷ GET THIS VERSION
$ git clone --branch v15.4.22 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v15.4.22
Adds a resolve command to tsh that may be used as the target for a Match exec condition in an SSH config
Updated tsh ssh to support the -- delimiter similar to openssh. It is now possible to execute a command via tsh ssh user@host -- echo test or tsh ssh -- host uptime
Postgres database session start events now include the Postgres backend PID for the session
Added a search input to the cluster dropdown in the Web UI when there's more than five clusters to show
Limit an access role so that approved requests can only create or modify Pod and Service resources, not namespaces or nodes.
yaml
role:
allow:
request:
kubernetes_resources:
- kind: Pod
- kind: Service
Adds a resolve subcommand to tsh for use as the target of Match exec conditions in SSH config
Defines a new kubernetes_resources field under role.allow.request to restrict what kinds of Kubernetes resources a requester can create or modify during access requests
pkcs11-tool gains EdDSAEdDSAA fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe., AES GCM/CMAC, RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. OAEP, HKDF; minidriver supports PinCacheAlwaysPrompt
└──▷ GET THIS VERSION
$ git clone --branch 0.26.0 https://github.com/opensc/opensc.git
# already have the repo? check out this version:$ git checkout 0.26.0
pkcs11-tool lifts the previous 5000-byte object size limit, enabling use of larger keys and certificates
pkcs11-tool implements improved key wrapping and unwrapping capabilities for enhanced portability
minidriver adds PinCacheAlwaysPrompt support for PIV cards, allowing explicit PIN prompts in cached environments
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Belpic Applet V1.8 is disabled by default, potentially affecting workflows relying on that specific applet version
Drata adds nested custom formulas, background check integrity logging, KnowBe4 framework filtering, and IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. test run notifications
Adds the ability to build upon previously created custom formulas for dynamic calculations
Logs and enforces manual unlinking of background check records across all associated records
Hides AI or HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. training options in KnowBe4 connection drawer if those frameworks are not activated
Drata adds ClickUp ticketing integration, Azure Management Groups Adaptive Automation, and vendor questionnaire flexibility
Adds ClickUp as a new ticketing connection, supporting all object types including Teams, Spaces, Folders, Lists, Ticket Types, Assignees, and Custom Fields.
Enables Adaptive Automation for Azure Management Groups, allowing users to create custom tests tailored to specific compliance requirements after establishing the connection.
Adds flexibility in vendor questionnaires to mark individual questions as required or all questions as required with a single click.
Updates AI response format in Questionnaire UI for better readability and provides more detailed data in responses.
Drata adds full-page AWS connection wizard, automatic test runs for key connectors, DCF mappings in Risk Library, and GitHub Rulesets support
Adds a dedicated full-page setup experience for AWS and AWS Organizational Units connections with upfront permission/resource display and troubleshooting guidance.
Enables automatic test runs upon successful connection establishment for Identity, Infrastructure, Version Control, and Ticketing connections.
Makes DCF control mappings available in the Risk Library for Risk Assessment customers to reference during risk assessment workflows.
Adds support for GitHub Organizational and Repository Rulesets with READ access only.
Drata adds Closed risk status, MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. auto-unlink, AI test failure summaries, and 38 new AWS tests
Adds Closed as a new status option for Risks alongside Active and Archived
Enables automatic device unlinking from personnel in Drata when devices are unlinked or deleted in supported MDM systems (excluding Workspace One)
Adds AI Adaptive Automation Test Summaries providing diagnostic insights for monitoring failures, downloadable via the Monitoring UI
Adds 38 new AWS tests automating over 15 controls focused on CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmarks
Adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. v8.1 framework support to Scrut Automation for compliance mapping
Adds the CIS v8.1 benchmarking framework as a new supported compliance option in the platform.
1 detail in Everything
1 more release in this issue
· 2024-11-12 → 2024-11-13
CISO Assistant v1.9.17 adds ref IDs to risk scenarios and editable objects, persistent URL filters, toast license notifications, clickable metrics, EBIOS RMEBIOS RMA French risk-management method published by ANSSI for analysing cyber threats and selecting countermeasures; tools use it to structure risk assessments that satisfy French and EU regulatory expectations. support, Huey background tasks, and mapping inference improvements.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.17 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.17
Adds a ref_id field to Risk Scenario objects (PR #1078)
Adds a ref_id field to all editable objects in the data model (PR #1044)
Adds a labels field on Assets and fixes asset creation via forms (PR #1094)
Adds persistent URL parameters for applied filters so they survive refreshes (PR #1074)
Adds an EBIOS RM matrix visualization (PR #1098)
+5 moreshow less
Enables Huey background task worker support (PR #1088)
Improves mapping inference with additional information (PR #1070)
Adds a toast notification on login when the license is nearing expiration (PR #981)
Makes metrics clickable in the UI (PR #1093)
Excludes third-party users from editors count (PR #1100)
10 details in Everything
7 more releases in this issue
· 2024-11-04 → 2024-11-29
CISO Assistant v1.9.15 adds disk usage tracking, priority to applied controls, and security objective enrichment for assets
└──▷ GET THIS VERSION
$ git clone --branch v1.9.15 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.15
priority field added to Applied controls model
Assets enriched to support security_objectives, rto, and mtd attributes
Disk usage metrics now tracked in monitoring
3 details in Everything
└──▷ BREAKING ON UPGRADE
!maturity field removed from model (useless field)
CISO Assistant v1.9.14 adds asset ownership tracking, disk usage metrics, and document management.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.14 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.14
└──▷ HOW TO FIND IT
When/why you'd use this — the value or use case.
📍In the Assets view, open an asset's details and enter owner information in the Owner(s) field.
Monitor system health via the new disk usage reporting feature.
📍Check the dashboard or system status section for disk usage metrics.
Adds ability to remove custom logos/favicons and fixes SVG logo handling in CISO Assistant v1.9.13
└──▷ GET THIS VERSION
$ git clone --branch v1.9.13 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.13
Make it possible to remove custom logo or favicon.
Adds provider filtering for threats in CISO Assistant v1.9.10
└──▷ GET THIS VERSION
$ git clone --branch v1.9.10 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.10
└──▷ HOW TO FIND IT
Filter threats by a specific provider in the UI or API
📍In the console, go to Threats and use the provider filter field.
Adds stacked bars for audits analytics and distinct querysets for my-assignments.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.9 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.9
distinct queryset optimization for my-assignments ensures each assignment appears only once
CISO Assistant v1.9.8 adds TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip.-based MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. and a new My Assignments page with Flash mode keyboard shortcut.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.8 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.8
Adds TOTP (Time-based One-Time Password) support for multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone..
Adds a My Assignments page giving users a dedicated view of their assigned tasks.
CISO Assistant v1.9.7 adds RNSI ALGERIE 2020 compliance, new mapping integrations, and API improvements
└──▷ GET THIS VERSION
$ git clone --branch v1.9.7 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.7
Adds RNSI ALGERIE 2020 as a supported compliance framework for cyber tooling assessments.
Introduces ISO 27001 <--> SecNumCloud correspondences to enable mapping between these frameworks.
Updates the MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage to version 16, enhancing threat modeling capabilities.
Provides a new API endpoint to retrieve requirements per compliance assessment for programmatic access.
Giskard tests and evaluates LLM applications for performance, bias, and security issues.
Giskard v2.16.0 adds LiteLLM support and a security policy
└──▷ GET THIS VERSION
$ git clone --branch v2.16.0 https://github.com/Giskard-AI/giskard-oss.git
# already have the repo? check out this version:$ git checkout v2.16.0
Adds LiteLLM provider support to allow routing model requests through LiteLLM gateways
Adds a default security_policy mechanism for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. evaluation workflows
Editor Plugins: Added a plugin interface allowing third-party extensions to interact with the Markdown editor, including a new renderMarkup command for converting MD/HTML to HTML output.
Added Overwrite Mode toggle in the Markdown editor settings, enabling cursor-based text replacement instead of insertion.
Added Disable Markup Autocompletion setting to stop automatic formatting triggers like bold/italic syntax while typing.
3 details in Everything
1 more release in this issue
· 2024-11-05 → 2024-11-10
Adds --resolve option to override DNS resolution with a specific IP address.
Adds --no-sessionid to disable TLS session ID resumption, forcing a full handshake.
Adds --tls-srp and --tls-srp-username flags to configure TLS-SRP authentication parameters.
Adds --tls-use-sha256 to enforce SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. in TLS 1.3 key derivation.
Cloudflare CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. now connects AWS compute accounts to scan S3 buckets for sensitive data without egress fees
Adds Cloud & SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. findings > Integrations path in Cloudflare One to connect a new AWS compute account for Data Loss Prevention scanning.
Cloudflare adds cache sharding via custom cache keys using accept, referer, and user-agent headers.
Adds support for accept* headers (including accept, accept-encoding, accept-language) in custom cache keys to serve distinct cached versions based on content negotiation
Adds referer header value to custom cache keys to cache content differently based on the referring page or site
Adds user-agent header value to custom cache keys to maintain separate caches for different browsers, devices, or bots
THE CYBER TOOLCHAIN