The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
Cariddi v1.3.5 adds Alibaba OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. bucket detection and updates BurpSuite integration
└──▷ GET THIS VERSION
$ git clone --branch v1.3.5 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:$ git checkout v1.3.5
feat: add Alibaba OSS bucket detection enables scanning for Alibaba Cloud Object Storage Service buckets
Updates the BurpSuite integration to improve compatibility with recent Burp versions
netscanner v0.5.2 adds automatic export of discovery logs and packet capturespacket capturesA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. to ~/.netscanner/* with timestamped filenames
└──▷ GET THIS VERSION
$ git clone --branch v0.5.2 https://github.com/Chleba/netscanner.git
# already have the repo? check out this version:$ git checkout v0.5.2
Adds auto-export of discovered clients, scanned opened ports, and packet logs to the user's home directory at ~/.netscanner/*
Exports data have timestamps in their file names for chronological identification
ldeep 1.0.59 adds LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. channel binding, recursive primary group enumeration, and low-priv PSO enumeration
└──▷ GET THIS VERSION
$ git clone --branch 1.0.59 https://github.com/franc-pentest/ldeep.git
# already have the repo? check out this version:$ git checkout 1.0.59
└──▷ TRY IT
Connect to an LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. server with channel binding and signing enabled for stronger security.
SharpHound v2.5.1 adds ECA RoleSeparation collection and a revamped LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. connection algorithm for improved stability.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.1 https://github.com/SpecterOps/SharpHound.git
# already have the repo? check out this version:$ git checkout v2.5.1
Collects ECA RoleSeparation data, expanding AD CS enumeration coverage.
Revamped LDAP connection algorithm with improved stability and automatic fallbacks.
$ git clone --branch 5.11.0 https://github.com/BC-SECURITY/Empire.git
# already have the repo? check out this version:$ git checkout 5.11.0
Adds Invoke-BSOD module to trigger blue screen of death scenarios for testing.
Adds ticketdumper IronPython module for credential extraction via KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. tickets.
Adds ThreadlessInject module for in-memory code injection without writing to disk.
Adds threaded job execution for PowerShell tasks using AppDomains to improve concurrency and reliability.
Adds detailed job tracking for all tasks within the Sharpire system instead of only tracking jobs.
BloodHound v5.12.0 enforces unique Asset Group name tags and adds group shortcutting for SyncLAPSPassword post-processing.
└──▷ GET THIS VERSION
$ git clone --branch v5.12.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v5.12.0
Enforces uniqueness of Asset Group name tags, preventing duplicate AG names across the environment.
Adds group shortcutting to SyncLAPSPassword post-processing, expanding attack-path coverage for LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet.-related edges.
Adds entity query responses and bh-graph models to the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. specification, broadening API documentation coverage.
dploot 3.0.0 adds local triage, Token Broker Cache looting, DPAPIDPAPIA Windows OS cryptographic API that encrypts and decrypts secrets tied to a user or machine identity, so applications can store credentials without managing raw keys themselves. blob decryption, and hashcat/JtR-compatible masterkey hash dumping.
└──▷ GET THIS VERSION
$ git clone --branch 3.0.0 https://github.com/zblurx/dploot.git
# already have the repo? check out this version:$ git checkout 3.0.0
└──▷ TRY IT
Loot Token Broker Cache (WAM) tokens from a remote Windows host to harvest OAuth/Azure tokens.
Flipper Zero Unleashed Firmware, an unlocked alternative firmware.
Unleashed Firmware unlshd-076 adds Novoferm SubGHz support, NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. EMV transaction display, and CCID worker improvements.
└──▷ GET THIS VERSION
$ git clone --branch unlshd-076 https://github.com/DarkFlippers/unleashed-firmware.git
# already have the repo? check out this version:$ git checkout unlshd-076
Adds full support for Novoferm remotes in the SubGHz module
Enables DEZ 8 display form for EM4100 LF RFID cards
Allows choosing RSSI threshold in SubGHz Hopping mode
Implements NFC EMV transaction visibility controls and reduces nesting
A portable multi-tool for pentesters and geeks; this is its official firmware.
Flipper Zero 0.104.0 adds Novoferm Sub-GHzSub-GHzRadio frequencies below 1 GHz (typically 300–900 MHz) used by IoT devices, key fobs, garage doors, and industrial sensors; cyber tools target this band to capture, replay, or analyze those wireless signals. decoding, Ultralight C auth, mf_classic API, and uFBt ARGS
└──▷ GET THIS VERSION
$ git clone --branch 0.104.0 https://github.com/flipperdevices/flipperzero-firmware.git
# already have the repo? check out this version:$ git checkout 0.104.0
Adds Novoferm remote decode support to the Sub-GHz protocol decoder.
Adds mf_classic_set_sector_trailer_read function to the NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. MFC API for controlled sector trailer reads.
Adds Ultralight C authorization support using a DES key for NFC card emulation/authentication.
Adds ARGS argument parsing support in uFBt CLI tools via the command line parser extension.
Enables closing apps from CLI if they support signals (all ViewDispatcher/EventLoop based apps now closed before new start).
Feature-rich, stable and customizable Flipper Zero firmware.
Momentum Firmware mntm-005 adds Legrand, Novoferm, Hormann protocols; NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. Felica emulation and writing; JS GPIOGPIOGeneral-Purpose Input/Output pins on a microcontroller or SoC that firmware can individually control as digital signals, letting cyber tools interact directly with hardware interfaces like UART, JTAG, or SPI. ADC and Sub-GH new API
└──▷ GET THIS VERSION
$ git clone --branch mntm-005 https://github.com/Next-Flip/Momentum-Firmware.git
# already have the repo? check out this version:$ git checkout mntm-005
Adds top CLI command (replaces ps) with CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage info
Adds RFID T5577 Raw Writer app
Adds Legrand doorbell protocol support in Sub-GHzSub-GHzRadio frequencies below 1 GHz (typically 300–900 MHz) used by IoT devices, key fobs, garage doors, and industrial sensors; cyber tools target this band to capture, replay, or analyze those wireless signals.
Adds EmosE601x and Acurite 5in1 protocols in Sub-GHz
Adds RSSI threshold selection for Hopping mode in Sub-GHz
+22 moreshow less
Adds Novoferm full remote support in UL
Adds Hormann EcoStar and Sommer FM238 options in UL
Adds custom guard time for Princeton protocol in OFW
Adds CSC Service Works Reloadable Cash Card parser in NFC
Adds Mifare Plus detection support in OFW NFC
Enables writing to Ultralight cards in OFW NFC
Adds Ultralight C authentication with des key in OFW NFC
Adds mf_classic_set_sector_trailer_read() function in OFW
Adds blank InstaFob detection in RFID
Adds Securakey Protocol and RKKTH Plain Text Format support in RFID
Enables Asset Pack selection via full-screen list from MNTM Settings
Adds ADC (analog voltage) support to gpio JS library
Adds subghz custom modulation, transmitFile(path, repeats), and end() function in JS
Adds SKIP_EXTERNAL toggle and EXTRA_EXT_APPS config option in FBT
Adds menu_get_selected_item() API in GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.
Adds TV animation in Desktop OFW
Adds Intruder animation in Desktop OFW
Adds Finnish keyboard layout to BadKB app
Refactors resource compression using heatshrink in OFW Updater
Adapts gzip to new CompressStreamDecoder API for better compression
Adds TarExtract command via RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. in OFW
Adds initial ISO7816 support and CCIDWorker in OFW USB/CCID
27 details in Everything
└──▷ BREAKING ON UPGRADE
!The ps CLI command is removed; use top instead.
!VGM color customization over RPC has been reworked; requires reflashing VGM and reconfiguring colors.
Codacy Cloud July 2024 adds DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. finding upload and Quality Issues grouping.
Adds the ability to upload Dynamic Application Security Testing (DAST) findings which appear in the Security and Risk Management dashboard
Groups Quality Issues detected in a repository by code pattern on the Quality Issues page for quick filtering
Adds new detection queries for TencentCloud CVM, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., TKE, CDB, and CLB resources.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.1 https://github.com/Checkmarx/kics.git
# already have the repo? check out this version:$ git checkout v2.1.1
Adds tencentcloud query support for CVM (Compute Virtual Machine) resources
Adds tencentcloud query support for VPC (Virtual Private Cloud) resources
Adds tencentcloud query support for TKE (Tencent Kubernetes Engine) resources
Adds tencentcloud query support for CDB (Cloud Database) resources
Adds tencentcloud query support for CLB (Cloud Load Balancer) resources
Checkov adds CKV_AZURE_212 detection for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. AppServiceInstanceMinimum and CKV_AWS check for AWS Bedrock Agent encryption with CMK
└──▷ GET THIS VERSION
$ git clone --branch 3.2.213 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.213
Adds CKV_AZURE_212 detection for ARM AppServiceInstanceMinimum resource configuration
Adds Terraform and CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. policy to ensure AWS Bedrock Agent is encrypted with a Customer Managed Key (CMK)
2 details in Everything
13 more releases in this issue
· 2024-07-01 → 2024-07-29
Checkov 3.2.199 adds Azure Defender and VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. DNS checks plus prereun for secrets
└──▷ GET THIS VERSION
$ git clone --branch 3.2.199 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.199
Adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. VnetSingleDNSServer check to Validate virtual network single DNS server configuration.
Adds Azure key vault prereun option in secrets config to execute logic before multiline pattern scanning.
Adds new CKV_AZURE_87 detection to ensure Azure Defender is On for Key Vault.
Checkov 3.2.196 adds a metadata exception filter for GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflows.
└──▷ GET THIS VERSION
$ git clone --branch 3.2.196 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.196
Checkov 3.2.194 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. checks for AKSEncryptionAtHostEnable, AKSEphemeralOSDisks, and managed disks.
└──▷ GET THIS VERSION
$ git clone --branch 3.2.194 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.194
└──▷ USE IT
Verify that a VM in an ARM template uses managed disks via the new CKV_AZURE_92 check.
shell
checkov -f template.json --check CKV_AZURE_92
Adds AKSEncryptionAtHostEnable rule for Azure Resource Manager templates to check if AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. host disk encryption is enabled
Adds AKSEphemeralOSDisks rule for Azure Resource Manager templates to verify ephemeral OS disk usage in AKS
Adds CKV_AZURE_92 rule for Azure Resource Manager templates ensuring Virtual Machines use managed disks
Checkov 3.2.189 adds two new ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. checks (AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. Paid SKU, Windows VM auto-updates) and updates CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. audit_logs values
└──▷ GET THIS VERSION
$ git clone --branch 3.2.189 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.189
└──▷ USE IT
Enforce AKS paid SKU policy across your ARM templates to ensure SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. coverage.
shell
checkov -d . --check CKV_AZURE_169
Verify Windows VMs in your infrastructure definitions have automatic updates enabled.
shell
checkov -d . --check CKV_AZURE_177
Adds CKV_AZURE_169 to enforce AKS clusters use the Paid SKU for SLA compliance
Adds CKV_AZURE_177 to ensure Windows VMs have automatic updates enabled
Updates valid values for audit_logs in CloudFormation template checks
Checkov 3.2.186 adds Azure Synapse policies and Bicep custom policy support
└──▷ GET THIS VERSION
$ git clone --branch 3.2.186 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.186
bicep_custom_policy_dir config key to load custom policies for Bicep files
New detection rules covering Azure Synapse resources in Terraform (*.tf) and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. templates (*.json)
Checkov 3.2.179 adds new Azure ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. checks for storage replication and Synapse Analytics policies.
└──▷ GET THIS VERSION
$ git clone --branch 3.2.179 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.179
└──▷ TRY IT
Scan ARM templates for storage replication compliance using the new check ID.
$ checkov -d . --check CKV_AZURE_206
Validate Azure Synapse Analytics policies against the new BCE-33785 rule.
$ checkov -d . --check BCE-33785
Adds CKV_AZURE_206 to enforce that Azure Storage Accounts use replication
Adds BCE-33785 check to validate Azure Synapse Analytics policies
Checkov 3.2.174 adds seven new Azure Resource Manager detection checks for AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., API Management, App Service Plan, Azure Search, SQL Database, and Azure Synapse.
└──▷ GET THIS VERSION
$ git clone --branch 3.2.174 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.174
Adds CKV_AZURE_172 check to ensure autorotation of Secrets Store CSICSIAn ambiguous acronym spanning Container Storage Interface, Crime Scene Investigation, and other expansions — without more context about which domain this tool operates in, a reliable definition cannot be given. Driver secrets for AKS clusters
Adds CKV_AZURE_173 check to ensure API Management uses at least TLS 1.2
Adds AppServicePlanZoneRedundant check for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. templates
Adds AzureSearchSLAIndex check for ARM templates
Adds SQLDatabaseZoneRedundant check for ARM templates
+1 moreshow less
Adds new policies for Azure Synapse in the azure detector
Checkov 3.2.171 adds eight new ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware./Azure security checks (CKV_AZURE and rule IDs)
└──▷ GET THIS VERSION
$ git clone --branch 3.2.171 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.171
Adds CKV_AZURE_171 check for AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. cluster upgrade channel selection
Adds CKV_AZURE_175 check for Web PubSub SKU with SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments.
Adds CKV_AZURE_178 check for Linux VM SSH key configuration
Adds CKV_AZURE_85 check for Azure Defender status on Kubernetes
Adds CKV_AZURE_99 check for Cosmos DB restricted access
+3 moreshow less
Adds DataFactoryNoPublicNetworkAccess check for Data Factory public network access
Adds DataLakeStoreEncryption check for Data Lake Store encryption
Adds EventHubNamespaceMinTLS12 check for Event Hub Namespace minimum TLS version
Checkov v3.2.163 adds new ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. checks for API Management public access, App Service PHP version and public access, Key Vault purge protection, and Pub/Sub identity.
└──▷ GET THIS VERSION
$ git clone --branch 3.2.163 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.163
└──▷ TRY IT
Scan ARM templates to detect if Azure API Management allows public access or lacks other new security controls.
Snyk PRs (Fix, Backlog, Upgrade) now available for all supported SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations
2 more releases in this issue
· 2024-07-17 → 2024-07-26
AppRisk Essentials and Pro add wildcard GitHub organization onboarding and profile edits without resubmitting credentials
AppRisk Essentials and Pro users can edit Integration Hub profiles without resubmitting existing credentials; this applies across SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows., App Context, SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., Secrets and Runtime integrations.
GitLab 16.4.6 adds a Rake task to display personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. expiration info and removes nil constraints from the PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. table.
10 more releases in this issue
· 2024-07-18 → 2024-07-23
Adds a Rake task to display Personal Access Token expiration details and a UI banner for expiry warnings.
Adds the gitlab:tokens:expiry Rake task to show token expiration info
Adds a UI banner that informs users about their Personal Access Token (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) expiration
New Rake task to inspect token expiration info and a UI banner for expiry awareness.
Adds the gitlab:auth:show_token_expiration Rake task to display token expiration details
Adds a UI banner that informs users about upcoming personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) expiration
GitLab 16.5.9 adds a Rake task to show Personal Access Token expiration info and a UI banner for expiry warnings.
Adds gitlab:tokens:expirations Rake task to query token expiration details
Adds a banner in the user interface to inform users about Personal Access Token (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) expiration
GitLab 16.6.9 adds a Rake task to display personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. expiration details.
GitLab 17.2 adds log streaming for K8s pods, pipeline execution policies, DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. checks, and more
Log streaming for Kubernetes pods allows viewing pod/container logs directly in the GitLab UI.
Vulnerability Explanation is now generally available in GitLab Duo Chat for SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. vulnerabilities.
Mend SCA 24.7.1 adds vulnerability exclusion in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence.SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., library copyright overrides via modal, and label support in Attribution Reports.
Adds an option in the Create Report wizard to exclude vulnerabilities from Dependencies SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports in the CycloneDX standard
Adds a modal interface for overriding copyrights for a selected library in attribution data
Labels are now supported in the Attribution Report
Mend SCA v24.7.1 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. vulnerability exclusion toggle, library copyright override modal, and label support in Attribution Report
Adds a toggle in the Create Report wizard to exclude vulnerabilities from Dependencies SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports (CycloneDX standard)
Adds a modal interface to override copyrights for selected libraries in attribution data
The new API allows customers to programmatically access billing invoices for current, past, and partial months, enabling automated reconciliation workflows.
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. Node.js v2.2.4 adds debug mode for diagnosing Koa middleware issues.
Adds debug configuration option to enable detailed logging for Koa application diagnosis
Adds uuid.version7 and uuid.is_version7VCLVCLVarnish Configuration Language, a domain-specific language used to configure the Varnish HTTP cache, letting tools control request routing, caching rules, and traffic manipulation with low-latency precision. functions for UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. v7 support.
Added uuid.version7 VCL function to generate UUID v7 identifiers
Added uuid.is_version7 VCL function to check if a string is a valid UUID v7
Wallarm adds detection for malicious JavaScript injection via polyfill.io supply chain attack.
Detects static imports of JavaScript code from the polyfill.io domain and other malicious domains involved in this campaign: kuurza[.]com, googie-anaiytics[.]com, bootcss[.]com, macoms[.]lanewcrbpc[.]com, polyfill[.]io, bootcdn[.]net, staticfile[.]net, unionadjs[.]com, xhsbpza[.]com
Wallarm Node 4.10.7 removes manual NGINX config requirement for API Specification Enforcement.
Removes the requirement for manual NGINX configuration when using API Specification Enforcement
Optimizes OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. data type detection in the API Discovery module
cside adds native MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. support for all plans with dashboard session management
Adds native multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. (MFA) support for all plans, including authenticator apps and hardware tokens like YubiKey and Apple Touch ID.
Enables viewing active account sessions and revoking previous sessions directly from the dashboard.
BunkerWeb v1.5.9 adds SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address.-based upstream support with new REVERSE_PROXY_SSL_SNI settings.
└──▷ GET THIS VERSION
$ git clone --branch v1.5.9 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout v1.5.9
└──▷ USE IT
Route traffic to an upstream that requires a specific TLS SNI value (e.g., a CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. or shared-hosting backend that serves multiple certs).
Adds REVERSE_PROXY_SSL_SNI and REVERSE_PROXY_SSL_SNI_NAME settings to support SNI-based TLS upstream connections in reverse proxy configurations.
Updates the web UI setup wizard to handle scenarios where a reverse proxy already exists but no admin user is configured.
Moves Linux package repository to repo.bunkerweb.io.
Updates CoreRuleSet to v4.5.0, bringing the latest WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. detection rules.
Updates security headers on default and error pages for improved posture.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Linux packages are now served from repo.bunkerweb.io instead of the previous packagecloud.io repository — existing package manager configurations pointing to the old repo URL must be updated.
Adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-based CLI logins for all browsers and environments
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.77.2-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.77.2-postgres
└──▷ USE IT
Log in to Infisical using your identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. via the CLI instead of username/password.
shell
infisical login --sso
--sso flag in the CLI enables SSO authentication across all browsers and environments
1 detail in Everything
11 more releases in this issue
· 2024-07-02 → 2024-07-22
infisical-cli/v0.26.0 adds --verify-jwt and manual token fallback for browser login failures
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.26.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.26.0
Provides a manual token entry option when browser-based authentication fails
infisical-cli v0.25.0 adds projectId support and switches secrets to raw format
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.25.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.25.0
└──▷ USE IT
Specify a project ID explicitly when setting a secret while already logged in.
shell
infisical secrets set --projectId <project-id> --secret-key mykey --secret-value myvalue
Adds --projectId flag support when the user is logged in for the secrets set command
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!All secret endpoints now use the raw format instead of the previous encrypted storage method.
Adds manual user activation/deactivation via UI and IP whitelisting configuration
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.77.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.77.1-postgres
└──▷ HOW TO FIND IT
Manually reactivate a suspended user account directly from the interface.
infisical-cli v0.24.0 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication support
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.24.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.24.0
oidc auth subcommand for CLI login via OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user..
Adds AWS KMSAWS KMSAWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves. support, new Terraform folder API endpoints, and configurable Azure auth URL for the K8 operator
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.77.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.77.0-postgres
Adds aws kms integration to manage encryption keys via AWS KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.
Adds new folder endpoints for Terraform providers
Adds azure.auth.resourceUrl config option in the Kubernetes operator to customize the Azure authentication resource URL
Adds share-secret hide/unhide and soft deletes shared secrets upon expiry
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.76.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.76.1-postgres
└──▷ HOW TO FIND IT
Hides a shared secret from view in the UI while preserving it for API access or audit trails.
📍In the Secrets Manager, select a shared secret and toggle Hide in the actions menu.
Unhides a previously hidden shared secret to restore full visibility.
📍In the Secrets Manager, locate the hidden item in the Hidden filter and toggle Unhide.
Adds share-secret hide and unhide functionality for managed secrets.
Performs a soft delete on shared_secrets when they reach their expiry date.
v0.76.0 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. machine identity auth, secret movement, and Org-level Identity management UI
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.76.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.76.0-postgres
oidc machine identity authentication method is now available for service-to-service auth.
Users can move secrets between folders via the Secrets > Move action in the UI or the POST /v1/secrets/:secretId/move API endpoint.
Adds admin_delete_users capability and token authentication method for identity workflows
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.75.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.75.0-postgres
Allows admins to delete users via the UI or API
Introduces a Token Authentication Method alongside the revamped Identity (Page) workflow
Displays a warning banner when deleting secrets in the fly.io integration
Adds secret sharing UI update, support for secret approval with groups, and a new Infisical Binary standalone core.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.74.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.74.0-postgres
Config added to .env or server config: SECRET_APPROVAL_GROUPS_ENABLED=true to enable secret approval workflows scoped by group membership.
Shell binary: a new standalone executable named infisical-core replaces the previous infisical-standalone binary for local core deployments.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The existing standalone binary is renamed from infisical-standalone to infisical-core. Any scripts or services invoking the old executable name will break and must be updated.
Native Slack webhook support for dynamic secrets; admin toggle for login options
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.73.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.73.1-postgres
Infisical v0.73.0 adds org-level project favorites and backend validation for LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. group configuration
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.73.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.73.0-postgres
└──▷ HOW TO FIND IT
Let team members pin their most frequently accessed projects to the top of the project list.
📍In the Infisical web UI, navigate to a project card and click the Favorite icon (star).
Prevent misconfigured LDAP group mappings from being saved by ensuring the backend validates the group configuration before acceptance.
📍Configure your LDAP integration via the Admin Settings › Authentication panel; the system will now reject invalid group configurations.
Adds the ability for organization members to mark projects as favorites via the UI.
Adds a server-side validation check for LDAP group configurations.
Nuclei v3.3.0 adds UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port checking, CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. enrichment, richer LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. output, and new SDK controls for timeouts and filesystem.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.0 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:$ git checkout v3.3.0
Adds isUDPPortOpen goja function to check whether a UDP port is open from JavaScript templates.
Adds cname information to HTTP protocol responses when available, enabling CNAME-aware detections.
Improves LDAP output with a custom type that returns additional information beyond basic query results.
Adds SDK option to disable the update check programmatically.
Adds support for supplying fs.FS explicitly via the SDK for custom template filesystems.
+2 moreshow less
Adds timeouts configuration in types.Options for fine-grained SDK timeout control.
Caido v0.39.0 adds backend plugins, Replay workflow integration, and a new HTTPQL field for filtering HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic.
└──▷ GET THIS VERSION
$ git clone --branch v0.39.0 https://github.com/caido/caido.git
# already have the repo? check out this version:$ git checkout v0.39.0
Adds backend plugin support, enabling server-side logic (e.g. file system access) to complement frontend plugins.
Enables preprocessors and workflows in Replay sessions for automatic encoding, signature/hash calculation, and CLI tool execution.
Adds new HTTPQL field req.tls to filter requests by HTTPS/TLS status.
Adds a Dedupe Key option to the Create Finding workflow node to prevent duplicate findings.
Lavamoat Tofu v7.3.0 adds support for Node.js 22.x
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-tofu-v7.3.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-tofu-v7.3.0
lavamoat-tofu-v7.3.0 extends compatibility to include Node.js 22.x
1 detail in Everything
5 more releases in this issue6 more releases in this issue · 2024-07-11
LavaMoat v2.1.0 adds allow-scripts support for Node.js v22
└──▷ GET THIS VERSION
$ git clone --branch preinstall-always-fail-v2.1.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout preinstall-always-fail-v2.1.0
LavaMoat v1.2.0 adds support for Node.js v22 in the allow-scripts feature
└──▷ GET THIS VERSION
$ git clone --branch laverna-v1.2.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout laverna-v1.2.0
$ git clone --branch lavamoat-core-v15.4.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-core-v15.4.0
$ git clone --branch allow-scripts-v3.1.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout allow-scripts-v3.1.0
$ git clone --branch webpack-v0.4.0-beta.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v0.4.0-beta.0
Syft v1.10.0 adds TiDB binary cataloging, Maven CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. generation, Go main module detection, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware./RISC-V Traefik support.
└──▷ GET THIS VERSION
$ git clone --branch v1.10.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.10.0
Detects Go main module from partial package builds, improving SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. accuracy for incomplete build artifacts.
Supports Traefik binary cataloging on linux/arm/v6 and linux/riscv64 architectures.
Catalogs TiDB binaries as a new supported package type.
Generates Maven-friendly CPEs for Java packages, improving compatibility with Maven-based vulnerability matching.
4 details in Everything
1 more release in this issue
· 2024-07-11 → 2024-07-30
Socket now uses a new yarn module resolution algorithm by default to generate npm v1 lockfiles from yarn.lock.
Replaces the previous yarn resolution method with an alternative algorithm that maps package.json dependencies to the yarn lock file and traverses it to generate an npm v1 lockfile for module resolution.
Adds a new API endpoint to export CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence.SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. from SocketSBOM reports or full scan IDs.
GET /v0/orgs/{org_slug}/export/cdx/{id} — Export CycloneDX SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. from a report ID or full scan ID
Apiiro adds new SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. dashboard/risk page and a REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. to export findings, moving API code risks out of the API security table.
Adds a new SAST dashboard and risks page in the sidebar for better visibility, prioritization, and remediation guidance of source code findings
Adds filtering by compliance standard on the SAST risk views to support audit assurance workflows
Introduces a new REST API endpoint to export SAST findings for broader extensibility
Moves risks in APIs detected in code to the new SAST experience instead of listing them in the API security table
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The component field now contains the code file where the finding was identified, instead of the previous value
!SAST risks related to APIs will no longer be listed in the API security table
Apiiro adds a new CVE report with remediation trends, reachability insights, and risk charts.
Introduces the CVE report to track vulnerability remediation trends including open vs resolved risks by criticality and Mean Time to Remediate (MTTR)
Adds deep insights on vulnerabilities leveraging unique reachability insights for crucial applications and packages
Provides a vulnerability risk chart identifying top vulnerabilities by EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it., and risk mass metrics
Enhances filtering capabilities to drill down into specific CVEs using exploitability and reachability insights
GuardDog v2.0.0 adds YARA/private rule support and Go ecosystem scanning.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.0 https://github.com/DataDog/guarddog.git
# already have the repo? check out this version:$ git checkout v2.0.0
Supports running YARA rules and private rules against packages for custom detection logic.
Adds Go ecosystem support, enabling GuardDog to scan Go packages for malicious indicators.
Adds detection for Python sqlite3-based data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. attacks.
Improves DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. hijacking rule coverage for broader Windows attack detection.
YARA-X v0.6.0 adds NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. output for the scan command
└──▷ GET THIS VERSION
$ git clone --branch v0.6.0 https://github.com/VirusTotal/yara-x.git
# already have the repo? check out this version:$ git checkout v0.6.0
└──▷ USE IT
Export scan results in JSON Lines format for downstream processing or ingestion into other systems.
shell
yara-x scan --format ndjson rules.yar target_file
1 more release in this issue
· 2024-07-01 → 2024-07-31
Timesketch 20240717 adds ApexChart visualizations, a Natural Language to Query API, and CSV export for analyzer stats.
└──▷ GET THIS VERSION
$ git clone --branch 20240717 https://github.com/google/timesketch.git
# already have the repo? check out this version:$ git checkout 20240717
New ApexChart-based visualizations available in the UI for richer, interactive timeline charts.
New NL2Q API (Natural Language to Query) lets users query timelines using plain-language prompts, with an improved v2 prompt engine.
MISP analyzer updated with new detection capabilities.
Adds CSV export option to tsctl analyzer-stats for easier offline reporting.
Analyzer output now includes only tags created by the running analyzer, reducing noise.
+1 moreshow less
Yeti Indicators analyzer updated with more precise SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. indicator queries and support for merging multiple intelligence attributes.
Frida 16.4.0 adds CoreDevice support on non-macOS via userspace CDC-NCM driver and iOS 18 dyld restart detection
Adds a userspace CDC-NCM driver for Apple CoreDevice connectivity on Windows, Linux, and other libusb-supported platforms when no kernel driver is available.
Add Await ObjC runtime initialization on iOS >= 18 to ensure Objective-C runtime is ready before script execution on iOS 18 devices
Expose os.build and hardware fields in the exposed system parameters via Frida's introspection API
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Node.js requirement bumped to >=16 || 14 >=14.17, dropping support for Node versions below these thresholds
Binary Ninja 4.1 adds Time-Travel Debugging, BASE scan engine, new debugger APIs, and History Sidebar.
Adds Time-Travel Debugging (TTD) support with reverse go/step buttons in the debugger sidebar
Introduces Binary Ninja Base Address Scan Engine (BASE) for automated base address detection
Adds New History Sidebar widget to view and navigate previous analysis states
Adds MemoryMap API integration to debugger for reliable memory region representation
Adds support for Objective-C Categories and 'Lazy Classes' with automatic processing
+13 moreshow less
Adds automatic recognition of TEB in user mode Windows binaries
Adds support for downloading symbols through debuginfod
Adds BNCustomPlatform API to allow specification of type parser arguments
Adds BaseAddressDetection API entry point
Adds Platform::GetGlobalRegsiters & Platform::GetGlobalRegisterType new platform APIs
Adds BinaryView::AddToEntryFunctions and BinaryView::GetAllEntryFunctions APIs
Adds ILIsCFGProtected attribute on CFGCFGControl Flow Graph — a directed graph representing all paths execution can take through a program, used by analysis tools to reason about reachability, dead code, and vulnerability patterns without running the code. and XFG Calls in Windows binaries
Adds get_expr, copy_expr, raw_operands, get_expr_count Python APIs for expression manipulation
Adds Python methods for getting/setting default calling convention
Adds uiSelectionAction setting type for file picker or action triggers
Adds additional notification dispatcher APIs in the Python API
Adds BinaryReader.TryReadPointer method
Adds BinaryDataNotifications for undo actions in the API
18 details in Everything
└──▷ BREAKING ON UPGRADE
!The loader.architecture API property is deprecated in favor of loader.platform.
!Support for Ubuntu 20.04 has been dropped; only 22.04 and 24.04 are supported.
!Support for Python 3.8 has been dropped; Python 3.9 is now the minimum supported version.
HyperDbg v0.10 adds assembly conditions in events, DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. event forwarding, a/!a assembler commands, and SDK APIs for VMI/Debugger modes
└──▷ GET THIS VERSION
$ git clone --branch v0.10 https://github.com/HyperDbg/HyperDbg.git
# already have the repo? check out this version:$ git checkout v0.10
└──▷ USE IT
Assemble raw opcodes into virtual memory at runtime for dynamic payload injection.
shell
!a <virtual_address> "nop; jmp 0x1234"
Assemble raw opcodes into physical memory for hardware-level debugging.
shell
a <physical_address> "mov eax, 1; ret"
Support using assembly conditions and codes in all events to control event execution logic
Added support for forwarding events to binary (DLL) modules via output mechanisms
Added the a assembler command for virtual memory operations
Added the !a assembler command for physical memory operations
Provided a unified SDK API for reading memory in VMI Mode and Debugger Mode
+7 moreshow less
Exported SDK APIs for reading and writing registers in Debugger Mode
Exported SDK API for writing memory in VMI Mode and Debugger Mode
Exported SDK API for connecting to the debugger and from the debuggee in Debugger Mode
Exported SDK API for starting a new process
Added and exported SDK API for unsetting message callbacks
Added message callback support using shared memory
Added maximum execution limitation to script IRs to prevent infinite loops
CHIPSEC 1.13.4 adds Meteor Lake SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. support, SMI contention scanning, remap lock bit checks, and expanded Linux physical memory write size.
└──▷ GET THIS VERSION
$ git clone --branch 1.13.4 https://github.com/chipsec/chipsec.git
# already have the repo? check out this version:$ git checkout 1.13.4
Adds Meteor Lake SPI support for firmware analysis on MTL platforms.
Adds SMI contention check to the smm_ptr module's scan mode.
Adds remap lock bit condition check to memory remapping security analysis.
Increases Linux maximum physical memory write size from 0xFFFF to 0xFFFFFFFF, enabling larger memory operations.
Adds NVRAM firmware volume padding check for deeper UEFIUEFIA firmware specification maintained by the UEFI Forum that replaces legacy BIOS, defining how an OS and hardware initialize at boot. Cyber tools target or hook it to inspect pre-OS execution environments. NVRAM validation.
+2 moreshow less
Adds error message when UEFI compression modules are missing, improving diagnosis of incomplete setups.
Enables ANSI color logging on Windows via the logger color command.
Prisma Cloud Compute Edition 32.07 adds Partially Completed registry scan status and API label support.
Adds the Partially Completed status for registry scans to show when at least one image has been successfully scanned.
Adds the optional includeLabels query parameter to the [Download Container Scan Results](https://pan.dev/prisma-cloud/api/cwpp/get-containers-download/) API to include container labels in the response.
Cortex Xpanse Expander July 2024 hotfix adds attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. test fields to API responses.
Get All Services and Get Service Details API responses now include the attack surface test fields even when attack surface testing is disabled.
Prisma Access 5.1 enables secure deletion of unused ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector IP blocks
Adds ability to delete unused ZTNA Connector IP blocks after removing all associated connectors and applications.
Prisma Cloud adds RQL attributes for cloud workload identitiesworkload identitiesAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. and last access detection, .NET Central Package Management support, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. regions, and new compliance standards.
Adds grantedby.cloud.entity.lastlogin attribute to RQL queries to detect inactive cloud service accounts in AWS and Azure environments.
Adds source.cloud.account.isvendor attribute to RQL queries to identify validated vendor access in AWS and GCP environments.
Adds source.MFAenabled attribute to RQL queries to identify users without Multi-Factor Authentication enabled.
Supports .NET Central Package Management by scanning dependencies defined in the Directory.Packages.props file via Software Composition Analysis (SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.).
Ingests data for OCI resources deployed in Chicago, Madrid, Paris, and Queretaro cloud regions.
+10 moreshow less
Adds a Network Flowlog filter to the Inventory > Unmanaged Assets page to search for internet-exposed assets connected to secured assets.
Enables CSV bulk download of all CVE data from the table view using the Download > Download all CVE data option, limited to 10K records.
Introduces three new widgets on the Vulnerabilities dashboard: Overview (Unique CVEs/Vulnerabilities Remediated), Vulnerabilities Funnel, and Most Important Vulnerabilities.
Adds a CVE Preview Card feature to highlight key CVE information directly in the table view without opening the sidecar.
Displays real-time counts of unique CVEs, vulnerabilities, and affected assets in the Vulnerability Results table view.
Introduces a Partially Completed status for registry scans when at least one image has been successfully scanned.
Adds support for Digital Operational Resilience Act (DORA), Australian Cyber Security Centre (ACSC) Essential Eight Levels 1-3, and new CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. GCP policy mappings as built-in compliance standards.
Exposes a new GET /uve/api/v1/vulnerabilities/search/download endpoint to download all vulnerabilities from an RQL search in CSV format.
Exposes a new GET /uve/api/v4/dashboard/vulnerabilities/prioritised endpoint to retrieve prioritized vulnerability data for the dashboard.
Adds the managedCommunication parameter to CDEM asset inventory API endpoints (GET asm/api/v1/asset, etc.) to filter internet-exposed assets connected to secured assets.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!The sourcerepo.googleapis.com service has been removed; Prisma Cloud no longer ingests metadata from the gcloud-cloud-source-repository API for accounts newly onboarded after June 6th, 2024.
!Compliance and Asset Inventory trendlines now display data only from the past one year; snapshots older than one year are not retained.
!Requests to the /audit/redlock endpoint exceeding 100K records now return a 413 Payload Too Large error.
!The PUT /user/role API is subject to a rate limit of Limit=3, Burst=3, returning HTTP 429 if exceeded.
Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.11 adds host file bypass for DNS queries on XDR Collectors.
XDR Collectors now bypass the Windows hosts file (C:\Windows\System32\drivers\etc\hosts) during DNS queries on Windows and Linux agents.
PAN-OS 11.1 adds encrypted DNS (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring./DoTDoTDNS over TLS: an IETF standard (RFC 7858) that wraps DNS queries in a TLS session on port 853, preventing eavesdropping and tampering that plain UDP DNS allows.) support for both the DNS Proxy and the Management Interface
Enables configuration of encrypted DNS (DoH or DoT) for the firewall's DNS Proxy service, with fallback to cleartext if servers reject encryption or timeout.
Adds ability to enable encrypted DNS on the firewall's Management Interface itself, allowing management traffic to resolve via DoH, DoT, or cleartext.
OpenSnitch v1.6.6 adds Reject to DefaultAction options and GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. scale factor settings
└──▷ GET THIS VERSION
$ git clone --branch v1.6.6 https://github.com/evilsocket/opensnitch.git
# already have the repo? check out this version:$ git checkout v1.6.6
DefaultAction now supports Reject, enabling explicit reject policies in rule configuration.
GUI screen/theme scale factor is configurable via a new settings option.
Rules can be configured without the GUI for headless or scripted management.
Sophos Firewall 20.0 MR2 adds a backup-restore assistant with flexible model, interface, and HA port mapping across appliance types.
└──▷ HOW TO FIND IT
Walk through the backup-restore assistant UI to remap interfaces when migrating a backup from a 1US XG Series appliance down to a desktop XGS 126.
📍In the Sophos Firewall admin console, go to Backup & Firmware › Restore, select the backup file (from 19.5 MR4 or later), and follow the backup-restore assistant to review and change the default port mapping before confirming the restore.
Adds a backup-restore assistant that lets you view and change default port mapping when restoring backups from version 19.5 MR4 and later to 20.0 MR2 and later.
Enables restoring backups across higher- to lower-capacity appliance models (e.g., 1US XG Series to desktop XGS 126), and across hardware appliances, cloud, virtual, and software firewalls.
Supports restoring high availability backups to devices with fewer or more interfaces, with the dedicated HA link permitted on a different port in the target device.
Adds cipher compliance controls to set the security balance between cipher compatibility and audit compliance (PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly.) by customizing allowed cipher suites.
Snort3 3.3.1.0 adds extractor fields, HTTP origin header detection, expanded MMSMMSMultimedia Messaging Service, a mobile carrier protocol that extends SMS to carry images, audio, and video between handsets; cyber tools use it to analyze or simulate rich-media mobile message delivery. curse, and new IP flow profiling parameters.
└──▷ GET THIS VERSION
$ git clone --branch 3.3.1.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.3.1.0
└──▷ USE IT
Capture HTTP referrer and origin metadata in extractor output for lateral-movement or phishing investigations.
Adds trans_depth, origin, and referrer fields to the extractor module for richer HTTP session metadata capture.
Adds origin header support to http_inspect for inspection of cross-origin HTTP requests.
Introduces new parameters to perf_monitor for IP flow profiling, enabling more granular performance analysis.
Expands MMS curse in the wizard for improved protocol identification of MMS traffic.
Enables OPT_TREE traces in release builds for detection-layer traceability without debug compilation.
+2 moreshow less
Makes fast-pattern printing available as a trace module in the detection engine.
Supports TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stream tracing without requiring special compilation flags.
7 details in Everything
1 more release in this issue
· 2024-07-10 → 2024-07-18
Snort 3.3 introduces new CLI command for CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. percentage and Cursor Action Type in Lua scripts
└──▷ GET THIS VERSION
$ git clone --branch 3.3.0.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.3.0.0
└──▷ TRY IT
Check current CPU utilization of the Snort process via command line.
$ snort --cpu-percent
Adds snort --cpu-percent CLI command to show Snort CPU usage
Adds new Cursor Action Type available in the framework for Lua-based actions
Zeek v7.0 adds table/set/vector delete, can_load() helper, SMB2SMB2A Microsoft network file-sharing protocol (version 2 of SMB) used for remote file, printer, and service access over a network; cyber tools target or implement it to inspect, relay, or exploit Windows file-sharing traffic. PDU parsing, and Prometheus telemetry framework
└──▷ GET THIS VERSION
$ git clone --branch v7.0.0 https://github.com/zeek/zeek.git
# already have the repo? check out this version:$ git checkout v7.0.0
└──▷ USE IT
Clear a vector without recreating it to avoid allocation overhead in tight loops.
text
global v = vector(1, 2, 3);
delete v;
Conditionally load a script package only if it is present in the Zeek path to prevent errors on minimal installations.
Disable an HTTP analyzer for a specific connection at establishment time using its numeric identifier.
text
event connection_established(c: connection):
{
local aid = lookup_connection_analyzer_id(c$id, Analyzer::ANALYZER_HTTP);
if ( aid > 0 )
disable_analyzer(c$id, aid, T, T);
}
delete statement now clears the contents of tables, sets, and vectors.
New can_load() helper function backed by bif find_in_zeekpath() allows guarding @load directives when script packages may or may not be installed.
Packagers can include a local addition into Zeek's version string via build flag --localversion=XXX and the LOCALVERSION environment variable for Docker builds.
SMB2 packets containing multiple PDUs now correctly parse all headers.
New built-in function lookup_connection_analyzer_id() retrieves the numeric identifier of an analyzer associated with a connection, enabling use of disable_analyzer() outside of confirmation/violation events.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The Telemetry framework moved to a Prometheus-first model; Broker::metrics_port is now Telemetry::metrics_port and Broker::metrics_export_endpoint_name is now Telemetry::metrics_endpoint_name.
!Options Broker::metrics_export_interval, Broker::metrics_export_topic, Broker::metrics_import_topics, and Broker::metrics_export_prefixes have been removed.
!The unit field has been removed from the telemetry log.
!All BROKER_METRICS_* environment variables have been removed.
!Cluster configuration requires a new metrics_port field in each node's node.cfg options and the cluster layout record defined in cluster-layout.zeek.
!Instruments no longer support count or int64_t; only double versions are provided.
!The is_sum argument has been removed from the constructors/creation methods for all instruments.
tcpreplay v4.5.1 adds AF_XDPAF_XDPA Linux kernel interface that hands raw packets to a userspace program straight off the network card, skipping the kernel's networking stack. It is how userspace tools reach line rate on 100G links. line-rate transmission, -wpcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. output, and --include/--exclude packet filtering
└──▷ GET THIS VERSION
$ git clone --branch v4.5.1 https://github.com/appneta/tcpreplay.git
# already have the repo? check out this version:$ git checkout v4.5.1
Adds -w <file> tcpreplay option to write replayed packets directly to a PCAP file instead of transmitting them over an interface.
Adds --include and --exclude tcpreplay options to specify specific packet numbers for selective replay.
Adds --fixhdrlen tcpreplay option to control handling of packet length changes during replay.
Adds -W tcpreplay option to suppress warnings during packet replay.
Adds AF_XDP socket support via libxdp API, enabling line-rate transmission on newer Linux kernels without third-party modules like netmap or PF_RING.
+1 moreshow less
Adds support for SLL2 (Linux cooked capture encapsulation v2) format.
Hubble v1.16 adds CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. expression filters, drop-reason filtering, and node-label visibility to flow observation.
└──▷ GET THIS VERSION
$ git clone --branch v1.16.0 https://github.com/cilium/hubble.git
# already have the repo? check out this version:$ git checkout v1.16.0
└──▷ TRY IT
Filter live flows using a CEL expression to match only flows from a specific source IP and port — useful for precise, ad-hoc investigations without pre-built filter combinations.
Security Onion 2.4.90 adds custom SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. actions, Suricata regex support, Kafka InfluxDB metrics, and a faster detection refresh interval.
└──▷ GET THIS VERSION
$ git clone --branch 2.4.90-20240729 https://github.com/Security-Onion-Solutions/securityonion.git
# already have the repo? check out this version:$ git checkout 2.4.90-20240729
Adds a new action to the SOC Actions list so users can more easily add their own custom actions.
Supports regex in Suricata rule management within the Detections interface.
Adds Kafka InfluxDB metrics collection and pillar configuration support.
Introduces new configuration values for the Detections Bulk Indexer.
Reduces detection refresh interval to 1 second for near-real-time detection index updates.
+1 moreshow less
Disables Logstash on heavy nodes to streamline pipeline architecture.
Rspamd 3.9.1 adds special handling of SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders. +all (pass-all) records to improve spam detection.
└──▷ GET THIS VERSION
$ git clone --branch 3.9.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:$ git checkout 3.9.1
Detects and scores SPF +all (pass-all) records specially, flagging domains that publish permissive SPF policies that allow any sender.
1 detail in Everything
1 more release in this issue
· 2024-07-12 → 2024-07-31
Abnormal AI adds sender authentication results (SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders./DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit./DMARC) to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Email Threats events
Adds sender authentication fields to the Email Threats event type for ingestion into SIEM integrations
Exposes SPF, DKIM, and DMARC check results directly in SIEM without manual portal access
New REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoint for ingesting Abnormal Portal audit logs
Malcolm v24.07.0 adds GE SRTP OT protocol analysis with a new env var to control it, plus a restart script service argument.
└──▷ GET THIS VERSION
$ git clone --branch v24.07.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v24.07.0
└──▷ USE IT
Enable the GE SRTP analyzer on a sensor that monitors GE-heavy OT networks by flipping the default off switch.
ini
ZEEK_DISABLE_ICS_GE_SRTP=false
Adds ZEEK_DISABLE_ICS_GE_SRTP to zeek.env and control_vars.conf to toggle the new GE SRTP network analyzer; defaults to true (analyzer disabled) given the protocol's uncommon use in OT environments.
Adds optional service argument to the restart script, allowing targeted restart of a single Malcolm service.
Integrates the ICSNPP GE SRTP network analyzer for passive analysis of GE SRTP industrial protocol traffic.
MISP feed pulls now specify JSON as the preferred format via HTTP headers, improving feed ingestion reliability.
!Support for the long-deprecated net-map.json file has been removed; any existing configurations relying on it will no longer function.
!docker compose bind mounts now return an error instead of silently creating empty directories when a source file or directory is missing — setups with missing mount sources will fail on upgrade.
Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds
Trivy 0.54.0 adds VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. Repository support, Azure Linux scanning, and --pkg-types/--pkg-relationships flags.
└──▷ GET THIS VERSION
$ git clone --branch 0.54.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.54.0
log.FilePath() function for logger
openSUSE tumbleweed detection and scanning
--pkg-types flag (replaces --vuln-type) to control package types scanned
Azure Linux support in Mariner database
China configuration for ACRs misconf scanning
+6 moreshow less
license parser to pnpm analyser for nodejs
image labels into SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. reports
vulnerability support for SPDX formats
--pkg-relationships flag to include package dependency relationships in vulnerability reports
share build-in rules
retrieve VEX attestations from OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registries
11 details in Everything
1 more release in this issue
· 2024-07-01 → 2024-07-30
Trivy 0.53.0 adds clean subcommand, local ImageID in SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface., and memory cache backend. Removes aws subcommand.
└──▷ GET THIS VERSION
$ git clone --branch 0.53.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.53.0
└──▷ TRY IT
Remove Trivy cache and temporary files to free disk space on CI/CD runners after scans.
$ trivy clean --all
Scan a container image and output SARIF results with local ImageID for tracking in vulnerability management tools.
Add clean subcommand to remove Trivy data files (cache, images, metadata) and free disk space
Add local ImageID to SARIF metadata for better correlation of scanned container images in SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment./SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. workflows
Add memory cache backend to improve performance and reduce disk I/O overhead during scans
Add conda license support for environment.yml files to detect dependencies licenses in Conda environments
Add Dart dependency resolution using first version of constraint for SDK version dependencies
+10 moreshow less
Set User-Agent header for Trivy container registry requests to improve tracking and access control compliance
Add Java support for maven-metadata.xml files in remote snapshot repositories for accurate version resolution
Add sbt project support via sbt-dependency-lock for dependency lock file parsing in Scala projects
Add misconf metadata to Cloud schema for enhanced cloud security posture analysis details
Add AWS CloudFormationAWS CloudFormationAn AWS service for declaring cloud infrastructure as code in JSON or YAML templates, letting cyber tools provision and tear down entire environments reproducibly without manual console steps. support for AWS::EC2::SecurityGroupIngress/Egress resources in misconfiguration scanning
Add API Gateway V1 support for CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. templates in infrastructure-as-code scanning
Add Rego selector support for all providers to enable fine-grained policy application across cloud environments
Add PHP installed.json file support for dependency resolution in Composer-based projects
Add plugin nested archive support for handling complex plugin packaging structures
Migrate SBOM output format to CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. v1.6 standard for improved interoperability
Inspektor Gadget v0.30 adds initial Wasm gadget support, kernel stack maps for traces, and deterministic image exports
└──▷ GET THIS VERSION
$ git clone --branch v0.30.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.30.0
Adds initial Wasm gadget runtime support via --wasm flag or config to load and run gadgets written in WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute..
Enables capturing kernel stack traces in trace-based gadgets (e.g. trace_exec) by exposing the kstack field in output records.
Makes ig image export produce deterministic tarballs by sorting entries and normalizing timestamps, enabling reproducible gadget images.
Adds helper functions for VAP and CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. admission library
└──▷ GET THIS VERSION
$ git clone --branch v3.0.12 https://github.com/kubescape/kubescape.git
# already have the repo? check out this version:$ git checkout v3.0.12
AddVapHelper and AddCelHelper in the VAP/CEL admission library
cilium-cli v0.16.14 adds a multicast subcommand, new L7/LRP connectivity tests, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. timer assertions, and a single JUnit report output.
└──▷ GET THIS VERSION
$ git clone --branch v0.16.14 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:$ git checkout v0.16.14
└──▷ TRY IT
Inspect or manage multicast groups on a Cilium-managed cluster using the new subcommand.
$ cilium multicast
Adds multicast subcommand for managing multicast networking.
New echo-ingress-l7-via-hostport-with-encryption connectivity test case (requires Cilium ≥ 1.16.0).
New local-redirect-policy-with-node-dns connectivity test case.
Connectivity tests now assert BGP timer intervals in BGP connectivity tests.
Sysdump now gathers gops data from the cilium-operator.
+1 moreshow less
Connectivity test runs now produce a single consolidated JUnit report.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The --test-namespace flag now always appends a concurrent group number suffix: the default test namespace is cilium-test-1 instead of cilium-test, even when --test-concurrency is set to 1.
2 more releases in this issue
· 2024-07-10 → 2024-07-31
Adds --disable-check flag to bypass validation and supports BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. CP connectivity testing
└──▷ GET THIS VERSION
$ git clone --branch v0.16.12 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:$ git checkout v0.16.12
action: Use github.action_path when accessing cilium.sh
Kata Containers 3.7 adds Firecracker backend, CNCF Confidential Container Runtime policy support, and SharedFS for remote hypervisors
└──▷ GET THIS VERSION
$ git clone --branch 3.7.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.7.0
Adds firecracker as a new hypervisor backend option in the runtime-rs agent
Enables pulling encrypted container images via standard OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registry calls without external credential helpers
Introduces support for the CNCF Confidential Container Runtime (coco) policy framework in the Go kata-runtime via the DAN (Device Access Network) implementation
Implements SharedFS initialization for remote hypervisor configurations to allow shared volume mounts
Adds --start-interval flag to healthcheck configuration for fine-grained startup probe timing.
Supports custom image reference lookup functions for cache push/pull in imagebuildah.
Adds initial NetBSD platform support.
Preserves owner info when using buildah copy --from= a container or image.
Changes default pull behavior for podman build to --pull missing.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The default for podman build is changed to --pull missing (previously pulled always); existing workflows that relied on always pulling fresh images will now use cached images when present.
!imagebuildah no longer uses traditional volume handling by default; builds relying on the previous volume behavior may behave differently without explicit configuration.
Adds nuking support for Network Firewall, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Lattice, Kinesis Firehose, RDS Proxy, App Runner, DataSync and more
└──▷ GET THIS VERSION
$ git clone --branch v0.37.0 https://github.com/gruntwork-io/cloud-nuke.git
# already have the repo? check out this version:$ git checkout v0.37.0
cloud-nuke now nukes Network Firewall resources (e.g., network-firewall/resource-policies, network-firewall/firewalls).
cloud-nuke now nukes VPC Lattice services (via the new vpc-lattice resource class).
cloud-nuke now nukes Kinesis Firehose delivery streams.
cloud-nuke now nukes RDS Proxy instances and proxy targets.
Adds support for nuking App Runner services (apprunner/service).
+2 moreshow less
Adds support for nuking DataSync Tasks (datasync/task) and DataSync Locations (datasync/location).
cloud-nuke can now skip the cloud-nuke-first-seen tag addition via a new configuration option.
Prowler 4.3.0 adds 32 new AWS/Azure checks, GCP service account impersonation, and configurable EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. logging.
└──▷ GET THIS VERSION
$ git clone --branch 4.3.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 4.3.0
└──▷ TRY IT
Authenticate to GCP using service account impersonation instead of a credentials file — useful for enforcing least-privilege scanning without storing key files.
Audit only the new Azure App Functions security checks to assess function app posture quickly.
$ prowler azure --list-checks--service app
Adds 24 new AWS checks across DMS, DocumentDB, Elasticache, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., Neptune, NetworkFirewall, and RDS services.
Adds 8 new Azure App Functions checks covering access keys, App Insights, managed identity, public access, runtime version, VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. integration, and FTPSFTPSFTP with TLS/SSL encryption layered on top, standardized in RFC 4217, used by tools that need to transfer files over authenticated, encrypted channels while staying compatible with legacy FTP infrastructure..
Supports GCP Service Account impersonation via --impersonate-service-account <service-account-email>, removing the need for a credentials file.
Makes eks_control_plane_logging_all_types_enabled check configurable via Prowler config.
4 details in Everything
1 more release in this issue
· 2024-07-04 → 2024-07-29
$ git clone --branch 3.16.11 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 3.16.11
ignore_unused_services boolean flag (default true) added to .prowler/config to exclude cloud provider service APIs that are not currently in use from scanning.
Policy Sentry 0.13.0 adds Python 3.13 support and faster IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. DB loading.
└──▷ GET THIS VERSION
$ git clone --branch 0.13.0 https://github.com/salesforce/policy_sentry.git
# already have the repo? check out this version:$ git checkout 0.13.0
Supports Python 3.13.
Improves IAM DB loading performance.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Python 3.7 is no longer supported; upgrade to Python 3.8+ before upgrading.
!Path constants changed from str to Path type, which may break code or configs that pass these constants as strings.
!Deprecated code has been removed; any usage of previously deprecated APIs will break.
!AWS docs removed from the wheel and JSON minified; tooling that relied on bundled AWS docs or unminified JSON files will break.
1 more release in this issue
· 2024-07-08 → 2024-07-21
Adds query CLI subcommand for retrieving IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. service data directly from Policy Sentry
└──▷ GET THIS VERSION
$ git clone --branch 0.12.14 https://github.com/salesforce/policy_sentry.git
# already have the repo? check out this version:$ git checkout 0.12.14
Cloud Custodian 0.9.39 adds 8 new AWS resource types, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. SSM inventory filter, S3 object lock filter, and more.
└──▷ GET THIS VERSION
$ git clone --branch 0.9.39.0 https://github.com/cloud-custodian/cloud-custodian.git
# already have the repo? check out this version:$ git checkout 0.9.39.0
New aws.codebuild-credential resource for managing CodeBuild source credentials.
New aws.servicediscovery-namespace resource with instance filter for AWS Service Discovery namespaces.
New AWS Network Manager resources: aws.networkmanager-core, aws.networkmanager-global, aws.networkmanager-site, aws.networkmanager-device, and aws.networkmanager-link.
New aws.memorydb-subnet-group resource, plus subnet, kms-key, security-group, and network-location filters on aws.memorydb.
New ssm-inventory filter on aws.ec2 to query EC2 instances by SSM inventory and installed packages.
+7 moreshow less
New lock-configuration filter on aws.s3 to check S3 object lock settings.
New db-parameter filter on aws.rds-param-group and aws.rds-cluster-param-group for inspecting RDS parameter group values.
New content and marked-for-op filters plus tagging actions (tag, remove-tag, rename-tag, copy-related-tag, auto-tag-user, mark-for-op) on aws.ssm-document.
New App Mesh filters: route, router, and service on aws.appmesh-mesh; gateway-route on aws.appmesh-virtualgateway.
Adds values_from support for DynamoDB as a data source in policy filters.
New time-range filter on gcp.api-key to find API keys by creation or update time.
ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. resources now include configuration information in policy evaluation.
Hunters Pathfinder AI adds SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Queue custom views, F5 Big IP WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. integration, and new Google/GCP threat detectors.
!The default confidence score for windows_event_machine_account_certificate_authentication is lowered to medium (from high) and no leads are entered into the SOC queue.
New Netscaler AppFW and GitLab Audit Logs integrations, Snowflake situational awareness detector, and enhanced plain text password discovery.
Adds Netscaler Application Firewall integration with ingestion to the data lake, IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search mapping, and Hunters Web Requests Schema mapping.
Adds GitLab Audit Logs integration with ingestion to the data lake and IOC Search mapping.
Adds new detector snowflake_query_awareness_behavior for identifying multiple situational awareness database commands executed within a 30-minute window on Snowflake accounts.
Improves edr_plain_text_password_discovery detector by replacing Windows Sid field with username extracted from target_file_path, adding user_folder_name field to EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. file events, and filtering out PDFs and Ivanti processes.
Hunters Pathfinder AI July 2024 adds SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Queue tabs, Detectors UI revamp, custom scoring API, SQL detectors, and new integrations.
Adds SOC Queue tabs to create customized, shareable views of the SOC Queue
Revamps the Detectors page UI with enhanced functionality to answer environment-specific detector questions
Introduces the Leads Scoring API endpoint for programmatic management of custom scoring rules
Enables SQL Custom Detectors (Raw SQL Auto and Scheduled) via the Detectors API
Improves lead view with collapse/expand all, default enrichment visibility, integrated Lead activity on Summary page, CSV export of activity, and quick-copy functionality
+4 moreshow less
Adds new workflow triggers: Lead Was Managed, Story Was Managed, and New/Updated Comment for bi-directional ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. sync
Adds Armis integration for IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search mapping and native alerts
Adds AWS Transit Gateway Flow Logs integration with network schema and IOC Search mapping
Adds Linux IP Tables (Shorewell) integration with network schema and IOC Search mapping
Sekoia.io adds GA Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. and Veeam Backup & Replication integrations with specific log collection.
Adds Fastly Next-Gen WAF Audit Logs integration to collect Corp audit logs and Site audit logs for monitoring unusual admin activity in your WAF
Adds Veeam Backup & Replication integration to collect Application, File, Network and Service logs to monitor your critical backup and replication systems
2 details in Everything
7 more releases in this issue
· 2024-07-01 → 2024-07-31
Sekoia.io adds BETA integrations for ESET Protect/Inspect, Juniper Switches, Azure App Gateway, EfficientIP and Sesame it Jizô NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems.
Adds ESET Protect / Inspect [BETA] integration to collect alerts and telemetry from Cloud and On-prem versions
Adds Juniper Switches [BETA] integration to collect firewall logs from Juniper switches
Adds Azure Application Gateway [BETA] integration to collect access and firewall logs
Adds Efficient IP [BETA] integration to collect DNS logs from EfficientIP SOLIDserver
Adds Sesame it Jizô NDR [BETA] integration to collect logs from the Jizô NDR network observability platform
Adds support for embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. and drag-and-drop of images directly in notebook markdown cells
Supports drag-and-drop of images from desktop into markdown cells to automatically upload and display them
Enables embedding images directly within markdown cells
Databricks GA adds support for Cloudflare R2 as cloud storage for Unity Catalog and Delta Sharing.
Cloudflare R2 is now generally available for use as cloud storage for data registered in Unity Catalog
Support for Cloudflare R2 extends to all Databricks data and AI assets previously supported in AWS S3, Azure Data Lake Storage, and Google Cloud Storage
Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access. adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support for SQL Server connections in Unity Catalog
New open-source Databricks JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. driver enters public preview with OAuth, Cloud Fetch, and Unity Catalog volume ingestion support.
Adds OAuth authentication support to the JDBC driver
Databricks Dedicated compute now supports fine-grained access control with materialized views and streaming tables via Databricks Runtime 15.4 LTS.
Adds Databricks Runtime 15.4 LTS support for fine-grained access control on dedicated compute resources, routing specific queries to serverless compute for data filtering.
Databricks Mosaic AI adds support for Meta Llama 3.1 models (8B, 70B, 405B) in Model Serving.
Adds Meta-Llama-3.1-405B-Instruct and Meta-Llama-3.1-70B-Instruct to Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. pay-per-token endpoints
Enables production usage of the full Llama 3.1 suite (8B, 70B, 405B) via provisioned throughput in the US region
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Starting July 23, 2024, Meta-Llama-3.1-70B-Instruct replaces support for Meta-Llama-3-70B-Instruct in Foundation Model APIs pay-per-token endpoints.
Unity Catalog enforcing self-assuming IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles for all storage credentials by Jan 20, 2025
Enforces that AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. roles for storage credentials must be self-assuming, ceasing work of non-compliant credentials.
Requires new storage credentials to use self-assuming IAM roles starting September 20, 2024.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Storage credentials using non-self-assuming AWS IAM roles will cease to work on January 20, 2025.
End of support for Databricks-managed passwords (basic auth)
└──▷ BREAKING ON UPGRADE
!Users attempting to authenticate with Databricks-managed passwords to the UI or APIs will be rejected; a unique code is sent via email instead if SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. is not configured.
Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access. now supports Salesforce Data Cloud in public preview
Adds support for running federated queries against data managed by Salesforce Data Cloud
Databricks expands authentication methods to support one-time passcodes and external identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
Enables users to authenticate via one-time passcodes or external accounts such as Google and Microsoft.
Google SecOps July 18, 2024 adds support for migrating RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. to IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. via auto-generated commands.
Adds auto-generated commands to migrate existing feature RBAC configuration to IAM permissions and roles when binding an instance to a Google Cloud project.
Trend Vision One ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. On-Premises Gateway v1.0.48 adds reverse proxy and rate limiting for private AI service access
Adds reverse proxy mode to the On-Premises Gateway to support private AI Service Access or general internet access
Adds rate limit configuration capability in reverse proxy mode specifically for private AI Service Access
2 details in Everything
24 more releases in this issue
· 2024-07-01 → 2024-07-29
This release introduces a new UI-driven workflow for security awareness training. Administrators can now trigger campaigns directly from specific high-risk user widgets, reducing the steps needed to educate at-risk staff.
Custom correlation rules for anomaly detection added to Correlated Intelligence in Cloud Email and Collaboration Protection.
Adds the ability for administrators to create custom correlation rules based on predefined detection signals for anomaly detection within Correlated Intelligence.
New Add to Block List response action for Cloud Email and Collaboration Protection administrators
Adds Add to Block List response action on the Operations → User-Reported Emails screen to add senders to TrendAI Vision One Suspicious Object List
Extends account-based response actions on the Top 5 Users with Account Takeover Risks Dashboard widget to include Disable User Account, Force Sign Out, Force Password Reset, and Add to Block List
This release extends the Zero Trust Internet Access On-Premises Gateway to support multiple on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. integrations for NTLMv2NTLMv2A Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. or KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. authentication.
View and manage IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses in Internet-Facing Assets within Attack Surface Discovery.
Supports viewing discovered IPv6 addresses for Public IPs in the Internet-Facing Assets section of Attack Surface Discovery
Enables adding individual IPv6 addresses to your organization in the Internet-Facing Assets section
Trend Vision One Virtual Network Sensor adds Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. platform support
ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. On-Premises Gateway 1.0.46 adds High Availability for NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent./KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. auth proxy and improved status handling.
Authentication proxy service for NTLM/Kerberos authentication now supports High Availability with load balancer
Authentication proxy service for NTLM/Kerberos authentication supports multiple on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. servers as round-robin or failover High Availability
Enhanced handling of changes in on-premises gateway status: healthy, unhealthy
Virtual Network Sensor v1.0.1316 adds deployment support for Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. and Google Cloud platforms.
Adds support for deploying on the Nutanix AHV platform
Adds support for deploying on the Google Cloud platform
XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. for Cloud now monitors AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. flow logs using TrendAI Vision One™ to detect malicious traffic, IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., and specific attack patterns like brute force and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
Container Inventory adds filter, search, and page view for K8S and ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. elements
Trend Vision One now allows enabling or disabling runtime security and scanning on multiple AWS ECSAWS ECSAmazon's managed container orchestration service that runs Docker containers on clusters of EC2 instances or Fargate, letting tools offload scheduling, scaling, and infrastructure management to AWS. clusters.
Adds the ability to enable or disable runtime security and runtime scanning on multiple Amazon ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. clusters in Container Inventory
Trend Vision One Identity Inventory private preview adds identity tracking for human/non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. and entitlements.
Adds Identity Inventory private preview feature within the Identity Security app group to track human and non-human identities, assigned entitlements, and privileges.
Enables viewing summaries of groups, roles, and devices registered with identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. (e.g., Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.) via the UI.
Sophos Central adds Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. Security V2 integration, public APIs for Detections/Cases, and a new alerts dashboard.
└──▷ HOW TO FIND IT
Locate and open the new default alerts dashboard in the console.
📍Manage Dashboards › Find Dashboards › All alerts
Adds Microsoft Graph Security V2 integration for threat investigation in Sophos XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools.
Releases two new public APIs for integration with Detections and Cases in Sophos XDR
Adds a pre-defined All alerts dashboard accessible via the Find Dashboards feature
Search now supports uuid function within calc operator for dynamic UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. generation.
Adds uuid function to the calc operator to generate UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. in search queries
Improves flexibility of the calc operator by enabling UUID generation capabilities
2 details in Everything
9 more releases in this issue
· 2024-07-02 → 2024-07-29
ThreatStream adds bidirectional integration with ServiceNow ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows..
ThreatStream OnPrem v5.8 adds multihoming, STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. location support, Sigma evaluation in AQL, Polyswarm sandbox, and new UI fields.
Adds source_locations and target_locations intelligence fields for advanced search and filtering
Adds OS upgrade to Ubuntu 22 LTS and password authentication to Elastic Search
Adds Source Locations and Target Locations fields to Import Assistant, observable details pages, and Threat Models
Adds 325 STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 locations (27 regions, 247 countries, 50 US States, Washington DC) support
Adds 'Add to New (for each rule match)' action to rules for creating investigations per match
+6 moreshow less
Adds AQL Search capability to initiate Sigma rule evaluation from a Sigma signature details page
Adds Export MITRE ATT&CK to JSON option to investigation details pages export menu
Adds Polyswarm as a sandbox service for malware detonation
Adds Can Audit permission control setting to User Admin tab
Allows Read Only users to view their API Key on the My Profile tab
Adds support for STIX 2.1 Notes in Observable details
Adds SKIP_FRONTEND deployment option to disable UI, new GraphQL API for STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. bundle ingestion
└──▷ GET THIS VERSION
$ git clone --branch 6.2.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.2.6
SKIP_FRONTEND deployment option allows disabling the user interface during installation.
New GraphQL API endpoint send_stix_bundle enables sending STIX bundles into the ingestion process programmatically.
OpenCTI 6.2.4 adds AWS Signature Version 4 support for OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. integration
└──▷ GET THIS VERSION
$ git clone --branch 6.2.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.2.4
Adds AWS_SIGNATURE_VERSION_4 configuration to enable SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets. authentication for the OpenSearch client
OpenCTI 6.2.2 adds Malware-Analyses and Tasks creation from the knowledge tab, allows sharing inferred relationships with organizations, and improves UI tooltips.
└──▷ GET THIS VERSION
$ git clone --branch 6.2.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.2.2
└──▷ HOW TO FIND IT
Contextually create a malware analysis from an indicator's knowledge page.
📍In the console, navigate to a Knowledge object, open its tabs, and select Malware-Analyses to create a new entry.
Share an inferred relationship with a specific organization in the UI.
📍In the console, locate an inferred relationship in the list view and use the Share action to select organizations.
Adds Malware-Analyses and Tasks creation options directly from the knowledge tab
Feedly Threat adds 2FA via TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. and exports TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. to ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Navigator
Adds two-factor authentication using a TOTP authenticator for Feedly login types, accessible from the Logins page in settings
Enables exporting TTPs to ATT&CK Navigator directly from Threat Actor and Malware Insights Cards
2 details in Everything
2 more releases in this issue
· 2024-07-03 → 2024-07-31
Adds Anomali ThreatStream integration for automated threat intel ingestion and double opt-in for EU newsletter compliance.
Adds Anomali ThreatStream integration to ingest Feedly AI-discovered IoCs, threat actors, malware, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., and CVE relationships.
Adds double opt-in process for automated newsletter emails to support GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. compliance in the European Union.
Yeti 2.1.10 adds observables delete endpoint, new DFIQ archive endpoint, and YARAify/ETOpen feeds
└──▷ GET THIS VERSION
$ git clone --branch 2.1.10 https://github.com/yeti-platform/yeti.git
# already have the repo? check out this version:$ git checkout 2.1.10
Adds DELETE /api/observables/<id> endpoint to remove observables via API
Adds GET /api/dfiq_archive endpoint for DFIQ-related data access
Adds technique_id field in MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. technique aliases
Enables integration with YARAify feed for YARA rule management
Integrates ETOpen feed for open threat intel collection
Tenzir is a data pipeline engine for security teams that collects, transforms, enriches, and routes telemetry.
Tenzir v4.19.0 adds a package manager and an in-memory buffer operator for back pressure control.
Adds buffer operator to store up to the specified number of events in memory, breaking back pressure for pipelines handling data spikes
Adds package operator to deploy combinations of pipelines and contexts as sets, loading from <configdir>/tenzir/package/<package-name>/package.yaml on startup
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The /serve endpoint's use_simple_format option is ignored; the endpoint now always uses the simple output format for schema definitions.
5 more releases in this issue
· 2024-07-04 → 2024-07-26
Tenzir v4.18.0 introduces operator-specific metrics, API metrics, a name argument for the metrics operator, and a --parallel option for export.
└──▷ TRY IT
Filter metrics to show only CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage by passing the specific metric name to the metrics operator.
$ metrics cpu
publish, subscribe, import, export, lookup, and enrich operators deliver their own, operator-specific metrics
metrics operator now accepts an optional name argument to filter specific metric types
New tenzir.metrics.api metrics record every API call made to a Tenzir Node
Emit connection status metrics via the new tenzir.metrics.platform metrics
Revamp the export operator with a new --parallel <level> option to tune worker threads
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The deprecated vast symlink for the tenzir-ctl binary no longer exists.
!The deprecated tenzir.db-directory option is removed; use tenzir.state-directory instead.
!The previously deprecated --low-priority option for the export operator no longer exists.
Sigma r2024-07-17 adds 62 new detection rules covering Kapeka backdoor, Kubernetes, macOS, AWS/cloud, and Windows Recall.
└──▷ GET THIS VERSION
$ git clone --branch r2024-07-17 https://github.com/SigmaHQ/sigma.git
# already have the repo? check out this version:$ git checkout r2024-07-17
Adds full Kapeka backdoor detection suite: autorun persistence, configuration persistence, execution via RunDLL32, scheduled task creation, and decrypted backdoor indicators.
Adds Kubernetes detection rules for admission controller modification, CronJob/Job modification, rolebinding modification, secrets modification/deletion, and unauthorized/unauthenticated access.
Adds macOS detection rules for file download via nscurl, system information discovery via sysctl, Time Machine backup deletion/disabling, and new Time Machine exclusion additions via tmutil.
Adds Windows Recall feature enablement detection via registry value deletion, registry key, and Reg.EXE execution.
Adds DSInternals suspicious PowerShell cmdlet detection (standard and ScriptBlock variants).
+22 moreshow less
Adds HackTool detections for Evil-WinRm, LaZagne, RemoteKrbRelay (including SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. relay secrets dump), and SharpDPAPI.
Adds cloud-focused rules for malicious IMDS credential usage outside AWS infrastructure, potential malicious CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. System Manager usage, and Ingress/Egress/LoadBalancer/RDS security group modifications.
Adds LocaltoNet and Portmap.IO tunneling service communication detection (Windows and Linux).
Adds DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. sideloading detections for DbgModel.DLL, MpSvc.DLL, and MsCorSvc.DLL.
Adds CVE-2023-1389 exploitation detection for unauthenticated command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. in TP-Link Archer AX21.
Adds DPAPIDPAPIA Windows OS cryptographic API that encrypts and decrypts secrets tied to a user or machine identity, so applications can store credentials without managing raw keys themselves. backup keys and certificate export activity IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. rule.
Adds Windows LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. credential dump from Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. detection.
Adds DNS query and network connection rules for AzureWebsites.NET by non-browser processes and Cloudflared tunnel domains.
Adds DarkGate loader drop detection in C:\Temp directory.
Adds Directory Service Restore Mode (DSRM) registry value tampering detection.
Adds detection for COM object hijacking via modification of default system CLSID default value.
Adds detection for BitlockerTogo.EXE execution.
Adds detection for renamed Microsoft Teams execution.
Adds detection for periodic backup of system registry hives being enabled.
Adds detection for PDF file created by RegEdit.EXE.
Adds detection for network connections initiated from the Users\Public folder.
Adds detection for potentially suspicious Qemu usage.
Adds detection for Microsoft Word add-in loaded.
Adds detection for uncommon file creation by MySQL daemon process and uncommon process access rights for target image.
Adds detection for files with system DLL names in unexpected locations.
Adds New Network ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. Entry and New Network Route Added cloud audit rules.
v4.37.0 adds 16 new detections for AcidPour, Gozi, ShrinkLocker, MOVEit CVE-2024-5806, Ivanti CVE-2024-29824, and VMware ESXi CVE-2024-37085.
└──▷ GET THIS VERSION
$ git clone --branch v4.37.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v4.37.0
New Analytic Story: AcidPour — covers wiper malware TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. targeting Windows environments via registry modifications.
New Analytic Story: Gozi Malware — detections for Gozi malware techniques including registry-based persistence.
New Analytic Story: ShrinkLocker — detections for ShrinkLocker ransomware techniques including BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. configuration abuse.
New Analytic Story: MOVEit Transfer Authentication Bypass — covers CVE-2024-5806 improper authentication in MOVEit SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. service.
New Analytic Story: Ivanti EPM Vulnerabilities — covers CVE-2024-29824 SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. leading to remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8).
+12 moreshow less
New Analytic Story: VMware ESXi AD Integration Authentication Bypass CVE-2024-37085 — detects re-creation of the ESXi Admins AD group to gain full hypervisor access.
New detection: Ivanti EPM SQL Injection Remote Code Execution — identifies exploitation of CVE-2024-29824.
New detections: MOVEit Certificate Store Access Failure and MOVEit Empty Key Fingerprint Authentication Attempt — surface CVE-2024-5806 exploitation attempts.
New detections: Windows ESX Admins Group Creation via Security Event, Net, and PowerShell — catches CVE-2024-37085 privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. on ESXi hosts.
New detection: Windows Known Abused DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Loaded Suspiciously — flags suspicious loading of commonly abused DLLs.
New detections: Windows LOLBASLOLBASLiving Off the Land Binaries and Scripts — legitimate Windows executables and scripts that attackers abuse to run malicious code, letting cyber tools detect or emulate attacker behavior without custom malware. Executed As Renamed File and Windows LOLBAS Executed Outside Expected Path — identify living-off-the-land binary abuse by name/path anomalies.
New detections: Windows Modify Registry Configure BitLocker, Delete Firewall Rules, Disable RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., on Smart Card Group Policy, to Add or Modify Firewall Rule, and Outlook WebView Registry Modification — cover registry-based attack techniques used by AcidPour, Gozi, and ShrinkLocker.
New detection: Windows Privileged Group Modification — detects unauthorized changes to privileged Windows groups.
New macro: remote_access_software_usage_exceptions — enables allowlisting in remote access software detections.
New lookup: remote_access_software_exceptions — supports the new exception-based remote access software detection workflow.
Updated lookup: remote_access_software — expanded list of known remote access software signatures used across related detections.
Updated lookup: lolbas_file_path — expanded reference data supporting the new LOLBAS path/rename detections.
17 details in Everything
1 more release in this issue
· 2024-07-17 → 2024-07-31
New detection: Internal Horizontal Port Scan — alerts on internal hosts scanning multiple targets on the same port.
New detection: Internal Vertical Port Scan — alerts on internal hosts scanning multiple ports on a single target.
New detection: Windows AD add Self to Group — catches adversaries adding their own account to AD groups for privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources..
+5 moreshow less
New detection: Windows Increase in Group or Object Modification Activity — surfaces anomalous spikes in AD group/object changes.
New detection: Windows Increase in User Modification Activity — surfaces unusual spikes in AD user account modifications.
New detection: Windows Network Share Interaction With Net — detects suspicious use of the Net command against network shares.
New detection: Windows Vulnerable Driver Installed — alerts when a known-vulnerable driver is installed on a Windows endpoint.
Adds new data_source objects to the content library.
Kunai v0.2.6 adds richer rule conditions and negative event-ID filtering for more precise detections.
└──▷ GET THIS VERSION
$ git clone --branch v0.2.6 https://github.com/kunai-project/kunai.git
# already have the repo? check out this version:$ git checkout v0.2.6
Adds none of them, none of $VAR_PREFIX, any of them, any of $VAR_PREFIX, all of them, all of $VAR_PREFIX, N of them, and N of $VAR_PREFIX condition expressions to rule definitions.
Supports prefixing event-IDs with - (minus) in event selection to exclude specific event types from processing.
2 details in Everything
1 more release in this issue
· 2024-07-19 → 2024-07-30
Beelzebub v3.2.2 adds Llama3/Ollama support for locally-hosted AI-powered honeypot deception.
└──▷ GET THIS VERSION
$ git clone --branch v3.2.2 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.2.2
└──▷ USE IT
Run a honeypot service backed by a local Llama3 model via Ollama instead of a cloud LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., keeping attacker interaction data fully on-premises.
yaml
Configure your service YAML to set the LLM provider to Ollama with the llama3 model, point the endpoint at your local Ollama instance (e.g. http://localhost:11434), then start Beelzebub as normal.
Supports Llama3 via Ollama as a local LLM backend for AI-driven honeypot responses, enabling on-premises deception without external API dependencies.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!The YAML service interface has been refactored — existing service configuration files may require updates to match the new structure.
Cribl Stream 4.7.2 adds OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. Traces Function, HTTP source IP allowlist/denylist regex, and new retry/config settings for sources/destinations.
OTLP Traces Function now available to normalize and batch OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. trace events (supports OTLP 0.10.0 and 1.3.1)
HTTP-based Sources support IP allowlist regex and IP denylist regex options
Retries section added to Kafka, Confluent Cloud, Amazon MSK, and Azure Event Hubs Sources and Destinations
Datadog Destination uses api/v1/distribution_points endpoint for distribution metrics
DNS resolution period setting added to Syslog (UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.), SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale., and Metrics (UDP) Destinations
+4 moreshow less
Filesystem Destination gains Compression level and Writing high watermark (KB) settings
REST Collector adds Retry-After header name setting
Cribl.Cloud Admins can edit and delete Members and Teams via UI
Audit logs now capture filter expressions for traceability
9 details in Everything
└──▷ BREAKING ON UPGRADE
!Scripts are disabled by default in new deployments; admins must explicitly enable them
Devicie launches new Portal UI for monitoring device metrics and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. compliance
Adds the Devicie Portal as a new web interface for logging in and viewing environment metrics
Fleet 4.54.0 adds iOS/iPadOS labels, label-scoped MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. profiles, upcoming maintenance windows, and configurable script timeouts.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.54.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.54.0
└──▷ TRY IT
Filter mdm_commands output to a specific host and command type to quickly audit pending MDM commands without waiting on a slow full-table response.
$ fleetctl get mdm_commands --host <hostname> --type ProfileList
Enables fleetctl gitops to rename teams by applying the same YAML filename with an updated team name.
Expands fleetctl query --hosts to accept hostnames, host UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., and/or hardware serial numbers.
Adds a host's upcoming scheduled maintenance window to the host details UI page and host API responses.
Adds TLS connection testing with the embedded certs.pem to fleetctl debug connection.
Adds host display name to calendar event descriptions.
+16 moreshow less
Adds .yml and .yaml file-type validation with error messaging to fleetctl apply.
Adds built-in iOS and iPadOS manual labels for MDM targeting.
Adds aggregation of iOS/iPadOS OS versions.
Adds support for renewing SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. certificates with custom enrollment profiles.
Adds automatic install of the latest released fleetd version when a host turns on MDM.
Adds support for END_USER_EMAIL and FLEET_DESKTOP parameters to Windows MSI install packages.
Adds labels_include_all and labels_exclude_any fields to the API for targeting MDM custom profiles/settings (with labels accepted as a deprecated alias for labels_include_all).
Adds fleetctl gitops and fleetctl apply support for labels_include_all and labels_exclude_any when configuring custom settings.
Adds UI for uploading custom profiles targeted to hosts matching all/excluding any selected labels.
Makes host script execution timeout configurable via agent options using script_execution_timeout.
Switches fleetctl run-script to a polling mechanism to support longer script timeout values.
Restricts arbitrary and saved script execution to admins and maintainers only (observer and observer+ roles excluded).
Updates fleetctl get mdm_commands to return 20 rows and adds --host and --type filters for faster responses.
Adds a Vulnerable filter to the host details software table.
Allows device users to reinstall self-service software from the UI.
Increases the timeout of the upload software installer API endpoint to 4 minutes.
21 details in Everything
└──▷ BREAKING ON UPGRADE
!Before migrating to this version, delete any existing labels named iOS or iPadOS — they will conflict with the new built-in iOS/iPadOS labels.
!fleetctl gitops team-rename support requires that fleetctl gitops has been run at least once with this version or later before renames will work correctly.
NodeZero July 2024 adds AWS and Azure gray-box pentests, a new test category workflow, and attack content for GeoServer and WhatsUp Gold.
Introduces NodeZero AWS Pentest, a gray-box assessment using a read-only role to analyze AWS accounts
Introduces NodeZero Azure Entra ID Pentest, a gray-box pentest using injected Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. and privileged AD credentials for hybrid environment analysis
Adds a new Pentest Setup Workflow allowing selection across four categories: Infrastructure Attack Surface, Identity Attack Surface, Operational Scenario Testing, and Rapid Response
Enhances AWS analysis with Lambda Function Code Extraction to detect sensitive information like AWS credentials
Enhances AWS analysis with EC2 Instance User Data Extraction to analyze for sensitive information such as AWS keys
Tenable One adds OT Exposure data as a source for Attack Path with new search filters and navigation options.
Adds OT Exposure (OT data) as a data source within the Attack Path application
Adds OT data source search filters to refine OT attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. results
Adds OT weakness search filters to narrow results by specific weaknesses
Adds OT detection filters to filter detections within the OT context
Adds OT Technique filters to filter by specific techniques in OT paths
New IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Connectors engine for VMS/IoT integration, Nested OT device detection, and DFE cloud updates
Adds IoT Connectors engine to integrate IoT or VMS servers via remote API or agent for device import.
Enables visual tracking of asset relationships using the Related Assets tab on the single asset page.
Adds detection of nested OT devices (e.g., PLC modules behind a backplane) for Rockwell connection types like CIP, DirectNet, and ControlNet.
Allows Dynamic Fingerprinting Engine (DFE) updates to be downloaded and applied directly from the cloud.
Adds PDF export capability for Executive Summary reports via Dashboards > Executive Report.
+5 moreshow less
Enables bulk or single asset diagnostic report exports for support purposes via Export Diagnostics.
Introduces a separate Ping query based on ICMP to test asset routability in Active Queries Management.
Adds Try Anyway button in Active Queries Management to override limits on the number of active query attempts during troubleshooting.
Allows viewing Tenable customer ID in the About view accessed via the username drop-down menu.
Synchronizes open ports on monitored assets when integrated with Tenable One for dynamic tagging.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The ActiveQueriesOpType type was removed; fields like ActiveQuery.operation, AssetDiscovery.operation, and PortScan.operation now use OpType! instead of ActiveQueriesOpType!.
!Field PingEnabled was removed from the Config object type.
!Enum values PingType, NessusAdvancedScan2Type, NessusAdvancedScanType, DnsType, InactiveAssetProbe, PortScanAssetEnrichment, and PortScanQueryType were removed from their respective enums.
!Default value for argument countTimeout on fields like Asset.eventAggregations, Mutation.bulkEditAssets, Query.assets, etc. changed from 700 to 3000.
Tenable One ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adds Effective TLDs as asset discovery sources; Automation Rules appear in Activity Logs.
Displays automation rule state changes as system tasks in the User Activity Logs page
Tenable One Identity Exposure 3.76 adds IoE for conflicting principals and dangerous delegation SPN checks.
Adds Indicator of Exposure (IoE) check to identify duplicated (conflicting) security principals such as users, computers, or groups
Adds new IoE reason report that flags accounts where constrained delegation's msDS-AllowedToDelegateTo attribute references a non-existent Service Principal Name (SPN)
Increases the size limit for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. objects managed by Tenable One Identity Exposure
Tenable One Identity Exposure 3.75 adds Shadow Credentials IoE and groups Password Spraying alerts
Adds an Indicator of Exposure for shadow credentials in Windows Hello for Business to detect backdoors and misconfigurations of associated key credentials.
Suppresses Password Spraying alerts for DC Sync sources linked to Azure ADConnect (basic mode), NTDS Extraction from VSS Requestor or Veeam, Enumeration of Local Administrators when source user SID is unavailable (basic mode), Petit Potam when logon event retrieval fails, and Golden Ticket when source vectors cannot be fetched (basic mode).
Adds hundreds of new compliance report templates, dashboards, widgets, and findings filters for Host Audits in Tenable FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts..
Adds new Report template categories on the Reports page containing new templates under Host Audits
Adds Dashboard templates in the Template Library (via New Dashboard > Template Library) for Host Audits
Adds Dashboard widgets in the Widget Library for Host Audits
Adds new benchmarking and compliance filters in the Findings workbench under the Host Audits tab
Brinqa 11.27.31 adds Status Configuration migration and fixes for ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. filters, BQL builder, and report formatting.
Enables adding multiple filters to Access Control Lists (ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource.)
Updates Visual Query Builder to support saved queries
Adds custom date format support to the report builder
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The upgrade requires supervision due to the launch of the Status Configuration feature.
Edgescan v2024-07-10 adds auto-renew toggle API, restricts IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. user creation, updates AI Insights data handling and UI.
Adds ability to toggle the auto renew all button via frontend endpoints
Restricts identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. from creating new user accounts, reserving account creation for clients
Removes access to onboarding forms as they are deprecated
Excludes inactive assets from Gen-AI Insights correlations
Displays additional organization and sub-organization details for each insight
OSV-Scanner v1.8.2 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.4 and 1.5 output formats
└──▷ GET THIS VERSION
$ git clone --branch v1.8.2 https://github.com/google/osv-scanner.git
# already have the repo? check out this version:$ git checkout v1.8.2
Adds support for generating reports in CycloneDX 1.4 format.
Adds support for generating reports in CycloneDX 1.5 format.
Nessus 10.8 adds CVSSv4/EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scoring, Agent Profiles in Manager, offline mode, scan type decoration, IMDSv2 support
Adds CVSSv4 and EPSS scoring for vulnerability findings with view and filter capabilities
Adds the Sensors > Agent Profiles menu in Tenable Nessus Manager to create and manage agent profiles for linking agents and applying product versions
Adds an offline mode for Tenable Nessus Professional and Expert users with limited internet connectivity
Decorates scan results with a scan type field to differentiate scans
Adds import-certs CLI support for importing server chains
+2 moreshow less
Adds support for importing unencrypted scan databases
Adds IMDSv2 support for BYOL scanners in AWS
7 details in Everything
└──▷ BREAKING ON UPGRADE
!Support is removed for Red Hat Enterprise Linux 6, Debian 10, Ubuntu 14.04, and FreeBSD.
!The hostname package is now a dependency for Tenable Nessus rpm installations; the hostname package must be installed if not present.
!Tenable Nessus tracks WAS licenses against only the hostname and port instead of the full URL.
runZero 4.0.240725 adds TwinCAT ADSADSAlternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware. discovery and asset/vulnerability fields to Event templates.
Discovery: Added support for devices using the TwinCAT ADS protocol
Event templates: Added asset risk, vulnerability, and outlier fields
runZero 4.0.240716.0 adds --import-pcap CLI option and Meraki wired-MAC correlation.
runzero CLI scanner now supports the --import-pcap flag for importing packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files directly
Meraki connector assets now report the wired-side MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. to improve asset correlation
New search dimension via VulnCheck KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. and richer CrowdStrike data retrieval.
Intruder Q2 2024 adds subdomain discovery, login page scanning, AWS API identification, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. detection, Cloudflare integration, and Microsoft Sentinel/SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. consolidation.
Adds subdomain discovery on the Enterprise plan to find exposed subdomains.
Adds login page discovery to identify and scan web application login pages.
Adds automatic AWS API identification for targets requiring an API schema.
Adds WAF detection to identify targets blocked by a Web Application Firewall.
Adds cloud asset prompt to guide setup of cloud integrations for visibility.
+5 moreshow less
Adds Cloudflare integration to expand scanning of externally facing cloud assets.
Expands Attack Surface Visibility with improved Network view for exposed ports and services.
Adds 1,000+ attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. specific checks for issue detection on discovered assets.
Adds Microsoft Sentinel integration to consolidate data from disparate SIEM sources.
Adds Single Sign-On (SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.) via Okta for managing multiple teams and business units.
Nudge v2.0.5 adds -simulate-date CLI flag and minorVersionRecalculationThreshold config key for OS version SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. logic
└──▷ GET THIS VERSION
$ git clone --branch v2.0.5.81760 https://github.com/macadmins/nudge.git
# already have the repo? check out this version:$ git checkout v2.0.5.81760
Adds the minorVersionRecalculationThreshold config key under osVersionRequirement to control how many macOS minor versions back trigger the previous version's requiredInstallationDate.
Adds the -simulate-date CLI flag to override the built-in date check, allowing admins to test Nudge behavior for any arbitrary date.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The Actively Exploited logic change alters SLA computation, resulting in a different requiredInstallationDate than offered in Nudge v2.0 -> v2.01.
1 more release in this issue
· 2024-07-18 → 2024-07-25
Acronis Cyber Protect combines backup, disaster recovery, and endpoint protection in one platform for businesses and managed service providers.
Acronis Cyber Protect 24.07 adds Direct Backup to S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend./Impossible Cloud storage, Immutable Object Lock support, Okta SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integration, and XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. automated response play
└──▷ HOW TO FIND IT
Configure direct backup to AWS S3-compatible storage for a workload.
📍Steps: In the Cyber Cloud console, select the workload › Backup settings › Destination › Add Storage Location › Select S3-compatible or Impossible Cloud › Enter endpoint details and credentials › Save.
Enable Object Lock (immutability) on a backup location to prevent data deletion.
📍Steps: In the Cyber Cloud console, go to Storage Locations › Select your S3/Impossible Cloud location › Enable Object Lock › Set retention period (e.g., 90 days) › Save. Note: The immutability period is renewed automatically during scheduled backups.
Create an Automated Response Playbook to isolate critical incidents.
📍Steps: Go to Advanced Security + XDR › Automated Response Playbooks › Create New › Add Condition: Incident Severity is Critical › Add Action: Isolate Workload › Save and Enable the playbook.
Launch Acronis Copilot for an incident to get mitigation advice.
📍Steps: Navigate to the EDR/XDR incident investigation screen › Select a specific incident › Click Launch Copilot › Ask questions about the threat or request remediation steps.
Adds direct backup and restore capabilities for Windows/Linux workloads (physical, VM, files) to S3-compatible and Impossible Cloud storage instances without requiring additional Acronis Backup Gateway machines.
Enables Object Lock (immutability) on backups stored in Amazon S3, S3-compatible, or Impossible Cloud storage to protect data from ransomware, tampering, and accidental deletion.
Adds support for single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (SSO) and automated user provisioning to Acronis Cyber Protect Cloud via the Okta identity management system.
Introduces Automated Response Playbooks in Advanced Security + XDR, allowing Customer Administrators to create workflows that trigger actions such as isolating workloads, stopping processes, or quarantining files based on incident conditions like Critical.
Adds Acronis Copilot (Early Access), an AI-assisted chat tool within the EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device./XDR incident investigation screen for threat mitigation advice and similar incident detection analysis.
+3 moreshow less
Adds Email archiving for Microsoft 365 (Early Access Program), enabling historical email protection, search, preview, recovery, and regulatory compliance management.
Adds support for Disaster Recovery protection of Windows workloads with dynamic disks for virtual machines using agentless backup mode.
Enables IT technicians to cancel production failovers at any stage, including during preparation and finalization, in Advanced Disaster Recovery.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Effective from the Acronis Cyber Protect Cloud 24.09 release, Two-Factor Authentication (2FA) will be mandatory for all partners using paid services; the option to disable 2FA at the account level will no longer be available.
!The /api/ams/ REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. is being deprecated and replaced by a new public REST API; it is not an official or public API and will have no commitment to support one year after the official announcement of deprecation.
An open-source command-line backup program that stores encrypted, deduplicated snapshots on local disks, SFTP servers, and object storage.
restic 0.17.0 adds --delete for restore, --ncdu for ls, bitrot detection in diff, AWS Assume Role, FUSEFUSEA Linux kernel interface that lets userspace programs implement a filesystem without kernel code, maintained as part of the kernel project; tools use it to mount virtual or synthetic filesystems without requiring root or kernel modules.-T, and more.
└──▷ GET THIS VERSION
$ git clone --branch v0.17.0 https://github.com/restic/restic.git
# already have the repo? check out this version:$ git checkout v0.17.0
└──▷ TRY IT
Restore a snapshot and delete any destination files not present in the snapshot, producing a clean mirror of the backup.
Adds --delete option to restore command to remove files at the destination that are not in the snapshot.
Adds --ncdu option to ls command to output directory listings in ncdu JSON format.
Adds --json option to version command for machine-readable version output.
Adds --target option to the dump command to specify the output destination.
Adds --from-files and --from-exclude-files options to restore to read include/exclude patterns from files.
+29 moreshow less
Adds --overwrite option to restore to make overwrite behavior customizable (e.g., always, never, if-newer).
Adds --dry-run / -n support to restore command.
Adds bitrot detection to the diff command.
Adds --host environment variable support via RESTIC_HOST.
Adds support for a custom User-Agent header for outgoing HTTP requests.
Adds --forget-all flag to forget command to allow forgetting all snapshots in a group.
Makes key command's actions (add, list, passwd, remove) separate sub-commands.
Adds support for AWS Assume Role for the S3 backend.
Adds support for FUSE-T with mount on macOS.
Adds support for connecting to rest-server via unix socket.
Adds support for reading backup source from a command's standard output via --stdin-from-command.
Adds support for rewriting host and time metadata in snapshots using rewrite --new-host and rewrite --new-time.
Adds support for Extended Attributes on Windows NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT..
Adds backup and restore of SecurityDescriptors on Windows.
Backs up more file metadata on Windows (e.g., file creation time).
Adds feature flags system configurable via RESTIC_FEATURES environment variable.
Adds extended options to configure Windows Shadow Copy Service via -o vss.* flags.
Optionally skips snapshot creation if nothing changed via --skip-if-unchanged.
Includes snapshot size in snapshots command output.
Makes prune command resumable and significantly reduces its memory usage.
Makes ls use message_type field in JSON output for consistent JSON parsing.
Includes full key ID in JSON output of key list.
Includes snapshot ID in reason field of forget JSON output.
Returns exit code 10 when repository does not exist and exit code 11 when repository cannot be locked.
Disables S3 anonymous authentication by default.
Ignores s3.storage-class archive storage tiers for metadata objects.
Improves dump performance for large files.
Supports repositories with empty password.
(Alpha) stores deviceID only for hardlinks to reduce unnecessary metadata.
34 details in Everything
└──▷ BREAKING ON UPGRADE
!Restic now returns exit code 10 if the repository does not exist and exit code 11 if the repository cannot be locked; previously both returned exit code 1 — scripts that check for exit code 1 on these conditions will need updating.
!The ls command now locks the repository by default; use ls --no-lock to restore the previous lock-free behavior.
!The tag command no longer accepts --no-lock; it now always requires an exclusive lock.
!ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. release binaries now require at least ARMv6; ARMv5 and older are no longer supported.
!The legacy index format (used before restic 0.2.0) and s3legacy repository layout are deprecated and will be removed in the next minor version; run restic repair index to migrate.
1 more release in this issue
· 2024-07-01 → 2024-07-26
restic v0.16.5 adds AZURE_FORCE_CLI_CREDENTIAL to override Azure managed identity with CLI credentials.
└──▷ GET THIS VERSION
$ git clone --branch v0.16.5 https://github.com/restic/restic.git
# already have the repo? check out this version:$ git checkout v0.16.5
└──▷ TRY IT
Force restic to authenticate against Azure Blob Storage via the Azure CLI instead of managed identity — useful on developer workstations or in environments where managed identity is misconfigured.
Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.
Druva adds file-level restore to alternate locations on Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. when proxies are disconnected, plus UAE region support and credit usage email alerts
Adds file-level restore to an alternate location for Nutanix AHV backups when Prism Central/Element or backup proxies are disconnected
Adds data protection support for the UAE storage region in Enterprise Workloads
Adds email notifications for cloud administrators when Druva credit usage is nearing exhaustion or terms are expiring
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Druva has discontinued support for Windows 2008 and Windows 2008 R2 operating system editions in VMware, Hyper-V, File Server, MS SQL, and NAS.
3 more releases in this issue
· 2024-07-04 → 2024-07-15
Druva adds backup and restore capabilities for Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. data.
Adds support for backing up and restoring Microsoft Entra ID organizational resources directory, users, groups, roles, devices, enterprise applications, and app registrations.
Introduces the ability to compare changes between snapshots to review updates before recovery.
Veeam Kasten is a Kubernetes-native platform for backing up, restoring, and migrating containerized applications and their persistent data.
Kasten K10 7.0.5 adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. multi-cluster support, a disaster-recovery UI, and an overhauled Location Profiles page
└──▷ HOW TO FIND IT
Walk through the new disaster-recovery UI to restore a full Kasten instance after total cluster loss.
📍In the Kasten K10 UI, go to Settings › Disaster Recovery, select Recover Kasten from Disaster, and follow the multi-step wizard to restore the instance from a Location Profile.
Adds openshift.io/required-scc annotation to all K10 permanent running pods, forcing use of k10-scc SecurityContextConstraints on OpenShift 4.14+.
FIPS-enabled clusters can now join a Veeam Kasten multi-cluster instance and be promoted to multi-cluster primary.
General availability of a new UI for recovering an entire Kasten instance following the loss of a cluster.
The Location Profiles page gains a dedicated view page, multi-step form, and table view with filtering.
Acsense adds Recycle Bin for Okta with transaction-based undo, infinite retention, and Splunk SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration.
└──▷ HOW TO FIND IT
Revert an accidental Okta policy deletion by tracing the Transaction ID and undoing the change.
📍In the Acsense console, navigate to the Recycle Bin, locate the deleted object via its Transaction ID, and click Undo.
Recycle Bin feature enables one-click recovery of deleted Okta objects
Transaction ID tracing allows actor identification and reverting posture changes via one-click Undo
SIEM integration with Splunk for event-based tracking
1Password for Linux 8.10.36 adds Wi-Fi QR generation, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. search, item-list search, and sharing history views
Adds QR code generation for Wireless Router items to share Wi-Fi credentials via scan
Adds support for searching passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. in the vault
Adds the ability to search within a list of items (vault or category)
Adds View Sharing History capability for individual items
1Password for Windows 8.10.36 adds Wi-Fi QR generation, item search history, and passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. search.
Adds QR codes for Wi-Fi to Wireless Router items, with display controls in Settings > Security
Enables searching for passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. within the app
Allows viewing the sharing history of an item via View Sharing History in the ellipsis menu
Supports importing items using a CSV file from Chrome
QR code generation for Wi-Fi items and passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. search capability added
Generates QR codes in Wireless Router items to let others scan and auto-connect to Wi-Fi
New QR code generation for Wi-Fi items and search support for passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices..
Adds QR code generation for Wireless Router items so family and friends can automatically connect to Wi-Fi
1Password for Mac 8.10.36 adds Wi-Fi QR codes, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. search, per-item search, and sharing history
Adds wireless router items that generate Wi-Fi QR codes for automatic network connection, with display settings controlled in Settings > Security
Enables searching for passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. across the vault
Adds item-level search within a specific list (vault or category) via the search interface
Adds the ability to view sharing history for an item via View Sharing History in the ellipsis menu
1Password for Android 8.10.38-13 adds decimal point support in text fields, passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. for hyatt.com, and autofill warnings for unsecured sites.
create passkeys for hyatt.com now supported
decimal points allowed in certain text fields within items
pop-up warning when filling details on unsecured sites
1Password for iOS adds landscape scrolling, prioritized passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. autofill, and Safari setup UX improvements in v8.10.38-13.
Scroll through the account list while the app is in landscape mode
Prioritize passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. over Login items in autofill suggestions when both are available for a website
Receive a guided pop-up to start configuring 1Password for Safari
1Password for Android beta adds New Sign-In Experience via QR code and interactive Watchtower cards
Adds New Sign-In Experience to sign-in to an Android or iOS mobile device from a desktop app using a QR code (Manage Accounts > Accounts > Sign-In & Recovery)
Adds visual improvements to the Wi-Fi sharing QR code
July 30, 20247 releases · 2024-07-09 → 2024-07-30Stable
JumpCloud July 30, 2024: New API endpoints and config changes
Adds capability for users to reset passwords from the User Portal when MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. is enforced but not yet enrolled.
Deprecates GET request for api/systemusers/reactivate/{id} in favor of a new POST method.
Updates Dynamic Groups API memberQuery filter operators to require $lte and $gte instead of $le and $ge.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The GET https://console.jumpcloud.com/systemusers/reactivate/{id} endpoint is deprecated and returns a 404 error; clients must switch to POST https://console.jumpcloud.com/systemusers/reactivate/{id} with the activation email in the request body.
!Dynamic Groups API memberQuery filters using $le or $ge operators will no longer function; these must be replaced with $lte and $gte respectively.
6 more releases in this issue
· 2024-07-09 → 2024-07-30
JumpCloud adds Windows MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. policy framework via Configuration Service Providers (CSPs) with six new configurable policies
Adds a new Windows MDM Policy Management framework using Configuration Service Providers (CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks.)
Adds Install Certificate Policy to the CSP framework
Adds Bluetooth Configuration Policy to the CSP framework
Adds Control Policy Conflict (enabled by default) to the CSP framework
Adds Windows Notification Service (enabled by default) to the CSP framework
New global policy setting for managing MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. admin security posture.
Custom API Connector now supports OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. Client Credentials and additional headers.
Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 Client Credentials Grant Type support to the Custom API Integration
Adds ability to configure Additional Headers for Custom API Integrations
Ory Kratos adds ability to delete individual OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. credentials for precise user management
Dashboard adds guided setup walkthrough for frontend/backend projects and self-serve email reactivation for hard bounces.
Adds a guided walkthrough when creating a new Stytch Project to help developers choose between frontend or backend integration and run an example app in three steps
Enables developers to reactivate inactive email addresses directly in the Dashboard after resolving the cause of a hard bounce, removing the need to contact support
Passbolt v4.9.0 adds resource location display in grid, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. suspend strategy, and new API filters for search-aros and gpgkeys
Adds suspension strategy option to the LDAP integration settings UI and corresponding admin configuration to prevent user deletion on directory sync
Adds a has-users filter to the /gpgkeys.json index endpoint (/api/gpgkeys/index?has-users=1)
Adds location metadata (folder hierarchy) to resource grid rows and allows searching resources by parent folder names via the browser extension search
Nudge Security is a SaaS security platform that discovers shadow IT assets, manages identity governance, and hardens security posture.
Nudge Security adds automatic SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. spend discovery, billing owner identification, and a Spend card for app cost tracking.
Adds automatic categorization of apps as paid based on email invoices from the previous three years
Adds automatic identification of a billing owner and cost center for each paid app
Adds manual entry fields for estimated annual spend, billing frequency, and renewal date via the Spend card in App Overview
Adds the ability to sort, filter, and edit spend fields in bulk from the App view
Adds Settings > Organization Settings to customize the Google or Microsoft field used to allocate spend
+1 moreshow less
Adds Settings > Spend Settings to add additional mailboxes for billing information extraction
Nudge Security adds a Spend dashboard for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. cost consolidation and optimization insights.
Adds a new Spend dashboard to identify redundant or inactive SaaS subscriptions and optimize costs
Enables tracking of upcoming renewal dates alongside app usage information within the Spend view
Introduces detection of paid accounts associated with unapproved apps in the Spend dashboard
authentik 2024.6.2 adds configurable Outposts refresh interval and user reputation scores in admin UI
└──▷ GET THIS VERSION
$ git clone --branch version/2024.6.2 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:$ git checkout version/2024.6.2
└──▷ HOW TO FIND IT
View reputation scores for a specific user to assess their risk profile.
📍Navigate to Authentik Admin › Users, click on a user, and locate the Matching User Reputation Scores section in the details panel.
Show matching user reputation scores in the web/admin user details view
Netskope SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. 3.1 for Microsoft 365 and extends inventory API with new timestamps
/api/v2/spm/inventory/getresources now returns creation_time and last_updated_time fields in its response.
SSPM introduces support for the Center for Internet Security (CIS) 3.1 compliance standard for Microsoft 365.
Netskope SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. adds Domain and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. dimensions to Category field and new AI Usage Dashboard widgets
Adds Domain dimension (e.g., Auditing & Logging, Authentication) to the SSPM Category field group for data-related compliance requirements
Adds MITRE ATT&CK dimension to the SSPM Category field group to define adversary tactical goals like Credential Access or Defense Evasion
Adds Top Instances Detected: App/Instance/Activity widget to the AI Usage Dashboard
Adds Instance Details table widget to the AI Usage Dashboard
Netskope R117 adds Next Gen API DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for Dropbox/Teams/Salesforce, severity-based remediation, and new Threat Protection scan/alert capabilities.
General Availability of Next Generation API Data Protection for Dropbox
General Availability of Next Generation API Data Protection for Microsoft 365 Teams (Commercial)
General Availability of Next Generation API Data Protection for Salesforce
Support for new Revoke Users Added at the File Level and Revoke Public Sharing restrict access actions in Next Gen API Data Protection
Introduction of Legal Hold as a policy action destination for Microsoft 365 OneDrive, SharePoint, and Google Drive
+17 moreshow less
Severity-based remediation actions (low, medium, high) for threat protection in Next Generation API Data Protection
New Threat Protection capability to scan cloud email bodies and alert on malicious links via API connectors
Addition of APRA CPS 234 compliance standard in SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications.
SSPM visibility and risk profiling for 3rd party apps in Okta instances
New Workday rule template in SSPM
HTTP-Auto Detect capability to identify and inspect HTTP(s) traffic on non-standard ports in Cloud Firewall
Google Gemini instance ID detection support in Google App Suite
Microsoft Copilot Upload activity support via app connector
Support for Google Drive as a forensic destination in Next Gen Forensics
New Netskope Client UI indicators for NPA Internet Security and Private Access tunnel statuses on system tray icon and one-click menu
Netskope REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. to configure domain fronting exceptions using wildcard or full-domain matches
RBI Fallback Action setting for non-isolable requests (block vs proxy)
RBI browser source criteria requirement for all new/edit isolate policies
RBI popup message isolation indicator customization (border color, position, images, custom text with HTML tags)
Optional description field for Endpoint DLP device constraints
Preview images and extracted text in DLP incidents with sub-file download options
New with-decrypted Geneve option in Netskope stitcher tool CLI
22 details in Everything
└──▷ BREAKING ON UPGRADE
!Classic Azure Blob Storage is no longer supported as a forensic destination for new instances; the UI checkbox is removed and cannot be re-enabled if disabled.
Bytebase 2.22.0 adds PostgreSQL blocking session monitoring, Oracle auto-completion, Hive KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. auth, and SQL Server MS_Description sync
└──▷ GET THIS VERSION
$ git clone --branch 2.22.0 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 2.22.0
Support monitoring blocking sessions during PostgreSQL task execution.
Support auto-completion for Oracle.
Support Kerberos authentication for Hive.
Sync extended property MS_Description on Table/Column as comment for SQL Server.
4 details in Everything
1 more release in this issue
· 2024-07-11 → 2024-07-25
Parse, analyze, store and display SSH handshakes from network captures
Parse, store and display DilithiumDilithiumNIST's main post-quantum digital signature standard (FIPS 204), formerly Dilithium. It is the planned replacement for RSA and ECDSA signatures on certificates and code., Falcon and Sphincs keys
Independently analyze key exchange and signature algorithms for PQ readiness in TLS handshakes
Organization.inventory, Project.inventory and ReportDone.inventory now include Network reports via GraphQL
Organization.vulnerabilities, Project.vulnerabilities and ReportDone.vulnerabilities edges sorted by descending severity, descending numberOfSlots, ascending number
+1 moreshow less
Vulnerability.slots and ReportVulnerability.slots connections sorted by descending instancesFailed
Adds support for viewing SSH handshakes in network report trace analysis via the Protocol selector.
Enables live rotation of managed secrets labeled with DATABASE_URL (e.g., via AWS Secrets Manager).
Adds GraphQL sorter fields (SlotsSorterFields.id, UsersSorterFields.id, UsersSorterFields.current, ProfilesSorterFields.preset) for sorting slots, users, and profiles in the API.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The file cryptography_operations_statistics.csv in bundled Report CSV export ZIP files is renamed to statistics.csv.
!Default report name format changed from Report 1 for {trace name} to Report for {trace name}.
OpenSSH 9.8 adds PerSourcePenities for automated client blocking and splits sshd into listener/session binaries.
└──▷ USE IT
Block IPs that fail auth or crash sshd, exempting a trusted management range.
text
# In /etc/ssh/sshd_config:
PerSourcePenalties yes
PerSourcePenaltyExemptList 10.0.0.0/8
Run ssh-keyscan silently without banner comments.
shell
ssh-keyscan -q host.example.com
Adds PerSourcePenalties and PerSourcePenaltyExemptList to sshd_config(5) to automatically block IP addresses that fail authentication or crash the server.
Splits the sshd(8) binary into a lightweight listener and a per-session sshd-session binary, removing support for disabling privilege separation or re-execution.
Adds -q flag to ssh-keyscan(1) to suppress hostname and banner comment lines that previously went to stderr.
Introduces PAMServiceName directive in sshd_config(5) (portable OpenSSH only) to explicitly set the PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. service name instead of relying on argv[0].
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Support for disabling privilege separation in sshd(8) is removed; previously required code changes are no longer supported.
!Support for disabling re-execution of sshd(8) is removed.
!sshd(8) (portable OpenSSH only) no longer uses argv[0] as the PAM service name; use PAMServiceName in sshd_config(5) to configure it.
ZPA PRA adds French, German, and Spanish keyboard support for RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. privileged consoles
Adds International Keyboard Support for Privileged Remote Access (PRA) on private.zscaler.com and zpatwo.net
1 detail in Everything
36 more releases in this issue
· 2024-07-01 → 2024-07-31
The release upgrades the Business Insights service from limited availability to General Availability, unlocking its SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. usage visibility, cost control models, and workplace utilization analytics for the entire customer base.
ZIA adds Block Non HTTP Traffic on HTTP/HTTPS Ports setting, Base64 DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./File Type support, ZSTD encoding inspection, and SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. Partner API management UI.
└──▷ HOW TO FIND IT
Restrict tunneling attacks by allowing only HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic through proxy ports.
📍Administration › Advanced Settings
Adds Administration > Advanced Settings > Block Non HTTP Traffic on HTTP/HTTPS Ports to restrict traffic exclusively to HTTP/HTTPS types.
Enables File Type Control and DLP policies to decode and inspect Base64-encoded files for original type and sensitive data.
Supports Zstandard (ZSTD) encoding (application/zstd) in proxy servers, allowing inspection of traffic from sites like Meta and Instagram without disabling browser-side compression.
Allows ZIdentity admins to create and view SD-WAN partner API clients and roles via the ZIA Admin Portal.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The Partner Administrator role has been renamed to SD-WAN Partner API Client, and Partner Administrator Role has been renamed to SD-WAN Partner API Role.
Zscaler Client Connector Portal 4.2 adds installation type display, CSV uploads for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. bypass, ZDX provisioning, CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. toggle, and WebView2 cert ignore.
installation type added to enrolled devices to distinguish strict enforcement from general deployment
CSV file upload capability in the VPN Gateway Bypass section of App Profiles
Direct ZDX License provisioning for existing ZPA-only customers without enabling device groups
Perform CRL Check toggle added to Server Validated Client Certificate Posture profiles
Ignore Client Cert errors for Webview2 option allows authentication with invalid/missing certificates via WebView2
ZIA adds custom EUN templates and client connector support for Cloud App Control and URL Filtering policies
Adds Browser Notification Template field to Cloud App Control and URL Filtering policy rules to associate custom End User Notification (EUN) templates with block or caution actions.
Adds End User Notification and Custom Message fields to granular Cloud App Control policy rule windows to enable Zscaler Client Connector-based notifications.
ZIA adds IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. policy control, ZSTD decoding, Votiro integration, and API/device-group enhancements.
Adds IoT-Policy-Enable field to the Location Import CSV file for batch enforcement of IoT Policy Control
Adds includeIOTGroups parameter to the /deviceGroups cloud service API endpoint
Adds Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. Portal option under Dashboard and Policy in the Admin Portal for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. access
Enables Base64-decoded file type detection in File Type Control policies
Enables DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. inspection on Base64-encoded files
+5 moreshow less
Adds Block Non HTTP Traffic on HTTP/HTTPS Ports toggle in Administration > Advanced Settings
Enables Zstandard (ZSTD) decoding for web traffic inspection
Integrates Votiro Secure File Gateway with Isolation profiles for file sanitization
Supports custom client-side connector onboarding for Google Applications using Private Key JSON files
Supports custom client-side connector onboarding for Google Cloud Platform (GCP) with Quarantine Bucket and Org ID
Zscaler Client Connector Portal 4.2 adds install type display, CSV upload for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. bypass, ZDX provisioning, and new posture/toggle options
Displays the installation type (strict enforcement vs general deployment) for enrolled devices in the portal
Allows admins to upload CSV files in the VPN Gateway Bypass section of App Profiles
Enables provisioning of ZDX License for existing ZPA-only customers without service interruption or device group enablement
Adds the Perform CRL Check toggle to the Server Validated Client Certificate Posture profile
Adds the Ignore Client Cert errors for Webview2 option to ignore client certificate errors during WebView2 authentication
Risk360 adds support for NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 in the Admin Portal.
ZIA adds Outbound Email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. with new policy rules, NSS log type, and analytics views
Adds the Administration > Email Tenants configuration area to specify which tenants use the Zscaler smart host
Adds the Administration > Email Profiles configuration area to define domain and recipient profiles for outbound email policy
Adds the Policy > Outbound Email Policy section for detecting data, allowing/blocking activities, and adding custom headers in outbound emails
Adds the Email DLP log type for the Nanolog Streaming Service (NSS) to stream logs to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems
Adds the Analytics > Email DLP Insights > Insights view for monitoring outbound email activity
+3 moreshow less
Adds the Analytics > Email DLP Insights > Logs view for filtering and viewing Email DLP log details
Adds the Analytics > Email DLP Report for reporting on Email DLP activities
Adds the Dashboard > Email DLP dashboard for visual monitoring of email DLP metrics
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure SQL support, critical issues notifications, new data posture policies, and scan exclusions.
Adds Azure SQL Server as a supported datastore with automatic scanning, classification, and predefined policy checks
Adds Critical Issues Notification visible after login to alert about cloud account access failures and links to the Issues tab
Adds new Data Posture Policies for AWS and Azure including intelligence-driven ransomware risk policies and specific Azure SQL security rules
Adds Folder Exclusion capability in scan settings to exclude specific Amazon S3 buckets or folders from data scans
Adds Included In (⊆) operator support for policy and investigation queries allowing combinations of custom/preset values like Null
+1 moreshow less
Adds Sensitive DLP Engine Filter on the Sensitive Data tab to filter files/tables by DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine sensitivity markers
Authentication Service adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. exemptions for service enrollment and admin grace periods
Adds UI option to disable MFA for user service enrollment when SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. is enabled
Adds UI option to allow users to skip 2FA for a short duration during admin portal login
ZIA adds custom Browser EUN templates and Zscaler Client Connector-based notifications for Cloud App Control and Inline Web DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest..
Adds Browser Notification Template field to Cloud App Control and URL Filtering rules to show custom end user notifications when application access is blocked or cautioned
Adds End User Notification and Custom Message fields to Cloud App Control policy rule windows to support Zscaler Client Connector-based EUNs
Enables selection of Show/Hide EUN messages and custom text in Inline Web DLP policy rules, configurable under Administration > End User Notifications > Client Connector
ZIA extends Cloud App Control and Inline Web DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies to show custom End User Notifications via Zscaler Client Connector.
Adds End User Notification and Custom Message fields in Cloud App Control Policy rule windows for granular action applications, enabling endpoint notifications via the Zscaler Client Connector.
Enables Show or Hide options with custom EUN messages for Inline Web DLP policy rules, allowing end users on endpoints to see notifications when content triggers a DLP rule.
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure SQL support, S3 folder exclusion, investigation query operators, and sensitive DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine filter
Adds Azure SQL Server as a supported datastore for data scanning and posture classification.
Adds an Issues tab visible post-login to notify about cloud account access failures during onboarding or configuration changes.
Introduces new Data Posture Policies for AWS and Azure, including intelligence-driven policies for ransomware risk based on active vulnerability campaigns.
Enhances the Alert Details tab with links to the Data Inventory page, alert status reason details, and a vulnerability graph view.
Adds folder exclusion capabilities in scan settings to exclude specific Amazon S3 buckets or folders from data scans.
+3 moreshow less
Adds support for the Included In (⊆) operator in investigation queries and custom policies to combine custom values with preset values like Null and Doesn't Exist.
Displays scan statistics on the DSPM dashboard, showing discovered and scanned resources by category.
Adds a Sensitive DLP Engine filter on the Sensitive Data tab to filter files or tables by specific DLP engines.
ZIA adds IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. policy control, IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection.Risky Behaviors category, URL filtering AND logic, Votiro file sanitization, and new API endpoints.
Adds IoT-Policy-Enable field to Location Import CSV and UI to apply URL/Cloud App policies to discovered IoT devices
Adds IPS threat category Risky Behaviors with allow/bypass actions in Firewall Logs
Adds urlCategories2 parameter to UrlFilteringRule API model for AND logic on URL categories
Adds /urlCategories/review/domains API endpoint (POST/PUT) to find matching entries in custom URL categories
Integrates Votiro Secure File Gateway with ZIA Isolation profiles for file disarm and reconstruction
+1 moreshow less
Adds new field proximityEnabledForCustomDictionary to /dlpDictionaries API endpoints for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionary proximity length
ZIA adds Outbound Email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. enforcement, Encrypt action for removable storage, and macOS Network Share blocking
Outbound Email Data Loss Prevention (DLP) allows policy enforcement on email content sent to external domains using the same tools as Inline Web DLP, Endpoint DLP, and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API DLP
Endpoint DLP policy rules gain a new Protect action that encrypts files copied to removable storage devices for safe internal sharing only
Endpoint DLP supports the Block action for the Network Share channel on macOS
A new log type, Email DLP, is available for Nanolog Streaming Service (NSS) and Cloud NSS feeds to stream logs to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems
New Analytics pages are added for monitoring: Email DLP Insights, Email DLP Insights Logs, Email DLP Report, and Dashboard > Email DLP
+3 moreshow less
Support for Shift JIS Encoding is added for extracting Japanese text from files in Endpoint DLP
Customized end user notification (EUN) and confirmation messages are available for Endpoint DLP
New predefined DLP dictionaries are supported, including Tax Identification Numbers for Finland, Greece, Ireland, Peru, Poland, Spain, US; VAT Number (Ireland); and others
ZIA adds IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Policy Control, IoT device group support in Device Groups API, and two-step admin portal login.
└──▷ HOW TO FIND IT
Bulk-enable IoT policy enforcement for multiple existing locations via CSV import.
📍IoT-Policy-Enable
Enforce IoT Policy Control option added to Gateway Options in Add/Add Sub-Location windows
IoT-Policy-Enable field added to the Locations Import CSV for bulk location configuration
IoT group added to Device Groups criterion in URL Filtering and Cloud App Control policies
Allow Unauthenticated Traffic for IoT Classifications predefined rule available for policy evaluation
includeIOTGroups parameter added to /deviceGroups API endpoint
+1 moreshow less
ZIA Admin Portal sign-in changed to two-step ZIdentity or password flow based on account settings
Provides CLI Access on Zscaler Client Connector and allows admins to interact with Zscaler Client Connector via CLI
Supports ZIdentity integration for the following features: Strict Enforcement mode, System Proxy fallback when direct enrollment fails, Endpoint Data Loss Prevention (DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.), and support for device groups and service entitlement in ZIdentity.
Adds localization support to change the language of the app user interface based on the system language. Zscaler Client Connector version 4.3 and later for macOS supports changing the English language to French and vice versa.
Allows administrators to bypass the IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. traffic during Zscaler Client Connector authentication.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Deprecates the legacy PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. parser option and replaces it with V8 JavaScript engine-based PAC parser. For Zscaler Client Connector versions 4.3 and later for macOS, the legacy PAC parser option is unavailable.
ZIA allows custom End User Notification messages for inline Web DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policy rules triggered on endpoints.
Adds Show or Hide EUN message selection in DLP policy rule configuration to control inline web DLP end-user notifications
Adds ability to specify custom EUN text content per DLP rule under Administration > End User Notifications > Client Connector
ZIA inline web DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. now inspects sensitive information contained in file names
ZPA adds new App Connector and Private Service Edge images for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 on AWS and Azure.
Adds support for new Red Hat Enterprise Linux 9 App Connector images for AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and Microsoft Azure
Adds custom Azure DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. storage endpoints, incident export PDF download, bulk actions page, and email notifications for downloads/exports.
Adds a Custom Storage Endpoint URL field to the Zscaler DLP Azure Integration page in Workflow Automation Admin Portal to use private endpoints
Adds an Export icon on the Incident Analytics dashboard to export displayed analytics to a PDF file
Enhances the Time Range Filter on Incidents and Incident Analytics pages to allow selecting the current date in Custom Date Range mode
Sends email notifications when incident file exports are completed and ready for download from the Downloads page
Sends workflow automation admin portal notifications when incidents CSV export is completed
+1 moreshow less
Adds a new Bulk Actions page under My Activity > Bulk Actions to monitor status of bulk actions on Incidents
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The Event Grid Topic Resource Id field is renamed to Event Grid System Topic Resource Id in the Zscaler DLP Azure Integration configuration
Sophos ZTNA 2.1 adds on-premise Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. as an identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. and seamless PoP failover for cloud gateways.
Supports Microsoft on-premise Active Directory as a configurable identity provider on all gateway platforms.
Provides seamless failover between points of presence for Sophos Cloud gateways, eliminating downtime during PoP transitions.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!You must upgrade to ZTNA 2.1 before upgrading to ZTNA 2.1.1 — skipping 2.1 is not supported.
Termius 9.0 adds horizontal tabs, command palette, vault consolidation, and new terminal themes
Adds horizontal tabs to simplify navigation between Vault, SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel., and connections.
Introducing the command palette feature accessible via CTRL+K/CMD+K, with quick jump (CTRL+J/CMD+J) and new connection (CTRL+T/CMD+T) shortcuts.
Consolidates all data under the Vaults tab, moving Keychain and Known Hosts from settings.
Adds three new terminal themes: Night Owl, Light Owl, and Aura.
Tailscale creates private WireGuard-based mesh networks with centralized identity and access controls.
Tailscale v1.70 adds split tunneling on Android, health notifications on macOS, Siri/Shortcuts DNS toggle, and new exit node MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. controls.
└──▷ GET THIS VERSION
$ git clone --branch v1.70.0 https://github.com/tailscale/tailscale.git
# already have the repo? check out this version:$ git checkout v1.70.0
└──▷ HOW TO FIND IT
Check reachability of a tailnet device from an Android phone without leaving the app.
📍In the Tailscale Android app, go to the devices list, long-press on a device, and select Ping to view ping latency and connection status.
New AllowedSuggestedExitNodes system policy (all platforms with MDM support) restricts which exit nodes Tailscale recommends or auto-selects.
New auto:any value for the ExitNodeID system policy automatically selects an exit node on Windows, macOS, iOS, and tvOS (Enterprise plan only).
macOS client now surfaces health notifications in the menu — covering connectivity loss, firewall blocks, and misconfigurations — and changes the menubar icon to show an exclamation mark when connectivity is affected.
macOS client warns users when the built-in macOS content filter (Screen Time) is blocking Tailscale from connecting.
On MacBooks with a display notch, a notification window appears when the Tailscale menubar icon is hidden behind the notch.
+3 moreshow less
Toggle Tailscale DNS via Siri or the Shortcuts app on macOS and iOS.
Android app adds a Ping view: long-press a device in the devices list and select Ping to access ping information and connection status.
Android app gains split tunneling support to force or exclude per-app traffic through the tailnet.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Tailscale v1.70 is the last version to support macOS 10.15 Catalina; macOS 10.15 will not be supported in future releases.
Adds kubernetes-secret schema for Machine ID secrets, --skip-idle-time to tsh play, and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. client redirect CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. filtering
└──▷ GET THIS VERSION
$ git clone --branch v16.1.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.1.1
└──▷ USE IT
Skip idle timeout logic when playing back session recordings for continuous monitoring or debugging.
shell
tsh play --skip-idle-time <session-id>
Machine ID can now be configured to use Kubernetes Secret destinations from the command line using the kubernetes-secret schema.
Added option to allow client redirects from IPs in specified CIDR ranges in SSO client logins.
Added audit events for AWS and Azure integration resource actions.
Added --skip-idle-time flag to tsh play.
4 details in Everything
8 more releases in this issue
· 2024-07-01 → 2024-07-31
New application-tunnel service in Machine ID, tbot systemd subcommand, --skip-idle-time for tsh play, and JSON access list listing.
└──▷ GET THIS VERSION
$ git clone --branch v15.4.10 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v15.4.10
└──▷ TRY IT
Play back recorded sessions without pausing for idle time to speed up review workflows.
$ tsh play <session_id> --skip-idle-time
Added application-tunnel service to Machine ID for establishing a long-lived tunnel to a HTTP or TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. application for Machine to Machine access.
Added the tbot install systemd command for installing tbot as a service on Linux systems.
Added a --skip-idle-time flag to tsh play.
Added ability to list access list members in json format in tctl cli tool.
Machine ID enables leaf cluster dialling via tbot and supports TELEPORT_REPORTING_HTTP(S)_PROXY env var in Enterprise
└──▷ GET THIS VERSION
$ git clone --branch v16.0.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.0.4
Adds TELEPORT_REPORTING_HTTP(S)_PROXY environment variable support to Teleport Enterprise for configuring the HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxy used by the usage reporting ingest service.
Teleport v15.4.6 adds Debug config to event-handler, system CA trust for self-hosted DBs, and alert TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. display.
└──▷ GET THIS VERSION
$ git clone --branch v15.4.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v15.4.6
Adds Debug setting to the event-handler configuration
Enables trusting system CAs for self-hosted databases
New tctl desktop bootstrap command and Debug event-handler setting; UI error display for SSH/K8s sessions
└──▷ GET THIS VERSION
$ git clone --branch v16.0.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.0.3
└──▷ USE IT
Automate the initial setup of Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. for Desktop Access using Teleport.
shell
tctl desktop bootstrap --help
Enable debug-level logging for event-handler troubleshooting via Helm values.
yaml
eventHandler:
debug: true
Adds tctl desktop bootstrap subcommand to bootstrap AD environments for Desktop Access.
Adds Debug configuration setting for the event-handler subsystem.
Adds audit event field tracking changes to the MFA for admin actions requirement.
Adds support to trust system CAs for self-hosted databases.
Adds error display in the Web UI for SSH and Kubernetes sessions.
+1 moreshow less
Makes tctl alerts ls display remaining alert TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit..
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The teleport updater no longer defaults to using the global version channel.
Aembit Edge adds an AWS ECSAWS ECSAmazon's managed container orchestration service that runs Docker containers on clusters of EC2 instances or Fargate, letting tools offload scheduling, scaling, and infrastructure management to AWS. Terraform module and TLS support between Agent Proxy and Controller.
Adds Aembit Edge Terraform Module for deploying components to AWS ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. via the Terraform Registry
Enables TLS between Agent Proxy and Agent Controller in ECS deployments using Aembit-provided PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.; customer-provided PKI is not supported for ECS.
2 details in Everything
1 more release in this issue
· 2024-07-03 → 2024-07-29
Secureframe July 2024 adds TX-RAMP support, ClickUp integration, GitHub public repo opt-out, and Trust Center bulk-import/subprocessor management.
Adds TX-RAMP framework support with coverage for both levels to enable Texas state agency compliance workflows
Integrates ClickUp as a task destination for automated compliance testing and sync of access changes, vulnerabilities, nonconformities, incidents, and system changes based on SLAs
Allows GitHub integration to opt out of syncing public repositories to exclude them from audit scope and check execution
Enables bulk-import of subprocessors directly from the vendor list within the third-party risk management experience
Adds grid view option for Trust Center compliance, resources, and sub-processors sections with a View All link for detailed searchable content
+1 moreshow less
Provides Zapier integration to automate Trust Center document request management and notifications via custom rules
Adds NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 framework to Scrut's pre-built library for compliance monitoring.
Adds support for the NIST Cybersecurity FrameworkNIST Cybersecurity FrameworkThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. (CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals.) Version 2.0 as a new pre-built framework option.
1 detail in Everything
22 more releases in this issue
· 2024-07-01 → 2024-07-18
Vendor Portal automatically saves questionnaire responses after each input
Vendor responses are automatically saved after each answer selection or text entry; if the device has an internet issue, automatic saving stops and a manual Save button is presented.
Adds Charlie HR integration to sync employee data via settings > integrations
Adds the ability to integrate Charlie HR with Scrut to fetch employee details including name, email, department, reporting manager, joining date, and exit date.
Adds auto-sync of employees from Charlie HR to Scrut every 24 hours.
Adds Deel integration to sync employee data (name, email, department, manager, dates) automatically.
Adds Deel integration option in Settings > Integrations for syncing employee details including name, email, department, reporting manager, joining date, and exit date
Enables auto-sync of synced employees to the Employees list under People every 24 hours
New DigitalOcean integration for automated evidence collection in Scrut Monitor
Adds support for a new DigitalOcean integration that automates evidence collection
Scrut Monitor now automatically generates evidence including lists of Droplets, user accounts, firewall configurations, backup configs, load balancers, monitoring events, and Kubernetes clusters
New Auth0 integration for automated evidence collection of user lists, organization members, and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. statuses.
Adds Auth0 integration to automate retrieval of user data (IDs, emails, names, phone numbers, creation dates, identities, MFA statuses) and organization details (roles assigned to users).
Scrut removes pre-login region selection, routing users directly to app.scrut.io with OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets./SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. options
Removes the data localization region selector (IN, US, EU) from the login flow for all users
Adds a manual sync action for supported integrations through Settings > Integrations.
Adds Sync now in the three-dot menu under Settings > Integrations, limited to once per integration in 24 hours; cloud-provider and project-management integrations are excluded.
Adds email notifications for flagged vendor questionnaire responses in Vendor Management module.
Lets a GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. user send an email about a flagged vendor questionnaire response by selecting the Notify Vendor checkbox and a POC.
Adds vendor notification to the Flag as Issue workflow, alongside its Risk Score and Flagging Reason fields.
Scrut now integrates with Azure DevOps to create work items directly from policy, test, and risk tasks.
Adds Azure DevOps integration enabling creation of tasks, issues, bugs, and epics via the Actions button in Policy, Test, Evidence, and Risk Management modules
Mondoo 11.11 adds GitHub Enterprise support, automated IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. discovery in code repos, and EU NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against. framework.
Adds github_enterprise integration for scanning GitHub Enterprise Server instances
Enables automated infrastructure-as-code (IaC) file discovery within scanned code repositories without manual path configuration
Drata adds 10 new integration connectors, AWS region configuration via connection drawer, and automated personnel CSV/JSON import via API
Adds support for Lever, Lattice, Mixpanel, 1Password, Webflow, Lacework, Matillion ETL, Sonarcloud, Databricks, and Azure DevOps as new user access review connections.
Enables self-serve region configuration for AWS Connections by allowing users to specify allowed regions or no region restrictions directly within the connection drawer.
Adds Identity Center sync support for AWS and AWS Organizational Units connections to automatically sync users from AWS Identity Center.
Introduces a new API endpoint to automate personnel upload via POST Body with CSV or JSON files, replacing manual export/formatting/upload steps.
Increases the maximum number of connectable Azure subscriptions from previous limits to 500.
5 details in Everything
2 more releases in this issue
· 2024-07-12 → 2024-07-27
Adds custom fields for Personnel, CaC pipelines for GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., and control notifications via Slack/MS Teams/email.
Code as Compliance (CaC) pipelines integrates Drata with GitHub Actions to block non-compliant infrastructure code before production
Admins can configure Slack and MS Teams notifications for control updates; control owners can enable email notifications
Custom fields added to Personnel data and included in Personnel Compliance Overview PDF report and Compliance overview CSV downloads
Decimal values supported in custom number fields for accurate percentage calculations in custom formulas
Drata adds custom risk formulas with CSV export and ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27701 control mapping
Adds custom formulas for Risks allowing computation of metrics like Risk Appetite and Financial Impact using fields such as Inherent Likelihood and Residual Score
Includes custom formula outputs in CSV exports alongside formula names
Adds multilanguage library support and ISO 27005 Annex A 5x5 risk matrix.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.6.3
Supports multilanguage libraries
Adds 5x5 matrix from ISO 27005 Annex A
2 details in Everything
5 more releases in this issue
· 2024-07-01 → 2024-07-27
CISO Assistant v1.6.2 adds PSSIE and DNSSI (Morocco) frameworks plus score/observation fields in audit reports.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.6.2
PSSIE framework support for security assessments
DNSSI (Maroc) framework support
Audit report now includes score and observation fields
Adds NCSC Cyber Essential requirements for IT infrastructure and a new requirement assessment view page.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.6.1
└──▷ HOW TO FIND IT
Start the new workflow for mapping IT infrastructure to NCSC Cyber Essential standards.
📍In the console, go to Requirements › Add Requirement and select 'Cyber essential requirements for IT infrastruture by NCSC'
Open the dedicated interface for evaluating compliance against specific requirements.
📍In the console, navigate to the new Requirement Assessment View page
Adds framework mapping and audit cloning capabilities to CISO Assistant.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.6.0
Adds the ability to map frameworks together via the new mapping frameworks feature
Enables cloning audits within or between projects as a consequence of the mapping feature
CISO Assistant v1.5.4 adds filters to tables, CCPA regulation support, CAIQ mapping to CCM, and risk scenario owners.
└──▷ GET THIS VERSION
$ git clone --branch v1.5.4 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.5.4
Adds ⭐-prefixed filters to tables for data filtering
Adds support for the CCPA Regulations framework
Adds CAIQ mappings to the CCM framework
Adds risk scenario owner capability to risk scenarios
CISO Assistant v1.5.3 adds support for CRA resolution annexes, SCF 2024-2, and NCSC CAF frameworks.
└──▷ GET THIS VERSION
$ git clone --branch v1.5.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.5.3
Panorays Q2’24 adds Risk Policy custom factors, SEC 8-K cyber news, CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. findings, Live Dashboards, and centralized Findings Management.
Enables admins to set default configurations adding or reducing points from the bottom-line risk rating based on external factors via Risk Policy: Custom Factors
Adds SEC 8-K filings as a new source for cyber news alerts to view latest cyber events filed by breached companies
Introduces New Cyber Posture Findings for Content Security PolicyContent Security PolicyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. (CSP) checking configuration against security best practices with High and Low severity levels
Launches Live Dashboards allowing users to build customized reporting dashboards using various data visualization widgets
Releases centralized Findings Management page with intuitive UI and data enrichment for confirming resolutions or disputing findings
+1 moreshow less
Deploys AI-powered Answer Lookup search bar enabling third parties to find past responses to previous questionnaire questions
Adds Gemini client integration and JSON report generation from scan results
└──▷ GET THIS VERSION
$ git clone --branch v2.14.1 https://github.com/Giskard-AI/giskard-oss.git
# already have the repo? check out this version:$ git checkout v2.14.1
└──▷ USE IT
Initialize the Gemini client to interact with Google's model for scanning or evaluation.
python
from giskard import Client
client = Client()
gemini_client = client.llm("gemini")
Export your scan results to a JSON file for downstream processing or sharing.
python
scan_results.to_json("my_scan_results.json")
Adds Gemini client support for generating model predictions and handling LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. interactions
Enables to_json() method on scan results to export findings as a JSON file
Adds --default-config-id CLI flag, custom embedding modelembedding modelLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. support, and Got It AI / AutoAlign / Patronus Lynx integrations
└──▷ GET THIS VERSION
$ git clone --branch v0.9.1 https://github.com/NVIDIA-NeMo/Guardrails.git
# already have the repo? check out this version:$ git checkout v0.9.1
Adds --default-config-id argument to the server CLI for specifying a default config
Enables registering and using custom embedding modelsembedding modelsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. via new library APIs
Adds Got It AI truthchecking integration for RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining. applications
kustomize localize now validates builds by default, with --no-verify flag to skip
└──▷ GET THIS VERSION
$ git clone --branch kustomize/v5.4.3 https://github.com/kubernetes-sigs/kustomize.git
# already have the repo? check out this version:$ git checkout kustomize/v5.4.3
└──▷ TRY IT
Localize a kustomization that references not-yet-downloaded or incomplete manifests without triggering the new build validation.
$ kustomize localize <path> --no-verify
Adds automatic kustomize build verification to kustomize localize (beta), catching missing or undownloadable manifests before localization completes.
Adds --no-verify flag to kustomize localize to skip build validation when working with intentionally incomplete manifests.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!kustomize localize now runs kustomize build as part of execution; setups that rely on localizing incomplete or missing manifests will fail unless --no-verify is passed.
curl 8.9.0 adds --http2-server-priority for HTTP/2HTTP/2The second major version of the HTTP protocol, standardized by the IETF, adding multiplexed streams, header compression, and binary framing over a single TCP connection to cut latency and reduce overhead. stream prioritization and fixes CVE-2024-7264
└──▷ GET THIS VERSION
$ git clone --branch curl-8_9_0 https://github.com/curl/curl.git
# already have the repo? check out this version:$ git checkout curl-8_9_0
└──▷ TRY IT
Set custom HTTP/2 stream priority to manage bandwidth for critical requests.
curl 8.9.0 adds --ip-tos, --mptcp, --vlan-priority, -w%{num_retries}, and CURLU_NO_GUESS_SCHEME
└──▷ TRY IT
Set DSCP values and enable Multipath TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. for a specific host
$ curl --ip-tos 0x2c --mptcp http://example.com
Track how many times curl retried the connection in a script
THE CYBER TOOLCHAIN