https://cybertoolchain.io/tools/axonius New releases and features in Axonius, tracked by The Cyber Toolchain. en Mon, 26 Oct 2026 07:59:11 GMT https://docs.axonius.com/axonius-help-docs/changelog/release-notes-1001 https://docs.axonius.com/axonius-help-docs/changelog/release-notes-1001 Mon, 26 Oct 2026 07:59:11 GMT Axonius 10.0.1 adds CMDB Reconciliation support for six new ITSM adapters, AI Workforce auto-pause, AVS factor querying, and Security Finding Risk Score v2⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Query AVS factors as structured fields on the Aggregated Security Findings and Vulnerability Repository pages using the Query Wizard, with autocomplete for each factor's Impact and value, plus support for custom values.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Security Finding Risk Score v2 now weights Axonius Vulnerability Score at 60% (up from 50%) and Asset Criticality at 35% (up from 25%); activating v2 deactivates v1 without deleting it, and scores recalculate immediately. • CMDB Reconciliation Workspace now supports Jira Service Management, Freshservice, Cherwell IT Service Management, Ivanti Neurons for ITSM, BMC Atrium CMDB, and BMC Atrium CMDB onPrem in addition to ServiceNow. • AI Workforce scheduled workers now pause automatically after 14 consecutive runs with the same result and no action taken; a notification card in AI Workforce > Notifications explains the pause and offers Resume. • Adapter Noise Filters Worker is a new weekly AI Workforce worker in the IT Asset Management department that finds uncorrelated devices and identifies which adapters bring them in, pointing to Advanced Settings for remediation. • Threat Intelligence notable events — including indicators of compromise and EDR hunting queries — are now readable by the AI agent and usable in its answers. • Agent Coverage Workspace adds a Manage agents panel to control which agents appear in the workspace, its dashboard, and AI agent answers, with a new `Manage Agent Coverage` role permission granted to the Admin role by default. • Tables in AI chat answers and AI Workforce briefings now display in a grid with sorting, column pinning, Copy Column Values, row count, and an Export CSV button. • Scoped users and admins in a data scope can now open the Vulnerability Repository and use its table, filters, queries, charts, and export. • Adds a `Last Used Users Nested Group Names` device field showing the combined nested group names of a device's last used users. Breaking changes: • Activating Security Finding Risk Score v2 deactivates v1; anything built on the previous scores (queries, dashboards, enforcement sets) may show different risk levels immediately after activation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/axonius https://docs.axonius.com/axonius-help-docs/changelog/release-notes-1000 https://docs.axonius.com/axonius-help-docs/changelog/release-notes-1000 Sun, 11 Oct 2026 16:50:06 GMT Axonius 10.0.0 ships Axonius AI (Companion, Workforce, MCP Server), asset-correlation investigation, AI attribute fields for software/SaaS, and expanded exposure management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Auto Approve Managed SaaS Applications` setting in `Settings → Enrichment` to control whether managed SaaS applications receive automatic approval status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Status Resolver` option in `Global Settings → Security Findings Data → Status Resolver` to automatically remove security findings closed for more than a configurable number of days (default 14 days for new customers, off for existing). • Adds `Preferred: Device Type` preferred field, calculated post-correlation, usable across Query Wizard, reports, dashboards, and Enforcement Sets — replacing the legacy Device Type identifier field. • Introduces Axonius AI Companion for querying asset data in natural language, translating plain-English questions into queries, charts, dashboards, and actions with a visible correlation path for analyst verification. • Introduces Axonius AI Workforce, a platform-wide automation engine for end-to-end ticket creation, policy enforcement, and case updates driven by asset context. • Introduces Axonius MCP Server, exposing the full Axonius environment to external AI tools, agents, IDE assistants, and low-code platforms via the Model Context Protocol. • Adds Explain Correlation and Explain Non-Correlation modules to investigate why device records were merged or kept separate, with AI-assisted deep-dive for Axonius AI customers. • Adds seven AI attribute fields (`AI: Deployment`, `AI: Model Location`, `AI: Autonomy Level`, `AI: Integrations`, `AI: RAG Enabling`, `AI: RBAC Supported`, `AI: Vendor Training`) automatically populated on Software, installed software, and SaaS Application assets. • Adds three new count fields to Aggregated Security Findings: `Open Security Findings`, `Closed Security Findings`, and `Risk Accepted Security Findings` as a complete, non-overlapping partition of Axonius Status values. • Adds customizable email templates for Exception Management, supporting custom subject, intro text, and rich-text body for seven exception email types including new approval request, approval reminder, request approved/denied, request update, expiration warning, and expired. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/axonius https://docs.axonius.com/axonius-help-docs/changelog/release-notes-908 https://docs.axonius.com/axonius-help-docs/changelog/release-notes-908 Thu, 24 Sep 2026 15:57:26 GMT Axonius 9.0.8 adds Network Connections visibility, six new adapters, ServiceNow template ticketing, and expanded static analysis CVE filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds three new filtering options to Static Analysis Enrichment Settings: `Exclude CVEs without specific affected versions` (default On for new customers, Off for existing), `Exclude CVEs published on or before [date]` (default date 2015-12-31 for new customers), and `Exclude devices matching this query` to remove matched devices from static analysis scope entirely.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Column Views - View` and `Column Views - Add` role permissions to control access to column views in the Adapters area; predefined Admin and Owner roles have both enabled by default after upgrade. • Adds a `Fetch pending` status and `Queued At` column to Adapter Fetch History for connections queued and waiting for an available worker, with `Terminate Fetch` now also cancelling connections in `Fetch pending` status. • Adds `Alerts as Incidents` settings group to the CrowdStrike Falcon adapter, replacing the standalone `Fetch Alerts as Incidents` toggle with a group that includes a fetch toggle and an `Alert statuses to fetch` selector. • Adds `Fetch Scan Ids`, `Fetch SAST Results`, and `Fetch API Security Results` advanced settings to the Checkmarx One adapter for optional retrieval of SAST results and API Security risks from the last completed scan per project. • Adds `Project Resources` advanced setting to the Digital Ocean adapter to enrich Droplets, Load Balancers, and Kubernetes Clusters assets with their DigitalOcean Project ID and Project Name. • Adds `Fetch Application Settings` advanced setting to the Akamai Application Security adapter to retrieve application settings including account lock state and registration completion. • Adds `Active Directory / LDAP - Static Role` secret engine type support to HashiCorp Vault integration for retrieving current passwords for LDAP static roles. • Introduces a new Network Connections page and per-device Network Connections tab for visibility into communication patterns across IT and OT environments, including protocols, ports, inbound/outbound connections, and cumulative connection counts. • Adds ServiceNow as a supported destination in the Recommended Actions ticket creation template flow, enabling automatic routing to assigned remediation owners via the same out-of-the-box template mechanism used for Jira. • Adds ARCON PAM adapter, fetching Users and Devices from ARCON Privileged Access Management. • Adds CyberArk Certificate Manager - SaaS adapter, fetching Certificates, Devices, and Users from CyberArk's certificate lifecycle management platform. • Adds LinkShadow adapter, fetching Devices and Users from the LinkShadow network detection and response platform. • Adds ONESOURCE adapter, fetching Users and Groups from the Thomson Reuters ONESOURCE tax compliance platform. • Adds Tencent Cloud EdgeOne adapter, fetching Domains & URLs, Compute Services, Load Balancers, and Network/Firewall Rules from the Tencent Cloud edge security acceleration platform. • Adds Zadara zCompute adapter, fetching Devices, Compute Images, Disks, and Network/Firewall Rules from the Zadara zCompute cloud compute platform. • Adds support for configuring multiple CyberArk Vault instances in the Enterprise Password Manager, each with its own domain, port, Application ID, and API Prefix settings. • Adds configurable email response link expiration under General GUI Settings, with a default of 24 hours and a maximum of 120 hours. • Adds support for OAuth 2.0 client credentials authentication to Custom Files and other file-based adapters when using URL/FTP as the file source, sending an `Authorization: Bearer` header automatically before each fetch cycle. • Adds support for fetching Users assets from Akamai Application Security, including email, role, team, lock state, and registration state. • Adds option to fetch email security grades (DMARC Grade, SPF Grade, DKIM Grade) for domains in the BitSight Security Ratings adapter. • Adds option to fetch tags assigned to network devices in the Cisco Catalyst Center adapter, supporting `Category: Value` format as key-value tags and unformatted tag names as key-only tags. • Adds option to make Username and Password fields optional in Cisco ISE connection configuration when pxGrid is enabled without credentials. • Adds support in Cisco Meraki adapter for fetching client SaaS application data, Meraki organizations as Accounts assets, networks and VLANs as Networks assets, and appliance NAT rules (port forwarding, 1:1 NAT, 1:Many NAT) as Cisco Meraki NAT Rule Firewall assets. • Adds option to filter fetched vulnerabilities by status in the CrowdStrike Falcon Discover adapter. • Adds option to limit rule-event enrichment to specific Rule IDs in the Exabeam Cloud adapter. • Adds option to fetch Dynatrace Application Settings, including IP allowlist, user account status, group permission, and platform-token status. • Adds option to fetch Invoices as Expenses in the Bill adapter, in addition to the existing Bills as Expenses fetch. • Checkmarx One adapter now fetches Business Applications. Breaking changes: • The `Maximum devices per API call` and `Number of days to` advanced settings have been removed from the Exabeam Cloud adapter — existing configurations using these settings must be updated. • The A10 Control adapter now requires the `/api/v2` suffix in the Host Name or IP Address connection setting (e.g., `https://a10control.example.com/api/v2`); existing connections using the old format will break. • The Bishop Fox adapter no longer creates Device assets from DNS records — the `Devices from Domains`, `Devices from Subdomains`, and `Devices from Targets` settings have been removed; existing connections are automatically upgraded to the corresponding `URLs from Domains`, `URLs from Subdomains`, or `URLs from Targets` settings. • DefectDojo findings are now parsed as Application Resources instead of Application Services — existing queries, dashboards, and reports targeting Application Services must be updated to target Application Resources. • The default number of parallel workers for Network Routes enrichment is reduced from 10 to 2; environments relying on the previous default throughput will need to explicitly set a higher value (up to 15) if needed. • The CrowdStrike Falcon standalone `Fetch Alerts as Incidents` advanced setting has been replaced by the `Alerts as Incidents` settings group — existing adapter configurations referencing the old standalone setting must be reconfigured. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/axonius https://docs.axonius.com/axonius-help-docs/changelog/release-notes-907 https://docs.axonius.com/axonius-help-docs/changelog/release-notes-907 Tue, 15 Sep 2026 13:52:14 GMT Axonius 9.0.7 adds CMDB Reconciliation workspace, 11 new adapters, Signature Mitigations for CVE findings, and Virtual Network Inspector management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new `CMDB Reconciliation` workspace that automatically aggregates, validates, and pushes data to CMDBs with zero manual data entry, supporting audit-readiness and licensing compliance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `OS: Windows Patch Release Type` and `OS: Windows Patch Release Date` enrichment fields (nested under the OS complex field) to Windows device records, updated daily from the Microsoft Windows Update catalog, enabling queries such as 'assets where patch release date is more than X days ago'. • Adds a new `Earliest First Fetch Time` field to the Vulnerability Repository and Aggregated Security Findings pages, recording the earliest first-fetch timestamp across all sources for each vulnerability. • Adds a new `Network Inspectors` page under `Settings → System` for Cyber-Physical Assets deployments, providing centralized management of Virtual Network Inspector appliances including add, token generation, token re-generation, and removal. • Adds a `Custom Data Asset Source` mechanism with a dedicated enforcement action that converts manually-entered custom data into a first-class adapter contribution, processed by the correlation engine with no defined retention period. • Adds 11 new adapters: DTS Identity (Users, Devices, Aggregated Security Findings, SaaS Applications, Software), HPE Alletra SAN (Devices), Moody's CreditLens (Users), NetSPI Resolve (Devices), OneSpan (Users, Groups, Application Settings), Radware Cloud Services (Networks, Application Settings), SOCRadar (Devices, Networks, URLs, Certificates), Spacelift (Users, Application Settings), Ubiquiti UISP (Devices), UiPath (Users, Application Settings), and WordPress Toolkit (URLs, Aggregated Security Findings, SaaS Applications). • Adds `Fetch Application Settings` advanced setting (default: disabled) to the Confluent adapter, which fetches Application Settings assets from Confluent cluster ACLs when enabled. • Adds `Devices API Version` connection setting to the Druva Cloud Platform adapter, allowing selection between version 1 (default) and version 2 of the Druva Devices API. • Adds Application Settings support to the Druva Cloud Platform adapter, fetching administrator roles and statuses from the Druva administrators API and evaluating audit event availability. • Adds support for the `fortinet:fortigate` entity type in the Dynatrace adapter, mapping those entities to Device assets in Axonius. • Adds support for fetching Domains & URLs for CloudFront distribution aliases in the AWS adapter, linking each alias to its CloudFront distribution for inclusion in Internet Exposure queries. • Adds Application Settings asset type support to the AppViewX CERT adapter, fetching authentication, access control, credential, key rotation, logging, retention, login, SMTP, SSH connection, and service account settings. • Adds an upper-bound detection date advanced setting to the Cynerio adapter for more granular control over the time range when fetching risks and vulnerabilities. • Adds `Single Account` / `All Organization Accounts` selection to the DocuSign adapter, with a new `Organization ID` field to discover and collect data across all accounts in a DocuSign organization. • Adds an optional `Is File` setting to Delinea Privilege Manager (Thycotic) Vault secret references, causing Axonius to retrieve file content instead of the field value when enabled. • Reclassifies Datadog host records tagged with `aws:lambda` or `functionname:` as Serverless Function assets instead of Device assets. • Enables admins to set a default view per role for specific Assets pages, automatically applied when a user with that role opens the page. • Makes destination endpoint fields in Remediation Ownership configuration optional, allowing remediation owners to be assigned to Security Findings without providing endpoint details. Breaking changes: • The Citrix ADC adapter no longer publishes Network Route assets for NAT rules; NAT translations now appear on Load Balancer assets instead. Existing queries, reports, or enforcement workflows targeting Network Route assets from Citrix ADC NAT must be updated to use NAT translations on Load Balancer assets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/axonius https://docs.axonius.com/axonius-help-docs/changelog/release-notes-906 https://docs.axonius.com/axonius-help-docs/changelog/release-notes-906 Thu, 03 Sep 2026 13:08:16 GMT Axonius 9.0.6 adds Jira ticketing from asset queries, Risk Scores for sub-assets, Okta Universal Logout, three new adapters, and expanded enrichment controls. • Adds `Number of Supported Major OS Versions` setting under Settings > Enrichment, which controls how many recent major OS versions are considered supported per OS type and populates the `Is Supported OS Version` Device field (default: one supported major version per OS type). • Adds two new global Network Routes enrichment settings: `Network Routes Enrichment` (enables/disables the enrichment pipeline during discovery cycles) and `Zones to Exclude` (names of zones whose subnets are excluded from enrichment). • Adds `Fetch Licenses` advanced setting to the Cisco Catalyst Center adapter, creating License assets and enriching device records with expiry status, feature license details, and Smart Account pool usage metrics. • Adds `Fetch Application Settings` advanced setting to the Datadog adapter, fetching account-, user-, and role-level settings — including ownership, domain and IP allowlists, governance notifications, identity providers, roles, sensitive-data scanning, and user settings — as Application Settings assets. • Adds `Fetch application settings` advanced setting to the Elasticsearch adapter, fetching cluster settings, API keys, users, and security settings as Application Settings assets. • Adds `Fetch Application Settings` advanced setting to the Keycloak adapter, fetching realm settings and user-profile settings as Application Settings assets. • Adds `Fetch Application Settings` advanced setting to the Harness adapter, fetching authentication mechanisms, role assignments, LDAP configuration, session timeouts, and security policies as Application Settings assets. • Adds `Account ID` connection setting to the Dell Boomi adapter (required to enable Application Settings fetching); existing connections without an Account ID continue to fetch only Devices data. • Adds `Gateway` as a selectable option in the HPE Aruba Networking Central `Devices type to fetch` advanced setting, with configurable concurrent gateway detail requests (1–25) and a new API rate limit setting (max calls per second). • Adds `Parse Records with Status Name Starting with 'App' as Business Applications` advanced setting to the IFS Assyst adapter. • Adds two new options to the Microsoft Entra ID / Intune `Fetch users Last Sign-In - How to fetch` advanced setting: non-interactive sign-ins (token refreshes, background service authentications) and automated processes. • Adds JWT Token authentication (OAuth2 Client ID and Client Secret) as an alternative to API Key in the RUCKUS Cloud adapter. • Adds OAuth 2.0 Client Credentials authentication as an alternative to API Key in the BeyondTrust Password Safe adapter. • Adds API Key authentication as an alternative to username/password for the Check Point Infinity adapter when connecting to a Management Server. • Adds ISPSS authentication support to the CyberArk Endpoint Privilege Manager adapter (Identity Administration sub-domain and EPM API application alias). • Adds the option to fetch Saviynt accounts as Account/Tenant assets from the `getAccounts` endpoint, with optional filtering to Active status, and entitlement details per user from the `getEntDetailsforUsers` endpoint. • Adds the `State` field (active or archived) and a new advanced setting to exclude devices with no or empty Last Seen value to the FortiDLP adapter. • Adds option to fetch Google Cloud Artifact Registry repositories as Compute Services assets in the GCP adapter. • Adds option to filter fetched devices by Organization ID in the DNSFilter adapter. • Adds option to fetch extended Gateway details (serial number, model, OS, status, group name, uplink) in HPE Aruba Networking Central, consuming one additional API call per Gateway. • Adds HPE fallback Device Manufacturer value advanced setting and Device Manufacturer population from physical server chassis data to the HPE OneView adapter. • Adds option to set the Last Seen value of Devices or Users to the current time in the Custom Files adapter. • Adds Dell Boomi Application Settings as a new asset type exposing authentication methods, user privileges, and SCIM provisioning status. • Adds Effecte advanced setting to exclude application installation records marked as hidden from Installed Software. • Replaces the ServiceNow `Parse operational status` advanced setting with configurable `Custom Parsing rules`; existing enabled configurations are automatically migrated to two equivalent rules covering Operational Status and Asset Operational Status fields. • Introduces new ticketing flow allowing users to open one or more Jira tickets directly from selected assets or an entire query result, with pre-filled content from asset data, a rich-text editor supporting dynamic value tokens, a live ticket count preview, and a Test Tickets option against a single sample asset. • Extends the new ticketing flow to the Recommended Actions page, with additional controls to include or exclude specific groups of Security Findings (e.g. those missing ownership data) and to group findings by one or more asset fields to control ticket count. • Enables Risk Score configuration for sub-assets (e.g. Network Devices, Repositories); when both a sub-asset and its parent asset have a Risk Score configured for the same asset or Security Finding, the sub-asset score takes precedence. • Adds dynamic charts to the Remediation Ownership page showing Security Findings per owner and Owned vs. Unowned Security Findings distribution, and to the Recommended Actions page showing actions per remediation owner and distribution of action sub-types. • Adds Okta Universal Logout support, enabling Okta Identity Threat Protection (ITP) to immediately terminate active Axonius user sessions on detected security risks such as compromised credentials or session hijacking. • Adds three new adapters: DataDome (bot protection, fetches Business Applications and Firewalls), Zentral (endpoint visibility for Apple/Linux/Android, fetches Devices and Users), and Zero Touch (unified endpoint management, fetches Devices). • Updates the Arnica.io adapter to retrieve repository information directly from the `/v1/inventory/repos` endpoint instead of aggregating it from findings data. Breaking changes: • The Cisco Firepower Management Center adapter no longer fetches ARP table data from firewall devices; the `Fetch ARP table from firewall devices` advanced setting has been removed. Access and NAT firewall rule assets no longer include a policy device name in their asset ID or firewall name. • The CrowdStrike Falcon advanced setting `Enrich Configuration Assessment with Rule Name` is renamed to `Enrich Configuration Assessment with Rule Information`; any saved references to the old name must be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/axonius https://docs.axonius.com/axonius-help-docs/changelog/axonius-release-notes-905 https://docs.axonius.com/axonius-help-docs/changelog/axonius-release-notes-905 Thu, 20 Aug 2026 10:01:33 GMT Axonius 9.0.5 adds OAuth 2.1 for service accounts, GitHub Advisory Database CVE enrichment, parallel adapter fetching, and 7 new adapters. • Adds OAuth 2.1 authentication support for service accounts; access tokens are issued via the `/api/oauth2/token` endpoint and invalidated automatically on credential reset or new token generation. • Adds `Number of connections to fetch in parallel` setting under Adapter Discovery Configuration to enable parallel connection fetching for Claroty CTD, F5 BIG-IP iControl, Infoblox DDI, Salesforce, VMware ESXi, and vSphere adapters. • Adds `Workstation OS Types to Exclude` setting to Network Routes Enrichment Configurations in Global Settings to exclude specific device operating systems from enrichment. • Adds `Include only` mode for field-level adapter scoping in data scopes alongside the existing `Exclude` mode, with updated labels distinguishing `Define asset access by adapter connection` from `Define field access by adapter connection`. • Extends vault (Enterprise Password Manager) integration to support sensitive file fields including client certificate files (`.pem`), client private key files (`.pem`), advanced configuration files (JSON/XML), and credentials-format files — in addition to existing password fields. • Adds a new `Range` operator for IPv4 field filters in the Query Wizard, enabling From-To IP address range searches. • Changes data scope behavior so selecting all individual connections for an adapter no longer auto-upgrades to adapter-wide selection; the adapter parent checkbox must be explicitly selected to include current and future connections. • Adds monthly recurrence options for historical snapshot scheduling: first day of month, last day of month, or a specific calendar day. • Adds an `Impersonated by` field to HTTP activity logs, recording both the acting user and the impersonated user for all actions taken during an impersonation session. • Updates default value for SSL certificate verification (`Verify SSL`) from disabled to enabled for all new adapter connections. • Adds CSV export for all chart visualization types — Bar, Pie, Donut, Stacked Bar, Line, Table, and Venn — across all compatible widgets, including count and percentage values, a Total row, full numeric values, and filenames in the format `Axonius - [Chart Name] - DD Month YYYY, HH.MM AM/PM.csv`. • Introduces a unified custom data editing panel on the asset table replacing separate Create and Edit dialogs, with bulk-edit support for updating shared fields across multiple assets simultaneously. • Adds 7 new adapters: Black Duck Polaris (Aggregated Security Findings, Application Resources, Business/SaaS Applications), Cisco IoT Control Center (Devices), Invicti Platform Cloud (Aggregated Security Findings, Business/SaaS Applications, URLs), Mashery/Boomi Cloud API Management (Application Services, Business Applications, Organizational Units, Secrets, Security Roles, URLs, Users), Mindtickle (Groups, Users), Smart SD (Devices), and StrongDM (Devices). • Adds `Enrich certificates with discovery data` advanced setting and `Discovery Name` field to AppViewX CERT adapter for enriching certificates with cipher, TLS version, and port scan data. • Adds `Connection Method` setting to Cisco ASA adapter to choose between Legacy REST API and HTTP Interface, required for Cisco Firepower 2100 and 2120 models. • Adds API Gateway support to Cisco Identity Services Engine (ISE) adapter for routing requests through Layer7 or IBM API Connect gateways. • Adds OCI (Oracle Cloud Infrastructure) account type to CrowdStrike Falcon `CSPM Account / Tenants Settings` advanced setting, enabling ingestion of OCI tenancy name, tenancy OCID, home region, user information, and CSPM Status. • Adds Software asset fetching from CSV and JSON files to the Custom Files adapter, and adds configurable custom field delimiter support for CSV files (e.g., semicolon or pipe instead of default comma); SMB file retrieval now supports Distributed File System (DFS) paths. • Adds `Certificate` advanced setting to Certero adapter (enabled by default) allowing users to disable fetching of Certificate assets. • Adds MAC address parsing option to Azure Defender for IoT adapter for 'Guess' (uncertain) MAC addresses identified by Azure Defender for IoT detection algorithms. Breaking changes: • Data scope behavior change: selecting all individual connections for an adapter no longer automatically upgrades to an adapter-wide selection; new connections added to the adapter will not be automatically included unless the adapter parent checkbox is explicitly selected. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/axonius https://docs.axonius.com/axonius-help-docs/changelog/release-notes-903 https://docs.axonius.com/axonius-help-docs/changelog/release-notes-903 Wed, 22 Jul 2026 07:06:02 GMT Axonius 9.0.3 adds 7 new adapters, a 'Preferred Last Seen' user field, Security Finding count fields by risk level, and dozens of adapter and enforcement enhancements. • New `AI Recommended Action Plans` optional field in the Recommended Actions table enables exporting detailed AI-generated action plans to CSV. • New `Total SF Count: Critical/High/Medium/Low Axonius Risk Level` fields on the Devices table let users query and count non-CVE Security Findings by risk level. • Checkmarx SAST adapter adds an optional OData API connection method as an alternative integration path, configurable via a new connection setting. • IBM QRadar adapter adds a new `Incidents` asset type that fetches QRadar offenses, plus three new advanced settings for time-based and status-based offense filtering; devices are now enriched with related offense information. • ServiceNow adapter adds a new `Custom HTTP Headers` connection setting with method and URL pattern filtering support. • Snyk adapter adds an option to select the Vulnerable Software ingest mode: ingest as CVEs, as Snyk Issue IDs, or both. • SQL - Send Assets to Table enforcement action adds new `Add Timestamp Column` and `Timestamp Column Name` parameters for including a configurable timestamp column in exported SQL tables. • Axonius - Enrich DNS Custom Data enforcement action adds support for A, AAAA, and PTR DNS record types, plus new `DNS Server` and `Query TTL` parameters. • ServiceNow - Create Incident and Create Incident per Asset enforcement actions now output `Incident Number`, `Opened At`, and `Short Description` as additional artifacts, and support custom HTTP headers. • Jira Software - Create Ticket and Create Ticket Per Asset enforcement actions add a new optional `Team` parameter for team ownership assignment. • ManageEngine ServiceDesk Plus - Create Request adds a new `Exclude Axonius notes from request description` parameter. • Gateway install packages can now be downloaded via a `curl` command by clicking 'Create and Copy curl command' in System Settings and supplying an API Key and API Secret. • New adapter: CrowdStrike Adaptive Shield (AI-powered SSPM) — fetches Audit Activities, Devices, SaaS Applications, Software, Users. • New adapter: Entro Security (non-human identity and secrets management) — fetches Users, Secrets. • New adapter: Lark/Feishu (collaboration and HR platform) — fetches Users. • New adapter: Microsoft Windows DNS Server — fetches Network Services. • New adapter: Nudge Security (SaaS management platform) — fetches Application Addons, SaaS Applications, Application Addon Instances, Admin Managed Extensions, Admin Managed Extension Instances, Users, User Initiated Extension Instances, User Initiated Extensions, Extensions, Application Keys, User Extensions. • New adapter: SAP S/4HANA (On-Prem) — fetches Users. • New adapter: Sweet Security (runtime CNAPP via eBPF) — fetches Devices. • New `Preferred Last Seen` aggregated field on the Users table shows the most recent `last_seen` timestamp across all adapters for a given user. • 1E adapter adds an optional JWT Audience (AUD) connection parameter for JWT-based authentication. • Akamai CDN Cloud adapter adds two new optional enrichment endpoints for `Origin Type` and `Origin Server Hostname` fields. • Akamai Kona WAF adapter adds a new optional `Fetch Property Versions` advanced setting that retrieves `Latest Version Updated By` and other version-related metadata. • Archer IRM adapter adds a configurable `Devices Page Size` advanced setting with a range of 50–1000 and a default of 200. • Atlassian adapter adds Atlassian Teams as a new Group asset type. • Axonius BACnet Scanner adapter adds a new optional `BACnet Network ID` connection setting for remote network discovery through routers. • Cisco adapter adds a new optional `Fetch Firewall Rules` advanced setting that retrieves ACL and NAT rules. • Cisco CX Cloud adapter adds the option to enrich hardware and network elements with Field Notices. • Custom Files and other file-based adapters now support Kerberos/GSSAPI authentication for SMB Share connections (SMB v2 and v3); supported adapters include Bently Nevada, BIND DNS, Bloomberg BPKG, CSV Network Services, Honeywell Experion, Honeywell FSC PDF, Honeywell TDC 3000, Huawei iMaster MAE, Rockwell FactoryTalk, Schneider Electric Triconex, Steel Cloud, Steel Cloud CVX, and Yokogawa BK Rev Info. • Delinea Privileged Remote Access adapter adds an optional `Platform Users` endpoint for cloud instances. • Docebo adapter adds an `Enrich Users with Certifications` option that fetches certification awards from the Docebo certifications endpoint. • Dynatrace adapter adds five new vulnerability fields: `Dynatrace Exposure`, `Data Assets`, `Davis Risk Level`, `Davis Risk Score`, and `Dynatrace Vulnerable Components`. • Infoblox DDI adapter adds an option to skip fixed addresses with no MAC address, excluding them from device ingestion. • Microsoft Entra ID adapter now fetches agent identities as Application Resources. • Ninja One (RMM) adapter is now supported in the Agent Coverage Workspace, enabling agent coverage tracking, version monitoring, and pre-built detection rules. • Oracle Cloud adapter adds five new optional block storage endpoints: Boot Volumes, Volumes, Volume Backups, Boot Volume Backups, and Volume Group Backups. • Palo Alto Networks Cortex XDR adapter adds the option to fetch hardware information including Device Manufacturer, Model, RAM, and CPU fields. • Ping Federate adapter adds an advanced setting to filter out machine-to-machine OAuth clients from SSO applications. • Proofpoint ObserveIT adapter adds a new `Parse endpoint location IP address as public IP` advanced setting (enabled by default). • Rapid7 Insight AppSec adapter adds an optional `Modules` endpoint for `Proof`, `Proof Description`, and `Module Name` fields, and an optional `Attacks` endpoint for `Attack Type` and `Attack Description` fields on vulnerability variances. • Rubrik Security Cloud adapter adds enrichment options for Virtual Machine Edge devices and EC2 Edge devices. • Sectigo adapter adds a configurable `Page size` advanced setting (default 100). • Sysdig - Secure adapter adds two new public API endpoints: `Inventory Hosts` and `Runtime Results`. • Tenable Vulnerability Management adapter adds an option to fetch cloud connectors (AWS, Azure, GCP) as Accounts. • Veeam adapter adds API version 1.7 support for Veeam Backup & Replication 13. • XM Cyber adapter adds a new `Sensors` endpoint that retrieves device data from the XM Cyber Sensors API. Breaking changes: • Amazon Web Services (AWS) adapter: the `Correlate EKS Containers with their EC2 Instance` advanced setting has been removed; cloud identifiers are now applied automatically. • Qualys Cloud Platform adapter: the Fetch software install paths (CSAM API) advanced setting has been removed; software install paths are now fetched inline from the Inventory API. • Sectigo adapter: the default `Page size` changed from 200 to 100. • OutThink adapter: a new required `Customer ID` connection field has been added; existing OutThink adapter connections must be updated to include it or they will break. • Code42 Incydr adapter has been rebranded to `Mimecast Incydr`; any references to the adapter by its old name will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/axonius https://docs.axonius.com/axonius-help-docs/changelog/release-notes-902 https://docs.axonius.com/axonius-help-docs/changelog/release-notes-902 Thu, 09 Jul 2026 14:26:35 GMT Axonius 9.0.2 adds CISA Vulnrichment, Latest Snapshot View, Ingestion Rules set_value, 4 new adapters, and SAML Visiting Data Scopes. • Adds CISA Vulnrichment as an out-of-the-box vulnerability enrichment source, providing CWE mappings, affected product data, and SSVC metrics. • New CVE Enrichment Settings section under System Settings > Enrichment consolidates control over 24 vulnerability enrichment sources with granular field selection. • Introduces Latest Snapshot View — a point-in-time, read-only view of asset data isolated from live discovery cycles, enabling faster and stable query results during active discovery. • Rebuilt data tables from the ground up, removing column limits, adding column pinning in Edit Columns, and replacing hover-based row actions with a three-dot menu. • Adds Markdown support to Dashboard Text Widgets, enabling formatted headings, bold text, and other markup directly in the widget editor. • Renames Findings to Monitoring across the platform, with updated navigation, page headers, table columns, filters, and rule-creation drawer. • New 'Ignore Security Findings fixed more than X days ago' setting on Adapter Configuration pages prevents stale CVE/Security Findings from being reintroduced. • Adds two new Adapter Connection notification triggers: alert when no fetch started in X days, and alert when no successful fetch completed in X days. • Ingestion Rules gain a new set_value post-action enabling dynamic field assignment during adapter data ingestion, supporting static literals, field-to-field copying, and built-in transformations (trim_prefix, trim_suffix, trim_regex, regex_extract). • New System Settings control for parallel task count during Network Routes enrichment, overriding automatic CPU-based calculation. • SAML user assignment rules now support a Visiting Data Scopes field, enabling automatic data scope access for matched users at login. • Dashboard Chart Click-Through now opens the Asset Table using the view associated with the clicked chart segment, preserving context across chart types. • New adapter: Broadcom Layer7 API Gateway (fetches Users, Application Resources). • New adapter: Figma (fetches Users, Groups, Audit Activities). • New adapter: Palo Alto Networks Cortex Cloud (fetches Devices, Containers, Cloud Security Exposures, Compliance Findings). • New adapter: UKG Pro HCM Reports-as-a-Service (fetches Users via SOAP/Cognos). • BIND adapter adds TSIG key authentication for DNS zone transfers (TSIG Key Name, TSIG Key Secret, TSIG Algorithm settings). • Cloudflare DNS adapter supports account-owned API tokens (cfat_ prefix) via a new optional Account ID connection setting. • CrowdStrike Falcon adapter adds 'Fetch Cases' advanced setting to access the Cases API. • Cisco Firepower Management Center adapter adds ARP table data fetching and a new Firewall Name field on Firewall Rule assets. • BeyondTrust Privilege Management Cloud adapter adds blocked application event data fetch from the v2 Events API with configurable time range, page size, and event action filters. • A10 adapter adds fetching of load balancer configuration data including service groups, partitions, listeners, and endpoint details. • BitSight Security Ratings adapter adds observations data fetch, including vulnerabilities and company findings. • FortiSASE adapter now fetches Devices and Installed Software, with a new advanced setting to enable or disable software fetching. • Google Cloud Platform adapter adds fetching of Google App Engine instances as Compute Services assets. • Infoblox DDI adapter enriches IPAM statistics directly onto Network assets as new fields (Network, Conflict Count, Unmanaged Count, Utilization) instead of creating separate device assets. • Axonius documentation now exposes llm.txt and markdown views for AI consumption, reducing inference costs for AI-assisted workflows. Breaking changes: • Bitbucket Cloud V2 connections require workspace slugs to be added after upgrading, as the `/user/workspaces` endpoint has been deprecated and a new Workspace Slugs connection setting is now required. • Com Laude domain records have been changed from the Devices asset type to Domains & URLs; existing queries that filter Devices by domain-related fields may need to be updated to query URLs instead. • Infoblox DDI A Records (`record:a`) and Shared A Records (`sharedrecord:a`) are now parsed as Domains & URLs instead of Devices; any saved queries, Enforcement Actions, dashboards, reports, or workflows targeting these records as Devices will need to be updated to use Domains & URLs instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/axonius https://docs.axonius.com/axonius-help-docs/changelog/release-notes-901 https://docs.axonius.com/axonius-help-docs/changelog/release-notes-901 Thu, 25 Jun 2026 13:10:50 GMT Axonius 9.0.1 adds 5 new adapters, SAML advanced role/scope mapping, custom compliance values, and dozens of adapter enhancements. • New Bold Security adapter: inventories endpoints, agent status, and browser extension protection. • New EasyDNS adapter: fetches domain registrations, zone management, and DNS record configurations. • New Google Threat Intelligence ASM adapter: discovers internet-facing assets including domains, networks, network services, and aggregated security findings. • New Lenovo Device Orchestration adapter: fetches devices and users with AI-driven fleet health, hardware diagnostics, and warranty data. • New One Identity Safeguard adapter: fetches managed devices with privileged access management context including credential vaulting and session monitoring. • SAML Advanced Mapping now supports independent role and data scope assignment via separate mapping tables, each matched to a different SAML claim. • Users can define Custom Setting Recommended Values for SaaS application compliance, overriding Axonius defaults with organization-specific standards. • Dashboard Saved Filters: users with Edit Dashboard permissions can now set a saved filter as the system default for a dashboard. • Abnormal Security adapter now fetches SOAR tokens as a new Secrets data source for inventorying API tokens. • Archer IRM adapter adds support for fetching Application Settings (password policies, session timeouts, lockout policies) via a new Fetch Application Settings advanced setting. • Arnica.io adapter adds severity-level filtering for findings (critical, high, medium, low, info, unknown) to improve query performance. • Check Point Infinity adapter enriches firewall policies with associated threat profiles and mitigated CVEs when threat profile fetching is enabled. • Cisco Meraki adapter enables custom parsing support for devices. • Cisco Secure Access adapter is now available in the Agent Coverage Workspace for tracking agent deployments and coverage gaps. • Cisco Webex adapter now fetches Activities as a new asset type, with optional role information and OAuth authorization enrichment for users. • Cloudflare Zero Trust adapter now fetches tunnel connections as Network Services. • CrowdStrike Falcon adapter now fetches AWS ECS Fargate assets as Serverless Functions. • CyberArk Endpoint Privilege Manager adapter adds support for Software assets and fetching installed programs. • CyberArk Idaptive adapter adds a new advanced setting to control whether device entities are fetched during discovery. • CyberArk Privileged Account Security adapter adds a 'Parse Device from User Account' advanced setting to create devices from account address domain values. • Duo Beyond adapter now fetches application-level account settings including MFA requirements, password policies, and lockout thresholds. • Freshdesk adapter now fetches Tickets. • GitHub adapter adds options to fetch SSH keys as Secrets and repository last login per user. • Jamf Pro adapter adds an option to fetch device compliance information from Jamf's Conditional Access API. • Jira Service Management adapter adds support for Groups and URLs entity types from Jira Insight. • Microsoft Active Directory adapter adds the option to fetch printers as Devices. • Microsoft Defender for Endpoint adapter adds detailed vulnerability information fields (summary, impact, remediation) and changes the default for vulnerability aggregation to True. • NodeZero adapter adds MAC address and UUID fields, network services data per pentest endpoint, and Active Directory password audit findings. • Observium adapter now fetches Network Devices. • Oracle Cloud adapter adds support for fetching Vaults, Vault Secrets, Keys, and Volume Backup Policies via the generic adapter engine. • Qualys Cloud Platform adapter adds a new advanced setting to fetch software install paths via the CSAM API. • Rapid7 Nexpose/InsightVM adapter replaces the boolean vulnerability rich text setting with granular per-field selection. • ServiceNow relationship settings consolidated into a dedicated 'Relationship enrichment configuration' section with Disabled, Fetch always, and Use cached relationships modes. • Akamai Kona WAF adapter adds an advanced setting to use the OS DNS resolver instead of Quad9 when parsing URL IP addresses. • Google Security Operations SIEM adapter's Queries advanced setting now accepts a single delimited string with a configurable Delimiter setting. • CyberArk Privilege Cloud adapter adds a configurable Safes page size setting to prevent timeouts on large safe volumes. • New Relic adapter adds an option to enrich Windows Services onto parent HOST devices instead of creating separate device records. • Abion adapter adds a new endpoint to fetch domain-specific information including hosts and contacts data. • Custom Files adapter now fetches Application Settings. Breaking changes: • HPE Aruba Networking ClearPass Policy Manager: the Extended Info Fetch Window (Days) value is now constrained to 0–90; existing configurations with values outside this range must be updated. • Microsoft Defender for Endpoint: the default value for vulnerability aggregation has changed to True, which may alter existing fetch behavior on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/axonius https://docs.axonius.com/axonius-help-docs/changelog/release-notes-901 https://docs.axonius.com/axonius-help-docs/changelog/release-notes-901 Thu, 25 Jun 2026 13:10:50 GMT Axonius 9.0.1 adds custom SaaS compliance values, SAML role/data scope mapping, and 6 new adapters. • Adds `Custom setting recommended value` for SaaS application settings to define organization-specific compliance standards. • Introduces independent mapping of roles and data scopes in SAML configurations via two separate tables in Advanced Mapping. • Adds six new adapters: Bold Security, EasyDNS, Google Threat Intelligence ASM, Industrial Defender ASM, Lenovo Device Orchestration, One Identity Safeguard. • Updates Airlock Digital adapter to fetch `Agent Versions` field for devices. • Enables AWS adapter to set `Fetch Organization Accounts as assets` (renamed from `Fetch Organizations as assets`). • Enables Archer IRM adapter to fetch Application Settings via new `Fetch Application Settings` advanced setting. • Adds Arnica.io advanced setting to filter findings by severity level (critical, high, medium, low, info, unknown). • Enables Cisco Secure Access adapter in the Agent Coverage Workspace for monitoring agent deployments and coverage gaps. • Updates Cisco Webex adapter to fetch Activities, role information, and OAuth authorizations via new advanced settings. • Allows Cloudflare Zero Trust adapter to fetch tunnel connections as Network Services. • Adds AWS ECS Fargate assets as Serverless Functions in CrowdStrike Falcon adapter with restructured POD asset configuration. • Enables Custom Files adapter to fetch Application Settings. • Adds CyberArk Endpoint Privilege Manager support for Software assets and installed programs via advanced setting. • Introduces advanced setting in CyberArk Idaptive adapter to control device entity fetching during discovery. • Adds configurable `Safes page size` setting in CyberArk Privilege Cloud adapter to prevent timeouts. • Enables CyberArk Privileged Account Security adapter to parse devices from user account domain values via `Parse Device from User Account` advanced setting. • Updates Duo Beyond adapter to fetch account settings including password policies, MFA requirements, and lockout thresholds. • Adds GitHub option to fetch and store SSH keys as Secrets in Axonius. • Enables Google Security Operations SIEM adapter to use `Delimiter` advanced setting for UDM queries (replacing list format with delimited string). • Updates HPE Aruba Networking ClearPass Policy Manager adapter with new constraints for Extended Info Fetch Window (Days) (0-90 days) and async fallback options. • Adds Jamf Pro option to fetch device compliance information from Conditional Access API. • Enables Jira Service Management adapter to support Custom Parsing for Firewalls and Groups/URLs entity types from Insight. • Allows Microsoft AD adapter to fetch printers as Devices. • Updates Microsoft Defender for Endpoint adapter with detailed vulnerability info in records and changed default for vulnerability aggregation to True. • Enhances New Relic adapter to enrich Windows Services onto parent HOST devices. • Adds NodeZero support for MAC address, UUID, network services, and Active Directory password audit findings. • Updates Observium adapter to fetch Network Devices. • Updates Oracle Cloud adapter to fetch Vaults, Vault Secrets, Keys, and Volume Backup Policy via generic adapter engine (disabled by default). • Enhances Proofpoint Endpoint DLP adapter to automatically extract directory fields from API responses. • Adds Qualys Cloud Platform advanced setting to fetch software install paths via CSAM API. • Replaces boolean `Parse Proof and Key Rich Text Fields for vulnerabilities` in Rapid7 adapters with granular configuration for selecting specific fields. Breaking changes: • The AWS adapter setting `Fetch Organizations as assets` is renamed to `Fetch Organization Accounts as assets`. • HPE Aruba Networking ClearPass Policy Manager requires Extended Info Fetch Window (Days) values to be between 0 and 90; existing configurations outside this range will fail or need updating. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/axonius https://docs.axonius.com/axonius-help-docs/changelog/release-notes-900 https://docs.axonius.com/axonius-help-docs/changelog/release-notes-900 Wed, 27 May 2026 12:12:49 GMT Axonius 9.0 introduces Business Context classification, Security Finding Rules, Asset Criticality, and a new navigation structure. • Adds `Business Context` feature for centralized asset classification by business unit, lifecycle status, and ownership • Adds three-tab view (`All`, `Axonius Security Findings`, `External Security Findings`) to the Security Findings page • Enriches vulnerability data with `Axonius Threat Intelligence` including exploit, weaponization, and KEV status • Introduces Axonius Vulnerability Score (AVS) calculated via an AI-powered pipeline for risk prioritization • Adds `Asset Criticality` mechanism with pre-defined rules and custom query-based categories for assets • Provides out-of-the-box `Security Finding Risk Score` and `Asset Risk Score` models for prioritization • Empowers analysts to assign remediation tasks via the new `Remediation Ownership` feature • Generates prioritized solution lists in `Recommended Actions` tab within the Action Center • Adds `Internal Software Version Rank` field to rank installed software versions by recency • Adds `Device Unique Users Count` and `Inactive License Users Count` fields for license tracking • Redesigns platform navigation into Home, Dashboard, Inventory, Exposures, Action Center, Adapters, and Analysis sections • Enables adding relationship columns from related asset tables in the Query Wizard • Allows setting maximum timeout (up to 6 hours) for Network Routes enrichment process Full history on Cyber Toolchain: https://cybertoolchain.io/tools/axonius https://docs.axonius.com/axonius-help-docs/changelog/release-notes-8025 https://docs.axonius.com/axonius-help-docs/changelog/release-notes-8025 Wed, 27 May 2026 06:49:14 GMT Axonius 8.0.25 adds incremental workflow testing, new adapters (A10, Netgate pfSense, etc.), and SaaS compliance standards. • Adds node-by-node Workflow Test Run & Debugging to build and test workflows incrementally without production risk • Adds ISO 27001 standard support in the Compliance field on the SaaS Applications page • Sets Create New Asset fields as default fields on Assets Pages • Adds Akeyless Vault adapter support for AWS IAM and Universal Identity authentication methods • Adds new adapter for A10 Control to fetch Devices • Adds new adapter for Beamy to fetch SaaS Applications • Adds new adapter for Boost Security to fetch Application Resources • Adds new adapter for FortiAuthenticator to fetch Users, Devices, Groups • Adds new adapter for GEM One to fetch Devices • Adds new adapter for Netgate pfSense to fetch Networks and Network/Firewall Rules • Adds new support for fetching allowed devices from AlgoSec Firewall Analyzer with device type filtering • Adds GitHub Advanced Security vulnerability alerts as Security Findings in Azure DevOps adapter • Adds option to fetch devices during active BigFix Inventory import • Enhances BitSight Security Ratings to parse domain and URL findings as separate asset types • Adds benchmark exceptions and rule-level errors per assessment in CIS-CAT Pro adapter • Adds hostname exclusion advanced setting in Cisco Meraki adapter • Migrates CloudFlare Zero Trust adapter to API Token-only authentication, removing User Email connection parameter • Adds Network Services fetching for Cloudflare DNS adapter with parsing of MX, TXT, SRV, NS, PTR records • Adds option to fetch only online devices in CrowdStrike Falcon adapter • Migrates CyberArk Endpoint Privilege Manager to POST /Sets/{set_id}/Endpoints/search endpoint • Adds Application Settings and SaaS Applications fetching options in Databricks adapter • Adds device log enrichment option in Exabeam Cloud adapter • Adds DNS lookup disabling option for virtual servers in F5 BIG-IP iControl adapter • Adds network assets fetching from global interfaces in FortiManager adapter • Adds Application Settings fetching in Google Workspace adapter • Adds support for API v3 in Greenhouse adapter alongside existing API v1 • Adds devices fetching and card reader enrichment in Lenel OnGuard adapter • Fetches Azure AI services as Application Services in Microsoft Azure adapter • Adds vulnerability severity filtering option in Microsoft Defender for Endpoint adapter • Adds Cloud Environment configuration option for Azure US Government Cloud in Microsoft Teams enforcement actions • Adds Application Settings fetching in MicroStrategy adapter • Disables Enrich Users with Messages From endpoint by default in Mimecast V2 adapter • Fetches networks and network site information in NetBrain adapter • Adds Use API v4 advanced setting for Nutanix Prism Central adapter • Updates Okta adapter connection test to support connections without okta.users.read permission • Adds activities fetching via OpenAI Compliance API in OpenAI adapter • Adds mutual TLS authentication, configurable OAuth scope, and page size configuration in Oracle Fusion HCM Cloud adapter • Adds Fetch Firewall Threat Profiles advanced setting in Palo Alto Networks Panorama adapter • Adds extension type filtering option for device endpoint queries in Ring Central adapter • Merges Table Mapping component in ServiceNow adapter to remove workflow complexity Breaking changes: • CloudFlare Zero Trust adapter removes User Email connection parameter; existing connections must switch to API Token-only authentication • Mimecast V2 adapter changes Enrich Users with Messages From endpoint to disabled by default; users must manually enable it in advanced settings Full history on Cyber Toolchain: https://cybertoolchain.io/tools/axonius