Falcon LogScale Documentation

• The REST endpoint for testing actions has been deprecated. api/v1/repositories/repoId/alertnotifiers/actionId/test has been deprecated. The new GraphQL mutations should be used instead.

• The REST endpoint for testing actions has been deprecated. api/v1/repositories/repoId/alertnotifiers/actionId/test has been deprecated. The new GraphQL mutations should be used instead.

• The following environment variables are deprecated as of this release. Their removal will be announced in a future version.

  • ZOOKEEPER_URL_FOR_NODE_UUID

  • ZOOKEEPER_URL

  • ZOOKEEPER_PREFIX_FOR_NODE_UUID

  • ZOOKEEPER_SESSIONTIMEOUT_FOR_NODE_UUID

  The recommended steps for migrating off of Zookeeper are described in Falcon LogScale 1.70.0 Stable (2023-01-16).

  Note

  When using Operator and Kubernetes deployments, you must upgrade to 0.17.0 of operator to support migration away from the Zookeeper requirement. See Version 0.17.0.

• Deprecated feature removal: the file-based backup feature was deprecated in 1.42.0 and is now removed from Humio. The following configs are no longer supported and will do nothing if set:

  • BACKUP_NAME

  • BACKUP_DIR

  • BACKUP_KEY

  The DELETE_BACKUP_AFTER_MILLIS config is still supported, as it is used for configuring the delay between a file being marked for deletion in Humio, and that file being removed from bucket storage.

• Deprecated feature removal: the file-based backup feature was deprecated in 1.42.0 and is now removed from Humio. The following configs are no longer supported and will do nothing if set:

  • BACKUP_NAME

  • BACKUP_DIR

  • BACKUP_KEY

  The DELETE_BACKUP_AFTER_MILLIS config is still supported, as it is used for configuring the delay between a file being marked for deletion in Humio, and that file being removed from bucket storage.

• Deprecated enabledFeatures query. Use new featureFlags query instead.

• The deprecated REST API for parsers has been removed.

• The deprecated REST API for actions has been removed, except for the endpoint for testing an action.

• The deprecated REST API for parsers has been removed.

• Deprecated enabledFeatures query. Use new featureFlags query instead.

• Remove the following feature flags and their usage: EnterpriseLogin, OidcDynamicIdpProviders, UsagePage, RequestToActivity, CommunityNewDemoData.

• The deprecated REST API for actions has been removed, except for the endpoint for testing an action.

• The Feature Flag, CookieAuthServerSide, has been deprecated as cookie authentication is now enabled by default. Instead, the configuration field ENABLE_BEARER_TOKEN_AUTHORIZATION has been introduced.

• The local disk based backup feature described at Making Back-Ups is deprecated, and is planned for removal in September 2022. We have found that restoring backups using this feature is difficult in practice, it is not commonly used, and the backup/restore functionality is covered by the bucket storage feature as well. For these reasons, we are deprecating this feature in favour of bucket storage.

  The DELETE_BACKUP_AFTER_MILLIS configuration parameter, which controls the delay between data being deleted in Humio and removed from backup, will be retained, since it controls a similar delay for bucket storage. Customers using local disk based backups should migrate to using bucket storage instead. Systems not wishing to use a cloud bucket storage solution can keep backup support by instead installing an on-prem S3- or GCS-compatible solution, such as MinIO.

• The deprecated built-in parser json-for-notifier has been deleted. It has been replaced by the parser json-for-action.

• The deprecated built-in parser bro-json has been deleted. It has been replaced by the parser zeek-json.

• New config MAXMIND_IP_LOCATION_EDITION_ID for selecting the maxmind edition of the IP location database. Deprecates MAXMIND_EDITION_ID, but old config will continue to work.

• The configuration options AUTH0_API_CLIENT_ID and AUTH0_API_CLIENT_SECRET have been deprecated in favor of AUTH0_CLIENT_ID and AUTH0_CLIENT_SECRET respectively - the old names will continue to work as aliases.