Latest GA Release

Falcon LogScale 1.263.0 GA (2026-10-20)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.263.0GA2026-10-20

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Advance Warning

The following items are due to change in a future release.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

Upgrades

Changes that may occur or be required during an upgrade.

  • Security

    • The following dependencies have been updated to address multiple CVEs:

      • org.xerial.snappy:snappy-java updated to version 1.1.10.10.

      • org.bouncycastle:bc-jdk18on-bom updated to version 1.86.1.

New features and improvements

Fixed in this release

  • Security

    • An issue has been fixed where the organization permission CreateRepository incorrectly allowed users to change retention on all repositories in the organization.

      The new organization permission ChangeRetentionForAllRepositories grants the ability to change retention policies on all repositories in the organization. Users who previously relied on CreateRepository for access should be assigned this new permission instead.

  • Storage

    • An additional fix has been applied to the previous issue of segments not being fully skipped when hash filters indicated no search work was needed, causing segment metadata to be loaded and discarded unnecessarily.

  • Queries

    • An issue has been fixed where tag distinction for persisted aggregations was checked across the entire organization instead of within the destination repository. Tags are now constrained based on the destination repository.

    • An issue has been fixed where deleting a persisted aggregation did not remove its results from the destination repository. If a persisted aggregation with the same tag was created again, the data was written to the same location, combining the old results with the new results.

      Results are now removed from the destination repository after a persisted aggregation is deleted, and results that arrive afterward are no longer retained.

    • An issue has been fixed with connection changes in multi-cluster search views for already running queries. New and updated connections on remote views would not check the connection tags filter, resulting in unnecessary query submissions and network calls between clusters, even though the query results were still correct.

    • An issue has been fixed where federated queries and queries referencing tables were not stopped correctly in some scenarios.

  • Fleet Management

  • Functions

    • An error message regression has been fixed where invalid regular expressions passed as a string to the regex() function or the regex argument of the replace() function could produce an internal validation error when passed to the parser's default regex engine (JitRex, also known as V1 engine).

    • Including the same field more than once when using the function defineTable() now returns an error at time of submission rather than causing the query to fail with an internal error.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • GraphQL API

    • The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.

      The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.

      Existing scheduled reports are automatically migrated, no action is required.

  • Auditing and Monitoring

    • Audit log entries for creating, updating, deleting, enabling, and disabling a scheduled report now include the following additional fields:

      • viewId

      • viewName

      • scheduledReportId

      • scheduledReportName

      The previously included field dashboardId remains available. Existing searches and dashboards involving these audit log entries continue to work, and can now filter and group by report and view.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • nginx/nginx has been updated to v2.0.0.

      • Normalizes access and error logs to CrowdStrike Parsing Standard (CPS)

      • Updates saved queries and dashboards to work with normalized fields.

      • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

      • Combines both the access log and the error log parsers into nginx parser.

      For more information, see Package nginx/nginx Release Notes.

    • cisco/firepower has been updated to v2.1.0.

      • Updated ECS version to 9.5.0

      • Added event.code field assignment from Vendor.mnemonic earlier in the parsing pipeline (before the match block) and removed the duplicate assignment at the end of the parser

      • Changed match block from Vendor.mnemonic match to event.code match for consistency

      • Added support for event codes 113015, 113016, 113017 with authentication failure categorization, reason and user extraction, and optional server IP extraction

      • Expanded event code 722003 to cover 722001, 722002, 722004, 722005, 722006 (SVC/SSL VPN Client errors) with improved field extraction for group, user, source address, and error reason

      • Enhanced event code 750003 with improved regex for source/destination address and port extraction, and username mapped to source.user.name

      • Replaced single event code 751002 with range 751001-751005 with improved regex patterns, source.user.name mapping, and error.message assignment from event.reason

      • Added support for event codes 716038 and 716039 (WebVPN authentication success/failure) with group name, source user, source address extraction, and static event.reason assignment

      • Added support for event code 611101 (VPN client login success) with source.address and source.user.name extraction

      • Added support for event code 611102 (VPN client login failure) with source.address and source.user.name extraction

      • Added support for event code 605004 (authentication denied) with source address/port, destination address/port, user, interface, and host IP extraction

      • Added support for event code 605005 (authentication permitted) with source address/port, destination address/port, user, interface, and host IP extraction

      • Added support for event code 113013 (AAA authentication failure) with action, reason, and user extraction

      • Added support for event code 113012 (AAA authentication success) with reason and user extraction

      • Added support for event code 113006 (AAA user authentication rejected) with user extraction

      • Added support for event code 113039 (AnyConnect session started) with group, user, and source address extraction

      • Added support for event codes 109011, 109034, 113021 (authentication info) with reason, action, user, source/destination address/port, and interface extraction

      • Removed user.name field mapping from event code 751002 test case assertions; replaced with source.user.name

      • Removed event.category[0]: network assertion from event code 751002 test case (now covered by the expanded range)

      • Added new test cases for event codes 722003, 750003, 113039, 113015, 716039, and 716038

      For more information, see Package cisco/firepower Release Notes.

    • f5networks/bigip has been updated to v3.1.2.

      • Updated test case data

      For more information, see Package f5networks/bigip Release Notes.

    • cisco/meraki has been updated to v2.0.4.

      • Updated ECS version to 9.5.0

      • Fixed port regex pattern for port event subtype to support MAC address prefix format (e.g., F8:AE:30:F2:5C:A7/35) before the port number, enabling correct parsing of STP role change events with interface identifiers

      • Added test case for port events with MAC address/port notation (e.g., Port F8:AE:30:F2:5C:A7/35 changed STP role from designated to disabled)

      • Renamed parser YAML file from cisco-meraki-df to cisco-meraki

      For more information, see Package cisco/meraki Release Notes.

    • fortinet/fortimail has been updated to v2.0.1.

      • Updated ECS version to 9.5.0

      • Updated CPS version to 1.2.0

      • Enhanced timestamp parsing to support timezone-aware formats using Vendor.log.tz field

      • Fixed regex pattern for email error matching to remove unintended empty match case

      For more information, see Package fortinet/fortimail Release Notes.