Latest GA Release
Falcon LogScale 1.257.0 GA (2026-09-08)
| Version? | Type? | Release Date? | Availability? | End of Support | Security Updates | Upgrades From? | Downgrades To? | Config. Changes? |
|---|---|---|---|---|---|---|---|---|
| 1.257.0 | GA | 2026-09-08 | Cloud | Next LTS | No | 1.177.0 | 1.177.0 | No |
Hide file download links
Download
Use docker pull humio/humio-core:1.257.0 to download the latest version
Bug fixes and updates
Breaking Changes
The following items create a breaking change in the behavior, response or operation of this release.
Functions
LogScale LTS version 1.258 will include a breaking change to subquery semantics for the
worldMap()andsankey()functions. Result fields will no longer be automatically detected, and results must be assigned to a specific field - magnitude forworldMap()and weight forsankey()respectively.This change avoids unpredictable behavior in sub-queries, and allows further development on related systems. The following is an example of a query that is impacted by this change:
logscaleworldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | sum(w_squared) | magnitude := math:sqrt(_sum) })Currently, the query will be interpreted as:
logscaleworldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | magnitude := sum(w_squared) })From version 1.258, the
math:sqrtpart of the query will no longer be discarded.
Advance Warning
The following items are due to change in a future release.
GraphQL API
The mutation deleteFeatureFlag will be removed from the code in LTS 1.270. It is replaced by resetFeature.
API
Starting in version 1.258, the
queryjobsendpoint will always use pagination, even when no pagination arguments have been given. When no arguments are provided, the endpoint will return the maximum page size and an offset of 0. Unless the dynamic configuration parameterQueryResultRowCountLimithas been raised from its default value, this will initially be the entire result.All clients should begin transitioning to use the paginated polling method ahead of version 1.258.
Deprecation
Items that have been deprecated and may be removed in a future release.
The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.
To temporarily opt out of the authentication requirement, the feature flag
UnauthenticatedMetacan be enabled.The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.
Behavior Changes
Scripts or environment which make use of these tools should be checked and updated for the new configuration:
GraphQL API
After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:
recoverOrganization — Restores the organization to visible state.
rollbackOrganization — Fully deletes the organization under certain conditions and permissions.
Previously, you could call any mutation on a soft-deleted organization.
Fleet Management
Upgrades
Changes that may occur or be required during an upgrade.
Security
LogScale has upgraded the following packages to address open CVEs:
io.projectreactor.netty:reactor-netty-httpfrom version 1.3.6 to version 1.3.7
org.apache.qpid:proton-jfrom version 0.34.1 to version 0.35.0
io.projectreactor:reactor-corefrom version 3.8.6 to version 3.8.7
New features and improvements
Fleet Management
Fixed in this release
User Interface
Rows in the
Tablewidget could not be selected while a query was in a stopped state. This issue has been fixed and row selection now works for stopped queries, matching the existing behavior for completed and live queries.Two issues regarding the Fields panel have been fixed:
Fixed an issue with the GraphQL API Explorer where a user's session would not be refreshed by the UI due to credential timeout.
Automation and Triggers
Two issues related to saved searches have been resolved:
Saved searches grouped by Last Modified are now bucketed according to the user's configured time zone instead of Coordinated Universal Time (UTC). Previously, searches had the potential to appear under the the wrong day for users outside UTC.
The Saved searches list now updates immediately following the creation of a new saved search. Previously, the new search did not populate until the user navigated away from and then returned to the Saved searches tab.
Queries
Fixed an issue in the query scheduler that could cause starvation of organization or user queries for extended periods.
Fixed an issue where the query scheduler may prioritize an organization or user unfairly.
Fixed a number of issues in the query scheduler which would cause unfair prioritization. These issues could lead to queries being deprioritized or taking significantly longer than expected to complete.
Known Issues
Storage
For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between
PRIMARY_STORAGE_PERCENTAGEandPRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.
Improvement
User Interface
The Query Editor now highlights specific characters in a malformed regular expression instead of the entire expression. Running an erroneous query no longer garbles the error message in the Results tab.
Storage
The timeout for uploading CSV/JSON files to bucket storage has been removed, and upload operations are now queued and run concurrently instead of each operation runnning sequentially.
GraphQL API
The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.
The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.
Existing scheduled reports are automatically migrated, no action is required.
Queries
Improved query caching and reuse by introducing a canonical sort order to the internal representation of filter queries. For example, the queries
A AND B AND CandB AND A AND Ccan now share cached results.
Recent Package Updates
The following LogScale packages have been updated within the last month.
Package Changes
infoblox/nios has been updated to v1.5.0.
Extended audit log parsing to support additional service names: python, sshd, and -serial_console in addition to httpd
Added client.address mapping from Vendor.audit.ip for login events
Enhanced created, modified and called events with object type/name extraction via regex and kvParse
Extended RestartService match to include ClearRestartFlags and NodeAdminOperation
Extended TransferTrafficCapture match to include CSV
Added process.id extraction from syslog priority format messages
Added BOOTREQUEST outcome handling: failure when message contains no dynamic leases, success otherwise
Added bind update event parsing with client.address, Vendor.action_blocked, and Vendor.reject_reason fields
Added r-l-e (Renewed/Issued/Freed) lease event parsing with client.ip, client.mac, host.name, DHCP state, time, vendor class, option tag, and network fields
Extended DNS service name match to include idns_healthd in addition to named
Added ICMP monitor event parsing for DNS dataset with client.domain, client.address, and ICMP status fields
Added cloud_dns_task_executor_overlay_ctl service handling mapped to nios.dns dataset
For more information, see Package infoblox/nios Release Notes.
everpure/flashblade has been updated to v1.2.2.
Added threat detection rules for critical FlashBlade administrative operations (pass-through detections to NG-SIEM):
PURE-FB-SYSLOG-CHANGE: Detects syslog target additions, modifications, or deletions (purelog setattr/create/delete)
PURE-FB-NTP-CHANGE: Detects NTP server configuration changes (purearray setattr --ntpserver)
PURE-FB-FS-DESTROY: Detects file system destruction (purefs destroy)
PURE-FB-EXPORT-DELETE: Detects SMB/NFS export deletions (purefs export delete)
PURE-FB-FS-PROTOCOL-REMOVE: Detects protocol/export removal from file systems (purefs remove)
PURE-FB-S3-BUCKET-DESTROY: Detects S3 bucket destruction (purebucket destroy)
PURE-FB-DNS-CHANGE: Detects DNS nameserver configuration changes (puredns setattr --nameservers)
Updated event.action to use coalesce([Vendor.Action, Vendor.Subcommand]) instead of lower(Vendor.Action)
Added event.provider field mapped from Vendor.UI
Updated process.command_line to include full command string formatted as Command Subcommand Arguments
Removed process.args[] array field (previously split from Vendor.Arguments)
Simplified host.hostname assignment to use inline lower() within coalesce()
Added network.protocol field for export/protocol-related detections
Added rule.id, rule.name, rule.category, and rule.description fields for threat detections
Updated ECS version to 9.4.0
For more information, see Package everpure/flashblade Release Notes.
microsoft/windows-dns-debug has been updated to v1.5.2.
Refactored timestamp parsing logic into a unified post-case __timestamp match block supporting five distinct timestamp formats
Added support for new timestamp format: d-M-yyyy H:mm:ss (e.g., 04-08-2026 19:55:33)
Simplified regex patterns in case statement to use generic .*? timestamp capture group for broader format compatibility
Removed inline parseTimestamp and drop calls from individual case branches
Updated ECS version to 9.4.0 and CPS version to 1.2.0
For more information, see Package microsoft/windows-dns-debug Release Notes.
cisco/firepower has been updated to v2.0.1.
Enhanced regex patterns for event codes 302020 and 302021 to support optional user domain and username extraction from ICMP connection messages
Added support for parsing user domain (destination.user.domain, source.user.domain) and username (destination.user.name, source.user.name) fields in ICMP built/teardown connection messages
Added new test cases for ICMP connection events with user information (302020 outbound/inbound and 302021 teardown with domain\user format)
For more information, see Package cisco/firepower Release Notes.
everpure/flasharray has been updated to v1.1.0.
Added threat detection logic (pass-through detections) for high-risk FlashArray operations including volume eradication, volume destruction, file system destruction, protection group snapshot destruction, syslog target modification, eradication delay modification, NTP configuration modification, and DNS configuration modification
Removed event.id field mapping from Vendor.MessageID
Updated ECS version to 9.4.0
Updated parser version to 2.1.0
For more information, see Package everpure/flasharray Release Notes.
cisco/umbrella has been updated to v1.4.4.
Updated ECS version to 9.4.0
Updated CPS version to 1.2.0
Added web to event.category[] for proxylogs events
Added access to event.type[] for proxylogs allow and block actions
For more information, see Package cisco/umbrella Release Notes.