Falcon LogScale 1.191.0 GA (2025-06-03)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.191.0GA2025-06-03

Cloud

2026-07-31No1.150.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Advance Warning

The following items are due to change in a future release.

  • Functions

    • Starting from release 1.195, the query functions asn() and ipLocation() will display an error instead of a warning should an error occur with their external dependency. This change will align their behavior to functions using similar external resources, like match(), iocLookup(), and cidr().

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The color field on the Role type has been marked as deprecated (will be removed in version 1.195).

  • The setConsideredAliveUntil and setConsideredAliveFor GraphQL mutations are deprecated and will be removed in 1.195.

  • The lastScheduledSearch field from the ScheduledSearch datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to the ScheduledSearch datatype to replace lastScheduledSearch.

  • The EXTRA_KAFKA_CONFIGS_FILE configuration variable has been deprecated and planned to be removed no earlier than version 1.225.0. For more information, see RN Issue.

Upgrades

Changes that may occur or be required during an upgrade.

  • Installation and Deployment

    • Upgraded the Kafka clients to 3.9.1.

New features and improvements

  • Automation and Triggers

    • New options are available in the UI for Scheduled searches:

      • Added the hourly frequency for running scheduled searches. Previously, only daily, weekly, and monthly schedules were available when selecting the Simple schedule configuration.

      • Scheduled searches now use the Simple hourly configuration by default instead of cron expression.

      For more information, see Scheduling.

  • Ingestion

    • Custom ingest tokens are now generally available through the API (not in the UI). A minimum length restriction of 16 characters has been added for custom ingest tokens.

      For more information, see Custom Tokens.

  • Functions

Fixed in this release

  • Administration and Management

    • Fixed incorrect registration of the segment-fetching-trigger-queue-size metric that was producing misleading values.

  • Automation and Triggers

    • Fixed a rare issue where information about the execution of Filter and Aggregate alerts could fail to be saved, potentially resulting in duplicate alerts.

  • Fleet Management

    • The Fleet overview page has been fixed as collectors with errors in log sources would incorrectly show the Okay status instead of ERROR.

Improvement

  • Installation and Deployment

  • User Interface

    • The legend title can now be enabled and added to the Time Chart widget.

  • Storage

    • Reduced the log level of OutOfOrderSequenceExceptions in the ingest pipeline from ERROR to WARN.

      These exceptions occur either due to data loss in Kafka (requiring Kafka administrator investigation) or, more likely, due to a timeout on message delivery, which will prompt the exception following the timed out message.

      The log level for writes to Global Database remains at ERROR, as it will cause the node to crash.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • asimily/iomt has been updated to v1.1.1.

      • Updated ECS version to 8.17.0

      • Removed rename() function calls for direct field assignments

      • Removed deprecated parser asimily-iomt-json

      For more information, see Package asimily/iomt Release Notes.

    • zscaler/internet-access has been updated to v1.4.1.

      • Fixed conditional parsing of file.mtime field to handle cases when Vendor.lastmodtime is not present

      • Updated parser version to 2.4.1

      For more information, see Package zscaler/internet-access Release Notes.

    • cloudflare/zerotrust has been updated to v1.2.2.

      • Fixed email attachment parsing by properly dropping temporary arrays

      • Updated ECS version to 8.17.0

      • Updated parser version to 2.1.2

      For more information, see Package cloudflare/zerotrust Release Notes.

    • akamai/asec has been updated to v1.1.1.

      • Updated ECS version from 8.11.0 to 8.17.0

      • Replaced rename() function with direct assignments for field mappings

      • Removed deprecated parser asec-json.yaml

      For more information, see Package akamai/asec Release Notes.

    • cisco/duo has been updated to v2.1.1.

      • Updated field mapping to use direct assignment instead of rename function

      • Updated ECS version to 8.17.0

      • Updated parser version to 2.1.1

      • Updated parser to use array:append for array declaration

      For more information, see Package cisco/duo Release Notes.

    • aws/waf has been updated to v1.1.2.

      • Updated field mapping to use direct assignment instead of rename() function

      • Removed deprecated waf-json.yaml parser

      For more information, see Package aws/waf Release Notes.

    • aws/s3-server-access has been updated to v1.2.1.

      • Updated parser to use direct field assignments instead of rename() function

      • Fixed field mapping consistency

      For more information, see Package aws/s3-server-access Release Notes.

    • okta/sso has been updated to v1.3.1.

      • Fixed source.user.full_name to use client.user.full_name instead of client.user.id

      For more information, see Package okta/sso Release Notes.

    • nozomi/ids has been updated to v1.3.0.

      • Updated timestamp parsing to support MMM dd yyyy HH:mm:ss format

      • Added support for new message types including threat intelligence updates, link status changes, and network scans

      • Enhanced MAC address normalization with uppercase conversion and consistent delimiter formatting

      • Improved field extraction for domain and username parsing

      • Fixed lowercase normalization for various address fields

      • The old parser nozomi-syslog is now officially removed from the Nozomi IDS package

      For more information, see Package nozomi/ids Release Notes.

    • juniper/srx has been updated to v1.3.0.

      • Updated parser to use ECS 8.17.0

      • Improved field extraction with format() function

      • Enhanced array handling with array:append() for event categories and types

      • Added support for mgd login events with user roles and service type

      • Fixed field handling for null values

      • The old parser srx-syslog is now officially removed from the Juniper SRX package

      For more information, see Package juniper/srx Release Notes.

    • darktrace/detect has been updated to v1.3.1.

      • Fixed timestamp parsing for Antigena events to use start time instead of end time

      For more information, see Package darktrace/detect Release Notes.

    • aws/vpcflow has been updated to v1.2.1.

      • Updated field mapping to use direct assignment instead of rename function

      • Updated ECS version to 8.17.0

      • Updated parser version to 1.2.1

      • Updated parser to use array:append for array declaration

      For more information, see Package aws/vpcflow Release Notes.

    • zscaler/private-access has been updated to v1.3.2.

      • Added support for private cloud controller status logs

      • Improved log type detection for logs without sourcetype field

      • Enhanced log format detection for various ZPA log types

      For more information, see Package zscaler/private-access Release Notes.

    • fortinet/fortimail has been updated to v2.0.0.

      • Improved parsing of key-value pairs with empty values

      • Enhanced event categorization for all log types

      • Added support for email address extraction from complex formats

      • Fixed handling of comma-separated recipient lists

      • Added URL parsing capabilities

      • Improved outcome determination logic

      For more information, see Package fortinet/fortimail Release Notes.

    • fortinet/fortimail has been updated to v1.1.1.

      • Updated field mapping to use direct assignment instead of rename function

      • Updated ECS version to 8.17.0

      • Updated parser version to 1.1.1

      • Updated parser to use array:append for array declaration

      • Updated client.ip to non-array field

      • The old parser fortimail is now officially removed from the Fortinet Fortimail package

      For more information, see Package fortinet/fortimail Release Notes.

    • cisco/meraki has been updated to v1.4.1.

      • Added support for BSD syslog format with MMM dd HH:mm:ss timestamp format

      For more information, see Package cisco/meraki Release Notes.

    • dell/isilon has been updated to v1.2.1.

      • Updated field mapping syntax from rename() to direct assignment for better performance

      • Fixed minor code formatting issues

      For more information, see Package dell/isilon Release Notes.

    • veeam/veeamdataplatform has been updated to v1.0.1.

      • Updated field assignments to use direct assignment instead of rename() function

      • Improved field mapping consistency

      For more information, see Package veeam/veeamdataplatform Release Notes.

    • aws/guardduty has been updated to v1.1.2.

      • Updated field mapping to use direct assignment instead of rename function

      • Removed deprecated guardduty-json.yaml parser

      • Updated parser version to 1.2.1

      For more information, see Package aws/guardduty Release Notes.

    • cisco/ise has been updated to v1.3.1.

      • Fixed field mapping for service.name instead of service.type

      • Improved timestamp parsing for additional formats

      • Enhanced field formatting for fields with hyphens in names

      For more information, see Package cisco/ise Release Notes.

    • f5networks/bigip has been updated to v2.3.1.

      • Fixed VLAN ID parsing in connection error and SSL handshake failure events

      For more information, see Package f5networks/bigip Release Notes.

    • aws/guardduty has been updated to v1.1.3.

      • Added event.reason field mapping from Vendor.title

      • Updated parser version to 1.2.2

      For more information, see Package aws/guardduty Release Notes.

    • aws/cloudtrail has been updated to v1.1.6.

      • Updated parser version to 2.0.6

      • Updated CPS version to 1.0.0

      • Fixed TLS field handling by removing rename function and adding drop operations

      For more information, see Package aws/cloudtrail Release Notes.

    • asimily/iomt has been updated to v1.1.2.

      • Updated parser version to 1.1.2

      • Updated parser to use array:append for array declaration

      For more information, see Package asimily/iomt Release Notes.

    • claroty/ctd has been updated to v1.2.1.

      • Fixed field mapping to use direct assignment instead of rename function

      • Improved case statement formatting for better readability

      • Updated parser version to 1.1.2

      For more information, see Package claroty/ctd Release Notes.

    • broadcom/proxysg has been updated to v1.2.1.

      • Updated field mapping to use direct assignment instead of rename function

      • Fixed parser version to 1.1.2

      For more information, see Package broadcom/proxysg Release Notes.

    • aws/fsx has been updated to v1.1.1.

      • Updated field mapping to use direct assignment instead of rename function

      • Updated ECS version to 8.17.0

      • Updated parser version to 1.1.1

      • Updated parser to use array:append for array declaration

      For more information, see Package aws/fsx Release Notes.

    • cisco/firepower has been updated to v1.6.4.

      • Fixed regex pattern for hop failure messages to handle interface names with spaces

      For more information, see Package cisco/firepower Release Notes.

    • imperva/cloud-waf has been updated to v1.4.0.

      • Added regex pattern matching to filter CEF events and drop non-CEF log entries

      • Updated ECS version to 8.17.0

      • Removed rename() function calls for direct field assignment

      • Deleted cwaf-cef.yaml parser file

      For more information, see Package imperva/cloud-waf Release Notes.

    • f5networks/bigip has been updated to v2.3.0.

      • Added support for F5 BIG-IP logs in Splunk format (HTTP traffic, load balancer failures, DNS requests/responses)

      • Fixed IP address field mapping to correctly populate source.ip, destination.ip, and server.ip fields

      • Improved timestamp parsing to support additional formats

      • Enhanced key-value parsing with better handling of empty fields

      For more information, see Package f5networks/bigip Release Notes.

    • aruba/clearpass has been updated to v1.2.3.

      • Updated field mapping to use format() function instead of rename() for better compatibility

      • Downgraded CPS version from 2.0.0 to 1.0.0

      • Removed deprecated clearpass-syslog.yaml parser file

      For more information, see Package aruba/clearpass Release Notes.

    • cisco/ios has been updated to v1.6.0.

      • Enhanced event type categorization for more accurate event classification

      • Added support for additional Cisco IOS event codes including SGACLHIT, FAIL, DHCP_SNOOPING_DENY, and more

      • Improved MAC address normalization for better consistency

      • Added deduplication of event categories and types

      For more information, see Package cisco/ios Release Notes.

    • infoblox/nios has been updated to v1.3.1.

      • Fixed an issue with DNS answers containing quotes

      For more information, see Package infoblox/nios Release Notes.

    • zscaler/internet-access has been updated to v1.4.0.

      • Updated parser to use direct field assignments instead of rename() function

        Fixed base64 decoding for URL fields

      For more information, see Package zscaler/internet-access Release Notes.

    • checkpoint/ngfw has been updated to v2.1.0.

      • Added support for CEF formatted logs with and without headers

      • Enhanced timestamp handling for various formats

      • Added field mappings for additional Check Point fields

      • Improved event categorization and field normalization

      • Added support for additional network direction indicators

      For more information, see Package checkpoint/ngfw Release Notes.