Falcon LogScale 1.205.0 GA (2025-09-09)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.205.0GA2025-09-09

Cloud

2026-10-31No1.150.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Advance Warning

The following items are due to change in a future release.

  • Configuration

    • The configuration option VERIFY_CRC32_ON_SEGMENT_FILES (default: true) which can be used to disable Cyclic Redundancy Check (CRC) verification when reading segments is planned to be removed in version 1.213.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The EXTRA_KAFKA_CONFIGS_FILE configuration variable has been deprecated and planned to be removed no earlier than version 1.225.0. For more information, see RN Issue.

  • rdns() has been deprecated and will be removed in version 1.249. Use reverseDns() as an alternative function.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

Upgrades

Changes that may occur or be required during an upgrade.

  • Installation and Deployment

    • Upgraded the bundled JDK from version 24.0.1 to 24.0.2.

New features and improvements

  • GraphQL API

    • Added new parameter allowInPlaceMigration for the addOrganizationForBucketTransfer GraphQL mutation. When set to true, this bypasses bucket upload overwrite checks for S3 and Azure, enabling in-place segment migrations. This behavior is unchanged for Google Cloud Storage (GCS), as it does not implement these checks.

      For more information, see addOrganizationForBucketTransfer() .

Fixed in this release

  • User Interface

    • Fixed an issue where the progress calculation of queries using defineTable() would incorrectly fluctuate, causing the progress bar in the search UI to move back and forth. Queries are now weighted evenly to ensure consistent progress tracking even if the work of a query is yet to be calculated.

  • Dashboards and Widgets

  • Other

    • Fixed an issue where concurrency issues when parsing YAML content occasionally caused threads to loop infinitely.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • GraphQL API

    • The assignedTasks and unassignedTasks fields of the ClusterNode GraphQL datatype now only show tasks relevant to the node's nodeRole, providing clearer information about active tasks.

  • Storage

    • Improved query planning performance for scenarios with many bucket-stored segments by implementing cached precomputed tables instead of expensive rendezvous hashing. The hash table size defaults to 10,000 rows and can be configured using NUMBER_OF_ROWS_IN_SEGMENT_TO_HOST_MAPPING_TABLE.

  • Queries

    • Improved query response handling by streaming large JSON responses. This enhancement allows responses to start streaming faster even when the entire response is very large, particularly helping in cases where responses previously hit request timeouts.

    • Query workers under digest load now respond more quickly when canceling running queries.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • darktrace/detect has been updated to v2.0.0.

      • Added support for CEF-formatted DCIP logs with new event.dataset "darktrace.dcip"

      • Enhanced MITRE ATT&CK technique and tactic mapping using objectArray functions

      • Improved field mappings for threat intelligence data

      • Updated parser to 3.0.0

      For more information, see Package darktrace/detect Release Notes.

    • zscaler/internet-access has been updated to v1.5.1.

      • Enhanced user email field handling to only set user.email when a valid email format is detected

      • Improved MD5 hash field processing for file.hash.md5

      • Fixed conditional logic for user field extraction across all dataset types

      • Updated parser version to 2.5.1

      For more information, see Package zscaler/internet-access Release Notes.

    • cloudflare/zerotrust has been updated to v1.4.0.

      • Added severity mapping based on risk score

      • Added event.kind = alert for zone-scoped-http-requests when severity is present

      • Added event.action mapping from Vendor.SecurityAction

      • Added array deduplication for event.category[] and event.type[]

      • Updated email field normalization to convert all email addresses to lowercase

      • Enhanced DNS event action mapping to use coalesce function for better field resolution

      • Updated parser version to 2.3.0 and CPS version to 1.1.0

      For more information, see Package cloudflare/zerotrust Release Notes.

    • tausight/ephi-risk-posture has been updated to v1.2.1.

      • Updated ECS version from 8.17.0 to 9.0.0

      • Updated CPS version from 1.0.0 to 1.1.0

      • Replaced rename() function calls with direct field assignments for improved performance

      • Fixed email.from.address field mapping to use array:append instead of direct array assignment

      • Added metadata-source.yaml file for package metadata

      For more information, see Package tausight/ephi-risk-posture Release Notes.

    • okta/sso has been updated to v1.4.2.

      • Enhanced timestamp parsing to handle events without published timestamp field

      • Improved target array parsing with better regex matching for JSON structure

      • Fixed handling of error message events that lack timestamp information

      • Updated parser version to 2.4.2

      For more information, see Package okta/sso Release Notes.

    • cloudflare/zerotrust has been updated to v1.5.0.

      • Enhanced bulk log processing with improved batched event handling

      • Added SHA256 hash generation for batched events to track event relationships

      • Improved JSON parsing structure for better event separation

      • Updated parser version to 2.4.0

      For more information, see Package cloudflare/zerotrust Release Notes.

    • okta/sso has been updated to v1.4.4.

      • Enhanced actor type handling with conditional logic for IP addresses and Event Hooks

      • Fixed client.user.full_name field mapping to handle different actor types appropriately

      For more information, see Package okta/sso Release Notes.

    • cisco/firepower has been updated to v1.7.1.

      • Updated CPS version to 1.1.0

      • Enhanced regex patterns for improved log parsing accuracy

      • Added support for user domain and username extraction in connection events

      • Improved multi-event code parsing for SSL VPN events (725001-9, 12, 13, 16, 21, 22)

      • Added event.outcome field for configuration and connection info events

      • Enhanced parsing for Group/User/IP patterns in VPN connection logs

      • Moved syslog severity code mapping to end of parser for better performance

      For more information, see Package cisco/firepower Release Notes.

    • zscaler/internet-access has been updated to v1.5.0.

      • Added support for multi-event processing with event.original.hash.sha256 field for bulk events

      • Updated parser to preserve event.original field for the first event in multi-event logs

      • Enhanced event processing logic to handle concatenated JSON events more efficiently

      • Updated parser version to 2.5.0

      For more information, see Package zscaler/internet-access Release Notes.

    • radware/alteon has been updated to v1.2.1.

      • Updated ECS version to 9.0.0

      • Removed deprecated alteon-syslog parser

      • Fixed field assignment operations to use direct assignment instead of rename operations

      • Updated parser version to 1.1.1

        ### Version 1.2.0

      Parser renaming and Deprecation notice

      The old parser alteon-syslog is deprecated, and replaced by the new parser radware-alteon. While the old parser will remain available during a tranisition period, all future changes will only go into the new radware-alteon parser. We recommend switching to the newer parser as soon as possible, to make for the smoothest upgrade. The old alteon-syslog parser will be removed at some point in the future. In your data, the field #type contains the name of the parser, so any queries you may have that searches for this field need to accomodate this change.

      Duplicated vendor fields dropped in new parser

      The old alteon-syslog parser would duplicate certain fields, which the new radware-alteon parser will not. The fields which were previously duplicated, would be present both under the Vendor namespace (e.g. Vendor.srcIp), and as a field mapped to CPS (e.g. source.ip). If the value of two such fields is byte-for-byte the same, the new parser will no longer preserve the vendor-specific field, but only the CPS field. If the value of the two fields differ, both fields will be preserved. This means the following fields will no longer be present in the parsed data, when using the new parser:

      • Vendor.keys.DstIP

      • Vendor.keys.DstPort

      • Vendor.keys.Method

      • Vendor.keys.ResponseCode

      • Vendor.keys.SrcIp

      • Vendor.keys.URL

      • Vendor.keys.UserAgent

      • Vendor.keys.WAFObservedIP

        ### Version 1.0.1

      • Adds logic to detect event.outcome for http requests based on status code

      • Adds comments to better explain the logic of the temporary fields

      • Bumps parser version to 1.0.1

        ### Version 1.0.0

      • Adds new event.module and Cps.version fields

      • Removes the Product field

      • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type

      • Bug fix: making event.category field an array

      For more information, see Package radware/alteon Release Notes.

    • cisco/firepower has been updated to v1.7.2.

      • Updated parser version to 3.3.2

      • Enhanced regex pattern for event code 106015 to better capture flags field with multiple values

      For more information, see Package cisco/firepower Release Notes.

    • checkpoint/ngfw has been updated to v2.3.1.

      • Fixed regex pattern for numerical action values to prevent backtracking issues

      • Updated parser version to 3.3.1

      For more information, see Package checkpoint/ngfw Release Notes.

    • okta/sso has been updated to v1.4.3.

      • Enhanced target array parsing with improved regex pattern to handle whitespace variations in JSON structure

      • Fixed parsing of target arrays with flexible spacing between "target" field and array brackets

      For more information, see Package okta/sso Release Notes.

    • aws/cloudtrail has been updated to v2.1.0.

      • Updated parser version to 4.0.0

      • Enhanced event categorization and typing for various AWS actions

      • Changed observer.type from "iam" to "identity" for IAM-related events

      • Updated AssumeRole and AssumeRoleWithSAML event categorization from authentication to iam

      • Modified ConsoleLogin event dataset from "cloudtrail.iam" to "cloudtrail.auth"

      • Added UserAuthentication event handling with authentication category

      • Improved event type mappings by removing "info" type from several actions

      • Enhanced StartInstances and RunInstances categorization from configuration to host

      • Added GenerateDataKey event handling with configuration category and creation type

      • Updated wildcard matching to be more specific and removed default fallback categorization

      For more information, see Package aws/cloudtrail Release Notes.

    • checkpoint/ngfw has been updated to v2.3.0.

      • Enhanced observer name extraction from originsicname field using regex pattern

      • Improved source field handling for email addresses and IP addresses in 'from' field

      • Added service.id and service.name field mappings with protocol detection

      • Enhanced network protocol detection based on service identifiers

      • Updated parser version to 3.3.0 and CPS version to 1.1.0

      For more information, see Package checkpoint/ngfw Release Notes.

    • cisco/ise has been updated to v1.4.0.

      • Added support for CISE_TACACS_Accounting events (codes 3300, 3301, 3302)

      • Added comprehensive TACACS+ diagnostics parsing for CISE_TACACS_Diagnostics category

      • Enhanced event categorization for TACACS+ authentication, authorization, and accounting events

      • Added support for TACACS+ network access control and user management events

      • Updated parser version to 2.1.0

      For more information, see Package cisco/ise Release Notes.

    • aws/guardduty has been updated to v1.2.1.

      • Updated severity threshold logic to use >= instead of > for more accurate alert classification

      • Fixed severity mapping to properly categorize findings at exact threshold values (9.0, 7.0, 4.0)

      • Updated parser version to 1.3.1

      For more information, see Package aws/guardduty Release Notes.

    • cisco/ise has been updated to v1.3.4.

      • Added parsing for CmdSet field to extract command line information into process.command_line field

      • Enhanced command parsing to filter and extract command arguments from TACACS authorization logs

      • Updated parser version to 2.0.7 and CPS version to 1.1.0

      For more information, see Package cisco/ise Release Notes.