Falcon LogScale 1.234.5 LTS (2026-08-20)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.234.5LTS2026-08-20

Cloud

On-Prem

2027-05-31No1.177.01.177.0No

Hide file download links

Show file download links

Hide file hashes

Show file hashes

These notes include entries from the following previous releases: 1.234.4, 1.234.3, 1.234.4, 1.234.3, 1.234.4, 1.234.3, 1.234.4

Bug fixes and updates.

Breaking Changes

The following items create a breaking change in the behavior, response or operation of this release.

  • Configuration

    • LogScale will now throw an error on boot if SECONDARY_DATA_DIRECTORY variable is configured. This change is intended to help administrators identify that they are using this deprecated feature that is now being removed.

      Imported from 1.234.4

Advance Warning

The following items are due to change in a future release.

  • Security

    • Starting from LogScale version 1.237, support for insecure ldap connections will be removed. Self-Hosted customers using LDAP will only be able to use ldaps secure connections.

      Imported from 1.234.4

  • Fleet Management

    • Due to efforts to improve resource management, Fleet Management groups will soon no longer support Falcon LogScale Collector versions below 1.5.0.

      Imported from 1.234.4

      For more information, see Manage Versions - Groups.

Removed

Items that have been removed as of this release.

GraphQL API

Storage

  • Secondary storage support has been entirely removed. The following configuration options are no longer available:

    Imported from 1.234.4

  • Secondary storage support has been removed from the redactEvents functionality, the health check functionality, and the internal segment fetching endpoint. This includes the removal of the secondary-disk-usage health check response from the health check API.

    Imported from 1.234.4

Metrics and Monitoring

  • The schedulesegments metric has been removed due to the data it provided no longer being of significant use. Previously, this metric measured the execution time for a particular piece of code that has now experienced significant changes since the metric's inception. Performance issues for that piece of code can now be observed via thread dumps, making a dedicated metric obsolete.

    Imported from 1.234.4

  • The humio-metrics repository metric secondary-disk-usage has been removed, as it measured functionality that is no longer present in the product.

    Imported from 1.234.4

Deprecation

Items that have been deprecated and may be removed in a future release.

Upgrades

Changes that may occur or be required during an upgrade.

  • Functions

    • The underlying data structure for the following query functions have been updated to improve cardinality estimation:

      This represents no change in operations for users.

      Imported from 1.234.4

New features and improvements

  • Automation and Triggers

    • It is now possible to schedule reruns of scheduled searches that have already been executed. This functionality is currently available through the GraphQL API using the new rerunScheduledSearch mutation, and the cancelScheduledSearchRerun mutation for canceling a rerun. Scheduled reruns can be viewed in the executionTimesToRerun field on the ScheduledSearch type. Reruns run in parallel with normal runs, with at most one rerun per scheduled search at a time.

      A maximum of 50 reruns can be scheduled per scheduled search. This limit is configurable using the SCHEDULED_SEARCH_MAX_NUMBER_OF_RERUNS configuration variable.

      Imported from 1.234.4

    • The new Interval scheduling option has been added as an alternative to cron expressions for scheduled searches. This new option uses Relative Time Syntax modifiers such as @every 5d, allowing searches to run at regular intervals.

      Imported from 1.234.4

      For more information, see Scheduling.

  • GraphQL API

    • The GraphQL mutation unsetRetention has been added, allowing individual retention settings on a repository to be restored to their default values. Previously, once retention settings such as timeBasedBackupRetention were set to a positive value, the only way to restore them to the default was to pass null via the updateRetention mutation, which some API clients do not support.

      The new mutation accepts boolean flags for each retention setting and restores those set to true back to their default values. The supported flags are:

      • timeBasedRetention

      • ingestSizeBasedRetention

      • storageSizeBasedRetention

      • timeBasedBackupRetention

      Imported from 1.234.4

  • Configuration

    • The feature flag EnableCompleteStateCache has been replaced with the dynamic configuration parameter QueryStateCacheCompleteEnabled.

      Imported from 1.234.4

Fixed in this release

  • Installation and Deployment

    • Fixed an issue where nodes could occasionally lose connection to Kafka clusters if the node was started with the environment variable KAFKA_COMMON_METADATA_RECOVERY_STRATEGY set to none.

      Imported from 1.234.4

  • User Interface

    • Web interface's table components could display stale data when filters were changed rapidly by users. For example, this issue might have occurred when entering data in a search box, toggling column filters, and/or clearing all filters in rapid succession, resulting in responses arriving out of order and causing outdated results to overwrite more recent data.

      To address this issue, table components in the UI now track request versions and ignore stale responses, ensuring only the most recent filtered results are displayed. Also, the previous/next pagination buttons are now disabled while a search is in progress.

      Before the fix, affected pages included:

      Imported from 1.234.4

    • The documentation link in the error message for aggregate alerts containing prohibited functions has been repaired.

      Imported from 1.234.4

  • Automation and Triggers

    • In rare cases, Email actions would fail to send emails when the following conditions occurred:

      • The email action sent results as an attached CSV.

      • The name of the trigger activating the actions contained one of the {field:FIELD_NAME} or the {field_raw:FIELD_NAME} message templates.

      • The name of the trigger with an unexpanded message template was longer than 30 characters.

      • The part of the name of the trigger coming before the message template was at most 30 characters.

      This issue has now been fixed and Email actions are now sent correctly even when the above conditions are met.

      Imported from 1.234.4

    • Fixed an issue where a filter alert could trigger on two events sharing the same @id field value, depending on timing. Filter alerts now deduplicate events using the @id field and will trigger on only one of them.

      Imported from 1.234.4

  • Storage

    • Fixed an issue with segment file validation on startup, where the validation process could end up blocking segment operations for an extended period of time. On nodes with a slow disk and many segment files, all segments could become locked for validation immediately instead of validating groups of files in smaller batches.

      Imported from 1.234.4

  • Ingestion

    • Fixed an issue where live queries that referenced a parser were not restarted when parser updates occurred. Changes to a parser referenced by a live query now cause the live query to be restarted similar to saved queries.

      Imported from 1.234.4

    • In the parser editor, when validating test cases against the CrowdStrike Parsing Standard (CPS), the parser schema validation would report a violation against the wrong field name in some cases. This issue has now been fixed.

      Imported from 1.234.4

  • Queries

    • A minor issue regarding prioritization in LogScale's query scheduler has been fixed. When starting work on scanning a segment piece, a query is effectively charged for the expected cost of the work. Previously, the total estimate was being incorrectly multiplied by the number of blocks in the segment, causing the query to temporarily appear more expensive than it should, resulting in a more strict deprioritization than necessary.

      Imported from 1.234.4

    • A minor issue introduced in version 1.134.0 has been fixed where streaming queries were not being throttled correctly, leading to individual streaming queries consuming too much capacity.

      Imported from 1.234.4

    • The query prioritization code used for humio-metrics has been adjusted to ensure all costs incurred by a user or organization is accounted for in the metrics gathered by LogScale. Previously, the final work completed by the last query performed was not counted, eliminating it from the final total.

      Imported from 1.234.4

    • Fixed an issue where unrelated, incorrect auto-completion suggestions would be provided by the Query editor when writing regex flags, for example in cases where the user's cursor was positioned after the regex flag in /foo/i. This issue has been fixed and auto-suggestions are now disabled in these cases.

      Imported from 1.234.4

    • An issue in the Query Editor> has been fixed where auto-completions would be suggested when writing inside comment blocks. For example, if the cursor was positioned inside //foo or /*foo*/, auto-completions would incorrectly be suggested. No suggestions are now provided in these cases.

      Imported from 1.234.4

  • Fleet Management

    • Fixed an issue where the UI would prevent deleting Log Collector configurations even when no collector instances were using the configuration.

      Imported from 1.234.4

  • Metrics and Monitoring

    • The calculation for the humio-metrics repo metric min-unacked-ingest-timestamp has been corrected to account for occasional underreporting due to overly optimistic (low) values.

      Imported from 1.234.4

  • Functions

    • Fixed an issue with the query functions format() and formatTime(), where negative time zone offsets could be printed incorrectly.

      Imported from 1.234.4

    • Fixed an issue where queries using the parseTimestamp() function on a timestamp that included a deprecated Java short zone ID (ZoneId.SHORT_IDS) would result in an erroneous time zone being supplied (Africa/Abidjan). Use of the deprecated codes will now result in an error message.

      For more information, see the Java ZoneId SHORT_IDS documentation.

      Imported from 1.234.4

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

      Imported from 1.234.4

Improvement

  • User Interface

    • The tab label for the package's settings page has been updated from Installed to Manage, and the page title has been updated from Installed packages to Manage packages.

      Imported from 1.234.4

  • Automation and Triggers

    • Improved the delineation of the time zone for scheduled reports - reports now define the time zone as UTC in the Report generated at field.

      Imported from 1.234.4

      For more information, see Schedule PDF Reports.

    • The field retryable has been added to the internal log events repository humio-triggers-execution-info. When a scheduled search execution fails, the log event now indicates whether the failure is retryable or non-retryable. Errors that are considered transent and therefore re-tryable include timeouts, I/O errors, or HTTP 5xx responses, while non-retryable, permanent errors include invalid configurations, missing actions, or blocked queries.

      This field can be found on scheduled searches containing the field ExecutionFailed

      Imported from 1.234.4

    • When a live query alert is canceled due to excessive ingest delay, LogScale now waits 1 minute before restarting it. Previously, these queries were restarted immediately, which could worsen cluster load.

      The wait time is configurable per alert type using the following configuration variables:

      Imported from 1.234.4

    • LogScale no longer shows notifications for disabled triggers. Any existing notifications for disabled triggers will be deleted shortly after upgrading to this version. Additionally, when a trigger is deleted, any associated notification is now deleted immediately rather than waiting for a background job.

      Imported from 1.234.4

    • S3 Action uploads now log the version ID returned by S3 for both the event and metadata files. When the target S3 bucket has versioning enabled, the fields eventFileVersionId and metadataFileVersionId are included in the repository humio-triggers-execution-info.

      Imported from 1.234.4

  • Ingestion

    • A new lookup file infrastructure has been enabled, which now allows Lookup Files to run more efficiently with faster load time.

      Imported from 1.234.4

  • Queries

    • The dynamic configuration parameter, ReverseDnsConcurrentRequestsPerQuery has been added to control the maximum number of parallel DNS lookups per reverseDns() query. The default value is 1 (sequential, matching previous behavior). The effective maximum is bounded by ReverseDnsConcurrentRequests, with the default value set to 10.

      Increasing ReverseDnsConcurrentRequestsPerQuery improves single-query throughput at the cost of reducing throughput available to other concurrent reverseDns() queries, as all queries share the ReverseDnsConcurrentRequests pool. Self-hosted customers resolving many IPs in a single query can increase this value to improve single-query throughput.

      Imported from 1.234.4

    • A log line has been added to the query scheduler to record the CPU time spent processing the most expensive block of data in the most recent 10 second time interval.

      An example of the results of this operation might look like this:

      2026-03-25T14:45:49.445+0000 [query-normal-scheduler] INFO c.h.q.m.SegmentQueue 145 - Slowest block intervalMs=10000 queryID=IQ-QKqKIDGrXDnrs2N1PozMlYil slowestBlockCpuMs=6

      The format for the results is as follows:

      • The timestamp for when the log was generated

      • The name of the thread that the log is coming from

      • The log level

      • The class the log line is coming from

      • The vhost that generated the log

      Note

      Log formats are subject to change and may be adjusted at any time.

      Imported from 1.234.4

    • The experimental feature flag KeepSegmentHashFiles has been removed - query performance has been improved by caching hash filter files for frequently used bucketed segments, even in cases where queries only need hash filter files for search. This feature is now enabled by default.

      Imported from 1.234.4

    • The LogScale Regular Expression Engine V2 has been optimized to handle "zero-or-more" repetitions that occur at the start of regular expressions and after the opening of groups. Regexes that align with the following formats are now up to 10x faster for inputs of length 70, but may be even faster compared to before, as the input grows in size:

      • /(.*)foo/

      • /(.*foo)/

      • /(((.*)f)o)o/

      In benchmarking, most regexes fitting these formats were found to be up to 10 times faster, particularly as the input grows in length.

      Due to technical constraints, some regexes that have this format may experience a reduction in performance speed due to prioritization protocols, particularly those that repeat a small set of characters. In general, these regexes are still as fast or faster than before.

      Imported from 1.234.4

    • An optimization in the LogScale Regular Expression Engine V2 has been extended. This extension accounts for greedy repetitions of single character predicates at the beginning of a regex, where either a minimum, maximum, or both is specified.

      As a result, regexes of the following forms are now up to 10x faster than before:

      • /.+foo/

      • /\w{3,}bar/

      Imported from 1.234.4

    • Improved LogScale-generated metrics by propagating information regarding data reuse from subqueries located in the query state cache to the main query.

      This improvement will not be noticeable to the user except when viewing the metric query-static-cost-cache-hit in comparison to the metric query-static-cost-total. In this case, the two metrics will more accurately reflect the real use for queries that use defineTable().

      Imported from 1.234.4

      For more information, see defineTable(), The humio-metrics Repository, query-static-cost-cache-hit Metric, query-static-cost-total Metric.

    • Queries running in profiling mode using the explain:asTable() function have been optimized, reducing the system overhead of measuring profiling statistics. The accuracy of the reported step-by-step timeMs metric reported by explain:asTable() has also been improved.

      Imported from 1.234.4

      For more information, see explain:asTable().

    • When all nodes in the cluster are running version 1.233.0 or later, correlate queries automatically switch to a more memory-efficient internal representation for link sets. This also lowers the default memory limit per link set from 20MB to 1MB.

      If a custom value has been configured via the CorrelateLinkValuesMaxByteSize dynamic configuration option, it will be respected regardless of cluster version.

      Imported from 1.234.4

  • Fleet Management

    • The margin in the Fleet Management overview page has been reduced to allow for a larger table. Filter buttons have been resized to match the height of the search field.

      Imported from 1.234.4

  • Metrics and Monitoring

    • LogScale has stopped logging internal request logs for both the is-node-up and query worker submission endpoints on successful requests.

      To avoid loss of visibility, the following metrics have been added to keep track of query worker submissions:

      • internal-queryjobs-submission-timing

      • internal-queryjobs-submission-size

      Imported from 1.234.4

  • Auditing and Monitoring

    • Added the field acceptedPotentialDataLoss to the remove-host audit log entry. This addition indicates whether the administrator chose to override safeguards against data loss when submitting the host removal via the API.

      Imported from 1.234.4

      For more information, see Audit Logging.

    • The view ID and view name have been added to uploaded file audit log entries. This information is included only for files uploaded to a view. For shared replicable files, the audit log entries will not include the view ID or view name.

      Imported from 1.234.4

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • zscaler/private-access has been updated to v1.5.2.

      • Refactored user field handling into a unified post-processing block applied across all log types

      • User identity fields (user.email, user.name, user.domain) are now resolved from a consolidated coalesce of Vendor.User, Vendor.NameID, Vendor.Username, and Vendor.suser

      • When the resolved username contains @, user.email is set and user.name and user.domain are extracted via regex

      • user.id is now assigned using coalesce([Vendor.ModifiedBy, user.email]) for all log types

      • Removed per-dataset inline user field assignments from audit, browser-access, user-activity, and user-status log type handlers

      • Updated ECS version to 9.4.0

      • Updated CPS version to 1.2.0

      For more information, see Package zscaler/private-access Release Notes.

    • cisco/umbrella has been updated to v1.4.3.

      • Enhanced DLP logs parsing with improved URL handling using parseUri function

      • Added url.original field mapping for DLP traffic logs

      • Improved destination.domain field extraction for better URL parsing accuracy

      Imported from 1.234.3

      For more information, see Package cisco/umbrella Release Notes.

    • fortinet/fortigate has been updated to v2.3.4.

      • Enhanced CEF parsing to handle optional angle brackets in syslog priority field

      • Improved Vendor.type assignment logic for numeric cat values to use subtype instead

      • Added catch-all case to prevent field dropping in event categorization

      • Enhanced wireless event categorization with dedicated network connection handling

      • Added comprehensive wireless action outcome mapping for success/failure determination

      • Improved observer.serial_number field mapping to include Vendor.sn field

      • Added message field mapping from Vendor.msg for all events

      • Moved message field assignment outside of alert-specific logic for broader coverage

      • Updated parser version to 5.2.0 and ECS version to 9.3.0

      Imported from 1.234.3

      For more information, see Package fortinet/fortigate Release Notes.

    • everpure/flashblade has been updated to v1.2.2.

      • Added threat detection rules for critical FlashBlade administrative operations (pass-through detections to NG-SIEM):

        • PURE-FB-SYSLOG-CHANGE: Detects syslog target additions, modifications, or deletions (purelog setattr/create/delete)

        • PURE-FB-NTP-CHANGE: Detects NTP server configuration changes (purearray setattr --ntpserver)

        • PURE-FB-FS-DESTROY: Detects file system destruction (purefs destroy)

        • PURE-FB-EXPORT-DELETE: Detects SMB/NFS export deletions (purefs export delete)

        • PURE-FB-FS-PROTOCOL-REMOVE: Detects protocol/export removal from file systems (purefs remove)

        • PURE-FB-S3-BUCKET-DESTROY: Detects S3 bucket destruction (purebucket destroy)

        • PURE-FB-DNS-CHANGE: Detects DNS nameserver configuration changes (puredns setattr --nameservers)

      • Updated event.action to use coalesce([Vendor.Action, Vendor.Subcommand]) instead of lower(Vendor.Action)

      • Added event.provider field mapped from Vendor.UI

      • Updated process.command_line to include full command string formatted as Command Subcommand Arguments

      • Removed process.args[] array field (previously split from Vendor.Arguments)

      • Simplified host.hostname assignment to use inline lower() within coalesce()

      • Added network.protocol field for export/protocol-related detections

      • Added rule.id, rule.name, rule.category, and rule.description fields for threat detections

      • Updated ECS version to 9.4.0

      For more information, see Package everpure/flashblade Release Notes.

    • everpure/flashblade has been updated to v1.2.0.

      • Added support for GUI and CLI session logs (purity.guisession and purity.clisession)

      • Enhanced heartbeat message parsing for system monitoring

      • Improved source address handling with IP/domain classification

      • Updated ECS version to 9.3.0

      • Enhanced regex patterns for better alert message parsing

      • Added session authentication event categorization

      Imported from 1.234.3

      For more information, see Package everpure/flashblade Release Notes.

    • dell/isilon has been updated to v1.3.1.

      • Updated parser version to 1.2.1

      • Enhanced regex pattern for uid and sid field extraction to handle non-numeric values using [^;]* pattern instead of \d+

      • Added new test case for handling SID values with alphanumeric format (SID:S-1-22-1-0)

      • Improved parsing reliability for API audit logs with complex user identifiers

      Imported from 1.234.4

      For more information, see Package dell/isilon Release Notes.

    • zscaler/internet-access has been updated to v2.1.3.

      • Enhanced firewall event categorization with improved match syntax for better performance

      • Updated event.action matching logic to include "bypassed" actions as allowed events

      • Improved conditional logic structure using match syntax instead of case statements

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      • Updated parser version to 4.0.3

      Imported from 1.234.4

      For more information, see Package zscaler/internet-access Release Notes.

    • cisco/firepower has been updated to v2.0.0.

      • Updated parser version to 5.0.0

      • Updated CPS version to 1.2.0

      • Updated ECS version to 9.3.0

      • Enhanced parsing for event codes 109201, 109207, 109210 with improved server address extraction and consistency with ASA format

      • Enhanced parsing for event code 113019 with additional vendor fields for group, session type, and network bytes calculation

      • Enhanced parsing for event codes 11300*, 11301* with improved server address, client NAT IP, and user extraction

      • Enhanced parsing for event codes 302013, 302015 with improved connection ID handling and username extraction from message end

      • Enhanced parsing for event code 302014 with corrected source/destination mapping based on connection initiator/target semantics

      • Enhanced parsing for event code 302016 with improved connection ID extraction and user closure reason parsing

      • Enhanced parsing for event code 302021 with event action extraction and network transport assignment

      • Enhanced parsing for event code 502103 with improved user privilege parsing and IAM categorization

      • Enhanced parsing for event codes 609001, 609002 with additional event action and destination address extraction

      • Enhanced parsing for event code 722051 with corrected field mapping for client NAT IP

      • Added support for event code 733100 with rate limiting and intrusion detection categorization

      • Added support for event code 746015 with DNS protocol parsing and question/answer extraction

      • Enhanced parsing for event code 746016 with improved DNS lookup failure parsing

      • Enhanced parsing for event codes 750001, 750002, 750006, 750007 with network configuration categorization

      • Added support for event code 750003 with network authentication failure categorization

      • Enhanced parsing for event code 751002 with improved authentication failure categorization and error message extraction

      • Added event.code field assignment from vendor mnemonic

      • Added event.reason field consistency logic to ensure availability across ASA and FTD events

      Imported from 1.234.3

      For more information, see Package cisco/firepower Release Notes.

    • aruba/clearpass has been updated to v1.4.1.

      • Added support for log4j format parsing with new regex pattern

      • Updated parser version to 3.0.1

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      Imported from 1.234.4

      For more information, see Package aruba/clearpass Release Notes.

    • rubrik/security-cloud has been updated to v1.1.3.

      • Enhanced timestamp parsing to support additional precision formats

      • Updated parser version to 1.1.3

      • Updated ECS version to 9.3.0

      • Updated CPS version to 1.2.0

      Imported from 1.234.4

      For more information, see Package rubrik/security-cloud Release Notes.

    • cisco/firepower has been updated to v2.0.1.

      • Enhanced regex patterns for event codes 302020 and 302021 to support optional user domain and username extraction from ICMP connection messages

      • Added support for parsing user domain (destination.user.domain, source.user.domain) and username (destination.user.name, source.user.name) fields in ICMP built/teardown connection messages

      • Added new test cases for ICMP connection events with user information (302020 outbound/inbound and 302021 teardown with domain\user format)

      For more information, see Package cisco/firepower Release Notes.

    • cisco/ios has been updated to v1.10.0.

      • Added new regex pattern to handle logs with sequence numbers and timestamps in format: <priority>message_count: sequence: timestamp: %facility-severity-eventcode: message

      • Added support for multiline message fragments that start with multiple spaces and lack proper IOS facility headers

      • Enhanced timezone handling to respect data connector timezone selection over parser-defined timezone mappings

      • Fixed IST timezone timestamp parsing to support optional milliseconds format

      • Improved LOGOUT event parsing to handle optional source address in parentheses

      • Updated parser version to 2.10.0

      Imported from 1.234.3

      For more information, see Package cisco/ios Release Notes.

    • juniper/srx has been updated to v1.5.4.

      • Fixed timestamp parsing format for single-digit day values in BSD syslog format to handle optional space padding

      • Updated parser version to 3.0.3

      Imported from 1.234.3

      For more information, see Package juniper/srx Release Notes.

    • juniper/srx has been updated to v1.5.3.

      • Fixed timestamp parsing format for single-digit day values in BSD syslog format

      • Updated parser version to 3.0.2

      • Updated CPS version to 1.2.0

      Imported from 1.234.3

      For more information, see Package juniper/srx Release Notes.

    • cisco/ios has been updated to v1.11.0.

      • Added support for AireOS/WLC (Wireless LAN Controller) style log headers with new regex pattern

      • Added parsing for DISC_INTF_ERR2 events for AP discovery request failures on wrong VLANs

      • Added parsing for DISC_AP_MGR_ERR1 events for AP manager discovery failures

      • Added parsing for MOBILESTATION_NOT_FOUND events for mobile station database lookup failures

      • Added parsing for Q_IND events for association request failures with client limit reached

      • Enhanced MAC address normalization to convert colon-separated format to dash-separated uppercase format

      • Reverted recent timezone handling change to ensure event timezone is prioritized over data connector timezone selection

      • Updated ECS version to 9.4.0

      • Updated CPS version to 1.2.0

      For more information, see Package cisco/ios Release Notes.

    • everpure/flashblade has been updated to v1.2.1.

      • Updated vendor name from Pure Storage to Everpure across all package components

      • Updated manifest author information to reflect Everpure branding

      Imported from 1.234.4

      For more information, see Package everpure/flashblade Release Notes.

    • cisco/meraki has been updated to v2.0.2.

      • Refactored parser logic to use match expressions for improved readability and performance

      • Added support for anyconnect_vpn_session_manager event type with session ID and user extraction

      • Enhanced case statement structure for better maintainability

      • Improved pattern matching efficiency in event type determination

      Imported from 1.234.4

      For more information, see Package cisco/meraki Release Notes.

    • microsoft/windows-dns-debug has been updated to v1.5.2.

      • Refactored timestamp parsing logic into a unified post-case __timestamp match block supporting five distinct timestamp formats

      • Added support for new timestamp format: d-M-yyyy H:mm:ss (e.g., 04-08-2026 19:55:33)

      • Simplified regex patterns in case statement to use generic .*? timestamp capture group for broader format compatibility

      • Removed inline parseTimestamp and drop calls from individual case branches

      • Updated ECS version to 9.4.0 and CPS version to 1.2.0

      For more information, see Package microsoft/windows-dns-debug Release Notes.

    • everpure/flasharray has been updated to v1.0.6.

      • Updated vendor name from Pure Storage to Everpure across all package components

      • Updated manifest author information to reflect Everpure branding

      Imported from 1.234.4

      For more information, see Package everpure/flasharray Release Notes.

    • everpure/flasharray has been updated to v1.1.0.

      • Added threat detection logic (pass-through detections) for high-risk FlashArray operations including volume eradication, volume destruction, file system destruction, protection group snapshot destruction, syslog target modification, eradication delay modification, NTP configuration modification, and DNS configuration modification

      • Removed event.id field mapping from Vendor.MessageID

      • Updated ECS version to 9.4.0

      • Updated parser version to 2.1.0

      For more information, see Package everpure/flasharray Release Notes.

    • infoblox/nios has been updated to v1.5.0.

      • Extended audit log parsing to support additional service names: python, sshd, and -serial_console in addition to httpd

      • Added client.address mapping from Vendor.audit.ip for login events

      • Enhanced created, modified and called events with object type/name extraction via regex and kvParse

      • Extended RestartService match to include ClearRestartFlags and NodeAdminOperation

      • Extended TransferTrafficCapture match to include CSV

      • Added process.id extraction from syslog priority format messages

      • Added BOOTREQUEST outcome handling: failure when message contains no dynamic leases, success otherwise

      • Added bind update event parsing with client.address, Vendor.action_blocked, and Vendor.reject_reason fields

      • Added r-l-e (Renewed/Issued/Freed) lease event parsing with client.ip, client.mac, host.name, DHCP state, time, vendor class, option tag, and network fields

      • Extended DNS service name match to include idns_healthd in addition to named

      • Added ICMP monitor event parsing for DNS dataset with client.domain, client.address, and ICMP status fields

      • Added cloud_dns_task_executor_overlay_ctl service handling mapped to nios.dns dataset

      For more information, see Package infoblox/nios Release Notes.

    • zscaler/internet-access has been updated to v2.1.4.

      • Consolidated user field handling into a unified post-processing block after all sourcetype-specific logic, replacing per-sourcetype user field extraction

      • Added user.id field assignment set equal to user.email when a valid email is detected

      • Removed per-sourcetype user field case blocks from zscalernss-dns, zscalernss-fw, zscalernss-web, zscalernss-tunnel, and zscalernss-casb sections

      • User resolution now uses coalesce([Vendor.elogin, Vendor.login, Vendor.user, Vendor.adminid]) across all sourcetypes

      • Updated ECS version to 9.4.0

      • Updated parser version to 4.0.4

      For more information, see Package zscaler/internet-access Release Notes.

    • cisco/umbrella has been updated to v1.4.4.

      • Updated ECS version to 9.4.0

      • Updated CPS version to 1.2.0

      • Added web to event.category[] for proxylogs events

      • Added access to event.type[] for proxylogs allow and block actions

      For more information, see Package cisco/umbrella Release Notes.

    • cisco/ise has been updated to v2.0.7.

      • Improve consistency for log.level parsing

      • Add support for connection failure events

      • Updated parser version to 3.0.7

      Imported from 1.234.4

      For more information, see Package cisco/ise Release Notes.

    • cloudflare/zerotrust has been updated to v2.2.1.

      • Fixed WAF alert generation logic to trigger when severity >= 50 (previously <= 50)

      • Updated parser version to 4.2.1

      • Updated ECS version to 9.3.0

      • Updated CPS version to 1.2.0

      Imported from 1.234.4

      For more information, see Package cloudflare/zerotrust Release Notes.

    • fortinet/fortigate has been updated to v2.4.0.

      • Added FortiSwitch device detection based on devname prefix (FSW)

      • Added FortiSwitch-specific event subtypes: link, poe, spanning_tree, switch, switch_controller

      • Added FortiSwitch-specific field mappings for MAC address learned on switch port

      • Standardized event.module to "fortigate", observer.type to "firewall", and observer.product to "fortigate"

      • Updated parser version to 5.3.0

      Imported from 1.234.3

      For more information, see Package fortinet/fortigate Release Notes.

    • cisco/ios has been updated to v1.10.1.

      • Enhanced regex patterns to handle optional carriage return characters at end of log messages for improved parsing reliability

      Imported from 1.234.4

      For more information, see Package cisco/ios Release Notes.

    • cisco/meraki has been updated to v2.0.3.

      • Fixed content_filtering_block parsing to use flexible key-value extraction instead of a rigid positional regex, allowing optional fields such as category0 between url= and server= to be handled without breaking the match

      • Updated server.ip and server.port extraction for content_filtering_block to split from the combined Vendor.server value produced by kvParse

      • Added user.name mapping from Vendor.user for content_filtering_block events

      • Added host.name mapping from Vendor.clientName for File Scanned events

      For more information, see Package cisco/meraki Release Notes.

    • f5networks/bigip has been updated to v3.1.1.

      • Updated ECS version to 9.3.0 and Parser version to 4.0.1

      • Enhanced HTTP request parsing for ASM events with improved regex extraction for request content

      • Fixed HTTP request body content extraction to properly parse content portion from request data

      • Added HTTP request MIME type field mapping from Content-Type header

      • Corrected HTTP request referrer field mapping to use proper vendor field

      • Improved authentication failure parsing with more specific regex pattern for user extraction

      • Fixed indentation and formatting issues in audit event processing section

      Imported from 1.234.3

      For more information, see Package f5networks/bigip Release Notes.