Falcon LogScale 1.246.0 GA (2026-06-23)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.246.0GA2026-06-23

Cloud

2027-07-31No1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Advance Warning

The following items are due to change in a future release.

  • Installation and Deployment

    • We are decommissioning the the Nexus server used to host Java-based LogScale installation binaries, with a tentative decommission date of August 14, 2026. To download Java-based LogScale installers, please send a request to logscalesuccess@crowdstrike.com to obtain a username & API token, which are required to download from our new distribution platform.

Removed

Items that have been removed as of this release.

GraphQL API

  • The GraphQL mutation removeSizeBasedRetentionForAllOrganizations has been removed. This mutation was previously deprecated and scheduled for removal in version 1.201.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field queryToRead in the query poll response has been deprecated and will be removed in version 1.258.

    Users that require table data for a subquery should use the tableName query parameter on the poll endpoint instead. This serves cached data rather than creating a new query based on the queryToRead string.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

  • rdns() has been deprecated and will be removed in version 1.249. Use reverseDns() as an alternative function.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • GraphQL API

    • After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:

      Previously, you could call any mutation on a soft-deleted organization.

New features and improvements

  • User Interface

    • Unicode control characters (C0, C1, and DEL) are now rendered as visible placeholders in the Event List, improving visibility of data that contains these previously invisible characters.

  • GraphQL API

    • The GraphQL field metadataEndpointUrl has been added to the SamlIdentityProvider output type in the GraphQL API. This field makes it possible to verify whether the GraphQL field metadataEndpointUrl is set correctly after creating or updating a SAML Identity Provider.

Fixed in this release

  • Security

    • Fixed an issue where a race condition caused the ability for permission assignments to be created for groups that had already been deleted.

  • Storage

    • Fixed an issue where in rare cases, events would be serialized into blocks incorrectly, leading to one or more fields becoming unreadable.

  • Functions

    • Fixed an issue with the correlate() function, where using the parameter jitterTolerance in conjunction with the sequence parameter being set to true could cause events falling within the jitter tolerance window but slightly out of timestamp order to be incorrectly excluded from results.

      correlate() now also supports jitterTolerance together with sequenceBy, provided the first field in sequenceBy is @timestamp or @ingesttimestamp. Previously, jitterTolerance could only be used with default sequencing. The jitter tolerance is applied to the first timestamp field, and any additional sequenceBy fields act as tiebreakers.

    • Fixed an issue with the correlate() function, where selective scanning would incorrectly influence the decision process for pipeline actions in cases where no data was available. Queries with one or more pipelines that contain zero matches in their segments will now finish much more quickly.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • Queries

    • The fields organizationId and userId have been added to the query ended logs generated on query workers when part of a query completes.

  • Fleet Management

    • The humio-fleet system repository is now created by default, both for newly created organizations and for existing organizations.

      Previously, this repository was only created on demand the first time Fleet Management ingested data from a log shipper, meaning organizations that did not use Fleet Management never had it. As a result of this change, a humio-fleet repository will appear in every organization regardless of whether Fleet Management is in use. The repository retains data for 30 days by default.

  • Metrics and Monitoring

    • Added the query and live-reduce thread pools to the thread-pool-queue-size metric.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • dell/isilon has been updated to v1.3.0.

      • Updated CPS version to 1.2.0

      • Updated parser version to 1.2.0

      • Added support for Dell Isilon API audit logs parsing

      • Enhanced regex pattern matching to handle both SMB protocol logs and API request logs

      • Added HTTP request method and response status code field mappings

      • Added JSON parsing for API request arguments

      • Enhanced user ID mapping with coalesce function for multiple source fields

      • Enhanced client IP mapping with coalesce function for multiple source fields

      • Added event outcome determination based on HTTP response status codes

      For more information, see Package dell/isilon Release Notes.

    • cisco/meraki has been updated to v2.0.1.

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      • Added support for anyconnect_vpn_auth_success event type with IP and port extraction

      • Improved kvParse operation for type= format logs with explicit separator parameter

      • Reordered event type parsing logic for better pattern matching efficiency

      For more information, see Package cisco/meraki Release Notes.

    • everpure/flasharray has been updated to v1.0.5.

      • Added new regex pattern for enhanced audit log parsing with support for command structure extraction

      • Enhanced observer.hostname field mapping to use coalesce function for better field population

      • Added event.id field mapping from Vendor.MessageID for improved event tracking

      • Updated parser version to 2.0.4

      • Updated CPS version to 1.2.0

      • Updated ECS version to 9.3.0

      For more information, see Package everpure/flasharray Release Notes.

    • aruba/clearpass has been updated to v1.4.1.

      • Added support for log4j format parsing with new regex pattern

      • Updated parser version to 3.0.1

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      For more information, see Package aruba/clearpass Release Notes.

    • rubrik/security-cloud has been updated to v1.1.3.

      • Enhanced timestamp parsing to support additional precision formats

      • Updated parser version to 1.1.3

      • Updated ECS version to 9.3.0

      • Updated CPS version to 1.2.0

      For more information, see Package rubrik/security-cloud Release Notes.

    • darktrace/detect has been updated to v2.1.0.

      • Updated CPS version to 1.2.0

      • Updated parser version to 3.1.0

      • Updated ECS version to 9.3.0

      • Enhanced AI Analyst event processing to include "informational" category for alert generation

      • Improved model breach event processing to use Vendor.model.category instead of Vendor.category for alert determination

      • Enhanced severity mapping for model breach events with improved priority-based scoring (1-5 scale)

      • Fixed event.risk_score assignment to occur before conditional processing

      • Improved code formatting and conditional logic structure

      • Enhanced regex patterns for email attachment hash processing

      For more information, see Package darktrace/detect Release Notes.

    • everpure/flashblade has been updated to v1.2.1.

      • Updated vendor name from Pure Storage to Everpure across all package components

      • Updated manifest author information to reflect Everpure branding

      For more information, see Package everpure/flashblade Release Notes.

    • cisco/ise has been updated to v2.0.6.

      • Enhanced network field mapping with improved source, destination, client, server, and host field assignments

      • Restructured IP address and domain handling for better network topology representation

      • Added host.ip[] and host.mac[] arrays for endpoint authentication tracking

      • Improved MAC address formatting with standardized uppercase and hyphen format

      • Updated ECS version to 9.3.0

      • Updated parser version to 3.0.6

      • Updated CPS version to 1.2.0

      • Enhanced user.email field with lowercase normalization

      • Fixed event.type assignment for profiler event code 80003 from "error" to "info"

      • Minor code formatting improvements and indentation fixes

      For more information, see Package cisco/ise Release Notes.

    • everpure/flasharray has been updated to v1.0.6.

      • Updated vendor name from Pure Storage to Everpure across all package components

      • Updated manifest author information to reflect Everpure branding

      For more information, see Package everpure/flasharray Release Notes.

    • cisco/ise has been updated to v2.0.7.

      • Improve consistency for log.level parsing

      • Add support for connection failure events

      • Updated parser version to 3.0.7

      For more information, see Package cisco/ise Release Notes.

    • cloudflare/zerotrust has been updated to v2.2.1.

      • Fixed WAF alert generation logic to trigger when severity >= 50 (previously <= 50)

      • Updated parser version to 4.2.1

      • Updated ECS version to 9.3.0

      • Updated CPS version to 1.2.0

      For more information, see Package cloudflare/zerotrust Release Notes.