Falcon LogScale 1.247.0 GA (2026-06-30)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.247.0GA2026-06-30

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Advance Warning

The following items are due to change in a future release.

  • Installation and Deployment

    • We are decommissioning the the Nexus server used to host Java-based LogScale installation binaries, with a tentative decommission date of August 14, 2026. To download Java-based LogScale installers, please send a request to logscalesuccess@crowdstrike.com to obtain a username & API token, which are required to download from our new distribution platform.

Removed

Items that have been removed as of this release.

GraphQL API

  • For the GraphQL datatype User, both the deprecated GraphQL field permissionsPage and the datatype UserPermissionsPage have been removed due to disuse. To obtain similar results, users should apply the permissions field instead.

    For more information, see User .

Configuration

  • The ability to configure the number of rows in a table via the environment variable NUMBER_OF_ROWS_IN_OWNER_HOSTS_TABLE has been removed, and replaced in favor of correlation with how segments are distributed across nodes. The default value for the number of rows is 10,000.

Metrics and Monitoring

  • The humio-metrics repository metric ingest-request-time-ms has been removed due to disuse.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

  • rdns() has been deprecated and will be removed in version 1.249. Use reverseDns() as an alternative function.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • GraphQL API

    • After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:

      Previously, you could call any mutation on a soft-deleted organization.

Fixed in this release

  • User Interface

    • An issue has been fixed that was causing Unicode-based control characters to be missing from the Event List.

  • Queries

    • Fixed an issue where a rare race condition occurring during query hand-over could cause failure during rolling restarts for static queries with defineTable() dependencies.

    • An issue has been fixed where queries with large join() function subquery results could cause nodes to crash during query submission from the query coordinator to the worker node.

  • Metrics and Monitoring

    • An issue with the query debug log fields userUtilizationPercentage and orgUtilizationPercentage has been fixed. These fields were showing incorrect values when multiple queries were running concurrently for a given user or organization.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • Queries

    • To make cluster upgrades less disruptive, the query state cache can now be reused when a cluster gets upgraded.

  • Other

    • The threads used for query mapping on worker nodes have been renamed. Previously, the naming convention was query-(vhost), where (vhost) was the virtual host of the node. The new naming convention is now (prefix)query-mapper, where (prefix) is the value of HUMIO_THREADNAME_PREFIX.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • dell/isilon has been updated to v1.3.1.

      • Updated parser version to 1.2.1

      • Enhanced regex pattern for uid and sid field extraction to handle non-numeric values using [^;]* pattern instead of \d+

      • Added new test case for handling SID values with alphanumeric format (SID:S-1-22-1-0)

      • Improved parsing reliability for API audit logs with complex user identifiers

      For more information, see Package dell/isilon Release Notes.

    • dell/isilon has been updated to v1.3.0.

      • Updated CPS version to 1.2.0

      • Updated parser version to 1.2.0

      • Added support for Dell Isilon API audit logs parsing

      • Enhanced regex pattern matching to handle both SMB protocol logs and API request logs

      • Added HTTP request method and response status code field mappings

      • Added JSON parsing for API request arguments

      • Enhanced user ID mapping with coalesce function for multiple source fields

      • Enhanced client IP mapping with coalesce function for multiple source fields

      • Added event outcome determination based on HTTP response status codes

      For more information, see Package dell/isilon Release Notes.

    • cisco/meraki has been updated to v2.0.1.

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      • Added support for anyconnect_vpn_auth_success event type with IP and port extraction

      • Improved kvParse operation for type= format logs with explicit separator parameter

      • Reordered event type parsing logic for better pattern matching efficiency

      For more information, see Package cisco/meraki Release Notes.

    • everpure/flasharray has been updated to v1.0.5.

      • Added new regex pattern for enhanced audit log parsing with support for command structure extraction

      • Enhanced observer.hostname field mapping to use coalesce function for better field population

      • Added event.id field mapping from Vendor.MessageID for improved event tracking

      • Updated parser version to 2.0.4

      • Updated CPS version to 1.2.0

      • Updated ECS version to 9.3.0

      For more information, see Package everpure/flasharray Release Notes.

    • aruba/clearpass has been updated to v1.4.1.

      • Added support for log4j format parsing with new regex pattern

      • Updated parser version to 3.0.1

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      For more information, see Package aruba/clearpass Release Notes.

    • rubrik/security-cloud has been updated to v1.1.3.

      • Enhanced timestamp parsing to support additional precision formats

      • Updated parser version to 1.1.3

      • Updated ECS version to 9.3.0

      • Updated CPS version to 1.2.0

      For more information, see Package rubrik/security-cloud Release Notes.

    • darktrace/detect has been updated to v2.1.0.

      • Updated CPS version to 1.2.0

      • Updated parser version to 3.1.0

      • Updated ECS version to 9.3.0

      • Enhanced AI Analyst event processing to include "informational" category for alert generation

      • Improved model breach event processing to use Vendor.model.category instead of Vendor.category for alert determination

      • Enhanced severity mapping for model breach events with improved priority-based scoring (1-5 scale)

      • Fixed event.risk_score assignment to occur before conditional processing

      • Improved code formatting and conditional logic structure

      • Enhanced regex patterns for email attachment hash processing

      For more information, see Package darktrace/detect Release Notes.

    • everpure/flashblade has been updated to v1.2.1.

      • Updated vendor name from Pure Storage to Everpure across all package components

      • Updated manifest author information to reflect Everpure branding

      For more information, see Package everpure/flashblade Release Notes.

    • cisco/meraki has been updated to v2.0.2.

      • Refactored parser logic to use match expressions for improved readability and performance

      • Added support for anyconnect_vpn_session_manager event type with session ID and user extraction

      • Enhanced case statement structure for better maintainability

      • Improved pattern matching efficiency in event type determination

      For more information, see Package cisco/meraki Release Notes.

    • cisco/ise has been updated to v2.0.6.

      • Enhanced network field mapping with improved source, destination, client, server, and host field assignments

      • Restructured IP address and domain handling for better network topology representation

      • Added host.ip[] and host.mac[] arrays for endpoint authentication tracking

      • Improved MAC address formatting with standardized uppercase and hyphen format

      • Updated ECS version to 9.3.0

      • Updated parser version to 3.0.6

      • Updated CPS version to 1.2.0

      • Enhanced user.email field with lowercase normalization

      • Fixed event.type assignment for profiler event code 80003 from "error" to "info"

      • Minor code formatting improvements and indentation fixes

      For more information, see Package cisco/ise Release Notes.

    • everpure/flasharray has been updated to v1.0.6.

      • Updated vendor name from Pure Storage to Everpure across all package components

      • Updated manifest author information to reflect Everpure branding

      For more information, see Package everpure/flasharray Release Notes.

    • cisco/ise has been updated to v2.0.7.

      • Improve consistency for log.level parsing

      • Add support for connection failure events

      • Updated parser version to 3.0.7

      For more information, see Package cisco/ise Release Notes.

    • cloudflare/zerotrust has been updated to v2.2.1.

      • Fixed WAF alert generation logic to trigger when severity >= 50 (previously <= 50)

      • Updated parser version to 4.2.1

      • Updated ECS version to 9.3.0

      • Updated CPS version to 1.2.0

      For more information, see Package cloudflare/zerotrust Release Notes.