Falcon LogScale 1.248.0 GA (2026-07-07)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.248.0GA2026-07-07

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Advance Warning

The following items are due to change in a future release.

  • Installation and Deployment

    • We are decommissioning the the Nexus server used to host Java-based LogScale installation binaries, with a tentative decommission date of August 14, 2026. To download Java-based LogScale installers, please send a request to logscalesuccess@crowdstrike.com to obtain a username & API token, which are required to download from our new distribution platform.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

  • rdns() has been deprecated and will be removed in version 1.249. Use reverseDns() as an alternative function.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • Automation and Triggers

    • Filter alert query validation has been made stricter, and is now mainly syntax-based. Dropping or reassigning @id and @ingesttimestamp is now rejected, even if values are restored later in the query.

  • Storage

    • With the introduction of table-based owner hosts in LogScale 1.240, and with bucket storage enabled, the assignment of segments for a query changed from looking at where the segments are currently stored to distributing randomly between the owners of the segments.

      For segments not present on any host, the old strategy would essentially pick one host deterministically and stick to that in the future, causing a behavior similar to having a replication factor of 1 for these segments.

      The new strategy would instead essentially enforce the replication factor on the segments. However, for over-committed clusters this has caused spikes in traffic and churning of the disk cache.

      The new behavior is now disabled by default, but can be re-introduced by enabling the UseWeightedOwnerHostsForBucketedSegments feature flag.

  • GraphQL API

    • After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:

      Previously, you could call any mutation on a soft-deleted organization.

  • Functions

    • The hashRewrite() query function now only replaces the 10 first occurrences of the matching value in @rawstring. A warning is emitted if 10 replacements are reached and the matched string is still present in the @rawstring field.

      The hashRewrite() query function now does not perform any replacement in @rawstring if the string to be replaced contains fewer than two characters. A warning is emitted if the value contains too few characters.

Upgrades

Changes that may occur or be required during an upgrade.

  • Security

    • Upgraded FasterXML/Jackson to 2.21.4 to address CVEs.

    • Upgraded Netty to 4.2.15.Final to fix vulnerabilities. See Netty project for more information about Netty.

  • Other

    • Updated io.projectreactor to 2025.0.6.

New features and improvements

  • GraphQL API

    • Added a name field to the PackageInstallation GraphQL output type.

  • Configuration

Fixed in this release

  • Dashboards and Widgets

  • Queries

    • Fixed an issue that could lead to a node crash during query handover because of allocation of a too large string value.

    • Queries using defineTable() could be left hanging for a while after the query was completed or cancelled. This issue has now been fixed.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • Installation and Deployment

    • Updated Wolfi base image for LogScale docker.

  • Queries

    • Ensured that MaxConcurrentQueriesOnWorker is fully respected by the query scheduler.

      Previously the limit could be breached (to an arbitrary value) if queries were submitted sufficiently close together.

  • Metrics and Monitoring

    • Enhanced the accuracy of the queryUtilizationPercentage, userUtilizationPercentage and orgUtilizationPercentage metrics that are logged by workers for queries.

      Removed the utilisationPercentage metric that was logged when a query ended.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • dell/isilon has been updated to v1.3.1.

      • Updated parser version to 1.2.1

      • Enhanced regex pattern for uid and sid field extraction to handle non-numeric values using [^;]* pattern instead of \d+

      • Added new test case for handling SID values with alphanumeric format (SID:S-1-22-1-0)

      • Improved parsing reliability for API audit logs with complex user identifiers

      For more information, see Package dell/isilon Release Notes.

    • zscaler/internet-access has been updated to v2.1.3.

      • Enhanced firewall event categorization with improved match syntax for better performance

      • Updated event.action matching logic to include "bypassed" actions as allowed events

      • Improved conditional logic structure using match syntax instead of case statements

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      • Updated parser version to 4.0.3

      For more information, see Package zscaler/internet-access Release Notes.

    • aruba/clearpass has been updated to v1.4.1.

      • Added support for log4j format parsing with new regex pattern

      • Updated parser version to 3.0.1

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      For more information, see Package aruba/clearpass Release Notes.

    • rubrik/security-cloud has been updated to v1.1.3.

      • Enhanced timestamp parsing to support additional precision formats

      • Updated parser version to 1.1.3

      • Updated ECS version to 9.3.0

      • Updated CPS version to 1.2.0

      For more information, see Package rubrik/security-cloud Release Notes.

    • everpure/flashblade has been updated to v1.2.1.

      • Updated vendor name from Pure Storage to Everpure across all package components

      • Updated manifest author information to reflect Everpure branding

      For more information, see Package everpure/flashblade Release Notes.

    • cisco/meraki has been updated to v2.0.2.

      • Refactored parser logic to use match expressions for improved readability and performance

      • Added support for anyconnect_vpn_session_manager event type with session ID and user extraction

      • Enhanced case statement structure for better maintainability

      • Improved pattern matching efficiency in event type determination

      For more information, see Package cisco/meraki Release Notes.

    • everpure/flasharray has been updated to v1.0.6.

      • Updated vendor name from Pure Storage to Everpure across all package components

      • Updated manifest author information to reflect Everpure branding

      For more information, see Package everpure/flasharray Release Notes.

    • cisco/ise has been updated to v2.0.7.

      • Improve consistency for log.level parsing

      • Add support for connection failure events

      • Updated parser version to 3.0.7

      For more information, see Package cisco/ise Release Notes.

    • cloudflare/zerotrust has been updated to v2.2.1.

      • Fixed WAF alert generation logic to trigger when severity >= 50 (previously <= 50)

      • Updated parser version to 4.2.1

      • Updated ECS version to 9.3.0

      • Updated CPS version to 1.2.0

      For more information, see Package cloudflare/zerotrust Release Notes.

    • cisco/ios has been updated to v1.10.1.

      • Enhanced regex patterns to handle optional carriage return characters at end of log messages for improved parsing reliability

      For more information, see Package cisco/ios Release Notes.