Falcon LogScale 1.256.0 GA (2026-09-01)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.256.0GA2026-09-01

Cloud

2027-10-31No1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Breaking Changes

The following items create a breaking change in the behavior, response or operation of this release.

  • Functions

    • LogScale LTS version 1.258 will include a breaking change to subquery semantics for the worldMap() and sankey() functions. Result fields will no longer be automatically detected, and results must be assigned to a specific field - magnitude for worldMap() and weight for sankey() respectively.

      This change avoids unpredictable behavior in sub-queries, and allows further development on related systems. The following is an example of a query that is impacted by this change:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | sum(w_squared) | magnitude := math:sqrt(_sum) })

      Currently, the query will be interpreted as:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | magnitude := sum(w_squared) })

      From version 1.258, the math:sqrt part of the query will no longer be discarded.

Advance Warning

The following items are due to change in a future release.

  • GraphQL API

  • API

    • Starting in version 1.258, the queryjobs endpoint will always use pagination, even when no pagination arguments have been given. When no arguments are provided, the endpoint will return the maximum page size and an offset of 0. Unless the dynamic configuration parameter QueryResultRowCountLimit has been raised from its default value, this will initially be the entire result.

      All clients should begin transitioning to use the paginated polling method ahead of version 1.258.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • GraphQL API

    • After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:

      Previously, you could call any mutation on a soft-deleted organization.

Upgrades

Changes that may occur or be required during an upgrade.

  • Security

    • LogScale has upgraded the Netty package to version 4.2.17.Final to address open CVEs. See Netty project for more information.

New features and improvements

Fixed in this release

  • Queries

    • An issue has been fixed where multi-cluster search queries using the correlate() function could fail to complete if changes occurred while the query was running, such as an update to a view's connections. These queries are now stopped with a warning and are allowed to rerun.

  • Metrics and Monitoring

    • The metric time-parsing for the repository humio-metrics has been reverted to the behavior where it measures per-batch parsing time.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • GraphQL API

    • The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.

      The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.

      Existing scheduled reports are automatically migrated, no action is required.

  • Storage

    • Persisted aggregations with a backfill window longer than the source or destination retention period will now correctly skip intervals where data is unavailable, including when the source is a view connected to multiple repositories. In that case, the longest retention across all connected repositories is used.

  • Queries

    • An optimization has been added to the Regular Expression Engine V2 where alternations of single character predicates are compiled as character classes. For example, alternations like a|b are compiled to the equivalent character class [ab].

      This improvement provides up to 20% better performance and helps prevent stack overflows during execution.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • zscaler/private-access has been updated to v1.5.2.

      • Refactored user field handling into a unified post-processing block applied across all log types

      • User identity fields (user.email, user.name, user.domain) are now resolved from a consolidated coalesce of Vendor.User, Vendor.NameID, Vendor.Username, and Vendor.suser

      • When the resolved username contains @, user.email is set and user.name and user.domain are extracted via regex

      • user.id is now assigned using coalesce([Vendor.ModifiedBy, user.email]) for all log types

      • Removed per-dataset inline user field assignments from audit, browser-access, user-activity, and user-status log type handlers

      • Updated ECS version to 9.4.0

      • Updated CPS version to 1.2.0

      For more information, see Package zscaler/private-access Release Notes.

    • everpure/flashblade has been updated to v1.2.2.

      • Added threat detection rules for critical FlashBlade administrative operations (pass-through detections to NG-SIEM):

        • PURE-FB-SYSLOG-CHANGE: Detects syslog target additions, modifications, or deletions (purelog setattr/create/delete)

        • PURE-FB-NTP-CHANGE: Detects NTP server configuration changes (purearray setattr --ntpserver)

        • PURE-FB-FS-DESTROY: Detects file system destruction (purefs destroy)

        • PURE-FB-EXPORT-DELETE: Detects SMB/NFS export deletions (purefs export delete)

        • PURE-FB-FS-PROTOCOL-REMOVE: Detects protocol/export removal from file systems (purefs remove)

        • PURE-FB-S3-BUCKET-DESTROY: Detects S3 bucket destruction (purebucket destroy)

        • PURE-FB-DNS-CHANGE: Detects DNS nameserver configuration changes (puredns setattr --nameservers)

      • Updated event.action to use coalesce([Vendor.Action, Vendor.Subcommand]) instead of lower(Vendor.Action)

      • Added event.provider field mapped from Vendor.UI

      • Updated process.command_line to include full command string formatted as Command Subcommand Arguments

      • Removed process.args[] array field (previously split from Vendor.Arguments)

      • Simplified host.hostname assignment to use inline lower() within coalesce()

      • Added network.protocol field for export/protocol-related detections

      • Added rule.id, rule.name, rule.category, and rule.description fields for threat detections

      • Updated ECS version to 9.4.0

      For more information, see Package everpure/flashblade Release Notes.

    • cisco/firepower has been updated to v2.0.1.

      • Enhanced regex patterns for event codes 302020 and 302021 to support optional user domain and username extraction from ICMP connection messages

      • Added support for parsing user domain (destination.user.domain, source.user.domain) and username (destination.user.name, source.user.name) fields in ICMP built/teardown connection messages

      • Added new test cases for ICMP connection events with user information (302020 outbound/inbound and 302021 teardown with domain\user format)

      For more information, see Package cisco/firepower Release Notes.

    • cisco/ios has been updated to v1.11.0.

      • Added support for AireOS/WLC (Wireless LAN Controller) style log headers with new regex pattern

      • Added parsing for DISC_INTF_ERR2 events for AP discovery request failures on wrong VLANs

      • Added parsing for DISC_AP_MGR_ERR1 events for AP manager discovery failures

      • Added parsing for MOBILESTATION_NOT_FOUND events for mobile station database lookup failures

      • Added parsing for Q_IND events for association request failures with client limit reached

      • Enhanced MAC address normalization to convert colon-separated format to dash-separated uppercase format

      • Reverted recent timezone handling change to ensure event timezone is prioritized over data connector timezone selection

      • Updated ECS version to 9.4.0

      • Updated CPS version to 1.2.0

      For more information, see Package cisco/ios Release Notes.

    • microsoft/windows-dns-debug has been updated to v1.5.2.

      • Refactored timestamp parsing logic into a unified post-case __timestamp match block supporting five distinct timestamp formats

      • Added support for new timestamp format: d-M-yyyy H:mm:ss (e.g., 04-08-2026 19:55:33)

      • Simplified regex patterns in case statement to use generic .*? timestamp capture group for broader format compatibility

      • Removed inline parseTimestamp and drop calls from individual case branches

      • Updated ECS version to 9.4.0 and CPS version to 1.2.0

      For more information, see Package microsoft/windows-dns-debug Release Notes.

    • everpure/flasharray has been updated to v1.1.0.

      • Added threat detection logic (pass-through detections) for high-risk FlashArray operations including volume eradication, volume destruction, file system destruction, protection group snapshot destruction, syslog target modification, eradication delay modification, NTP configuration modification, and DNS configuration modification

      • Removed event.id field mapping from Vendor.MessageID

      • Updated ECS version to 9.4.0

      • Updated parser version to 2.1.0

      For more information, see Package everpure/flasharray Release Notes.

    • infoblox/nios has been updated to v1.5.0.

      • Extended audit log parsing to support additional service names: python, sshd, and -serial_console in addition to httpd

      • Added client.address mapping from Vendor.audit.ip for login events

      • Enhanced created, modified and called events with object type/name extraction via regex and kvParse

      • Extended RestartService match to include ClearRestartFlags and NodeAdminOperation

      • Extended TransferTrafficCapture match to include CSV

      • Added process.id extraction from syslog priority format messages

      • Added BOOTREQUEST outcome handling: failure when message contains no dynamic leases, success otherwise

      • Added bind update event parsing with client.address, Vendor.action_blocked, and Vendor.reject_reason fields

      • Added r-l-e (Renewed/Issued/Freed) lease event parsing with client.ip, client.mac, host.name, DHCP state, time, vendor class, option tag, and network fields

      • Extended DNS service name match to include idns_healthd in addition to named

      • Added ICMP monitor event parsing for DNS dataset with client.domain, client.address, and ICMP status fields

      • Added cloud_dns_task_executor_overlay_ctl service handling mapped to nios.dns dataset

      For more information, see Package infoblox/nios Release Notes.

    • zscaler/internet-access has been updated to v2.1.4.

      • Consolidated user field handling into a unified post-processing block after all sourcetype-specific logic, replacing per-sourcetype user field extraction

      • Added user.id field assignment set equal to user.email when a valid email is detected

      • Removed per-sourcetype user field case blocks from zscalernss-dns, zscalernss-fw, zscalernss-web, zscalernss-tunnel, and zscalernss-casb sections

      • User resolution now uses coalesce([Vendor.elogin, Vendor.login, Vendor.user, Vendor.adminid]) across all sourcetypes

      • Updated ECS version to 9.4.0

      • Updated parser version to 4.0.4

      For more information, see Package zscaler/internet-access Release Notes.

    • cisco/umbrella has been updated to v1.4.4.

      • Updated ECS version to 9.4.0

      • Updated CPS version to 1.2.0

      • Added web to event.category[] for proxylogs events

      • Added access to event.type[] for proxylogs allow and block actions

      For more information, see Package cisco/umbrella Release Notes.