Falcon LogScale 1.260.0 GA (2026-09-29)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.260.0GA2026-09-29

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Breaking Changes

The following items create a breaking change in the behavior, response or operation of this release.

  • Functions

    • This release includes a previously announced breaking change to the semantics of sub-queries in the functions worldMap() and sankey(). The result field is no longer automatically detected, and results must now be assigned to a specific field: magnitude for worldMap() and weight for sankey().

      This change prevents unpredictable behavior in sub-queries and enables further development on related systems.

      For example, the following query is affected by this change:

      logscale
      worldMap(lat=lat, lon=lon, magnitude={ w_squared := w*w | sum(w_squared) | magnitude := math:sqrt(_sum) })

      Previously, this query was interpreted as:

      logscale
      worldMap(lat=lat, lon=lon, magnitude={ w_squared := w*w | magnitude := sum(w_squared) })

      From this version, the math:sqrt part of the query is no longer discarded.

Advance Warning

The following items are due to change in a future release.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • API

    • The endpoint /queryjobs now always uses pagination, even when no pagination arguments are provided. In this case, the maximum page size is returned with an offset of 0, which in most cases returns the entire query result. If the QueryResultRowCountLimit dynamic configuration has been raised above its default value, some polls may be limited to this maximum page size.

      All external LogScale users should switch to explicitly using query result pagination on polls.

Upgrades

Changes that may occur or be required during an upgrade.

  • Security

    • netty-bom has been updated to version 4.2.18.Final to address CVE-2026-89044. For more information, see the official documentation here.

New features and improvements

  • Fleet Management

    • A new Compare mode has been added to the Fleet Management Config Editor. It shows the current changes compared to the latest published configuration.

Fixed in this release

  • Security

    • An issue has been fixed where the parameter alternativeIdpCertificate for SAML identity provider configurations could only be provided when the parameter idpCertificate was set, and not when the parameter metadataEndpointUrl was provided instead. A SAML identity provider configuration is now valid as long as it specifies at least one of the following parameters:

      • idpCertificate

      • alternativeIdpCertificate

      • metadataEndpointUrl

  • Dashboards and Widgets

    • An issue has been fixed in the Time Chart widget that could cause duplicated data points for the same x-axis value.

  • Log Collector

    • An issue has been fixed where Falcon LogScale Collector installers were not visible to users without Fleet Management permissions in the download dialog.

  • Queries

    • An issue has been fixed where queries containing table-producing sub-queries such as defineTable() would sometimes silently stop processing due to an error during the start of the main mapper query.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • GraphQL API

    • The GraphQL mutation newFile() now supports the option to supply data for files created at the same time, and will no longer return an error when users have create permission but not read permission.

      The user can now supply a list of header-values, and a list-of-lists of rows of data, the length of which must match. This change is backwards compatible.

    • The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.

      The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.

      Existing scheduled reports are automatically migrated, no action is required.

  • Ingestion

    • When a LogScale node has been unable to delete already-digested ingest records from Kafka for 30 minutes, an error is now logged with the field systemAlertId having value IngestQueueOffsetDeletionStalled.

  • Queries

    • The maximum pipeline length allowed in a query has been doubled from 100 steps to 200 steps.

  • Metrics and Monitoring

    • The hourly organization usage logs now include additional fields per repository and per organization:

      • retentionDays - The time-based retention setting for the repository. When configured, the time is measured in days.

      • compressedStorageSize - The compressed on-disk size of live data, alongside the existing field storageSize.

      • falconCompressedStorageSize - The compressed size for Falcon-type repositories.

      The usage job interval is now configurable using the environment variable USAGE_JOB_INTERVAL_MINUTES. The default time interval is 60 minutes.

  • Auditing and Monitoring

    • Audit logs for query requests made using a view permissions token now include the actor.ip field, which was previously missing from these log entries.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • cisco/meraki has been updated to v2.0.4.

      • Updated ECS version to 9.5.0

      • Fixed port regex pattern for port event subtype to support MAC address prefix format (e.g., F8:AE:30:F2:5C:A7/35) before the port number, enabling correct parsing of STP role change events with interface identifiers

      • Added test case for port events with MAC address/port notation (e.g., Port F8:AE:30:F2:5C:A7/35 changed STP role from designated to disabled)

      • Renamed parser YAML file from cisco-meraki-df to cisco-meraki

      For more information, see Package cisco/meraki Release Notes.

    • cisco/firepower has been updated to v2.1.0.

      • Updated ECS version to 9.5.0

      • Added event.code field assignment from Vendor.mnemonic earlier in the parsing pipeline (before the match block) and removed the duplicate assignment at the end of the parser

      • Changed match block from Vendor.mnemonic match to event.code match for consistency

      • Added support for event codes 113015, 113016, 113017 with authentication failure categorization, reason and user extraction, and optional server IP extraction

      • Expanded event code 722003 to cover 722001, 722002, 722004, 722005, 722006 (SVC/SSL VPN Client errors) with improved field extraction for group, user, source address, and error reason

      • Enhanced event code 750003 with improved regex for source/destination address and port extraction, and username mapped to source.user.name

      • Replaced single event code 751002 with range 751001-751005 with improved regex patterns, source.user.name mapping, and error.message assignment from event.reason

      • Added support for event codes 716038 and 716039 (WebVPN authentication success/failure) with group name, source user, source address extraction, and static event.reason assignment

      • Added support for event code 611101 (VPN client login success) with source.address and source.user.name extraction

      • Added support for event code 611102 (VPN client login failure) with source.address and source.user.name extraction

      • Added support for event code 605004 (authentication denied) with source address/port, destination address/port, user, interface, and host IP extraction

      • Added support for event code 605005 (authentication permitted) with source address/port, destination address/port, user, interface, and host IP extraction

      • Added support for event code 113013 (AAA authentication failure) with action, reason, and user extraction

      • Added support for event code 113012 (AAA authentication success) with reason and user extraction

      • Added support for event code 113006 (AAA user authentication rejected) with user extraction

      • Added support for event code 113039 (AnyConnect session started) with group, user, and source address extraction

      • Added support for event codes 109011, 109034, 113021 (authentication info) with reason, action, user, source/destination address/port, and interface extraction

      • Removed user.name field mapping from event code 751002 test case assertions; replaced with source.user.name

      • Removed event.category[0]: network assertion from event code 751002 test case (now covered by the expanded range)

      • Added new test cases for event codes 722003, 750003, 113039, 113015, 716039, and 716038

      For more information, see Package cisco/firepower Release Notes.