Release Date: November 1st 2026

These Release Notes contain new features and enhancements added in version 10.0.1.

Axonius AI

The following new features and enhancements were added to Axonius AI:

• Ask AI from Global Search: When a global search finds no assets or saved queries, the "No results found" message now offers an Ask AI button. Selecting it closes the search and sends your search text to the AI chat panel, which starts answering right away.
• Adapter Noise Filters Worker: A new weekly AI Workforce worker in the IT Asset Management department finds devices that Axonius cannot correlate because they have no hostname, asset name, MAC address, serial number, or cloud ID. The worker shows which adapters bring in these devices and points to the adapter Advanced Settings that can fix the problem. The worker only reads settings and never changes them.
• Automatic Pause for Unchanged Workers: A scheduled AI Workforce worker now pauses itself after 14 consecutive runs with the same result and no action taken on them. A notification card in AI Workforce > Notifications explains why the worker paused and offers Resume. You can also resume a worker by turning Activate back on in Scheduled Workers. Followed workers, schedules that email their report, custom workers with Live write, and the AI Workforce's own schedules never pause. Pausing and resuming are recorded in the Activity Log.
• Edit Worker Overview Cards Individually: On a worker's Overview tab, the Cadence, Standing instructions, and Approved Actions cards each have their own edit icon. For Run Enforcement actions, a new Run on option lets you choose between the action's own trigger query (default) and the current run's findings (up to 100 Devices or Users assets). The Cadence card shows "Paused" when a worker is paused.
• Tables in AI Answers: Tables in AI chat answers and AI Workforce briefings now display in a grid with wrapped text, sorting, column pinning, and Copy Column Values. A row count and an Export CSV button appear below each table.
• Threat Intelligence Notable Events: The AI agent can now read notable events in the threat intelligence feed, including indicators of compromise and EDR hunting queries, and use them in its answers.

---

Cyber Assets New Features and Enhancements

The following new features and enhancements were added to Axonius Cyber Assets:

Agent Coverage Workspace - Manage Agents

A new Manage agents panel on the main Agent Coverage page lists all agents, so you can choose which agents the workspace shows. This helps users focus the agents that are actually in scope and reduce noise.
Each agent row also has a Hide action. Hidden agents are removed from the workspace, its dashboard, and the AI agent's answers, and you can show them again at any time. A new role permission, Manage Agent Coverage, controls all Agent Coverage settings and is granted to the Admin role.

CMDB Reconciliation

The CMDB Reconciliation Workspace now supports data from the following adapters, in addition to ServiceNow:

• ServiceNow

• Jira Service Management

• Freshservice

• Cherwell IT Service Management

• Ivanti Neurons for ITSM

• BMC Atrium CMDB

• BMC Atrium CMDB onPrem

Patch Tuesday

Patch Currency Status Chart

The Patch Currency Status - Clients vs. Servers chart on the Windows Patch Tuesday workspace now has three segments that add up to the bar total: Up to Date, Lagging, and No Patch Data. Devices with no patch data no longer count as Up to Date, and Lagging counts devices that are more than 2 CUs behind on any source, matching the Devices Requiring Immediate Attention panel.

Devices Page

The following new features and enhancements were added to the Devices page.

• Last Used Users Nested Group Names Field: A new device field, Last Used Users Nested Group Names, shows the combined nested group names of the device's last used users.

Exposures New Features and Enhancements

The following new features and enhancements were added to Exposures:

Multiple Approvers in Exception Rules

Each approval step in an exception rule can now include several users and Axonius user roles as approvers, and the first approver to act decides the request. Email notifications go to all eligible approvers. A request is canceled automatically if its current step has no eligible approver left.

Exception Management Enhancements

Exception rule instructions now accept up to 5,000 characters, and the Reason category field in Create Exception is marked as optional.

Querying AVS Factors as fields on the Aggregated Security Findings and Vulnerability Repository pages

AVS factors are now stored as structured fields on these pages, so you can filter the assets in them by individual factor values and impacts using the Query Wizard. The Query Wizard provides autocomplete values for each factor's Impact and value, and users can also add custom values. The AVS Factors view on the asset’s Profile page continues to show the factor breakdown as before.

Changes in the Display of Internet Exposure Data on Relevant Assets

The Asset Profile pages of supported assets (Devices, Load Balancers, URLs, and Firewalls) now show data produced by the Network Routes enrichment as its own Network Routes source, including a dedicated icon, listed among all other adapter connection sources. The related data appears in the All Fields tab of the asset’s Profile Page. This makes Network Routes values and related network route IDs easier to identify instead of attributing them to the underlying stored source.

The Fields that are now sourced directly from Network Routes are: Internet Exposure, Internet Exposure Context and Related Network Route IDs.

The Internet Exposure and Internet Exposure Context fields also show now on the Security Finding asset profile as sourced from Network Routes, while in the past, they were shown as sourced from NVD CVE Enrichment.
The change is only in the display - the data stays the same as before.

Security Finding Risk Score v2 is here

Axonius has rebuilt the out-of-the-box Security Finding Risk Score to better reflect real-world risk:

• Axonius Vulnerability Score now drives 60% of the score, up from 50%.

• Asset Criticality is weighted at 35%, up from 25%, with a refined Critical/High/Medium/Low scale.

• Internet Exposure drops to 5%, and its query was rebuilt to remove false positives.

  Activating v2 deactivates v1. Nothing is deleted - every existing Risk Score, including v1, stays available and can be reactivated anytime. Scores are recalculated immediately, so some risk levels will change and anything built on them (queries, dashboards, enforcement sets) may look different.

Vulnerability Repository for Data-Scoped Users

Users in a data scope, and admins who switch into a data scope, can now open the Vulnerability Repository and use its table, filters, queries, charts, and export. The CVE catalog and its enrichment fields (such as CVSS, EPSS, KEV, and Axonius Threat Intelligence) are the same for every scope. However, the Detection Status field is hidden for scoped users.

Asset Criticality

• Asset Criticality Deleted Query: A custom category whose saved query is deleted or archived becomes Inactive at the next run, and the Activity Log records the change. The category drawer shows "Deleted or unavailable query".

• Asset Criticality Category Queries: A custom Asset Criticality category now uses the saved query you select, so you can edit the query and the next classification run applies the change. Duplicating a category creates an editable copy of its query.

• Saved Queries Used In: The Used In column on the Queries page now lists the Asset Criticality categories that use a query, with a link to the category.

Other Features

• Risk Score Run Results: Devices that the Risk Score skips because they have no Security Findings now appear as Additional results in the run results instead of Successful results. The Successful count now means assets that received a score.

SaaS Applications New Features and Enhancements

The following new features and enhancements were added to SaaS Applications:

• Parent Company in Users' Assigned Applications: Each application under Assigned Applications on the Users page now includes a Parent Company field, matching the value shown in SaaS Applications. Use it to filter, group, and chart users by the company that owns their applications.

Software New Features and Enhancements

The following new features and enhancements were added to Software Assets:

• Software Values on Devices: With the Software Management add-on, installed software on a device now includes the software's Preferred Approval Status, End Of Life, Is End Of Life, End Of Support, Is End Of Support, Category, and Sub-Category fields. You can use these fields as columns and in queries.
• Software Profile Device Count: The software profile now shows the number of devices as a Device Count row in All Fields, instead of a Devices link in the side panel header. Select the number to open the Associated Devices list.
• Approval Status in Version Breakdown: The Versions tab (Version Breakdown) now includes an Approval Status column after Software Version, using the same colors as the Approval Status column. The column is also included in the CSV export and the API.
• Next N Days for End of Life and End of Support: The End-of-life and End-of-support filters in the Versions tab now offer the Next N days operator.
• Software Version Approval Colors: In the Software and Software Registry tables, each software version is now colored by its approval status, both in the cell and in the "+X" hover panel.

---

Axonius Platform New Features and Enhancements

Dashboard

The following new features and enhancements were added to the Dashboards:

Dashboard Management Enhancements

• Import Keeps Dashboard Folders: Exporting a dashboard now saves its folder path, and importing it recreates the same folders below the folder you select in the access step. Missing folders are created where you have permission to create them. The review step of a multi-file import shows the folder path of each dashboard. Files exported from earlier versions import into the selected folder, as before.
• Simpler Dashboard and Chart Menus: The Export PDF button is removed from the dashboard header. The dashboard menu now has one Export submenu with PDF, Image, and JSON, and Add Chart is the only visible header button. The dashboard and chart menus group related items with separators, with one Full Screen item that holds the rotation choice, one Pin toggle, and one Image item for download and copy.
• Simpler Move or Copy: The Place the copy option is removed from Move or Copy. A copy is placed below the original in the same dashboard, or at the end of another dashboard. Duplicate and Edit is now Copy and Edit in the Move or Copy dialog.
• Workspace Home Dashboard Name: When a workspace's main page shows another dashboard, the workspace Home page now displays the line "Home page dashboard: " below the workspace description.

Dashboard

Chart Enhancements

• Charts Group and Measure by Related Asset Fields: Field Segmentation and Pivot charts can now group by a field of a related asset, such as the owner's department for a device. Field Summary, Asset Data, and Pivot measures can use a related field with the same calculations as regular fields. An asset with several related values is counted under each value, and assets with no related asset appear under No related asset. Selecting a segment opens the asset table with the same relationship condition. If the relationship was edited or deleted in Asset Graph, or the relation is too large to calculate, the chart shows a message instead of data.
• Chart Click Keeps Refine Data: Selecting a segment of a chart based on a saved query with Refine Data now opens the asset table with the refinement applied, so the table matches the chart. For Query Intersection, Matrix Data, and Query Timeline charts, the Refine Data of the base query and of the selected query both apply, and the base query wins on the same column. Selecting the chart in the Chart Wizard preview works the same way.
• Matrix Data Groups: A Matrix Data chart can now show up to 5 groups, each with its own asset type, base queries, and intersecting queries.
• Smoother Chart Swapping in the Grid: When you drag a chart sideways in the dashboard grid, the other chart stays in place until the swap point, and charts swap only when they are in the same row.

• Sort Charts on the Dashboard: You can now sort a chart directly on the dashboard, using Sort in the chart menu or the sort arrow that appears when you hover over the chart. Options are By Name and By Value, plus Percentage Change and Quantity Change for charts that compare to a previous date, and Query order for Query Comparison charts. The sort applies only to your current view and does not change the saved chart.
• Stack Order for Pivot Charts: Stacked Pivot charts with a Dimension Column have a new Stack order list in the Chart Wizard.
• Top N Follows the Sort: When a sort is by name or by change, Top N now takes the first N items in that sort order. This changes the results of saved Field Segmentation and Pivot charts that use Top N with a sort by name or by change.
• Historical Snapshot Fallback: When a relative historical date has no snapshot, dashboards and charts now use the closest earlier snapshot within the previous 7 days instead of showing No Data. The chart still shows the date of the snapshot used.
• Empty Chart Messages: Empty Field Segmentation, Pivot, Matrix Data, and Adapter Segmentation charts now explain why they are empty.
• Capture Chart and Copy Image Performance: Capture Chart and Copy Image now work quickly on large charts and capture the visible part of the chart.
• Chart Query Filter: The query filter in the Chart Wizard now uses the full Query Wizard, including favorites, and supports relationship fields. This applies to Field Segmentation, Pivot, Field Summary, and Asset Data charts.
• Reorder Pivot Dimensions: You can reorder the Dimensions rows of a Pivot chart by dragging them or with the keyboard. Saved table sorts move with the rows.
• Show as Yes / No for Summaries: Pivot Summary, Gauge, and Field Summary views on dashboards now offer a Show as Yes / No option.
• Sort by Percentage for Pivot Bar Charts: A Pivot bar chart with a compare date can now be sorted by Percentage, with Others shown last.

Assets Pages

The following features were added to all assets pages:

• Comparison Report Asset Name: The Comparison Report now shows the host names in the Asset Name column when no adapter sends an Asset Name, including in the CSV export.
• Asset Table Count: The table count and Select All actions now follow the table's asset Refine Data selection.

Query Wizard

• Field Comparison with List Fields: A Field Comparison between a single-value field and a list field with the equals operator now matches when one item of the list is equal. Results are now the same for current data and past dates. The not-equal operator matches only when no list item is equal. Saved queries that use this comparison can return different results after upgrade.

Action Center

The following new features and enhancements were added to the Action Center:

Enforcement Sets

• Enforcement Set Permissions: Roles that have the Enforcements Add permission but not Update can now change only the Enforcement Sets they created. Save is disabled on sets created by other users, and the server rejects the change. Creating a new set still works. Copying a rule no longer edits or deletes the source rule.
• Enforcement Did Not Run Status: Run History and the run drawer now show Did Not Run: No Assets for an action that ran on no assets, instead of Success (0/0). Alerts and actions with an error keep their status.

Standardized Ticket Statuses

The Tickets page now shows standardized status badges: Closed, Cancelled, In Progress, Open, and Overdue. The Status filter includes the new Cancelled and Overdue options

Adapter Pages and Adapter Interface

The following updates were made to the common functionality across all adapters:

Security Findings CVE and vendor IDs Setting for Exposures Adapters

A new adapter setting, Security Findings: CVE and vendor IDs, is now available under Adapter Configuration for 45 adapters that fetch Security Findings, including Tenable, Qualys, Rapid7, CrowdStrike and Snyk. This setting controls whether a scanner finding is saved under its CVE IDs, its vendor ID (such as a plugin ID or QID), or both. It can also be set per connection.

The setting replaces the separate split settings on 11 adapters, such as Tenable Nessus’ Insert both CVE and Plugin as Security Findings and Snyk’s Vulnerable Software Ingest Mode. On upgrade, each adapter and connection is set to the mode that matches its previous behavior, so existing Security Findings do not change.

Rows saved for a CVE now show the vendor ID (for example, the plugin or QID) in the Adapter Vulnerability ID field. Vendor ID findings also appear now in the Aggregated Security Findings page.

Activity Log

• CPA Remote Support Activity Log Events: The Activity Log has a new CPA Remote Support category with three actions: CPA Remote Support Changed, Network Inspector Access Approved, and Network Inspector Access Closed. The entries show the requester as a de-identified support ID, the appliance, the access window, and the reason.
• Workflow Ended Activity Log Entry: The Activity Log now records an entry in the Workflows category when a workflow run ends, for example "Workflow 'name' with run ID 101 ended with status Failed". A failed run is logged as an Error, and the entry is also sent to syslog and HTTPS forwarding. Sub-runs, test runs, and duplicate runs write no entry.

System Settings

The following updates were made to various System settings:

• Apply Refine Data in Dashboard Charts: A new admin setting, Dashboard charts - Apply the saved query's Refine Data, under Settings > GUI > UI, controls whether dashboard charts apply the Refine Data of their saved query. It is on by default, and administrators can turn it off.

• Banner Expiry Date: Under Settings > GUI > UI > Banner Indication, administrators can select Set banner expiry date and choose an Expiry date and time. After that time, the banner is removed automatically, including on pages that are already open and on the login page.

• Separate Asset Permissions: The role permission Create, delete, and link is now split, per asset type, into three permissions: Create assets, Delete assets, and Link and unlink assets. Existing roles keep their access, because they receive all three permissions on upgrade.

• Create Custom Data Permission: A new role permission, Create custom data, controls who can create new custom fields, in the user interface and through the API. Roles without it can still set values of existing custom fields if they have Edit tags and custom data. Roles that can edit custom data today receive the new permission automatically.

• Service Account Credential Lifetime: Service account credentials now expire after a lifetime of 1 to 90 days, with a default of 90. Expired credentials are rejected, and admins are alerted 30 days, 7 days, and on the day the credentials expire. Existing credentials do not expire until their next reset.

• Transfer Private Content When Deleting Users: The Delete User dialog, for single and bulk deletion, can now transfer the deleted user's private dashboards, saved queries, and reports to another user. By default, nothing is transferred.

• Field Mapping for all Asset Types: Field Mapping now supports all Axonius asset types, such as Load Balancers, Databases, Compute Services, and Network/Firewall Rules. Correlation fields cannot be used as mapping targets, so correlation is not affected.

• Defining Network Labels as Internal CIDRs: Users can now report CIDR blocks reported by selected Network assets as Internal CIDRs. Axonius matches each configured value against the beginning of an adapter tag value on the Network asset. Use this setting when CIDR blocks that are publicly routable but internal to your organization are reported by Network assets.

• More Detail in Failed Fetch Emails: The notification email about adapters that failed to start fetching now begins with a link to your Axonius instance. Its table adds a Possible reason column, a link to the Connections page, and a Next steps list.

• Use OCSP Setting: The Use OCSP setting under System Settings > Privacy and Security > Certificate and Encryption is now honored on Axonius Federal Systems. OCSP is enabled only when the feature and the Use OCSP setting are both on.
• CPA Remote Support Setting: The new CPA Remote Support checkbox in Settings > Remote Support (Maintenance page) controls whether Axonius can access your Network Inspectors. It is on by default and appears only to customers with Cyber-Physical Assets. A warning appears while it is on, and turning it off asks for confirmation and takes effect immediately.
• Data Scope Adapter Connections: The adapter connection picker in the data scope drawer now lists adapters with selected connections first.
• Inactive User Sessions: A session now ends at its next request when its user, or the admin signed in as that user, is no longer active.
• Role Basic Filters: Basic filters saved on the Administrator role now stay with that role. A newly added asset type on another role starts from the system default.
• HashiCorp Vault - Added the AppRole mount path advanced setting to support Vault instances that mount the AppRole authentication method somewhere other than the default approle path. Leave the setting empty to use the default path.

General Updates

• Gateway proxy address validation: The “Proxy address” field for gateways is now validated. It accepts only a host name, an IP address (IPv6 in brackets), or a URL, with an optional port, and no spaces or quotes. A port typed in the address now takes priority over the “Proxy port” field. Gateways saved earlier with an invalid proxy address can no longer download an installer until you edit them and save a valid value.
• Double-Click to Reset Column Width: In tables, double-click a column resizer to return the column to its default width.
• Consistent Chevron for Table Details: In the Enforcement Actions and Events table of workflows, the Ignored Fetch History table, and the Total Assets column, details now open from a chevron next to the value. This replaces the info icon and the hover over the whole cell.

• Export Disk Space Check: Exports now check available disk space before they start and stop if space runs low. The File Status filter on the Exports page now offers Not enough disk space.
• CSV Exports: When the time zone setting is on, date columns are labeled (UTC).

---

Adapter and Enforcement Action Updates

New Adapters

The following new adapters were added:

• Apigee Edge - Apigee Edge is an API management platform that provides tools for designing, securing, deploying, publishing, and analyzing APIs through API proxies, API products, and developer apps. (Fetches: Application Services, Application Resources, Users, Accounts)
• Avaya Experience Platform - Avaya Experience Platform is a contact center and unified communications platform that provides voice, chat, email, and messaging services along with agent and device management. (Fetches: Devices, Users)
• Genetec Security Center - Genetec Security Center is a unified physical security platform that provides access control, video management, and license plate recognition through cardholder, credential, and access-event management. (Fetches: Users)
• HCL AppScan on Cloud - HCL AppScan on Cloud is an application security testing platform that provides static, dynamic, interactive, and software composition analysis to identify vulnerabilities in web and mobile applications. (Fetches: Business Applications, Application Resources, Aggregated Security Findings, SaaS Applications)
• Nlyte - Nlyte Asset Optimizer is a data center infrastructure management (DCIM) platform that provides asset lifecycle management, capacity planning, and audit and compliance tracking for data center assets. (Fetches: Devices)
• Park Place Technologies Central Park - Park Place Technologies Central Park is a data center maintenance platform that provides asset management, contract management, ticketing, and hardware monitoring through a unified support portal. (Fetches: Devices)
• Right-Hand Cybersecurity - Right-Hand Cybersecurity is a Human Risk Management platform that offers security awareness training, phishing simulations, and behavior-based user risk scoring to reduce human cyber risk. (Fetches: Users)
• Skyhigh Security - Skyhigh Security is a Security Service Edge platform that provides cloud security posture management, configuration auditing, and compliance monitoring across multi-cloud infrastructure. (Fetches: Accounts, Application Resources)
• Viakoo - Viakoo is an IoT device management platform that provides discovery, firmware and password remediation, and service assurance for physical security devices such as cameras and access control systems. (Fetches: Devices)
• VMware VCF Operations - VMware Cloud Foundation Operations (formerly vRealize / Aria Operations) is an infrastructure operations management platform that provides monitoring, capacity planning, troubleshooting, and inventory visibility for vSphere and VCF environments. (Fetches: Devices, Alert Findings)

Updated Adapters

The following adapters were updated:

• Acunetix Premium - Added support for Security Findings modes, so you can choose how findings are represented by CVE IDs, vendor IDs, or both.
• Airlock Digital
  • Added the Fetch most recent blocked execution per device advanced setting. When enabled, the adapter adds the most recent blocked (audit) execution event to each device, including the date and time, file name, user name, event type, policy name, policy version, parent process, and SHA256. This setting sends one API request per device.
  • Added the Blocked execution history lookback (days) advanced setting, which controls how many days before today the adapter searches for the most recent blocked execution event. This setting applies only when Fetch most recent blocked execution per device is enabled.
• Alibaba Cloud
  • Added the Fetch ECD advanced setting, which fetches Elastic Desktop Service (ECD) cloud desktops from the configured regions as Devices.
  • Added the Fetch Object Storage (OSS) advanced setting, which fetches Alibaba OSS buckets in the configured regions as Object Storages.
  • Added the Fetch Object Storage (OSS) Tags advanced setting, which adds available tags to fetched OSS buckets.
  • Added the Fetch Container Registry (ACR) advanced setting, which fetches Alibaba Container Registry instances in the configured regions as Compute Services.
  • Added the Fetch Databases (RDS) advanced setting, which fetches Alibaba ApsaraDB RDS instances in the configured regions as Databases.
  • Added the Fetch Databases (RDS) Tags advanced setting, which adds available tags to fetched ApsaraDB RDS instances.
  • Added the Fetch Application Load Balancers (ALB) advanced setting, which fetches Alibaba Application Load Balancers as Load Balancers.
  • Added the Fetch Classic Load Balancers (CLB) advanced setting, which fetches Alibaba Classic Load Balancers as Load Balancers.
  • Added the Fetch Networks (VPC) advanced setting, which fetches Alibaba virtual private clouds as Networks.
  • Added the Fetch Disks advanced setting, which fetches Alibaba disks as Disks.
  • Added the Fetch Kubernetes Clusters (ACK) advanced setting, which fetches Alibaba ACK Kubernetes clusters as Compute Services.
• Amazon Web Services (AWS)
  • Added the Fetch Bedrock Agents advanced setting, which fetches AWS Bedrock Agents as AI Agents. This setting is available for the AI product and is disabled by default.
  • Added the Fetch Agent Version Details advanced setting, which retrieves version details for each fetched Bedrock Agent.
  • Added the Fetch Agent Tags advanced setting, which retrieves tags for each fetched Bedrock Agent. Enable it together with Fetch Agent Version Details.
  • Added the Fetch Agent Knowledge Bases advanced setting, which retrieves the knowledge bases associated with each fetched Bedrock Agent.
  • Added the Fetch Agent Action Groups advanced setting, which retrieves the action groups associated with each fetched Bedrock Agent.
• Anthropic (Claude)
  • Added support for the Enterprise Analytics API type, which fetches Users with Claude activity, cost, and token-usage analytics. To use it, select Enterprise Analytics as the API type and provide an Analytics API key with the read:analytics scope.
  • Added the Analytics User Activity Lookback Days advanced setting to control how many days of Claude user activity are retrieved. Enter a value from 1 through 365. The default is 30.
  • Added the Analytics Cost And Token Usage Lookback Days advanced setting to control how many days of per-user cost and token usage are retrieved. Enter a value from 1 through 31, and keep it at or below the user activity lookback value. The default is 30.
  • Added the Fetch Knowledge Sources (Enterprise: Files / Compliance: Projects Knowledge) advanced setting to fetch Knowledge Sources. With the Enterprise API type, the adapter collects files. With the Compliance API type, it collects active projects.
  • Added the Project Attachments advanced setting to include attachment details for fetched project Knowledge Sources on Compliance connections.
  • Added support for fetching Claude managed agents as AI assets.
• Apple Business Manager v2 - Added the Fetch AppleCare Coverage advanced setting, which is disabled by default. When enabled, the adapter fetches AppleCare coverage information (Status, Payment Type, Description, and Agreement Number) for each device. Enabling this setting makes one additional API request per device and may slow the fetch.
• Arista CloudVision - Added the Fetch Topology Neighbors (Arista V2 only) advanced setting, which is disabled by default. When enabled for Arista V2 connections, the adapter adds connected-device details, including the remote device name, local interface, remote interface, and a Direct connection type, to device assets.
• ArmorCode
  • Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication). CVE only is the default, and Vendor ID only uses the ArmorCode finding ID.
  • Security Findings now retain the full list of CVEs associated with each ArmorCode finding.
• Auvik - Added the Fetch network interfaces and connected devices advanced setting, which is disabled by default. When enabled, the adapter adds network interface details to device assets and adds direct connections between device interfaces as connected devices.
• BigFix - Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication). CVE only is the default, and Vendor ID only uses the Fixlet ID.
• BitSight Security Ratings
  • Removed the Parse non-CVE vulnerabilities advanced setting. Use Security Findings: CVE and vendor IDs to control which Security Findings rows are created. Set this option explicitly if you relied on the removed setting.
  • Added the Security Findings mode setting, which controls whether vulnerability findings are represented by CVE IDs, vendor IDs, or both. When no mode is selected, the adapter continues to use the behavior determined by its existing configuration.
  • Added the Fetch SSL certificates from findings (supplements port 443 observations) advanced setting, which is disabled by default. When enabled, the adapter adds SSL certificate details from BitSight findings to the SSL Information of existing Devices and URLs.
• BMC Atrium CMDB onPrem - Added support for RSSO authentication. Enter an RSSO Login URL, and optionally an RSSO Tenant, along with the existing user name and password to authenticate through RSSO.
• Box Platform
  • Added the Box API URL connection setting, which lets you enter the Box API root URL. The adapter uses this value for its REST API requests and OAuth2 JWT token exchange. The default value is https://api.box.com.
  • Added the ability to retrieve supported application settings, such as password policy and session duration, through the Box Enterprise Configurations API.
• Brinqa - Added support for Security Findings modes, so you can choose how findings are represented by CVE IDs, vendor IDs, or both.
• Censys ASM - Added the optional Web Entities endpoint, which enriches Device assets with Web Entity and Web Entity Instance details for HTTP and HTTPS services. To use it, enable the endpoint in the adapter's advanced settings.
• Checkmk - Added the Fetch HW/SW Inventory Network Interfaces advanced setting, which is disabled by default. When enabled, the adapter adds network interface data from the HW/SW Inventory API to device assets.
• Cisco Catalyst Center (formerly Cisco DNA Center)
  • Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication). CVE only is the default, and Vendor ID only uses the security advisory ID.
  • Added the Fetch Hardware Details advanced setting to fetch device modules, physical equipment, and stack details for stack switches. The setting is disabled by default. Enabling it adds two API calls per device, and a third call for stack switches.
  • Added the Fetch Physical Topology advanced setting, which is disabled by default. When enabled, the adapter fetches the physical topology links for every network device as connected devices.
  • Added the Fetch Interfaces advanced setting, which is disabled by default. When enabled, the adapter fetches every interface for every network device as network interfaces.
  • Added the Fetch Device Health (Assurance) advanced setting, which is disabled by default. When enabled, the adapter fetches Assurance health scores for every network device. This setting requires a Catalyst Center Advantage (Assurance) license.
• Cisco Firepower Management Center - Added the Enrich firewall access rules with threat profiles advanced setting, which is disabled by default. When enabled together with Fetch firewall rules, the adapter fetches Snort 3 intrusion policies and rules and adds the CVEs blocked by each access rule's intrusion policy to the rule as a threat profile. Fetching the full intrusion-rule catalog can increase fetch time.
• Cisco Umbrella
  • Added the Fetch networks, internal networks and sites as Network assets advanced setting, which is disabled by default. When enabled, the adapter collects Cisco Umbrella networks, internal networks, and sites as Network assets. This setting requires Cisco Umbrella API v2.
  • Added the Fetch network tunnels as Network assets advanced setting, which is disabled by default. When enabled, the adapter collects Cisco Umbrella network tunnels as Network assets, including tunnel state when the API returns it. This setting requires Cisco Umbrella API v2.
  • Added the Parse Secure Web Gateway status and applied policy bundle of roaming computers advanced setting, which is disabled by default. When enabled, the adapter adds Secure Web Gateway status information and the applied policy bundle to roaming computer device assets.
• Claroty xDome - Added support for Security Findings modes, so you can choose how findings are represented by CVE IDs, vendor IDs, or both.
• CrowdStrike Falcon - Security findings without a CVE ID are now handled according to the Security Findings mode configured for the connection. Review this mode if you want to exclude findings without CVE IDs.
• CrowdStrike Falcon Discover - Security findings without a CVE ID are now handled according to the Security Findings mode configured for the connection. Review this mode if you want to exclude findings without CVE IDs.
• Custom Files - Added the optional Target Role ARN and Target Role External ID settings to the Amazon S3 file source, so the adapter can assume a target role through a second AWS STS role-assumption hop before accessing the S3 bucket.
• Cyberint Argos Edge
  • Added support for Security Findings modes, so you can choose how findings are represented by CVE IDs, vendor IDs, or both.
  • Added Aggregated Security Findings created from the CVEs in Argos vulnerability alerts. When available, findings include the risk score and EPSS score, and the CVEs are also added to the related ASM assets identified by each alert.
• CyCognito Platform - Added support for Security Findings modes, so you can choose how findings are represented by CVE IDs, vendor IDs, or both.
• Delinea Privilege Manager (Thycotic) - Advanced settings are reorganized, and some now appear under Endpoints Config. All existing configuration is retained.
• Delinea Secret Server
  • Added the optional Domain setting to the global Thycotic Secret Server vault settings. Enter the Active Directory domain for an Active Directory service account, or leave the field empty for a local Secret Server account.
  • Added the Fetch Secret Details (Username and Notes) advanced setting, which retrieves and parses the Username and Notes fields for each eligible Secret. This setting is disabled by default, requires Fetch Vaults to be enabled, and sends one additional API request for each Secret. Secrets that require check-out or approval are skipped.
• DNSFilter
  • Added support for fetching Networks assets. Select the Networks option in Endpoints Config to fetch DNSFilter networks as Networks assets.
  • Added the Network Public IPs option, which adds public IP information to fetched Networks assets.
  • Added the Network Subnets option, which adds subnet information and CIDR blocks to fetched Networks assets.
  • Added the Policies option, which adds policy details to fetched Networks assets and to device data when it is also selected under the User Agents endpoint.
• Docker
  • Added support for Personal Access Token (PAT) and Organization Access Token (OAT) authentication, which you select by using the new Authentication Method setting.
  • Added the Organization Namespace setting, which specifies the Docker Hub organization from which the adapter fetches repositories and image tags. When this setting is empty, the adapter uses the User Name as the namespace.
  • Renamed the Password field to Password / Access Token. The field now accepts the account password, PAT, or OAT that matches the selected authentication method.
  • Updated the adapter to use the Docker Hub v2 endpoints to authenticate and to fetch repositories and image tags.
• Dynatrace
  • Added the Security Findings mode setting, which controls whether findings that include CVEs are represented by their CVE, the vendor's finding ID, or both. The default mode is Vendor ID only, so review any queries or automations that depend on CVE-based finding identities.
  • Added the Split Security Findings per process group of this host advanced setting, which creates a separate Security Finding for each security problem and host process group instead of one Security Finding for each security problem. This setting requires the Fetch extra vulnerability info and remediation items settings to be enabled, and enabling or disabling it changes the Security Finding IDs that the adapter creates.
  • Added the Fetch service call relationships (API v2) advanced setting, which adds a Service Calls field to Devices with the service ID, service name, called services, and calling services.
  • Added the Fetch process group instance network connections (API v2) advanced setting, which adds a Process Connections field to Devices with the process group instance ID and name, network-client relationships, and peer hosts. Because process group instances can be 10-100 times the host count, enabling this setting may substantially increase fetch time.
• Eclypsium
  • Added the Security Findings mode setting, which controls whether security findings are saved as CVE rows, vendor-finding rows, both, or without duplicate rows. The default mode is CVE only.
  • Security tests now associate all reported CVEs with the test finding, including CVEs supplied as newline-separated values.
  • A CVE reported by a single finding is now saved once rather than as duplicate rows.
• Edgescan Fullstack Vulnerability Management - Added support for Security Findings modes, so you can choose how findings are represented by CVE IDs, vendor IDs, or both.
• Eracent
  • Added the Authentication Method connection setting, which lets you choose between User Name and Password or Token authentication. All existing configuration is retained.
  • Advanced settings are reorganized, and some now appear under Endpoints Config. All existing configuration is retained.
• ExtremeCloud IQ - Added the Fetch LLDP/CDP Neighbors advanced setting, which adds LLDP/CDP neighbors to device assets as Connected Devices.
• FortiManager
  • Added the Parse IPsec Phase-2 Selectors advanced setting, which adds the local and remote subnets from each IPsec tunnel's phase-2 selectors to the tunnel device. This setting requires Allow IPSEC VPN devices.
  • Added the Fetch SD-WAN Templates advanced setting, which adds the SD-WAN templates assigned to each FortiManager device, including zones, members, health checks, and service rules.
  • Added the Fetch VPN Manager Communities advanced setting, which adds VPN Manager communities to the FortiManager devices that are members, including topology, IKE proposals, gateways, and protected subnets.
  • Added the Fetch Static Routes advanced setting, which adds static routes from every device VDOM in the FortiManager device database.
• Fortinet FortiGate
  • Added the Parse Public Global Interfaces as Networks advanced setting for FortiManager connections, which is disabled by default. When enabled, the adapter creates a Network asset for each Global Interface that has a public IPv4 address and represents a network rather than a single host.
  • Added the Fetch SD-WAN configuration and health checks advanced setting, which adds SD-WAN zones, members, health checks, health-check link states, and service rules to the FortiGate device. This setting is available for direct FortiOS connections only.
  • Added the Parse IPsec VPN phase 2 selectors advanced setting, which adds the local and remote subnets and status from IPsec VPN phase 2 selectors to IPsec VPN devices.
  • Added the Fetch IPsec VPN tunnel configuration advanced setting, which adds IPsec phase 1 and phase 2 interface configuration to IPsec VPN devices. This setting is available for direct FortiOS connections only.
  • Added the Fetch SSL-VPN settings advanced setting, which adds SSL-VPN settings, including listen interfaces, port, and tunnel IP pools, to the FortiGate device. This setting is available for direct FortiOS connections only.
  • Added the Fetch routing configuration advanced setting, which adds static routes and BGP and OSPF neighbors to the FortiGate device. This setting is available for direct FortiOS connections only.
  • Added the Fetch DHCP server scopes as Networks advanced setting, which collects DHCP server scopes as Networks assets with CIDR blocks, interface, default gateway, DNS servers, DHCP ranges, and reserved addresses. This setting is available for direct FortiOS connections only.
• Google Cloud Platform (GCP)
  • Added the Fetch Google Cloud Model Armor Templates advanced setting, which fetches Google Cloud Model Armor templates as Guardrail assets. This setting is disabled by default.
  • Added the Fetch Google Gemini Enterprise Agent Platform Models advanced setting, which fetches Model Registry models as AI Models assets. This setting is available when the AI product is active and is disabled by default.
  • Added the Fetch Google Gemini Enterprise Agents advanced setting, which fetches Gemini Enterprise Agent Engine reasoning engines as AI Agent assets. This setting takes effect only when the AI product is activated and is disabled by default.
• Google Workspace (G Suite)
  • Added the retrieval of Organizational Unit details for Users and Devices. To retrieve this data, add the https://www.googleapis.com/auth/admin.directory.orgunit.readonly OAuth scope to the credentials used by the adapter, and then run the adapter again.
• HackerOne
  • Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication). CVE only is the default, and Vendor ID only uses the HackerOne report ID.
  • Security Findings now retain the full list of CVEs associated with each HackerOne report.
• Halcyon - Added the Fetch Asset Details advanced setting, which is disabled by default. When enabled, the adapter adds the Deployment Group Name and Deployment Group ID to Device assets.
• HashiCorp Consul
  • Added the Node Services advanced setting, which fetches the services registered on each Consul node and adds the service port and service details to the matching Device.
  • Added the Intentions advanced setting, which fetches Consul intentions as Firewall assets.
• HP Network Node Manager i (NNMi)
  • Added the Enrich devices with Layer 2 connections advanced setting, which adds Layer 2 connection details and directly connected devices to device assets.
  • Added the Fetch IP subnets as networks advanced setting, which creates Networks assets for IP subnets discovered by HP NNMi.
  • Added the Fetch VLANs as network segments advanced setting, which creates VLAN network-segment Networks assets discovered by HP NNMi.
  • Added the Fetch open incidents advanced setting, which creates Incidents assets for HP NNMi incidents that are not in the closed lifecycle state.
• HPE Aruba Networking Central - Added the Fetch site topology (LLDP links) as Connected Devices advanced setting, which is disabled by default. When enabled, the adapter adds LLDP topology links for access points, switches, and gateways as connected devices.
• HPE Intelligent Management Center (IMC)
  • Added the Device VLANs option in Endpoints Config, which enriches Device assets with the VLAN count and VLAN list reported by HPE IMC.
  • Added the Global VLANs option in Endpoints Config, which fetches HPE IMC global VLANs as Networks assets.
• HPE OneView
  • Added the Fetch licenses advanced setting, which adds license details to server devices. This setting is disabled by default.
  • Firmware baseline compliance was previously collected automatically. It is now disabled by default.. It is now controlled by the new Fetch firmware baseline compliance advanced setting. To continue collecting firmware baseline compliance information for server devices, enable this setting.
• HYPR Passwordless
  • Added the Authentication Method connection parameter, which lets you choose between Static API Token and OAuth2 Client Credentials (JWT) authentication.
  • Added support for OAuth2 Client Credentials (JWT) authentication using a Client ID, Private Key, and Key ID (kid), with an optional Private Key Passphrase for encrypted private keys.
  • Existing connections that use an API token are automatically migrated to the Static API Token authentication method, and no action is required.
• Invicti
  • Removed the Fetch vulnerabilities with CVE ID advanced setting. Use Security Findings: CVE and vendor IDs to control which rows are fetched. The Fetch only vulnerabilities with a CVE option remains available to skip vulnerabilities without a CVE.
  • Added the Security Findings mode setting, which controls whether vulnerability results are saved as CVE rows, vendor-finding rows, both, or without duplicate rows. When no mode is set, the existing Fetch vulnerabilities with CVE ID settings determine the mode.
  • Vulnerabilities now associate CVEs reported by affected software versions with the Invicti vulnerability finding.
  • A CVE reported by a single finding is now saved once rather than as duplicate rows.
• IONIX (formerly Cyberpion) - Added support for Security Findings modes, so you can choose how findings are represented by CVE IDs, vendor IDs, or both.
• Ivanti Security Controls - Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication). CVE only is the default, and Vendor ID only uses the bulletin ID.
• JFrog Xray - Added the optional Custom HTTP Headers connection setting to send additional HTTP headers with adapter requests, including overriding the default Content-Type header when your JFrog Xray deployment requires it.
• Kaspersky Security Center - Added the Fetch BIOS serial number from hardware inventory advanced setting, which is disabled by default. When enabled, the adapter adds the BIOS serial number from Kaspersky Security Center hardware inventory to device data when one is available.
• Keyfactor - Added the Fetch Certificate Authorities and Templates advanced setting, which enriches certificate assets with Certificate Authority and certificate template details. This setting is disabled by default.
• LibreNMS
  • Added the Parse ports as network interfaces advanced setting.
  • Added the Fill the device ARP table advanced setting, which populates each device's ARP table from the ARP entries already retrieved for that device.
  • Added the Fetch LLDP/CDP links advanced setting, which retrieves LLDP/CDP link data and populates connected-device details.
  • Added the Fetch VLANs advanced setting, which retrieves VLANs and creates a Networks asset for each device VLAN.
  • Added the Fetch BGP peers advanced setting, which retrieves BGP peer details for each device.
  • Added the Fetch OSPF neighbors advanced setting, which retrieves OSPF neighbor details for each device.
• LogicMonitor - Added the Attach network interface instances to their device advanced setting, which adds instances from the SNMP_Network_Interfaces datasource as network interfaces of the device they belong to. This setting requires Fetch instances to be enabled.
• ManageEngine Endpoint (Desktop) Central and Patch Manager Plus - Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication). CVE only is the default, and Vendor ID only uses the vulnerability ID.
• Medigate - Added support for Security Findings modes, so you can choose how findings are represented by CVE IDs, vendor IDs, or both.
• Microsoft Azure
  • Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication) for Azure Defender for Cloud vulnerability assessments. CVE only is the default and creates one Security Finding row for each CVE.
  • Each assessment now retains its assessment ID and list of CVEs, and the adapter retrieves CVE details for Defender for Cloud vulnerability assessments.
  • Added the ability to fetch Microsoft Defender for Cloud DevOps repositories from Azure DevOps, GitHub, and GitLab security connectors as Application Resources.
• Microsoft Entra ID (formerly Azure Active Directory) and Microsoft Intune - Added the Fetch Device Health Scripts & Remediations advanced setting, which fetches Intune device health script run states and remediation outcomes for devices. This setting is disabled by default and requires the DeviceManagementConfiguration.Read.All permission.
• Microsoft Intune
  • Added the Endpoint Analytics Device Scores advanced setting, which enriches devices with Endpoint Analytics device scores.
  • Added the Endpoint Analytics Startup Performance advanced setting, which enriches devices with Endpoint Analytics startup performance data.
  • Added the Endpoint Analytics Application Reliability advanced setting, which enriches devices with Endpoint Analytics application reliability data.
  • Added the Endpoint Analytics Resource Performance advanced setting, which enriches devices with Endpoint Analytics resource performance data.
  • Added the Endpoint Analytics Battery Health advanced setting, which enriches devices with Endpoint Analytics battery health data.
  • To use the Endpoint Analytics settings, the Microsoft Graph application requires the DeviceManagementManagedDevices.Read.All application permission, and the Intune tenant must have an Intune license and Endpoint Analytics enabled.
• Netdisco
  • Added the Fetch port inventory (interfaces, VLANs and neighbors of all devices in one call) advanced setting.
  • Added the Fetch VLAN inventory as VLAN network assets advanced setting, which creates Networks assets from the Netdisco VLAN inventory.
  • Renamed the Enrich device MACs from nodes MACs advanced setting to Populate the MAC address table from nodes. End-host node records are now added to the device MAC Address Table instead of being added as network interfaces.
• Netskope
  • Added the Fetch SaaS application with tags advanced setting, which retrieves application tags and the sanctioned status for SaaS Applications. This setting is disabled by default.
• Axonius Network Inspector
  • The Axonius Network Inspector adapter card and page now list Aggregated Security Findings as a supported asset type, in addition to Devices.
  • The Axonius Network Inspector adapter now appears under the IoT and OT categories on the Adapters page, replacing Cloud Mgmt and MDM/EMM.
• New Relic
  • Added the Fetch Host Network Interfaces advanced setting.
  • Added the Fetch Entity Relationships advanced setting.
• Nucleus Security
  • Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication). CVE only is the default, and Vendor ID only uses the finding ID.
  • Added the Fetch findings via Data Export (AWS SaaS tenants only) advanced setting to fetch findings through the latest available Data Export files for the configured projects. The setting is disabled by default, and existing connections continue to use the current findings retrieval behavior.
• Nutanix Prism Central
  • Added the Fetch VM disks advanced setting, which retrieves disk details for every VM. This setting requires Use API v4 and is disabled by default.
  • Added the Fetch VM Nutanix Guest Tools advanced setting, which retrieves Nutanix Guest Tools details for every VM. This setting requires Use API v4 and is disabled by default.
  • Enhanced API v4 VM records to include CPU and memory details, VM-to-host and VM-to-cluster relationships, and resolved host and cluster names when available.
  • Enhanced API v4 host records to include CPU topology, disks, boot time, and the node serial number when available.
• Okta - Added the Fetch Apps as Business Applications advanced setting (default: disabled), which creates a Business Application asset for every fetched app. This setting requires Fetch Apps and is available for CAASM.
• Onspring Compass - Added support for fetching Users from the Onspring app named Users.
• Op Innovate WASP - Added support for Security Findings modes, so you can choose how findings are represented by CVE IDs, vendor IDs, or both.
• OpenText Universal CMDB - Added the optional Client Context and Repository connection settings to support Universal CMDB deployments that use multi-tenancy. Client Context defaults to 1, and Repository is not sent in the authentication request when it is left empty.
• Orca Cloud Visibility Platform
  • Added support for Security Findings modes for alerts, so you can choose how findings are represented by CVE IDs, vendor IDs, or both.
  • Added support for collecting Access control alerts by default when no alert category filter is selected.
  • Vulnerabilities alerts remain excluded by default. To collect them as incidents, select Vulnerabilities in the alert category filter.
• Palo Alto Networks Prisma Cloud
  • Security findings without a CVE ID are now handled according to the Security Findings mode configured for the connection. Review this mode if you want to exclude findings without CVE IDs.
  • Added the Fetch AWS EKS clusters as Compute Services advanced setting, which is disabled by default. When enabled, the adapter fetches AWS EKS clusters as Compute Services assets and uses the cluster ARN as the Cloud ID.
• Palo Alto Networks Prisma Cloud Workload Protection
  • Added the Fetch WAAS policy rules as Firewalls advanced setting, which creates a Firewalls asset for each WAAS policy rule.
  • The adapter now trims leading and trailing spaces from the configured Domain value and connects to the Prisma Cloud Compute console over HTTPS.
• Panorays - Added support for Security Findings modes, so you can choose how findings are represented by CVE IDs, vendor IDs, or both.
• Pentera
  • Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication). CVE only is the default, and Vendor ID only uses the vulnerability ID.
  • Security Findings now retain the full list of CVEs associated with each Pentera vulnerability.
• Pivotal Cloud Foundry - Added the Fetch Apps as Applications advanced setting to fetch apps as Application assets instead of Device assets. The setting is disabled by default.
• Prometheus - Added the Network Interfaces advanced setting, which fetches the network interface name, MAC address, operational status, administrative status, speed, and MTU for Devices.
• Qualys Cloud Platform
  • Removed the Insert both CVE and QID as Security Findings advanced setting. Use Security Findings: CVE and vendor IDs to control the Security Findings rows that are created.
  • The Insert QIDs without CVEs option remains available. When Security Findings: CVE and vendor IDs is set to Both, Vulnerabilities assets match Qualys detections by QID instead of CVE.
  • Added the Security Findings mode setting, which controls whether findings are created as CVE rows, vendor identifier rows, both, or a mix that avoids duplicate rows for findings with one CVE. When the setting is empty, the adapter derives its behavior from its existing vulnerability settings, and a selected mode takes precedence.
• Qualys VMDR OT
  • Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication), so findings can be identified by CVE IDs or Qualys QIDs. CVE only is the default and creates one row for each CVE.
  • Findings without a CVE remain represented by their Qualys QID in every mode, and vendor-based findings use the QID- prefix.
• Qualys WAS - Added the Security Findings mode setting, which controls whether findings that include CVEs are represented by their CVE, the vendor's finding ID, or both. The default mode is Vendor ID only, so review any queries or automations that depend on CVE-based finding identities.
• Radiflow - Advanced settings are reorganized, and some now appear under Endpoints Config. All existing configuration is retained. The saved Fetch CVEs setting is migrated automatically to the endpoint configuration that controls device-detail retrieval.
• Rapid7 InsightVM
  • Removed the Insert both CVE and Plugin as Security Findings, Don’t split source vulnerabilities into CVEs, and Ingest non-CVE Rapid7 Plugin as Security Findings advanced settings. Use Security Findings: CVE and vendor IDs to control which Security Findings rows are created.
  • Added the Security Findings mode setting, which controls whether vulnerability findings are represented by CVE IDs, vendor IDs, or both. When no mode is selected, the adapter continues to use the behavior determined by its existing configuration.
• Rapid7 Nexpose and InsightVM
  • Removed the Don’t split source vulnerabilities into CVEs advanced setting. Use Security Findings: CVE and vendor IDs to control which Security Findings rows are created.
  • Added the Security Findings mode setting, which controls whether vulnerability findings are represented by CVE IDs, vendor IDs, or both. When no mode is selected, the adapter continues to use the behavior determined by its existing configuration.
• Rapid7 Nexpose Warehouse
  • Removed the Insert both CVE and Plugin as Security Findings advanced setting. Use Security Findings: CVE and vendor IDs to control which Security Findings rows are created.
  • Added the Security Findings mode setting, which controls whether vulnerability findings are represented by CVE IDs, vendor IDs, or both. When no mode is selected, the adapter continues to use the behavior determined by its existing configuration.
• Red Hat Automation Controller (Ansible Tower) - Added the Parse network device facts advanced setting, which is disabled by default. When enabled, the adapter parses ansiblenet* facts from the host facts it already fetches.
• Red Hat Insights - Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication). CVE only is the default, and Vendor ID only uses the advisory ID.
• Red Hat Satellite - Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication). CVE only is the default, and Vendor ID only uses the Errata ID.
• RiskRecon
  • Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication). CVE only is the default, and Vendor ID only uses the finding ID.
  • Security Findings now retain the full list of CVEs associated with each RiskRecon finding.
• runZero
  • Added the Security Findings mode setting, which controls whether findings that include CVEs are represented by their CVE, the vendor's finding ID, or both. The default mode is Vendor ID only, so review any queries or automations that depend on CVE-based finding identities.
  • Added the Fetch Installed Software advanced setting, which is disabled by default. When enabled, the adapter retrieves installed-software data for discovered devices and adds it to Software assets.
• SailPoint IdentityNow - Added the Fetch Identity Attributes via Search API advanced setting. This is useful for tenants that do not expose these attributes through the regular identities or accounts API endpoints. This setting is disabled by default.
• SecureW2 JoinNow - Advanced settings are reorganized, and some now appear under Endpoints Config. All existing configuration is retained. The saved Async chunk size value is now limited to a range of 1 to 20.
• SecurityScorecard - Security findings without a CVE ID are now handled according to the Security Findings mode configured for the connection. Review this mode if you want to exclude findings without CVE IDs.
• SentinelOne - Security findings without a CVE ID are now handled according to the Security Findings mode configured for the connection. Review this mode if you want to exclude findings without CVE IDs.
• ServiceNow - The Install status filter and Operational status filter advanced settings, including their include and exclude lists, now apply to Business Applications and Databases in addition to Devices.
• SharePoint
  • Added the Fetch Items as advanced setting, which lets you choose whether fetched SharePoint list items are stored as Application Resources or Devices.
  • Changed the default asset type for fetched SharePoint list items from Devices to Application Resources. To keep list items as Devices, set Fetch Items as to Devices in the adapter's advanced settings.
• Skybox Firewall Assurance - Added the Populate Access Ranges Allowed from enabled allow rules advanced setting, which populates the allowed access ranges on Firewalls assets from enabled allow rules.
• Snowflake Data Warehouse
  • Added the Fetch licenses as asset advanced setting, which fetches license data from a Snowflake view or table that you define and stores it as Licenses assets.
  • Added the Licenses View Name advanced setting, where you enter the name of the Snowflake view or table that contains your license data.
  • Added the Enable Custom Parsing advanced setting with support for License assets, so you can map raw fields to existing or new fields.
  • Licenses assets now use both the source ID and the licensing type as their identifier, so records with the same ID and different licensing types remain distinct.
• Snyk
  • Removed the Vulnerable Software Ingest Mode advanced setting. Use Security Findings: CVE and vendor IDs to control which Security Findings rows are created.
  • Added the Security Findings mode setting, which controls whether Snyk issues are represented by CVE, vendor ID, or both. When no mode is selected, the adapter derives its behavior from the existing Vulnerable Software Ingest Mode setting, and each CVE entry for a Snyk issue retains its own vulnerability identifier.
• Sophos Cloud Optix - Advanced settings are reorganized, and some now appear under Endpoints Config. All existing configuration is retained.
• Splashtop
  • Grouped the connection credentials by Authentication Method. Choose OAuth2 (Client ID, Client Secret, and MFA Code) or API Key. Existing connections that use an API key are set to API Key, and all other existing connections are set to OAuth2.
  • Advanced settings are reorganized, and some now appear under Endpoints Config. All existing configuration is retained.
• Splunk
  • Added the ability to create SaaS Applications assets from rows returned by SaaS-mapped macros and saved-search reports.
  • Added the Ignore SaaS Applications Repository for SaaS Application records advanced setting, which creates SaaS Applications assets for named records that are not in the Axonius SaaS Applications Repository. This setting is disabled by default and is available when customers have Axonius SaaS Applications. Applications derived from DNS records still require a repository match.
  • When Splunk User Applications is selected in the Do Not Populate Duplicate Fields setting, the adapter no longer adds DNS-derived applications to the user application fields. Instead, it associates the DNS users with the corresponding SaaS Applications assets. During upgrade, Axonius adds Splunk User Applications to this setting if no Splunk SaaS Application mapping with a search name is configured. To keep populating the DNS-derived user application fields, remove Splunk User Applications from this setting.
• SQL Server - Added support for the Licenses asset type. To retrieve License assets, configure a SQL table for the Licenses asset type. Each row becomes a License asset, and you can use License custom parsing to map additional columns from the source row.
• Symantec Endpoint Protection 14.x - Added the Fetch Licenses advanced setting, which retrieves the license inventory and creates Licenses assets. This setting is disabled by default.
• Tenable Cloud Security - Security findings without a CVE ID are now handled according to the Security Findings mode configured for the connection. Review this mode if you want to exclude findings without CVE IDs.
• Tenable Nessus
  • Removed the Insert both CVE and Plugin as Security Findings advanced setting. Use Security Findings: CVE and vendor IDs to control which Security Findings rows are created.
  • Added the Security Findings mode setting, which controls whether findings are created as CVE rows, vendor identifier rows, both, or a mix that avoids duplicate rows for findings with one CVE. When the setting is empty, the adapter derives its behavior from its existing vulnerability settings, and a selected mode takes precedence.
  • This adapter now fetches Security Findings.
  • Renamed the Fetch only enabled scans advanced setting to Fetch only enabled scheduled scans to clarify that it applies to scans with an enabled Nessus schedule. The setting behavior is unchanged.
  • Added the Classify Web Application Sitemap assets as Domains & URLs advanced setting, which is disabled by default. When enabled, hosts that report the Web Application Sitemap plugin (91815) are created as Domains & URLs instead of Devices. If this setting and Classify Attack Surface Discovery assets as Domains & URLs are both enabled, a host that reports both plugins is classified as Attack Surface Discovery.
• Tenable Vulnerability Management
  • Removed the Insert both CVE and Plugin as Security Findings advanced setting. Use Security Findings: CVE and vendor IDs to control which Security Findings rows are created.
  • Added the Security Findings mode setting, which controls whether findings are created as CVE rows, vendor identifier rows, both, or a mix that avoids duplicate rows for findings with one CVE. When the setting is empty, the adapter derives its behavior from its existing vulnerability settings, and a selected mode takes precedence.
  • Added macOS local and service account information and Windows user account details, such as local status, security identifier, and disabled status, to device records.
  • Added Windows local group membership details, including the names of group members.
  • Added the Prefix strictly local users with the hostname advanced setting, which adds the hostname to local Windows user names and local group member names. This setting is disabled by default.
  • Added the Prefix local domain users with the domain advanced setting, which adds the domain to Windows domain user names and domain group member names. This setting is disabled by default.
• Tenable Vulnerability Management Scan Export CSV
  • Added support for Security Findings modes (CVE only, Vendor ID only, Both, and No duplication), so findings can be identified by CVE IDs or Tenable plugin IDs. CVE only is the default and creates one row for each CVE.
  • Findings without a CVE remain represented by their Tenable plugin ID in every mode, and vendor-based findings use the Plugin- prefix. Available CVSS, CVSS v2, and CVSS v3 scores are preserved.
• Tenable.sc (SecurityCenter)
  • Removed the Insert both CVE and Plugin as Security Findings advanced setting. Use Security Findings: CVE and vendor IDs to control which Security Findings rows are created.
  • Added the Security Findings mode setting, which controls whether findings are created as CVE rows, vendor identifier rows, both, or a mix that avoids duplicate rows for findings with one CVE. When the setting is empty, the adapter derives its behavior from its existing vulnerability settings, and a selected mode takes precedence.
  • Added the Fetch NetBIOS and SMB Domain Information from Plugin 10785 advanced setting, which is disabled by default.
• ThousandEyes - Added the Agent-to-Agent Tests option to the Enterprise Agents endpoint configuration, which retrieves agent-to-agent test configuration for target enterprise agents on ThousandEyes v7 connections.
• Tufin SecureTrack
  • Added the Map enabled allow security rules to Access Ranges Allowed advanced setting, which adds access ranges for enabled security rules that allow traffic.
  • Corrected NAT translation data so that each NAT rule keeps its own original and translated networks.
• UKG Pro HCM Reports-as-a-Service (RaaS) - Added the Enable Custom Parsing advanced setting, which lets you map fields from the raw report data to existing or new Users fields.
• United Security Providers - Added the Use network device name as Asset Name when client name is empty option. This option is disabled by default.
• Veeam - Added the Use latest restore point creation time as Last Seen advanced setting (default: disabled), which sets a device's Last Seen value to the creation time of its latest restore point. Enable Fetch Backup Objects and Fetch Restore Points for this setting to take effect.
• VMware NSX
  • Added the Fetch Policy API distributed and gateway firewall rules as Firewall assets advanced setting, which fetches these rules as individual Firewalls assets.
  • Added the Fetch Tier-0 and Tier-1 gateway NAT rules as Firewall assets advanced setting, which fetches these NAT rules as individual Firewalls assets.
  • Added the Fetch load balancer pools and virtual server listeners advanced setting, which adds virtual server listener data to Load Balancers assets.
• VMware NSX Advanced Load Balancer
  • Added the Fetch virtual service listeners (VIP ports, pool member ports and network profile protocols) advanced setting, which collects listener details for virtual services when used together with Parse as load balancer.
• Vulcan Cyber - Added the Security Findings mode setting, which controls whether findings that include CVEs are represented by their CVE, the vendor's finding ID, or both. The default mode is Vendor ID only, so review any queries or automations that depend on CVE-based finding identities.
• WhatsUp Gold
  • Added the Fetch interface utilization report advanced setting, which adds interface name, ID, and speed information from the group interface utilization report to device network interfaces.
  • Added the Parse active monitors advanced setting, which adds the total active monitors, total active monitors down, and down active monitors to device records.
• Wiz
  • This adapter now fetches Application Settings.
• WordPress Toolkit - Added the Security Findings mode setting, which controls whether findings that include CVEs are represented by their CVE, the vendor's finding ID, or both. The default mode is Vendor ID only, so review any queries or automations that depend on CVE-based finding identities.
• Zabbix
  • Added the Parse host interfaces (type, port, open ports) advanced setting, which is disabled by default.
  • Added the Fetch network discovery hosts as devices advanced setting, which is disabled by default.
  • Added the Fetch map links as connected devices advanced setting, which is disabled by default.
• Zscaler Private Access (ZPA)
  • Added support for OneAPI (OAuth) authentication through ZIdentity. Use the new Auth Method setting to choose between Client ID and Client Secret or OneAPI(Oauth), and provide the Vanity Domain for OneAPI(Oauth).
  • Added the Cloud Name and Tenant ID connection settings, which are required only for OneAPI(Oauth) connections to multi-cloud tenants.
  • The Domain setting now defaults to the Zscaler Private Access API domain. It is ignored when OneAPI(Oauth) is selected.
  • The adapter now refreshes the authentication token before it expires during a fetch.

New Enforcement Actions

The following Enforcement Actions were added:

• Freshservice - Update Problem - Updates existing Freshservice Problems that are returned by the selected query or selected from an asset page. You can update the Problem name, description, status code, priority, and impact, or provide additional fields in JSON format. Use Freshservice - Update Ticket to update Freshservice Tickets.
• Google Workspace - Manage Chrome Extension - Sets the Chrome extension installation policy for the selected assets. The policy can apply to an Organizational Unit, a Google Group, or the target derived automatically from each asset, and you can choose to block, allow, force install, or reset the policy to the inherited setting.

Updated Enforcement Actions

The following Enforcement Actions were updated:

• Cisco Support - Enrich Cisco Devices OS with EOL/EOS - Added the Compute Node parameter, which lets you select the compute node whose Cisco adapter instance processes the Cisco End-of-Life and End-of-Support lookup.
• Duo - Create User - Added the optional Phone Number parameter, in E.164 format, to associate a phone with the user. Axonius associates an existing Duo phone with that number, or creates and associates a new Duo phone when no matching phone exists.
• Duo - Update User - Added the optional Phone Number parameter, in E.164 format, to associate a phone with the user. Axonius associates an existing Duo phone with that number, or creates and associates a new Duo phone when no matching phone exists.
• Jira - Create Issue - Added a list of available Jira project keys, collected by the Jira Software adapter, to the Project Key field. You can still enter a custom project key.
• Jira - Create Issue per Asset - Added a list of available Jira project keys, collected by the Jira Software adapter, to the Project Key field. You can still enter a custom project key.
• Jira Software - Create Ticket - Added a list of available Jira project keys, collected by the Jira Software adapter, to the Project Key field. You can still enter a custom project key.
• Jira Software - Create Ticket Per Asset - Added a list of available Jira project keys, collected by the Jira Software adapter, to the Project Key field. You can still enter a custom project key.
• Palo Alto XSOAR - Create Incident per Asset - Renamed the action from Demisto - Create Incident per Asset, and added the Use stored credentials from adapter parameter, which lets you select an adapter connection whose stored Palo Alto XSOAR credentials the action uses to create one incident for each matched asset.
• ServiceNow - Create Incident - Added a list of ServiceNow table names, collected by the ServiceNow adapter, to the table selection. The list includes the task table and the tables that extend it. You can still enter a custom table name.
• ServiceNow - Manage Assets with Scripted REST API
  • Added the Request Mode option, which lets you send assets either one per request (the default) or in batches. Existing configurations continue to send one asset per request.
  • Added the Batch Array Key and Batch Size options, which are required when Request Mode is set to Batch requests.
  • When Request Mode is set to Batch requests, the Number of parallel requests setting is ignored and batch requests are sent one at a time.
• SQL - Send Assets to Table - Added the Export only the query's sub-fields of the split field parameter, which is disabled by default.
• TeamDynamix - Create Ticket
  • Added the optional Form ID parameter to send a TeamDynamix form identifier when creating a ticket.
  • Added the optional Custom Attributes (json format) parameter to send custom attribute values, as a JSON array of objects, when creating a ticket.
• Tenable.sc (SecurityCenter) - Add IPs to Scan - Added the Use hostnames option, which adds the preferred hostname of each selected asset to the scan targets along with its IP addresses.
• Tenable.sc (SecurityCenter) - Add or Remove IP Addresses to/from Assets - The Source Adapter field is now a dropdown list of the adapters configured in your instance, sorted alphabetically and displayed by adapter title.

Fixed Bugs

Authentication & Connectivity

• Checkmarx One - Added support for entering a custom tenant URL in the Domain connection setting, in addition to selecting a regional host. Use this option when your Checkmarx One tenant uses a cxone.cloud URL.
• Cisco Nexus Dashboard - Fixed an issue where the connection failed with a 404 error on Nexus Dashboard version 4.2.1 and later. The adapter now automatically uses the unified Infra and Manage APIs when the legacy platform APIs are unavailable, and continues to use the legacy APIs for earlier versions without any configuration changes.
• Connections - Fixed an issue where duplicating a connection failed with a "Server is already gone" error when the selected destination compute node was different from the compute node of the original connection.
• Delinea Secret Server - Fixed an issue where passwords could not be retrieved from a vault that has no gateway configured when adapter connections are routed through a tunnel. Axonius now retrieves the password through a worker that is not tunneled. Added request timeouts to Delinea Secret Server (version 11) connections.
• GitHub - Fixed an issue where a missing installation response (404) could leave a GitHub App connection authenticated with the wrong credential for subsequent requests. The adapter now uses a fresh credential for each request.
• Halcyon - Fixed an issue where Halcyon enforcement actions run on devices in a sub-tenant were sent to the primary tenant and failed. Enforcement actions now target the tenant that the device belongs to.
• Industrial Defender ASM (Automation Systems Manager) - Fixed an issue where asset and vulnerability requests were missing the required /AsmDataService path prefix.
• Kaseya VSA - Fixed an issue where a fetch could end early when Kaseya VSA rejected the session token. The adapter now re-authenticates and retries the request, and the session refresh is scheduled correctly even if Kaseya VSA reports an incorrect token expiration time.
• Keeper Enterprise Password Vault - Fixed connection issues by removing report command options that Keeper does not support, and updated the adapter to correctly handle the role list format returned in user report data.
• Keeper Secrets Manager - Fixed an issue where the connection could time out while waiting for Keeper to approve a new device. The adapter now completes device approval and two-factor authentication using a time-based one-time password (TOTP), retries rejected TOTP codes up to three times, and clearly reports when the account requires SSO login, has no Authenticator (TOTP) two-factor channel, or when Keeper rejects the configured password.
• NetWitness NDR - Fixed an issue where the adapter showed a failed connection during a fetch because host data was not requested for the correct service.
• OpenText Service Management (SMAX) - Fixed an issue where the adapter could not use the authentication token returned by OpenText Service Management as plain text, which prevented follow-up requests from succeeding.
• Qualys Cloud Platform - Improved connection reliability by retrying failed API authentication attempts up to three times, with a five-second delay between attempts. An authentication report response that contains no report data is now reported as a warning instead of an invalid response.
• Seismic - Fixed an issue that prevented the adapter from connecting to Seismic. The adapter now uses a separate base URL for authentication, so you must edit each existing Seismic connection and set the new required Authentication Domain field (default: https://auth.seismic.com). The Domain Name field was renamed API Domain, and the Tenant field now accepts only the tenant name and not a URL.
• Veeam - Fixed an issue where a fetch ended with warnings and fetched fewer devices after the Veeam authentication token expired and the server returned a 401 error. The adapter now re-authenticates and retries the request so the fetch can complete.

Data Accuracy

• Asset Profile - Fixed an issue where data produced by the Network Routes enrichment, including related network route IDs, was attributed to the adapter connections that store it. Asset Profile now lists Network Routes as its own source.
• BigID - Fixed an issue where sensitive data source connection properties could be included in the fetched data. These properties are now removed before the data is processed.
• CipherTrust Manager - Added the Fetch KMIP Clients as Certificates advanced setting (default: false), which lets you fetch KMIP clients as Certificate assets instead of Device assets. By default, KMIP clients continue to be fetched as Device assets.
• CSV - Send to SFTP - Fixed an issue where the CSV - Send to SFTP enforcement action reported that the CSV adapter provided no response and marked the run as partial, even though the upload succeeded. The action now reports the correct outcome of the upload and returns the failure message when an upload fails.
• Custom Files - Added the Clear dynamically parsed fields when the cell is empty advanced setting (default: off). When enabled, a dynamically parsed field is removed from an asset if its cell in the source file is empty or its column is no longer in the file, instead of keeping the value from a previous fetch.
• Dragos Platform - Fixed an issue where devices that Dragos reports as industrial switches, switches, or routers were not classified as network infrastructure devices. These devices now have the Is Network Infrastructure field set automatically during device ingestion.
• LogicMonitor - Fixed an issue where the Cloud ID of Azure devices was populated with the provider resource ID. The Cloud ID now uses the Azure VM UUID when it is available.
• PDQ Inventory - Fixed an issue where the Last Seen value of a device was not taken from the correct source. Last Seen is now set from the last online time reported by PDQ.
• Ping Federate - Fixed an issue where OAuth clients that use only the client credentials grant type were not consistently excluded when the exclusion option was enabled. Grant types are now recognized regardless of letter case, and excluded clients are no longer fetched or processed.
• Qualys Cloud Platform - Fixed an issue where the setting that controls Information Gathered vulnerabilities was not applied when fetching vulnerability knowledge-base data. When Information Gathered vulnerabilities are allowed, they are now retained and enriched with their knowledge-base details.
• ServiceNow - Fixed an issue where a physical location that was cleared in ServiceNow continued to appear on the asset in Axonius. The field is now removed when ServiceNow reports it as empty.
• ServiceNow - Create Incident - Removed a stale setting from saved ServiceNow Create Incident actions that could not be removed through the user interface.
• Trellix ePolicy Orchestrator (ePO) - Fixed an issue where devices that share the same hostname overwrote each other's Solidcore enrichment data. Each device now receives the Solidcore data that matches its own agent.
• Veracode - Added the Fetch Devices advanced setting, which is enabled by default. Disable it to stop creating Devices from Veracode application profiles. When Fetch Devices is disabled and Fetch Business Applications is enabled, the adapter creates Business Applications instead and places vulnerability data from findings on them. Do not disable both settings, because Veracode application profiles then produce no assets.

Data Completeness

• BeyondTrust PRA Cloud - Fixed an issue where only 100 devices were fetched. The adapter now paginates correctly, and it refreshes its authentication token and retries when a request fails because the token expired.
• CIS-CAT Pro - Fixed an issue where the adapter could return 0 assets when a bulk database insert failed on large device payloads. Axonius now retries each record individually, so only records that continue to fail are skipped.
• Cisco Adaptive Security Appliance (ASA) - Fixed an issue where connections that use the HTTP Interface returned very little data. The adapter now creates Cisco ASA Devices with software version, hardware, uptime, and interface details, and maps access control list (ACL) rules and network address translation (NAT) rules as Firewall data.
• CrowdStrike Falcon - Fixed an issue where policy names were missing for policies that exist only in child CIDs in Flight Control (multi-tenant) deployments. Added the Fetch Child CID Policies (Flight Control) advanced setting (default: false), which fetches policies for each unique child CID found in device data. Configure at least one Policy type before enabling this setting.
• CSV Export - Fixed an issue where exported CSV files were sometimes truncated for large exports. Large exports are now more reliable when handling large rows, temporary data store errors, and long-running responses.
• Enforcement Center - Fixed an issue where enforcement actions created or updated through the API failed to run with a "Failed asset breakdown" error when optional configuration values were omitted. Omitted values now receive the default values of the action type, matching actions saved through the Enforcement Center. Run errors now also identify the name of any missing configuration value.
• Figure OS
  • Added end-of-support, end-of-life, and extended-support lifecycle enrichment for Alibaba Cloud Linux major versions 2, 3, and 4. Alibaba Cloud Linux is now also available as an OS Type when you configure supported major OS versions.
  • Fixed an issue where Android devices did not receive lifecycle enrichment. Android versions earlier than 9 now use the correct version cycle, and minor or patch releases without a dedicated cycle now use the lifecycle data of their major version. Assets whose lifecycle data has no published end-of-life date now show a clear reason why enrichment was skipped.
• Freshservice - Create Service Request per Asset - Fixed an issue where the action failed with a validation error when the optional Requester Email or Requested for fields were left blank. Blank fields are now left out of the request, and the error returned by Freshservice is now shown as the action result when a request fails.
• Freshservice - Update Ticket - Fixed an issue where the Freshservice - Update Ticket enforcement action did not complete ticket updates. The action now sends supported ticket values, including custom fields, to Freshservice, and updates the ticket description from the comment supplied to the action.
• Google Cloud Platform (GCP) - Added the UID field to GCP assets, including Cloud Run services, so that the value can be used to correlate GCP assets with assets from other sources, such as the Pod ID in CrowdStrike.
• HYPR Passwordless
  • Fixed an issue where only the first page of users was fetched. The adapter now fetches all pages of users.
  • Fixed an issue where a failed device request for one user stopped the entire device fetch. Device data is now retained for users whose requests succeed, and throttled requests are retried.
• IBM Guardium Data Protection
  • Fixed an issue where rows from the GIM_STATE online report were discarded. These rows are now collected as Devices, with one Device for each GIM module row.
  • Fixed an issue where S-TAP configuration data was not collected when Guardium returned IBM numbered-host messages. Both single-line and multi-line message formats are now supported.
• Lansweeper Cloud - Fixed an issue where a failed bulk export for a site completed as an empty result without any error. The failure is now reported as a fetch error that includes the site name and ID, and the fetch continues for the remaining sites.
• Microsoft Azure - Fixed the management group filter so that it fetches the subscriptions that belong to the configured management groups, at any level of the hierarchy. Management group IDs can be entered as plain IDs, full resource IDs, or comma-separated values.
• OpenStack - Improved error handling when fetching Devices or Hypervisors. If a fetch fails for one asset type, the adapter now records an error event with the host and error details, and continues to fetch the other configured asset types.
• Oracle Cloud - Fixed an issue where the adapter failed with a generic error when fetching identity data. The adapter now reports detailed Oracle Cloud Infrastructure error information, and a failure to retrieve the group membership of an individual user no longer stops the users fetch.
• Palo Alto Networks Cortex XDR - Added the Running processes path filters advanced setting, so you can choose which paths are used to filter running processes when Fetch running processes is enabled. Matching is case-insensitive, and an empty list fetches running processes from all paths.
• Platform
  • Fixed an issue where the Software Type field was not populated for many security findings. The field is now populated automatically from CPE data, including findings enriched from the National Vulnerability Database (NVD) and findings from Tenable Security Center.
• Rockwell FactoryTalk AssetCentre - Fixed an issue where the adapter did not discover devices from exports that begin with a server or container bus.
• SQL - Send Assets to Table - Fixed an issue where assets that were not returned during an export were not reported back. Axonius now retries missing assets and reports a success or failure result for every requested asset.
• SQL Server - Added the Advanced Configuration Per Connection option (default: disabled) for custom adapter copies that have an advanced configuration. When enabled, you can configure advanced settings separately for each connection. Existing advanced configuration values are retained.
• Tenable Nessus - Fixed an issue where not all findings were fetched. When Fetch scans from the last X days is set to a value greater than 0, the adapter now also includes scans whose last run ended within that period and reads completed earlier runs within the period, using the newest run for each host.
• Trellix ePolicy Orchestrator (ePO) - Fixed an issue where a failed or empty saved-query enrichment, such as Benchmark or Events, could affect the fetch. The adapter now continues to fetch devices and the other enrichment data, and the logs identify the enrichment and saved query that failed.
• Vectra AI
  • Improved fetch reliability by retrying transient failures when requesting pages of data. If retries are exhausted, the fetch is reported as partial instead of successful.
  • Fixed an issue where recently modified hosts could be skipped because host retrieval stopped based on an old detection timestamp. Host retrieval now continues if detection enrichment fails.

Parsing

• BeyondTrust PRA Cloud - Fixed an issue where the Last Seen field was not populated. The adapter now parses the last connect timestamp into the Last Seen field.
• Cisco Firepower Management Center
  • Fixed an issue where disabled firewall rules were included in network route processing.
  • Fixed an issue where NAT translations did not identify their connection direction correctly.
  • Fixed an issue where addresses in the RFC 6598 shared address space (100.64.0.0/10) were treated as public addresses during NAT parsing.
• Custom Files - The adapter now supports Custom Parsing for the following complex fields:
  • Network Interfaces - for Device assets
  • Installed Software - for Device and Software assets
  • Installed Software: CVEs - for Device and Software assets
• ManageEngine ServiceDesk Plus - Fixed an issue where Windows license keys and non-meaningful version or service pack values were included in operating system strings, which prevented end-of-life enrichment from matching the operating system.
• Mandiant - Added the IP address as a network interface when an aggregated device name is a valid IP address.
• Nutanix Prism Central - Fixed an issue where Windows build information appended to guest operating system strings prevented end-of-life enrichment from matching the operating system. Architecture information is retained.
• Palo Alto Networks Cortex XSIAM - Fixed parsing of device data so that the agent version, agent status, endpoint tags, and server tags are correctly populated on devices.
• Qualys Cloud Platform - Added support for recognizing the Red Hat CoreOS category when parsing vulnerabilities.
• SAP S/4HANA (On-Prem) - Fixed an issue where Business Users were not retrieved or parsed correctly. The adapter now uses the request format required by the SAP service, uses the SAP logon ID as the username with a fallback identifier, and handles date and time values correctly.
• ServiceNow - Improved the reliability of custom parsing reload handling.
• Splashtop
  • Added parsing of the operating system user into the Last Used Users field to improve correlation.
  • Added parsing of the operating system domain into the Domain field to improve correlation.
• SQL - Send Assets to Table - Fixed an issue where a date field with multiple values was written to the table as a list instead of a date and time value. The action now writes the most recent date and time value so the column keeps its date and time type.
• ThreatLocker
  • Added decoding of Base64-encoded serial numbers.
  • Added collection of MAC addresses from computer network data.

Performance

• Anomali ThreatStream - Fixed slow connections and fetches by retrieving only active IP indicators from Anomali ThreatStream.
• Check Point Harmony Endpoint - Fixed an issue where errors during job polling caused the fetch to appear completed without returning assets. Rate-limited job polls are now retried with exponential backoff, and other job polling errors now fail the fetch with a descriptive error.
• Cisco Meraki
  • Fixed an issue where the adapter did not honor the Retry-After value returned by the API when it was rate limited. The adapter now waits for the requested time before retrying, or two seconds if no value is returned.
  • Reduced unnecessary error logging for networks that do not have VLANs enabled.
• F5 BIG-IP iControl - Improved request reliability by retrying timed-out requests and token refresh requests. ASM enrichment requests are now sent in batches of five, and policy data enriched before a request failure is retained.
• SQL - Send Assets to Table
  • Added the Database write mode (SQL Server only) setting to reduce the time needed to export large amounts of data. Select Standard (default) to commit each chunk during the export, or Optimized for large exports to commit once per request after all chunks are written.
  • Increased the default value of the Chunk size (rows per INSERT) setting from 50 to 200.
  • For SQL Server, a mismatched non-text column can now be widened to text when the action creates or re-creates the table, so the export can continue.