Release Date: November 15th 2026

These Release Notes contain new features and enhancements added in version 10.0.2

Axonius AI

Memory Management Available by Default

Memory Management is now enabled by default. Users with the Manage organizational AI memory permission (Admin and Owner by default) can open Memory Management from the Agent settings menu in the AI Agent sidebar footer. From there, they can view, add, edit, and delete the organizational memories the AI Agent uses in every conversation.

• Add memories from a document - In the Add Organizational Context drawer, select Upload a document and upload one PDF, CSV, or TXT file at a time of up to 10 MB. Axonius extracts up to 25 memories from the file and then discards it. The Memories table has new Type (Doc or Free Text) and Source columns, and memory details show the source document.
• Delete multiple memories at once - Select up to 200 rows in the Memories table using the checkboxes, then click Delete memories in the selection bar. Each deletion is recorded in the Activity Log.

Find Duplicate Devices in Agent Coverage Gaps

You can now see which devices missing a security agent are likely uncorrelated duplicates of devices that already have it. When you ask the AI Agent about security agent coverage gaps, it compares hostname, asset name, MAC address, serial number, and IP address, and splits the gap into “likely the same device”, “weak match”, and “no match”, with a count and percentage for each.

Duplicate Devices in Coverage Check Results

You can now see how many unmanaged devices are likely the same as a managed device in the Coverage Check briefing, including its notification and email. For example: “Likely the same device: 6 of 18 match a managed device; weak match 3, no match 9”.

Cyber Assets New Features and Enhancements

Change Priority Action Removed from Business Context

The Change Priority row action was removed from the Business Context rule tables because it duplicated Edit. To change a rule's priority, click Edit and update the Priority field.

Exposures New Features and Enhancements

The following new features and enhancements were added to Exposures:

• Security Findings Last Updated: Added a sortable Last Updated date and time column for Security Findings, available in the Security Findings table and asset profile, that shows when a finding's data last changed.

• Vulnerabilities Settings: Removed the Don't split source vulnerabilities into CVEs system setting from Vulnerabilities Settings. Use the Security Findings: CVE and vendor IDs setting on each adapter to control this.

• Risk Score Settings: If the settings can't load, the Risk Score Settings page now shows an error in place of the settings and the Save button, so default values can't be saved over your saved settings. If a Risk Score run can't read the settings, the run now stops before it writes a score.

• Recommended Actions - New Create Ticket Permission: Creating a ticket from a recommended action now requires the Security Findings: View security findings permission. Users without it no longer see Create Ticket in the Action Drawer. To let a role keep creating tickets from Recommended Actions, add this permission to it. See Creating Tickets from Recommended Actions.

• Axonius Remediation Time Adjustment: The Axonius Remediation Time field no longer shows on Security Findings that are not Closed, including when one source of the finding reported it closed.

• Security Finding Rules Fields: The Security Finding Rule Name and Resolved Status (Open/Closed) fields now stay available in Aggregated Security Findings and the Vulnerability Repository after a discovery cycle, while a Security Finding Rule is active or has found assets.

Risk Score - Results Preview Enhancements

• The Results Preview now applies the data scope of the user to the compensating controls, to fields that the data scope hides in part, and to the Security Findings query. See Previewing the Risk Score.
• For a query with a Refine Data on a Security Findings column, the Results Preview now shows Preview Failed if your role doesn't have the Security Findings: View security findings permission.
• When you clear the query, the Results Preview no longer shows the asset of the previous query.
• Improved the data scope checks of the Risk Score Results Preview.

Axonius Platform New Features and Enhancements

Dashboard

The following new features and enhancements were added to the Dashboards:

Dashboard Management Enhancements

Change Access for Multiple Dashboards

It is now possible to change Access for multiple dashboards in one go.

Chart Queries Follow the Dashboard's Shared Data Scopes

When you share a dashboard with selected data scopes, or add data scopes to a shared dashboard, the saved queries used by its charts and filters are now shared with those data scopes instead of with all data scopes. Queries keep any data scopes they already have. If some queries can’t be shared, the dashboard is still saved and a message tells you how many weren’t shared.

Share a Dashboard with Users in Its Data Scopes

On a shared dashboard that has data scopes, the access list now shows the users of those data scopes, so you can give each user No Access or Viewer access.

Chart Enhancements

Percent Format for Fields on a 0-10 Scale

For an Average or Median measure in a pivot chart, Format > Percent now offers Values 0-10 in addition to the existing option. With Values 0-10, an average risk score of 4.5 shows as 45%. Saved charts don't change.

Smaller Text Charts

You can now resize a Text chart down to two grid columns, instead of four.

Timeline Date Ranges That End in the Future

The absolute date range of a Timeline chart can now end after today. The chart shows data up to today.

Assets Pages

The following features were added to all assets pages:

Show Asset Profile Dashboards Only on Matching Assets

When you create or edit an asset profile dashboard, a new Dashboard visibility field lets you choose a saved query, conditions, or both. The dashboard then appears on the asset page's Dashboards tab only for assets that match the query. Dashboards without a query still appear on every asset.

Edit Table Cells in Place

Clicking the edit icon on an editable cell now opens the editor inside the cell instead of in a separate window. Each value type has its own editor, such as text, number, date, true/false, or a list. Press Enter or click outside the cell to save, and press Esc to discard. Fields with Required When or Read-only When rules still open in the edit window. Note that you have to be in Live Data mode in order to edit a field.

Export an Asset Dashboard as an Image

On an asset profile's Dashboards tab, use Export > Image to save the dashboard as a PNG file named after the asset and the dashboard.

Edit Columns Enhancements - Complex Fields

• In Edit Table > Edit Columns, the Available Columns list now shows the remaining sub-fields of a displayed complex field under a gray parent row, the same as the Displayed Columns list.
• Selecting or clearing a complex field now affects only that field, so you can add a complex field with only some of its sub-fields. The list shows how many of its sub-fields are selected, for example 2 of 5. To select a complex field with all of its sub-fields, search for it and click Select All.

Devices Page

Preferred Deployment Type is now available as a visible preferred field to use for Devices query, dashboards, etc.

Query Wizard

Values Kept When You Change the Operator or Field

Previously, when you changed the operator or the field in a Query Wizard condition, the value you entered was automatically cleared - even when the existing value remained perfectly valid for the new selection. Now, when you change the operator or the field, the value is kept if it still fits. For example, changing "equals 10.0.0.1" to "contains" keeps the same IP address. When you switch to a list operator, a single value becomes a one-item list, and when you switch from a list to a single-value operator, the first item is kept. The value is cleared only when the new operator takes no value or needs a different kind of input.

Archive Unused Predefined Queries

Admins can now move unused predefined queries to the Archive folder with Move to Folder, and restore them to the Predefined Queries folder later. A query that's still in use can't be archived, and a message shows what uses it. Archived predefined queries stay archived after a restart or an upgrade.

Share Public Queries with Selected Data Scopes

Change Access can now share a Public query with all data scopes or only with the data scopes you select.

Reports

Two reports with the same name can no longer be created at the same time.

Action Center

The following new features and enhancements were added to the Action Center:

Enforcement Sets

Risk Score Actions Follow the Manage Risk Scores Permission

• In the Enforcements table, users whose roles don't have the Manage Risk Scores permission have the following Risk Scores actions disabled: Create, Duplicate, Change Run Priority, Delete, and scheduling actions. These actions appear disabled in both the row menu and the bulk actions. On the Risk Score Settings page, the Risk Level fields are read-only for these users.
• To view a Risk Score or to run a saved Risk Score, the permission is not necessary.
• An Enforcement Set or a Workflow without the "Axonius - Calculate Risk Score" action does not need the permission.
• Every change to a Risk Score on any page (the main Risk Score page and any other pages using Risk Scores) now needs the Manage Risk Scores permission AND the usual Action Center permission for the change. For example, to edit a Risk Score, you need the "Edit" and "Manage Risk Scores" permissions.

Create Tickets Enhancements

• For Jira, the ticket content field in the Create Ticket drawer and wizard is now called Summary instead of Title. ServiceNow keeps Short Description.
• After you create tickets, the Creating N tickets window now has an Open Tickets link to the Tickets page.

Workflows

Jira Tickets Start the Jira Ticket Workflows

Jira tickets that an Axonius Enforcement Center action creates now start the Jira ticket workflows at once, and multi-day gaps between fetches no longer miss ticket changes.

Recommended Actions

Enforce Option Added to the Recommended Action Drawer

The Recommended Action drawer header now has an Enforce option next to Create Ticket. It offers Create Enforcement and Use Existing Enforcement, and both run on all the Security Findings of the action, without the need to exit the drawer.

Adapter Pages and Adapter Interface

The following updates were made to the common functionality across all adapters:

Adapter Interface

Delete Data from Removed Connections

On an adapter profile page, admins with access to all data can use the Delete Data button in More > Assets from Removed Connections to delete the data that the adapter fetched through connections that were removed, and keep the data from other adapters on each asset. The count in this window no longer includes connections that were edited or moved between nodes. When you delete a connection together with its entities, data that another connection took over is kept. Each deletion is recorded in the Activity Log.

Adapter Custom Parsing

• Added the Where it comes from section to Advanced Options, which shows the rule's Raw Path as the first path and lets you add fallback or conditional paths that are evaluated in order, using the first non-empty value.
• Added the option to select When parsed field or When raw data for each conditional path, with a field picker in When Field for choosing an available parsed field. New conditional paths default to When parsed field, and existing conditional paths continue to read raw data.
• Added the View raw data option, which shows a sample raw record for the adapter. Drag a key to enter its path or drag a value to use that value.

Activity Log

See What Changed in a Saved Query

The Activity Log entry for an edited saved query now lists which parts of the query changed.

Dashboard Access Logged

When Log read activity is enabled, the Activity Log now records when a user opens a dashboard, including the dashboard name and ID. Each user's access to a dashboard is recorded at most once every 30 minutes.

Adapter Names in logs

The Activity Logs entry for a connection label rename in saved queries now shows the adapter title, not the internal adapter name.

Device Name in Device View Entries

The Activity Log entry for viewing a device now includes the device name together with its ID.

Run Saved Query Activity Log Entry

When an admin enables Add activity logs for access (read) activity in Activity Logs Settings, the Activity Logs page shows a Run Saved Query entry each time a user runs a saved query in the Axonius application. The page records only runs that a person starts, not runs by API keys, AI agents, dashboard charts, reports, enforcements, or alerts. It shows one entry when the same user runs the same saved query more than once in 30 minutes.

Asset Names in View Entries

When an admin enables Add activity logs for access (read) activity in Activity Logs Settings, the View entries in the Activity Logs page include the asset name for each asset type, for example Viewed users with id 1a2b3c, name ‘john.smith’. The entries show only the ID when an asset has no name.

Saving Risk Score Settings Added

Saving the Risk Score Settings is now recorded in the Activity Logs as Risk Score Settings Updated.

System Settings

The following updates were made to various System settings:

Manage Risk Scores Permission

A new Manage Risk Scores permission in the Action Center category of the role editor controls who can create, edit, duplicate, import, delete, activate, schedule, and run Risk Scores, and who can change Risk Levels in Risk Score Settings. Roles that already had Action Center add, edit, delete, or duplicate permissions get it automatically, including Admin and Owner. Users without it don't see Add Risk Score, and the Risk Score actions are disabled for them.

Send Query History Events to Syslog and HTTPS Logs

A new Send query history events option in Syslog Settings and HTTPS Logs Settings sends one event for each query run. Each event includes the user, start and end time, duration, status, source (UI, API, enforcement, or chart), the saved query name, the query text, and the data scope. The option is off by default.

At Least One Active Admin Always Remains

Axonius now prevents any delete, deactivation, or role change that would leave the system with no active user who has the Admin role. This applies on the Users page and through SCIM. Service accounts, Axonius accounts, and Admins with a data scope don't count as active Admins.

New Minimum for Password Brute Force Protection

In Password Brute Force Settings, the minimum value of Maximum attempts is now 3.

Easier to Read Identity Provider Settings

In the SAML Identity Providers settings, each provider section now shows its provider name as the title. When you have two or more providers, the sections are collapsed, and only a section with an error opens when you save.

Reserved User and Service Account Names

The names "admin" and "ai_workforce" are now reserved and can't be used for new users or service accounts, in any combination of uppercase and lowercase letters. You also can't rename a service account to one of these names. Existing accounts with these names keep them.

CVE Export Enhancements

A new Remove "Aggregated" prefix from field names setting removes the "Aggregated: " prefix from the column titles of aggregated fields in CSV exports, for example Host Name instead of Aggregated: Host Name. The setting is off by default and applies to all exports. Only the header row changes.

---

Adapter and Enforcement Action Updates

New Adapters

The following new adapters were added:

• Constellix DNS - Constellix DNS is a managed authoritative DNS service that provides domain hosting, DNS record management, traffic routing, and monitoring through an API. (Fetches: URLs)
• CrowdStrike Falcon LogScale - CrowdStrike Falcon LogScale is a log management and observability platform that provides high-performance streaming ingestion, indexing, and search of machine-generated log data. (Fetches: Devices, Users, Software, SaaS Applications)
• Cycode - Cycode is an application security posture management platform that provides static code analysis, secret detection, dependency scanning, CI/CD pipeline protection, and risk-based vulnerability prioritization across the software development lifecycle. (Fetches: SaaS Applications, Application Resources, Users, Aggregated Security Findings)
• ISS Cyber Risk Score - ISS Cyber Risk Score is a security ratings platform that provides external attack surface observations, domain-level findings, network attribution data, and vendor risk assessment scoring. (Fetches: URLs, Aggregated Security Findings, SaaS Applications)
• MISP - MISP is an open source threat intelligence platform that collects, stores, correlates, analyzes, and shares structured indicators and cybersecurity intelligence. The adapter fetches MISP users and enriches CVEs with the published MISP events that reference them. (Fetches: Users, SaaS Applications, Aggregated Security Findings)
• Salesforce Marketing Cloud - Salesforce Marketing Cloud is a digital marketing platform that provides email, mobile, social, and advertising automation, journey management, audience segmentation, and campaign analytics. (Fetches: Activities)

Updated Adapters

The following adapters were updated:

• Amazon Web Services (AWS)
  • Organized the existing connection settings into Authentication, Scope, and Connection Identity sections in the connection form. No settings were added, removed, or changed, and existing connections continue to work.
  • Added the Fetch EKS Fargate Profiles advanced setting, available under Fetch EKS, to fetch EKS Fargate profiles as Compute Services assets.
  • Added the Enrich KMS with metadata option under KMS Settings. When you enable it together with Enrich assets with KMS information, the adapter retrieves KMS key metadata and fetches KMS Keys as Secret assets. Existing KMS enrichment settings are retained automatically.
  • Added the KMS Key ID field for Amazon DynamoDB tables, AWS Lambda functions, S3 buckets, and Secrets Manager secrets when the adapter can resolve the associated KMS key.
  • Added the Fetch Redshift parameter groups (require_ssl) option under Redshift Settings. When enabled, the adapter retrieves the require_ssl value from in-sync Redshift cluster parameter groups and uses it to populate the Transit Encryption Enabled field. The existing Fetch Redshift setting is now part of Redshift Settings, and its value is retained automatically.
  • Added a Listeners field to AWS load balancer assets, showing each listener’s ingress endpoints, egress endpoints, protocol, and actions. This is relevant to Classic Load Balancers and Elastic Load Balancing version 2. This setting requires the Fetch information about ELB advanced setting.
  • The adapter now extracts the IAM roles that users and roles can assume serially instead of using distributed data processing.
• Atera - Added the JWT Token connection setting to support bearer token authentication. The API Key setting is now optional, and when both settings are configured, the adapter uses the JWT Token. Existing connections that use an API Key continue to work.
• Axonius Users - Added the Fetch Application Settings advanced setting (disabled by default).
• Black Duck Continuous Dynamic (NTT Application Security) - The adapter now fetches site records whose hostname is a valid URL as Domains & URLs assets. Site records with plain hostnames continue to be fetched as Devices.
• BMC Helix ITSM
  • Added support for OAuth 2.0 (RSSO) authentication, in addition to Username / Password authentication.
  • Added the Grant Type setting, which lets you choose Client Credentials or Password as the OAuth 2.0 grant used by the RSSO server.
  • The Username and Password fields are no longer required for every connection. They are required only for the authentication method or grant type that uses them. Existing connections continue to use Username / Password authentication.
• Broadcom Layer7 API Gateway
  • Added the Connection Type setting, which lets you connect to a single gateway or use Kubernetes Cluster Discovery to automatically discover gateways in a Kubernetes cluster and fetch their services and users. Existing connections are automatically set to the Single Gateway connection type, and their Host Name or IP Address value is retained.
• Cisco
  • Added support for bulk connections that fetch multiple switches from a Hosts CSV File that uses the same protocol and credentials.
  • Added the Hosts CSV File - number of hosts to fetch in parallel advanced setting, which controls how many hosts are fetched at the same time for a bulk connection.
• Cisco Application Policy Infrastructure Controller (APIC) - Added the Fetch contracts between EPGs as Firewall rules advanced setting (default: false), which collects permit contracts between endpoint groups (EPGs) as Firewall assets.
• Citrix ADC
  • Added the Fetch GSLB Domains as URLs advanced setting (default: disabled), which fetches domains bound to each GSLB virtual server as URL assets.
  • Added the Add Forward Actions to Load Balancer Listeners advanced setting (default: disabled), which adds a Forward listener action for each service group and service bound to a virtual server.
• Cloudflare DNS
  • Added support for fetching account-level DNS settings as Application Settings assets. These settings are collected only when an Account ID is configured on the connection.
  • Custom Firewall Rules are now mapped to Network/Firewall Rules on Devices.
• Commvault - Added the "Fetch backup times from Job History for clients without VM backup status" advanced setting, which is disabled by default. When you enable it, the adapter retrieves backup start and end times from the latest completed Backup job in the 30-day Job History for clients that do not provide them in their VM backup status.
• Cribl - Added the Fetch Application Settings advanced setting (disabled by default).
• Crowdstrike Adaptive Shield - Added the Fetch activity from the last X days advanced setting to control how many days of Activity Monitor data the adapter fetches.
• CrowdStrike Falcon
  • Organized the existing connection settings into Environment Target, Authentication, and Scope sections in the connection form. Existing connections continue to work.
  • Added the Fetch local privileged group members via Real Time Response advanced setting (default: disabled). When enabled, the adapter runs a read-only Real Time Response script that retrieves the members of the built-in Administrators group on online Windows devices and the sudo and wheel groups on online Linux devices. Offline devices do not return this data, and enabling the setting can increase fetch duration.
  • Added the RTR command timeout (seconds) advanced setting (default: 60) to set the maximum time to wait for the Real Time Response command to complete.
  • The Device Policies field now keeps only the policy assignment of each device. Use the Prevention Policy, Sensor Update Policy and Firewall Policy fields for the policy details. After the next fetch, the Data sub-fields of Device Policies have no value, so queries and Enforcement Sets that use them don't match devices.
• Datto RMM (Autotask Endpoint Management) - Added the optional Site ID advanced setting. Enter a Datto RMM site ID to fetch devices from that site only, or leave the setting empty to fetch devices from the whole account.
• Delinea Secret Server
  • Added support for OAuth2 client-credentials authentication with a Delinea Platform Service User.
  • Added the Parse secrets as Users only for these secret templates advanced setting. When Parse secrets (with username values) as Users is enabled, enter the Secret Server secret template names to parse only secrets from those templates as Users.
• FleetDM
  • Added the Fetch Device Labels advanced setting to fetch device labels and add them to device data.
  • Added the Fetch Device Policies advanced setting to fetch device policies and add their details to device data.
  • Added the Fetch Users advanced setting to fetch host users and add the username and shell information to device user data.
  • Added the Fetch End Users advanced setting to fetch end-user details and add them to device data.
  • Added the Hosts Page Size advanced setting to set the number of hosts requested per page (1–500).
• Frontline VM - Added support for Fortra VM through the new Account ID connection setting.
• GitHub - Added the Fetch repository workflows advanced setting (default: disabled), which adds the GitHub Actions workflows of each repository to its Workflows data.
• Google Cloud Platform (GCP)
  • Grouped the connection settings into sections. The JSON Key pair for the service account setting is now in the Authentication section, and the Projects Include Filter (GCP Format) setting is now in the Scope section.
  • Added the Fetch Google Firebase Hosting Sites advanced setting to fetch Google Firebase Hosting sites as Compute Services assets.
  • Added the Fetch Firebase Hosting Custom Domains advanced setting to include custom domain details for each fetched Firebase Hosting site.
  • Added the Fetch Firebase Hosting Live Channel advanced setting to include live channel release details for each fetched Firebase Hosting site.
  • Added the option to fetch IAM service accounts as User assets, along with their user-managed service account keys as Secret assets.
• Google Workspace (G Suite) - Organized the connection settings into Authentication and Environment Target sections to make related fields easier to find. Existing connections and setting values are not affected.
• Imperva WAF
  • Added the Fetch threat profiles (signature policies and their CVEs) for web application rules advanced setting (default: false), which adds threat profiles, including policy names, CVEs, and enabled, block, and alarm states, to Firewall assets.
  • Added the Maximum signature detail requests per fetch cycle (threat profiles) advanced setting (default: 5000), which limits the number of signature-detail requests the adapter makes during a fetch cycle.
• Intel 471 Enrichment
  • Updated the adapter to retrieve vulnerability reports from the Intel 471 Verity report stream.
  • Replaced the Email Address and API Key connection settings with User Name and Password. Update existing connections with your Intel 471 Verity credentials, and keep the existing Domain and Verify SSL values.
• Ivanti Neurons for ITSM - Added the Enable Custom Parsing advanced setting, which lets you parse additional fields from the raw data into device assets.
• Jamf Pro - Renamed the Is Managed field to Remote Management: Managed so that it is easier to find in the Available Columns panel.
• Jira Service Management (Service Desk) Fetch Tickets
  • Ticket synchronization now reports newly created tickets and updated tickets as separate events, and evaluates the complete time interval since the last run.
  • The JQL advanced setting now also limits ticket synchronization events to tickets that match the query, in addition to overriding the ticket fetch query.
• Let's Encrypt - This adapter is deprectated.
• Microsoft Active Directory (AD)
  • Organized the existing connection settings into Target, Authentication, and Scope sections in the connection form. Existing connections continue to work.
  • Added the Parse Printer portName as IP Address advanced setting, which parses the portName attribute of printer objects as the printer device IP address.
• Microsoft Azure
  • Added support for fetching additional Azure resources. These resources appear in Axonius as Compute Services, Application Services, or Databases.
  • Container App replicas and containers are fetched as Compute Services.
  • Cosmos DB SQL and MongoDB databases are fetched as Databases.
  • Database for PostgreSQL and Database for MySQL Flexible Server databases are fetched as Databases.
  • Kusto clusters and databases are fetched as Databases.
  • SQL Managed Instance databases are fetched as Databases.
  • Redis Enterprise clusters and databases are fetched as Application Services.
• Microsoft Defender for Endpoint (Microsoft Defender ATP)
  • Grouped the connection settings into sections. The client-credentials authentication selection is now in the Authentication section, and the domain selection and Tenant ID settings are now in the Environment and Target section.
  • Added regional commercial API hosts to the Source Host Name connection setting.
  • Added the Fetch software last seen timestamp advanced setting, which adds the Last Seen timestamp to installed software on devices.
• Microsoft Endpoint Configuration Manager (MECM) (formerly SCCM)
  • Grouped the connection settings into sections. The MECM/MSSQL Server, Port, and Database settings are now in the Environment Target section, and the Authentication Method and Use SSL settings are now in the Authentication section.
  • Added the Set asset type by Distinguished Name advanced setting, which lets you fetch device records whose Distinguished Name matches a regular expression as Compute Services instead of Devices.
  • Added the Last Seen source field advanced setting, which lets you choose which SCCM client-summary timestamp supplies a device's Last Seen date when an SCCM client is installed.
• Microsoft Entra ID (formerly Azure Active Directory) and Microsoft Intune
  • Organized the connection settings into Authentication and Environment Target sections to make related fields easier to find. Existing connections and setting values are not affected.
  • Added the Settings Catalog (configuration policies) name filter - prefix or exact name advanced setting (default: empty), which limits the Settings Catalog policies that the adapter fetches and reports on to those whose names start with the values you specify.
• Nautobot - Added the option to fetch devices by running saved GraphQL queries.You can also adjust the Saved GraphQL Queries Page Size in the advanced settings.
• Notion - Added a default value of https://api.notion.com for the Host Name or IP Address connection setting.
• Okta
  • Organized the existing connection settings into Environment Target, Authentication, and Scope sections in the connection form. Existing connections continue to work.
  • Okta is now classified as an agent source for Agent Coverage, and Okta Verify device records contribute to Agent Coverage automatically. Only Okta device records count - Okta users and accounts never count as agents.
• OneTrust
  • Added support for fetching Business Applications from asset inventories.
  • Added the Enable Custom Parsing advanced setting, which lets you define how to parse specific fields from the fetched raw data into an existing field or a new field. For more information, see Adapter Custom Parsing.
• Oracle Cloud
  • Added the Enable Functions Fetch advanced setting (default: disabled) to fetch Oracle Cloud Functions as Serverless Functions assets.
  • Added the Enable Integration Instances Fetch advanced setting (default: disabled) to fetch Oracle Integration instances as Application Services assets.
  • Added the Enable Visual Builder Studio Instances Fetch advanced setting (default: disabled) to fetch Oracle Visual Builder Studio instances as Application Services assets.
  • Added the Enable Service Connectors Fetch advanced setting (default: disabled) to fetch Oracle Service Connectors as Application Services assets.
  • Added the Enable Streams Fetch advanced setting (default: disabled) to fetch Oracle Streams as Application Services assets.
  • Added the Enable Events Rules Fetch advanced setting (default: disabled) to fetch Oracle Events Rules as Application Services assets.
• Palo Alto Networks Prisma Access - Added the Fetch Application Settings advanced setting (default: disabled), which fetches Application Settings assets.
• PowerDNS - Added the Zone Records Endpoint advanced setting (default: disabled) under Endpoints Config, which fetches enabled A, AAAA, and CNAME zone records as URL assets.
• Red Hat OpenShift Container
  • Added the Fetch Namespaces advanced setting to fetch Namespaces as Organizational Units assets.
  • Added the Fetch Services advanced setting to fetch Services as Network Services assets.
  • Added the Fetch Service Accounts advanced setting to fetch Service Accounts as Users assets.
• Rockwell FactoryTalk AssetCentre
  • Added the Fetch unrecognized bus devices advanced setting (default: disabled) to create a Devices asset for each bus entry that has an IP address but no chassis.
• Salesforce - Added the Fetch per-user OAuth app grants advanced setting to fetch the OAuth tokens that users granted to connected apps.
• SentinelOne - Disabled Deep Visibility enrichment during device retrieval. The Deep Visibility Enrichment Settings advanced setting is now hidden, and the adapter no longer processes Deep Visibility enrichment events.
• Sepio - The adapter now fetches Users assets in addition to Devices, including username, email, phone, and blocked-until information when supplied by Sepio Prime.
• ServiceNow
  • Added the Add sys_id of reference fields option to the advanced options of each Table Schema Mapping entry.
  • Removed the "Use 'cmdb_ci' table instead of 'alm_asset' table for install status and location" advanced setting. The adapter now uses the cmdb_ci install status and location by default. Configurations that previously disabled the setting are automatically updated with Device custom parsing rules that retain the alm_asset values, and existing Device custom parsing rows are kept.
  • Device install status include and exclude filters now match the cmdb_ci install status, so review any configured values. The retired-device time filter now evaluates the install status after Device custom parsing is applied.
  • Removed the "Save only virtual devices" advanced setting. If the setting was enabled, it is automatically replaced with the ingestion rule device.is_virtual != "False", applied at the same configuration scope.
  • Removed the advanced settings Populate the Device Company field with z_support_group_manager_company, Populate the Device Owner based on assigned_to parsed field, and Use "VM Object ID" as "AWS Cloud ID". For each setting that was enabled, equivalent Device Custom Parsing rows are created automatically, so no action is required.
  • Replaced the Exclude disposed and decommissioned devices advanced setting with a device ingestion rule that excludes devices whose Install Status is Disposed or Decommissioned. Existing configurations where the setting was enabled are updated automatically, and devices continue to be excluded.
• SharePoint
  • Added the Fetch OneDrive usage details for personal sites advanced setting (default: disabled) to enrich personal sites with OneDrive usage details. This setting takes effect only when site-usage reporting is enabled. If Microsoft 365 conceals user details in usage reports, Axonius cannot match the report row to a personal site, and that site remains without usage details. This setting requires the Microsoft Graph application permission Reports.Read.All.
• Slack - Grouped the connection settings into sections. The Host Name or IP Address, Account Sub Domain, and Enterprise Grid Organization settings are now in the Environment Target section, and the Authentication Token, Username, Password, and MFA Secret settings are now in the Authentication section.
• SNMP - Added the Fetch LLDP neighbors advanced setting (default: disabled) to collect LLDP neighbor data for each device through LLDP-MIB.
• SQL Server - Added the Aggregate accounts by key (SQL column name), Aggregate business applications by key (SQL column name), and Aggregate URLs by key (SQL column name) advanced settings.
• Symantec DLP - Added support for an encrypted TCPS connection to the Oracle database.
• Tenable Vulnerability Management
  • Added the Parse plugin CPE into every CVE of a plugin with multiple CVEs advanced setting to add the plugin CPE, CPE vendor and product, software name, version, and vendor to the Security Finding for each CVE reported by a multi-CVE plugin.
  • Added the Fetch accepted vulnerabilities regardless of severity levels advanced setting (default: disabled). Select this option to include vulnerabilities whose risk was accepted in Tenable even when their severity is outside the levels selected in Fetch vulnerabilities with these severity levels.
• Tenable.sc (SecurityCenter)
  • Replaced the Fetch Local Linux Users from Plugin 95928 (Linux User Information) advanced setting with Fetch Local Users from Tenable Plugins, which supports Linux, macOS, and Windows local-user plugins. Existing configurations that used the previous setting are converted automatically.
  • Added the Do not create User assets from Fetch Local Users advanced setting, which writes accounts from the selected plugins to the device Users table instead of creating User assets.
  • Added the Prefix strictly local users with the hostname and Prefix local domain users with the domain advanced settings, which format Windows account names as HOSTNAME\user or DOMAIN\user.
• TOPdesk Enterprise Service Management - Added the Additional TopDesk asset fields to fetch advanced setting, which lets you request tenant-specific TOPdesk Asset Management fields, such as those in a Laptop asset template, and view their values on device assets.
• Viptela (Cisco) SD-WAN
  • Added the Fetch zone-based firewall and ACL policy definitions as firewall rules advanced setting (default: disabled), which collects each zone-based firewall and ACL policy sequence as a Firewall asset.
  • Added the Fetch static NAT entries of Cisco VPN feature templates as NAT rules advanced setting (default: disabled), which collects static NAT and subnet-static NAT entries from Cisco VPN feature templates as Firewall assets.
• VMWare ESXi and vSphere - Organized the existing connection settings into Environment Target and Authentication sections in the connection form. Existing connections continue to work.
• watchTowr - Added the Fetch Geo Only IP Addresses as Devices advanced setting (default: disabled), which also fetches IP addresses that contain only location data as Devices.
• Wazuh - Added the Browser Extensions option to the Include agent extra items advanced setting to fetch browser extension details for devices and record each browser extension as installed software.
• Wiz
  • Organized the existing connection settings into Environment Target, Authentication, and Scope sections in the connection form. Existing connections continue to work.
  • DaemonSet and Kubernetes CronJob assets are now fetched as Compute Services with the asset types Wiz Kubernetes DaemonSet and Wiz Kubernetes CronJob.
  • Added the Enrich assets with Kubernetes Jobs advanced setting (default: disabled), which adds Kubernetes Job details to the Kubernetes CronJob Compute Services they belong to.
  • Removed Kubernetes Job from the asset types you can select. Existing connections that had Kubernetes Job selected now have Enrich assets with Kubernetes Jobs enabled.
  • Added support for fetching cloud configuration findings as Aggregated Security Findings.
  • Removed the Do not fetch devices where Power State is TurnedOff advanced setting. Existing configurations where the setting was enabled are updated automatically with an ingestion rule that excludes devices whose power state is TurnedOff.
  • Load Balancer assets now include the Authorization Endpoints field, which lists the OIDC authorization endpoints used by the listeners of AWS Application Load Balancers.
• XCP-ng
  • Added the VM Network Interfaces advanced setting (default: disabled) to retrieve VM network interfaces and add their MAC address data to the associated VM.
  • Added the Hosts advanced setting (default: disabled) to retrieve host records as Devices.
  • Added the Host Network Interfaces advanced setting (default: disabled) to retrieve host network interfaces and add their network details to the associated host.

New Enforcement Actions

The following Enforcement Actions were added:

• Axonius - Enrich Geolocation and ASN by IP - Enriches Devices, Load Balancers, and Compute Services with geolocation and autonomous system number (ASN) data for public IP addresses, using the DB-IP dataset in the Axonius data enrichment database.
• CrowdStrike Falcon - Add Network to Network Scanner - Creates CrowdStrike Falcon network scan networks from configured CIDR ranges or from the private IPv4 addresses of selected assets, assigns them to a zone, and assigns scanners manually or by zone. Subnets that already exist in CrowdStrike Falcon are skipped.
• EasyVista Service Manager - Create or Update Assets - Creates new EasyVista assets, updates EasyVista assets already fetched by the EasyVista Service Manager adapter, or does both.
• Microsoft Intune - Wipe Managed Device - Sends a wipe request for selected Microsoft Intune managed devices, with options to retain enrollment data or user data.
• Odoo - Close Ticket - Changes an Odoo Helpdesk ticket to the configured closed stage.
• Odoo - Open Ticket - Creates an Odoo Helpdesk ticket for the assets returned by the selected query or the assets selected on the relevant asset page.
• SNMP - Enrich Asset Data - Polls selected device IP addresses through SNMP and adds the collected SNMP data to the matching Axonius device.
• ThreatLocker - Remove Duplicate Computers - Asks ThreatLocker to remove computer records that it identifies as duplicates for the managed organization.

Updated Enforcement Actions

The following Enforcement Actions were updated:

• BMC Helix ITSM - Create Ticket - Added support for OAuth 2.0 (RSSO) authentication.
• Create User - SAP Concur - The optional sections (Add Phone Numbers, Enable Enterprise User, Add Approvers, Enable Spend User, and Add Travel User) are now disabled by default, and their enable toggles are no longer required. When creating a new action configuration, enable each optional section you need and complete its required fields. Disabled sections do not add their optional data to the request.
• Efecte - Create Incident
  • Added the Support Group parameter to set the support group on the incident.
  • Added the Custom Fields (JSON Format) parameter to provide additional Efecte attribute codes and values.
  • Added the Attachment Attribute Code parameter to attach a CSV file of the query results to the incident.
• Halo - Create or Update Device - Added the optional Halo User ID parameter.
• Illumio Update Workload - Added the optional Labels to merge (KEY=VALUE) parameter, which updates or adds the specified labels on a workload without replacing its other existing labels.
• Jira Service Management - Create Insight Asset per Asset and Jira Service Management - Update Insight Asset now update existing assets on on-prem connections that use a personal access token.
• ServiceNow - Create Assets
  • Added support for processing batches of source assets through one selected ServiceNow adapter connection. Each source asset, and each record created by asset splitting, returns its own success or failure result.
  • Bulk insert remains available when its configuration is enabled, and it replaces the removed bulk create route. Do not combine bulk insert with IRE reconciliation or related assets.
  • Added the ServiceNow fields to use for the existing asset check parameter. When Skip asset creation if the asset already exists in ServiceNow is enabled, select the mapped ServiceNow fields that must match an existing record.
• ServiceNow - Manage Assets with Scripted REST API
  • Added support for processing batches of source assets through one selected ServiceNow adapter connection. Each source asset, and each record created by asset splitting, returns its own success or failure result.
  • Mapped records can now be sent as an array when the batch request configuration is enabled, which replaces the removed bulk route. Do not combine this mode with IRE reconciliation or related assets.
• ServiceNow - Update Assets - Added support for processing batches of source assets through one selected ServiceNow adapter connection. Each source asset, and each record created by asset splitting, returns its own success or failure result.
• Snyk - Create Jira Issue - Now works with trigger queries that have a data refinement, and it runs on the Snyk adapter.

Fixed Bugs

Authentication & Connectivity

• Adapter Connections - Fixed an issue where an adapter connection continued to show "Successfully connected" after its fetch was skipped because the gateway it routes through was disconnected and no backup gateway was available. These connections now show an error status with the reason for the skipped fetch.
• Airlock Digital - Fixed an issue where testing a connection failed when proxy credentials were saved without a proxy address. The adapter now ignores those credentials and connects directly.
• Check Point Harmony Email & Collaboration (Avanan) - Added support for authenticating with a Check Point Infinity Portal API key through the new Use Check Point Infinity Portal API connection setting.
• Check Point Harmony Endpoint - Fixed an issue where the adapter stopped retrieving data because the Check Point gateway rejected its GET requests. The adapter no longer sends a Content-Type header with GET requests.
• Custom Files - Fixed an issue that prevented the adapter's connections from loading on the adapter page and caused an error when editing existing connections.
• Google Security Operations SIEM REST
  • Fixed an issue where connecting with a PEM private key pasted with escaped newlines failed. The adapter now reads the key correctly, and displays a clear credential error if the key cannot be parsed.
  • Fixed an issue where connecting with a base URL that includes a tenant path failed.
• Ironclad Contract Lifecycle Management - Fixed an issue where the adapter received a 403 Forbidden error because its OAuth token did not include the public.records.readRecords scope. The adapter now requests a dedicated token with this scope for the records endpoint.
• Jira Service Management - Create Insight Asset per Asset - Fixed an issue where the action failed with a "No user name or password" error when it updated an existing Insight asset on an on-premises Jira Service Management connection that uses a Personal Access Token. The action now uses the authentication method configured on the connection. Connections that use Basic authentication continue to use Basic authentication.
• Men&Mice DNS Management - Fixed an issue where the adapter could not connect when Use Session Authentication was enabled.
• Microsoft Azure - Fixed an issue where Azure Resource Graph, Azure Resource Manager batch, and Log Analytics requests used public-cloud URLs instead of the endpoints for the selected Azure cloud, which caused authentication failures in sovereign clouds.
• Microsoft Azure DevOps - Create Task - Fixed an issue where the action did not use the selected stored connection when no inline credentials were provided. CSV attachments now authenticate with the configured Azure DevOps authentication method, and missing connection parameters return a clear error.
• Microsoft Hyper-V (PSRemote) - Fixed an issue where the connection test reported success even when the credentials were invalid. The connection test now fails when WinRM rejects the configured credentials.
• Palo Alto Networks Cortex Cloud - Fixed an issue that caused the connection test to fail with an HTTP 400 error.
• Palo Alto Networks Prisma Access Insights - Fixed an issue where the PANW region connection setting could cause connection failures.
• PingOne Advanced Identity Cloud - Fixed an authentication issue. The adapter now authenticates by using the OAuth 2.0 client credentials grant and requests the fr:idm:* scope before it retrieves users. Update the OAuth 2.0 client in PingOne Advanced Identity Cloud to allow the client_credentials grant and the fr:idm:* scope, and update the connection's Client ID and Client Secret if you create a new OAuth 2.0 client.
• Sectigo - Fixed an issue that caused fetches to fail after Sectigo discontinued the version 1 persons API. The adapter now uses the version 2 persons API to fetch users.
• Splunk
  • Fixed an issue where the Create and Update Assets enforcement action failed with a 405 error when it created a KV store collection that already existed and the Host Name value included a scheme, a path, or a trailing slash.
  • Fixed an issue where fetches ended with errors when an application settings endpoint returned an authorization error.

Data Accuracy

• BitSight Security Ratings
  • Fixed an issue where the adapter imported an incorrect DMARC status. The adapter now uses the email security grade from the latest finding for each risk vector.
  • The adapter now applies the existing "only affects rating" option when fetching email security findings.
• Microsoft Active Directory (AD)
  • Fixed an issue where underscores in Active Directory and Microsoft Entra ID group names were replaced with spaces. Group display names now keep their original formatting.
  • Fixed an issue where group user counts could be incorrectly correlated between groups with different security identifiers (SIDs). User counts now match by SID when a valid SID is available.
• Microsoft AD - Create users - Fixed an issue where the action did not set the Common Name (CN) of the new user. When the Username field is empty, the action now uses a mapped Common-Name value, then the source user's Active Directory username, and then a mapped SAM-Account-Name. If none of these has a value, the action stops before creating the user and explains which fields can supply it.
• Microsoft Defender for Endpoint (Microsoft Defender ATP) - Fixed an issue where the OS: Distribution value was parsed incorrectly for Debian devices.
• Nucleus Security - Fixed an issue where non-device assets, such as cloud resources, were imported as uncategorized devices. Added the Asset types to fetch advanced setting, which limits fetched devices to the Nucleus asset types you specify.
• Preferred OS lifecycle fields - Fixed an issue where the Preferred OS: End of Life, End of Support, and End of Extended Support fields, and their status fields, could show lifecycle dates for a different Windows edition.
• ServiceNow - Create Assets - Fixed an issue where assets created in Axonius by this action were assigned an incorrect class name. The action now preserves the ServiceNow table name as the device class, so the class is correct for both the default computer table and custom tables.
• SharePoint - Send CSV - Fixed an issue where XLSX exports included an extra column with a blank header. XLSX exports now contain the same data columns as the CSV export.
• SNMP - Corrected the IP range example in the description of the SNMP host field to use the abbreviated range format, for example 192.168.1.1-50.
• Tenable Cloud Security - Fixed an issue where Azure virtual machines were not correlated correctly with the same machines fetched from other sources.
• Tenable.sc (SecurityCenter)
  • Fixed an issue where installed software was associated with devices by IP address alone. Repeated installed software entries are removed.
  • Fixed an issue where enforcement actions did not match existing MAC address filter rules in Tenable Security Center when the letter case of the MAC addresses differed.
• TRIMEDX - Fixed an issue where Aggregated Security Findings with Network Inspector vulnerability data were not sent correctly as vulnerability events. Each finding is now sent as one vulnerability event, and its publish date is sent as the release date when available. Assets without vulnerability data now fail with a clear reason instead of sending an empty payload and being reported as successful.

Data Completeness

• Active Directory Certificate Services (AD CS)
  • Fixed an issue where the adapter fetched no certificates when certificate filters were configured.
  • Fixed an issue where certificate retrieval stopped early on certificate authorities with large gaps in request ID values.
  • Fixed an issue where certificate retrieval returned no certificates when certutil output included diagnostic text before the JSON data.
• Aggregated Security Findings - Fixed an issue where CVEs with no Software Type from the finding source or the NVD were missing a Software Type.
• BMC Atrium CMDB - Fixed an issue where the adapter could not discover fields in BMC Helix environments that return plain text instead of a JSON schema.
• Cisco Secure Access - Fixed an issue that caused the DNS Forwarders fetch to fail with a 400 Bad Request error when multiple DNS Forwarder Types were selected. The DNS Forwarder Type setting now lists the available types (Network DNS Forwarder, Virtual Appliance, Connector, and Domain Controller), and you can select one or more of them.
• Citrix ADC - Fixed an issue that prevented saving the advanced settings unless you selected a value for Optional items to fetch.
• CrowdStrike Falcon - Fixed an issue where vulnerability data was intermittently not fetched. The adapter now retries the Spotlight vulnerability permission check after temporary timeouts and connection failures, and logs when vulnerability enrichment is skipped.
• CSV - Software Inventory - Added support for reading End of Life and End of Support dates for installed software from the Axonius_End_Of_Life and Axonius_End_Of_Support columns.
• Custom Files
  • Fixed an issue where files selected by a regular expression pattern in an Azure Blob directory were not loaded when their names did not end with the configured file type.
  • Fixed an issue where directory loads with Is GZIP enabled did not load matching files with the .gz suffix from Azure Blob and Amazon S3.
  • Improved the Azure Blob error message when no files match, so that it identifies the active filters and the number of skipped files.
• CVE and installed software fields - Fixed an issue where adapter CVE and installed software fields that contained unexpected non-list values caused processing to fail during cleanup, CVE enrichment, and vulnerability exclusion.
• Duo - Update User - Fixed an issue where the action failed with the error "Invalid request parameters (All values must be strings)".
• Efecte - Fixed an issue where the User field was not populated on Workstation assets.
• Fetch Events - Fixed an issue where Fetch Events could not be filtered by connection labels that contain accented or non-Latin characters, which prevented you from viewing the events for those connections.
• GitHub
  • Added missing details to security findings parsed from code-scanning and secret-scanning alerts.
  • Fixed an issue where Code Scanning and Secret Scanning alerts were not treated as security findings. These alerts are now represented as Incidents that include security finding data, and Incidents are treated as vulnerable assets.
• JFrog Xray - Fixed an issue where CVE details were not fetched when the vulnerability report option was enabled. The adapter now reads the report ID correctly from the completed report status response.
• Lansweeper Cloud - Fixed an issue where a failure while retrieving Aggregated Security Findings for one site was not clearly reported.
• Microsoft Defender for Endpoint (Microsoft Defender ATP) - Fixed an issue where the File Events Most Sensitivity Label field was empty for devices with custom sensitivity label names. Added the Sensitivity label ranking advanced setting, where you can add your organization's labels and assign each a rank. The adapter selects the label with the highest rank for each device.
• Microsoft Fabric - Send Assets to Lakehouse - Fixed an issue where valid uploads with long CSV headers failed.
• Microsoft Intune - Fixed an issue where installed software was not fetched because the request to Microsoft Graph timed out.
• Ninja One (RMM)
  • Fixed an issue where device pagination could return repeated pages when device IDs were not consecutive, which resulted in incomplete device collection.
  • Improved recovery from temporary API failures, rate limits, and expired tokens during fetch.
  • The adapter now retains the device hostname and DNS name when network interface enrichment is unavailable.
• OneTrust - Fixed an issue where only some Application assets were fetched.
• Red Hat Ansible Tower - Launch Job Template - Fixed an issue where Custom Data values mapped in the extra variables mapping were not sent to Ansible. To map a Custom Data field, add the gui: prefix to its field path.
• SNMP - Fixed an issue where connections that use an IP range did not fetch assets. The adapter now returns one device for each responding host in the range, and the host IP is included in the device data. Connection checks probe up to 256 hosts in the range and succeed when at least one host responds. If no host responds during a fetch, the fetch fails and the error message identifies the failed hosts.
• SQL - Send Assets to Table - Fixed an issue that caused the action to fail with a schema type mismatch error when the exported data contained empty values.
• Tanium Client Status - Create Action - Fixed an issue where selected devices were not added to the action's target group. The action now creates Computer Name target groups from the selected device hostnames and validates the hostnames before creating the action.
• Tanium Comply - Enhanced open port data for devices to include the service name of each port, when Tanium returns a valid matching name.
• Tenable Cloud Security - Fixed an issue where Azure SQL servers were not fetched. Azure SQL servers are now fetched as Database assets, including their host and port.
• Tenable Vulnerability Management - Add IP Addresses to Tag Value
  • Added the IPs to add (overrides other IP selection options) parameter, which lets you enter the IP addresses directly. This parameter overrides the other IP selection options.
  • Added the IP Source Field Mapping parameter, which lets you select the Axonius fields from which to extract IP addresses for each asset.
• Tenable.io - Overwrite ACR - Fixed an issue where the action reported success but the Asset Criticality Rating (ACR) was not changed in Tenable.
• Tines - Fixed an issue where pagination requests started at page 0, which Tines rejects.
• XenServer - Added the Network Interfaces and Guest Metrics advanced settings, which are disabled by default. When you enable them, device records include network interface MAC addresses, IP addresses, and operating system information.

Parsing

• Eracent - Fixed an issue where software names that include a colon followed by a package summary did not correlate.
• Google Security Operations SIEM REST - Fixed parsing of artifact events and aggregated events, including stable asset identifiers when aggregated queries do not return identifier outcomes.
• ServiceNow - Added support for custom parsing of Tickets, which lets you map raw ticket data, such as correlation_id, to existing ticket fields, such as External ID. To configure it, use Enable Custom Parsing in the adapter's Advanced Settings. For more information, see Adapter Custom Parsing.
• ThreatLocker - Fixed an issue where the Last Seen field was empty for devices. The adapter now populates Last Seen from either the Last Check In or the lastCheckin value returned by ThreatLocker.

Performance

• BeyondTrust Password Safe - Fixed delayed fetches caused by fetching a large amount of user audit data. Added the Fetch user audits from the last X days advanced setting (default: 90), which limits how far back user audits are fetched when User Audits is selected in Additional assets to fetch.
• Cisco Identity Services Engine (ISE) - Fixed an issue where fetches took a very long time or timed out when the server ignored paging parameters and returned the same results repeatedly.
• CyberArk Privilege Cloud
  • Added the Account Enrichment Parallelism advanced setting (default: 10), which sets how many accounts have their Account Activities and Account Extended Data fetched at the same time. Increase the value to speed up fetching large numbers of accounts, or decrease it if CyberArk Privilege Cloud returns HTTP 429 rate-limit responses.
  • Fixed an issue where the Groups fetch never finished and eventually timed out.
• HPE Aruba Networking ClearPass Policy Manager - Fixed an issue where the throttling settings (Asynchronous request chunk size and Wait time between Asynchronous chunks) were not applied to device fingerprint requests, which could overload the ClearPass server.
• Microsoft Entra ID (formerly Azure Active Directory) and Microsoft Intune - Fixed an issue where report export jobs failed immediately when Microsoft Graph returned an HTTP 429 (too many requests) error.
• SysAid - The adapter now retries requests that receive a rate-limit response (HTTP 429), using the wait time provided by SysAid when available.
• Tenable.sc (SecurityCenter) - Added See Also to the heavy fields you can select for security findings. Select it only when you want to retrieve the See Also information, which helps reduce document size when it is not needed.

---