Stellar Cyber 7.0.0 Release Notes

Highlights

The following features are the highlights of this release.

• Alert and Case Auto-Triage with Case Queues – Enable AI case summary and auto-triage for each case queue, with a new default AI Analyst queue for critical cases.

• Case Metrics – Define case metrics from quick-start templates or custom timer conditions, then track them as case queue columns and on the Case Detail page.

• Detailed Sandbox Evidence in Malware Alerts – View the detailed Sophos sandbox report, including process, file, registry, and network artifacts, directly in the alert so analysts can validate a verdict without leaving it.

• Parser Studio Enhancements – Use Parser Studio to enable and disable parsers in bulk with the Disable Inactive Parsers workflow, monitor parser activity with a 7-day ingestion column, create parsers from scratch, and download parsers for use across tenants.

• System Action Center Public APIs – Use System Action Center APIs to create and manage actions across all trigger categories programmatically.

• New Context-Driven Detections – Detect Active Directory pass-the-ticket attacks, Microsoft 365 sign-ins from never-before-seen ASNs, and SSH brute-force attempts that include aborted sessions.

• Printable Payload on IDS Alerts – View the triggering packet content directly in the alert details panel.

• Expanded Response Actions – Respond to threats with FortiGate URL and domain blocking, Microsoft Defender for Endpoint responder actions, and Cybereason Malop-level containment.

• New Alert Integrations – Integrate alerts from Cisco AMP, Ironscales, and Memcyco.

• New Connector – Connect to ThreatDown Nebula to ingest detections, endpoints, endpoint scans, events, and suspicious activity.

Actions Required

There are no actions required in this release.

Behavior Changes

Changes that affect the way users interact with the product or interpret results are listed below.

• AELDEV-67525: API error responses return the request identifier under a new name – The API error responses to return the request_id field in place of requestId were updated. After upgrading to 7.0.0, integrations and scripts that parse the requestId field in server error responses no longer find it and might fail or lose log correlation. Update any integration that reads the error identifier to use the request_id field.

• AELDEV-67820: Public API endpoints for sensors now require RBAC privileges – Role-based access control (RBAC) privilege enforcement was added to the public sensor endpoints under /data_sensors, which were previously reachable by any authenticated API user regardless of privilege profile. After upgrading to 7.0.0, an API user whose privilege profile does not grant the privilege that governs the equivalent action in the user interface receives a 403 response where the request previously succeeded. Review the privilege profiles assigned to API users and automation that call these endpoints before upgrading. Enforcement on the pre-existing endpoints can be disabled for an organization as a transition measure; the privilege check on the new uninstall endpoint is always enforced.

• AELDEV-28743: The tenant group list API no longer returns logo image data – The tgrp_logo field was removed from tenant group list API responses. After upgrading to 7.0.0, integrations that read the logo image from the list response no longer receive the image data. Update these integrations to retrieve logo images on demand through the /tenant_group/{id}/logo endpoint.

Deprecated Features

The following features are deprecated.

Upcoming Deprecation: SentinelOne Deep Visibility API – The Deep Visibility content type in the SentinelOne connector will be migrated to the Deep Visibility (SDL) content type in 7.0.0 due to a SentinelOne API being deprecated. Refer to the following dates:

• Standard SaaS: Feb 15, 2027

• GovCloud: April 26, 2027

Make sure to migrate content types from Deep Visibility to Deep Visibility (SDL) before the API is deprecated.

Upcoming Deprecation: Trend Micro Cloud One v2.0 API – The Trend Micro Cloud One v2.0 API is being deprecated. If you previously used the Trend Micro Cloud One connector, you should now use the Trend Micro Vision One connector in 7.0.0 and the Endpoint Inventory content type, which is only supported in the v3.0 API. The Trend Micro Vision One v3.0 API covers what previously required two separate connectors: Trend Micro Vision One and Trend Micro Cloud One. The Endpoint Inventory content type replaces the Computers content type previously collected through the Trend Micro Cloud One connector.

Migration is available in 7.0.0 to customers who request it.

Autonomous SOC

New Features

• ASOC-152: Added per-queue AI case summary and auto-triage settings for case queues.

  Added a Case Summary and Analysis section to the case queue create and edit workflow. The Case Summary setting enables AI-generated case summaries and analysis for cases in the queue, and the Auto-Triage setting enables the auto-triage agent for cases matching the queue conditions. Default queues, previously not editable, can now be edited for these two settings, and a new default AI Analyst queue for critical cases is created with the settings enabled.

  Case Summary is available to all customers. The Auto-Triage setting is available to licensed Autonomous SOC customers, and both settings appear only when the corresponding administrative setting is enabled. Added a dedicated case queue service that notifies the Autonomous SOC engine about case changes that need AI analysis, replacing the earlier mechanism that monitored the case database directly.

Detection/ML

New Features

• AELDEV-69344: Added Cisco AMP alert integration.

  Added third-party alert integration for Cisco Advanced Malware Protection (AMP). Detection events reported by Cisco AMP, such as Threat Detected and Execution Blocked, are mapped into Stellar Cyber alerts, so you can centrally monitor endpoint detections, correlate them with other data sources, and use them for case creation without manual analysis. See Integration of Third Party Native Alerts.

  Also added connector normalization that maps Cisco AMP host, user, and file fields to Stellar Cyber canonical fields, enabling alert detection and asset extraction for endpoint events. The Cisco AMP event ID is emitted as a string to preserve full 64-bit precision, so the Find Original Record search links each alert back to its original events correctly.

• AELDEV-68929: Added Ironscales alert integration.

  Added third-party alert integration for the Ironscales email security platform. Phishing, spam, attack, compromised, and account takeover detections reported by Ironscales are normalized into Stellar Cyber alerts and are available for correlation, case creation, and reporting. See Integration of Third Party Native Alerts.

  Also added normalization that promotes the incident classification, sender and recipient email addresses, and email subject to Stellar Cyber canonical fields, enabling Ironscales incidents to generate the alerts. This integration lets you monitor and investigate email-borne threats alongside alerts from your other security tools.

• AELDEV-68306: Added an alert type for MS365 Login From New ASN.

  Added an alert type for Microsoft 365 sign-ins from never-before-seen networks. Added a customizable detection that triggers when a Microsoft 365/Entra ID account signs in from an autonomous system number (ASN) not previously observed in the historical sign-in activity. The detection supports a configurable lookback period and a training period, and applies tenant-scoped suppression for frequently observed ASNs to reduce alert noise. This detection helps you identify potential account compromise early while keeping alert volume manageable. See All Alert Types by Name and Using the Detection Management System.

• AELDEV-67555: Added case correlation for alerts generated by correlation rules.

  Added case correlation based on the correlation_info fields carried by alerts generated from Automated Threat Hunting correlation rules. The case correlation engine identifies the entities in these alerts and groups alerts that share the same normalized value in supported correlation_info fields, such as a common user principal name, into the same case, including across correlation rule alerts and native detections. Safeguards such as time windows and alert type compatibility prevent unrelated alerts from being over-correlated. This enhancement ensures that alerts with explicitly shared correlation context are grouped together automatically, reducing the manual effort needed to connect related activity.

• AELDEV-61066: Added Memcyco alert integration.

  Added Memcyco third-party alert integration with the Memcyco API to collect security events, including failed logins, platform changes, and compromise detections. The connector collects events through read-only API access and reports a clear error when an invalid API key is supplied. See Integration of Third Party Native Alerts.

  Also added normalization that promotes Memcyco vendor fields, such as event name, IP address, URL, and username, to Stellar Cyber canonical fields across the events, attacks, and spoofing content types, enabling the alert integration. Asset normalization ingests Memcyco device and user records as Stellar Cyber assets, so Memcyco device and user data populates asset analytics. This integration lets you monitor and investigate Memcyco security events alongside your other data sources.

• AELDEV-59279: Added an alert type for Possible Pass-the-Ticket Attack.

  Added Active Directory detection for pass-the-ticket attacks. The detection tracks Kerberos ticket activity and raises an alert when a Ticket Granting Service (TGS) request is observed from an IP address that never obtained a Ticket Granting Ticket (TGT) for the same account, a pattern that indicates the reuse of a stolen ticket. Customizable /24 subnet matching on the Detection Management System page lets you tune how source addresses are compared. This detection helps you identify the malicious reuse of Kerberos tickets in Active Directory environments. See All Alert Types by Name and Using the Detection Management System.

Improvements

• AELDEV-72528: Improved processing of Sophos protection-disabled and outbreak events into alerts.

  Improved the Sophos alert integration to correctly process Real-time Protection Disabled (Event::Endpoint::SavDisabled) and Outbreak Detected (Event::Endpoint::CoreOutbreak) events. Previously, these events were present in ingested Sophos logs but did not generate alerts. The alert filtering was adjusted so that these events now generate the corresponding Stellar Cyber alerts, ensuring that you no longer miss these high-severity Sophos events.

• AELDEV-71314: Improved Successful Login After Brute Force fidelity scoring for internal IP addresses.

  Improved fidelity scoring for the Successful Login After Brute Force detection when the source is an internal IP address. Internal IP addresses carry no Autonomous System Number (ASN) information, which previously inflated the fidelity score. The scoring now accounts for the missing srcip_asn field, so alert fidelity is more accurate for internal traffic and you can triage these alerts with greater confidence.

• AELDEV-70538: Improved suppression for ESET Inspect alert integration.

  Improved the ESET Protect alert integration so that ESET Inspect detections are deduplicated by machine and rule instead of the per-occurrence eset.eialarmid identifier. Recurring Inspect detections on the same host within the suppression window are now collapsed into a single alert, significantly reducing duplicate alert volume. See Integration of Third Party Native Alerts.

• AELDEV-68309: Improved three alert types to add subtypes for aborted SSH sessions.

  Improved the brute-force detection logic to account for SSH sessions that terminate in the Aborted state. Previously, these sessions were ignored and did not contribute to login_result evaluation, even though they are common during scanning and automated brute-force attacks that do not complete the full authentication handshake. These sessions are now evaluated, so brute-force behavior is no longer under-reported or missed in environments where attack tools terminate sessions prematurely. The following alert types have a subtype for Aborted SSH Network Events: External User Login Failure Anomaly, Internal User Login Failure Anomaly, and Internal Account Login Failure Anomaly. See All Alert Types by Name.

Stellar Cyber Platform

New Features

• AELDEV-73312: Added support for the new credential management workflow.

  Added platform-level support for a new credential management workflow, including key exchange between the Data Analyzer and Data Lake and handling for Data Processor disaster-recovery and high-availability deployments. The data sink workflow and the connector framework were updated to use the same mechanism, and all services adopt the workflow together through the Early Access Program. This change establishes consistent credential handling across Stellar Cyber services.

• AELDEV-72895: Added an HTTPS endpoint option for data sinks without SSL validation.

  Added support for sending data sink output to HTTPS endpoints without running SSL certificate validation. Previously, the data sink could not send output to storage devices that require HTTPS but present certificates that fail validation. This option lets the data sink connect to such devices, including S3-compatible storage systems that accept only HTTPS connections.

Improvements

• AELDEV-73532: Updated the query_window_start field to use a consistent datetime format across indexes.

  Updated the query_window_start field to use a consistent datetime format across indexes, including the syslog, scans, and traffic indexes. Previously, the field was stored as a datetime in the window index but as a numeric timestamp elsewhere. The consistent format supports the expanded set of connectors that report query_window_start in 7.0.0, ensuring uniform datetime handling for searches and analysis.

• AELDEV-67557: Improved the Office 365 Multiple Users Deleted alert with user count and username list.

  Improved the Office 365 Multiple Users Deleted alert to include the total number of deleted users and the list of deleted usernames detected within the alert time window. The alert now populates the deleted_user_count and deleted_user_list fields, which are shown in the alert details and available through the API. The displayed user list is capped at 50 entries to preserve performance, while the count reflects the full total. This enhancement lets you assess the scope of the activity without pivoting to raw logs.

• AELDEV-67064: Improved the time required to load user interface settings when signing in.

  Improved the time required to load user interface settings when a user signs in. A check of the mail server status ran as part of the settings request and could take approximately 15 seconds to complete, delaying the interface for every user. Stellar Cyber now retrieves the mail server status separately and in parallel with the settings request, so a slow response from the mail server no longer holds up the interface. Measured response times for the settings request are now approximately 0.7 seconds on SaaS deployments and approximately 1.1 seconds on on-premises deployments. Controls that depend on the mail server continue to be disabled when the mail server is unavailable, and no configuration change is required.

Sensors

New Features

• AELDEV-72713: Added a printable payload field on IDS alerts with inline display in alert details.

  Added the printable payload of matched traffic as a searchable Interflow field (ids.payload_details.payload_printable) on intrusion detection system (IDS) alerts generated by the Modular Sensor, with inline display in the alert details panel. You can view, copy, and expand the printable payload directly on the alert for faster triage, and the field is available for threat hunting and case context. The existing PCAP retrieval path on the sensor is unchanged and remains available for full forensic analysis.

  Modular Sensors must be running 7.0.0 for this feature.

• AELDEV-71616: Added sensor CLI commands showing heartbeat and phone-home status.

  Added sensor CLI commands to display the heartbeat connection of the sensor to the managing DP, as well as the time and status of the last phone-home and support log upload. Refer to the show cm heartbeat and show support upload commands in Available Commands in the Sensor CLI Access Window. This gives administrators visibility into sensor-to-DP connectivity when troubleshooting from the sensor console.

• AELDEV-71317: Added a sensor CLI option to upgrade via ACPS or the Data Processor.

  Added a new upgrade command to the sensor CLI. This command upgrades a sensor's software directly from the CLI, retrieving the upgrade image via ACPS or the Data Processor. This provides a recovery path for upgrading a sensor when the standard upgrade workflow is unavailable.

Improvements

• AELDEV-73711: Added support for Intel E810 series network adapters on sensors.

  Added the Intel Network Adapter Driver for E810 series devices to the sensor Ubuntu 22.04 image. Sensors deployed on hardware with E810 network interface cards can now use those interfaces without manual driver installation.

• AELDEV-70934: Added Intel E610 NIC driver support to the sensor VM image.

  Added native driver support for the Intel Ethernet Controller E610 1GBASE-T network adapter (PCI ID 8086:57b1) to the sensor VM image. E610 interfaces on current-generation servers such as the Dell PowerEdge R670 are now detected automatically after PCI passthrough, so SPAN traffic collection works without manually installing an out-of-tree driver.

• AELDEV-72518: Added official Linux Server Sensor support for OpenSUSE Leap 15.6 and 16.0.

  Added official support for installing the Linux Server Sensor on OpenSUSE Leap 15.6 and 16.0. Deployments on this platform are now validated for sensor installation and upgrade, so you can run the server sensor on OpenSUSE Leap 15.6 and 16.0 with full support.

• AELDEV-71143: Added Linux Server Sensor support for Ubuntu 26.04.

  Added support for deploying Linux Server Sensors on Ubuntu 26.04 LTS hosts. Deployments on hosts upgrading to Ubuntu 26.04 can continue to collect logs and telemetry with the server sensor.

• AELDEV-71294: Added a minimum image guardrail for sensor ISO installation.

  Added a minimum base image guardrail to the sensor ISO image used for disk imaging. Installation is rejected when the target does not meet the minimum supported base image version, preventing sensors from being installed on unsupported bases.

Connectors

New Features

• AELDEV-72209: Updated the Trend Micro Vision One connector to v3.0 API.

  The Trend Micro Vision One connector now uses the Trend Micro Vision One v3.0 API and covers what previously required two separate connectors: Trend Micro Vision One and Trend Micro Cloud One.

  The Trend Micro Cloud One v2.0 API is being deprecated. If you previously used the Trend Micro Cloud One connector, you should now use the Trend Micro Vision One connector and the Endpoint Inventory content type, which is only supported in the v3.0 API. See Configuring Trend Micro Vision One Connectors.

  Migration is available in 7.0.0 to customers who request it.

• AELDEV-71574: Introduced the ThreatDown Nebula connector.

  Added the ThreatDown Nebula connector to ingest detections, endpoints, endpoint scans, events, and suspicious activity through the ThreatDown API. See Configuring ThreatDown Nebula Connectors.

• AELDEV-67465, AELDEV-63463, AELDEV-66973: Added blocking and unblocking of domains and URLs on FortiGate firewalls.

  Added actions for blocking and unblocking domains and URLs on FortiGate firewalls. This complements the existing block and unblock IP address capability, letting analysts manage domain and URL blocking directly from the Stellar Cyber Platform. To run Block URL actions, create a Web Filter and apply it to a firewall policy in the Fortigate Firewall connector.

  The Block URL and Unblock URL actions are available on the Threat Hunting page when records contain url or event.url and on the Automation | Action History page under the Firewall Actions tab. See Configuring Fortigate Firewall Connectors and Understanding Event Details.

• AELDEV-54698: Enhanced the XDR Connector to add full normalization and enrichment.

  Added full normalization and enrichment support for incoming security events to the XDR Connector webhook ingestion by converging the webhook ingest workflow with a new user interface and additional functionality. Incoming event data is standardized into the Stellar Cyber Platform event schema, mapped to a unified taxonomy, and enriched with metadata. This convergence improves data consistency across integrated security tools. See Configuring XDR Connector.

  This is an Early Access Program (EAP) feature.

Improvements

• AELDEV-73636: Improved XDR Connector preview to execute normalization and enrichment steps.

  Improved the XDR Connector preview so that it executes the configured normalization and enrichment steps against the sample event. Edits to normalization fields such as vendor, product, and category, or to enrichment rules, are now reflected in the preview output, and invalid configuration produces a clear, step-attributed error before the connector is submitted. The preview runs the same code paths used at ingestion time, so preview results match production behavior. See Configuring XDR Connector.

• AELDEV-73627: Updated Trend Micro Vision One response actions to the v3 API.

  Trend Micro Vision One responders use Webhook templates that support actions. For the V2 API, there were five actions. For the V3 API, there are now four actions.

  The response actions that use the V3 API are: Trend Vision One Add To Block List (V3 API), Trend Vision One Isolate Endpoint (V3 API), Trend Vision One Remove From Block List (V3 API), and Trend Vision One Restore Endpoint Connection (V3 API).

  The response actions that use the V2 API are: Trend Vision One Add To Block List (Deprecated), Trend Vision One Isolate Endpoint (Deprecated), Trend Vision One Remove From Block List (Deprecated), Trend Vision One Restore Endpoint Connection (Deprecated), and Trend Vision One Quarantine Email Message.

  The Trend Vision One Quarantine Email Message response action uses the V2 API. Because there is no V3 API equivalent, this response action is unchanged from previous versions.

  It is recommended that you set up the new (V3 API) response actions and remove the old (Deprecated) response actions from your configuration. See Configuring Trend Micro Vision One Connectors.

• AELDEV-73611: Improved data normalization for Idira Privilege Cloud audit events.

  Improved data normalization for audit events ingested through the Idira Privilege Cloud connector. Additional fields, including the client IP address, username, user ID, login_result, and login_type, are now mapped to standard Stellar Cyber metadata fields so audit events participate fully in machine-learning detections and correlation.

• AELDEV-71556: Enhanced the Idira (formerly CyberArk) Privilege Cloud connector.

  Enhanced the Idira (formerly CyberArk) Privilege Cloud connector, which ingests audit events through the Audit SIEM integration API. See Configuring Idira Privilege Cloud Connectors.

• AELDEV-72419: Improved Office 365 audit normalization with canonical file and user fields.

  Improved normalization of Office 365 audit records to populate canonical entity fields. SharePoint audit records now map file details to file_name, file.path, file_size, and file hash fields, and the stable user object ID to user.id, with additional user-field coverage for Microsoft Entra ID (formerly Azure Active Directory) and general audit records. Populated canonicals improve search, correlation, and detection on Office 365 data.

• AELDEV-72417: Improved Microsoft Entra ID risky user normalization with canonical user fields.

  Improved normalization of Microsoft Entra ID (formerly Azure Active Directory) risky user records to populate canonical user fields. The at-risk user identity is now mapped to username, user.name, user.id, and user.full_name, improving search and correlation for identity-based detections.

• AELDEV-72416: Improved Azure Event Hub normalization of source and destination IP fields.

  Improved normalization of Azure Event Hub records to populate canonical IP fields such as srcip, dstip, srcport, and dstport for Web Application Firewall (WAF) content types. Client and server IP addresses, ports, and hostnames in Azure WAF access and firewall logs are now mapped from the vendor fields. Populated IP canonicals improve search, correlation, and detection on these records.

• AELDEV-72415: Improved SentinelOne alert normalization with canonical host and process fields.

  Improved normalization of SentinelOne alerts to populate canonical host and process fields, including host.name, host.id, process.name, process hash fields, process owner, and parent-process details. SentinelOne alerts now carry the same canonical entity fields as SentinelOne threat events, improving search, correlation, and detection coverage.

• AELDEV-72290: Added proxy support for the Cisco FMC connector running on DP.

  The Cisco Firewall Management Center (FMC) connector running on DP supports proxy. Ensure that your proxy can reach the Cisco FMC host. See Configuring Cisco Firewall Management Center (FMC) Connectors.

• AELDEV-71267: Extended the query_window_start timestamp to other connectors.

  Extended the query_window_start timestamp, previously available only for the Microsoft Office 365 connector, to Microsoft Entra ID (formerly Azure Active Directory), Azure Event Hub, Microsoft Defender for Endpoint, and Microsoft Defender for Cloud Apps connectors. This field allows consistent measurement of ingestion latency by recording the start of the polling window during which Stellar Cyber collected the event from Microsoft's API. See Configuring Microsoft Entra ID (formerly Azure Active Directory) Connectors, Configuring Azure Event Hub Connectors, Configuring Microsoft Defender for Endpoint Connectors, and Configuring Microsoft Defender for Cloud Apps Connectors.

• AELDEV-71048 and AELDEV-71052: Added content types to Memcyco connector.

  Added new content types to the Memcyco connector: Attacks, Spoofing, and Users. The Users content type has a message category of Assets. See Configuring Memcyco Connectors.

• AELDEV-70599: Updated the SentinelOne connector to migrate Deep Visibility.

  The Deep Visibility content type in the SentinelOne connector will be migrated to the Deep Visibility (SDL) content type due to a SentinelOne API being deprecated.

  Updated the SentinelOne connector to query the SentinelOne Singularity Data Lake (SDL) API instead of the deprecated Deep Visibility API, which SentinelOne retires for SaaS tenants on February 15, 2027. Also added to the connector is new authentication for Deep Visibility (SDL) and configuration fields for entering the SentinelOne Account ID and Site ID. See Configuring SentinelOne Connectors.

• AELDEV-68290: Added ESET endpoint UUID resolution from Cato Networks events for ATH actions.

  For the Automated Threat Hunting (ATH) actions for Cato Networks events, you can resolve from the endpoint's IP address (identify the endpoint by a source IP address and resolve the IP address to map to the ESET UUID). Use the user-facing variables in the webhook template. Use eset.source_uuid_by_ip to resolve the ESET device UUID by matching the event's normalized srcip, or the raw cato_networks.src_ip as a fallback, against the device's ESET primaryLocalIpAddress. Use eset.source_uuid to resolve the UUID from the Cato Networks device display name. See Configuring ESET Responder Connectors.

• AELDEV-43676: Enhanced Cloudflare to collect WAF events using the Generic S3 connector.

  Enhanced Cloudflare to collect Web Application Firewall (WAF) events arriving via Cloudflare Logpush → customer S3 → Generic S3 connector. Use the log source Cloudflare WAF (JSON) in the Generic S3 connector. See Configuring Generic S3 Connectors.

Parsers

New Features

• DATA-3604: Introduced a parser for ingesting Apache APISIX logs.

  Added a built-in parser for ingesting Apache APISIX API gateway logs in RFC 3164 syslog format on port 6219. The parser extracts API gateway access event data, including client IP addresses, request URLs and methods, HTTP status codes, response sizes, user names, user agent strings, and upstream server addresses and ports, and normalizes it into the Stellar Cyber schema. This parser improves visibility into API gateway traffic and supports investigation of client requests and upstream service activity.

• DATA-3577: Introduced a parser for ingesting Cisco Secure Workload logs.

  Added a built-in parser for ingesting Cisco Secure Workload logs in Cisco custom header, key-value pair, and JSON format on port 6216. The parser extracts workload security event data, including source and destination IP addresses, ports, and protocol information. This parser provides log coverage for Secure Workload deployments, which do not support CEF or LEEF export, and supports investigation of workload traffic and segmentation policy activity.

• DATA-3560: Introduced a parser for ingesting Extreme Networks ExtremeCloud IQ logs.

  Added a built-in parser for ingesting Extreme Networks ExtremeCloud IQ logs in RFC 3164 syslog format on port 6217, covering the AP230, AP250, AP305C, AP410C, AP510C, and AP650 models. The parser extracts wireless access point event data and normalizes it into the Stellar Cyber schema. This parser improves visibility into wireless infrastructure activity and supports investigation of wireless client and access point events.

• DATA-3556: Introduced a parser for ingesting BeyondTrust Privileged Remote Access logs.

  Added a built-in parser for ingesting BeyondTrust Privileged Remote Access (PRA) logs in BeyondTrust custom format on port 6214. The parser extracts privileged remote access event data, including session activity, user identities, and endpoint access details, and normalizes it into the Stellar Cyber schema. This parser improves visibility into privileged remote sessions and supports auditing and investigation of vendor and administrator access to critical systems.

• DATA-3538: Introduced a parser for ingesting Check Point CloudGuard WAF logs.

  Added a built-in parser for ingesting Check Point CloudGuard WAF logs, forwarded through Infinity Portal Event Forwarding, in RFC 5424 syslog format with a CEF payload on port 6213. The parser extracts web application firewall event fields including source IP address, HTTP host name, method, URI path and query, WAF action, override action, user reputation score, and event severity. This parser improves visibility into the prevention decisions that CloudGuard WAF makes and supports investigation of blocked web requests and reputation-based enforcement.

• DATA-3532: Introduced a parser for ingesting IBM TS4500 logs.

  Added a built-in parser for ingesting IBM TS4500 tape library logs in RFC 3164 syslog format on port 6212. The parser extracts tape library event data, including system and operational messages, and normalizes it into the Stellar Cyber schema. This parser improves visibility into tape library operations and supports monitoring and investigation of events on backup and archival storage infrastructure.

• DATA-3531: Introduced a parser for ingesting Dell PowerMax storage logs.

  Added a built-in parser for ingesting Dell PowerMax storage system logs in Dell custom header with syslog format on port 6211. The parser extracts storage system event data, including source and destination network details where present, and normalizes it into the Stellar Cyber schema. This parser improves visibility into storage array activity and supports monitoring and investigation of events on PowerMax arrays.

• DATA-3502: Introduced a parser for ingesting Claude Code OpenTelemetry telemetry.

  Added a built-in parser for ingesting Claude Code OpenTelemetry data in JSON format over HTTP on port 6210. The parser extracts log events, including user prompts, API requests and errors, tool executions, permission decisions, and authentication events, along with metric series covering sessions, token and cost usage, and code changes. This parser gives SOC teams visibility into AI coding-assistant activity in their environments.

Improvements

• AELDEV-71125: Added bulk enable/disable of parsers with 7-day ingestion visibility in Parser Studio.

  Added bulk enable and disable of modular parsers in the Parser Studio list view, along with a new 7d Ingestion column showing the rolling 7-day ingested volume of each parser and a threshold filter to surface low-traffic parsers. A confirmation dialog warns when any selected parser is currently ingesting data. This lets administrators relieve sensor memory pressure by retiring parsers that are not receiving data. The 7-day metric is a periodically refreshed per-tenant snapshot and is not shown in the All-Tenants view.

  Added the Disable Inactive Parsers workflow, which uses the ingestion threshold to select the parsers to disable. Parser state changes follow the per-tenant model and apply consistently regardless of the sensor technology in use, and bulk parser state management is also supported through the API.

• AELDEV-70581: Added legacy built-in parser activity information to the Parser Studio list.

  Added activity information for legacy built-in parsers in the Parser Studio list view, together with bulk enable and disable actions that follow the existing per-tenant model. Administrators can see whether a parser is actively ingesting data before disabling it, and a confirmation step warns of potential impact when disabling an active parser. Disabling unused parsers reduces parser memory usage on sensors.

• AELDEV-70204: Added download of modular parser configurations for cross-tenant reuse.

  Added a download action for modular parsers in the Parser Studio list view. A downloaded parser configuration can be re-uploaded to another tenant using the existing parser upload workflow, so parsers can be reused across tenants without recreating them from scratch. This capability is available for modular parsers only.

• AELDEV-70203: Added the option to create a parser from scratch in Parser Studio.

  Added a Parser Studio entry point for creating a parser from scratch without cloning an existing parser. The parser creation workflow is unchanged; the new option starts from a blank configuration, giving you a clean starting point for building custom parsers.

• AELDEV-69093: Improved Parser Studio Ignore Values to support adding multiple values at once.

  Improved the Ignore Values selection on the Parser Studio Normalization Parameters page. Multiple ignore values can now be selected with check boxes and added or removed in a single operation instead of one value at a time.

• AELDEV-68915: Added custom legacy and modular parsers to the Add Log Source Configuration dialog box.

  Added custom legacy and modular parsers created in Parser Studio to the Name drop-down list in the Add Log Source Configuration dialog box. You can now choose custom parsers defined for a tenant as a log source in the same way as built-in parsers.

• AELDEV-67031: Added Root Tenant support for modular custom parsers in on-premises deployments.

  Added support for the Root Tenant to create and deploy modular custom parsers in on-premises deployments. The parser create, update, delete, deploy, and dry-run operations now accept the Root Tenant scope, providing feature parity with tenant-scoped parser management.

  The Root Tenant option was also added to the tenant selection in the Parser Studio connection settings step on Data Processors that serve only the root tenant, matching the tenant choices already offered by the Upload Custom Parser workflow.

• DATA-3578: Added support for ManageEngine PAM360 resource-audit session logs.

  Added support for ManageEngine PAM360 resource-audit session log messages in the ManageEngine PAM360 parser. These messages, received on port 6062, previously failed with an Unsupported format parser error because their syslog timestamp format was not recognized. The parser now supports additional syslog timestamp formats, and session events such as session start records are parsed and normalized into the Stellar Cyber schema.

• DATA-3576: Expanded the Barracuda firewall parser to support web filter logs from Barracuda CloudGen Firewall.

  Expanded the Barracuda firewall parser (port 5524) to parse the web filter logs that Barracuda CloudGen Firewall produces. These logs use a different structure from the firewall activity logs that the parser already supported, and previously failed to parse. The parser now extracts the source and destination IP addresses, the requested URL, and the URL category, and derives the action taken on the request from the numeric action code in the log. Parsed events are normalized into the schema for search, correlation, and detection.

• DATA-3567: Updated the Citrix ADC parser to map the client IP to the source IP field.

  Updated the Citrix ADC parser to map the citrix_adc.client_ip value to the top-level srcip field when the value is a valid IP address, while retaining the original citrix_adc.client_ip field. Placing the client IP address in srcip enables geolocation enrichment and standard source-IP-based filtering and detections for Citrix ADC events.

• DATA-3565: Improved modular parser error visibility with searchable error records.

  Improved modular parsers to emit a searchable error record when parsing or normalization fails, matching legacy parser behavior. The record carries the raw message in parser_raw_msg and the failure reason in parser_err_msg, so failed records can be found and investigated in Threat Hunting.

• DATA-3557: Improved the Barracuda firewall parser.

  Improved the Barracuda firewall parser to enhance field extraction from Barracuda firewall logs, adding support for a new log header format and additional log instance type content. Parsed events are normalized into the Stellar Cyber schema for search, correlation, and detection.

• DATA-3548: Improved the ColorTokens parser to normalize IP addresses and other common fields.

  Improved the ColorTokens parser so that values carried inside the metadata object of an event are normalized to top-level fields. The destination IP address arrived enclosed in curly braces, which prevented the value from passing IP address validation and left the normalized destination IP address field empty. The parser now removes the enclosing characters before assigning the value, and also promotes the source IP address, the protocol, and the port to their normalized fields. Events from ColorTokens now support searching and filtering on these fields.

• DATA-3547: Updated the Linux Audit parser.

  Updated the Linux Audit parser to support auditd end-of-event (EOE) records. Parsed audit events are normalized into the Stellar Cyber schema for search and correlation.

• DATA-3533: Extended the Imperva parsers to extract additional fields.

  Extended the Imperva log parsers to extract additional fields. In the Imperva - SecureSphere (CEF) parser, fields such as description, reason, requestmethod, applicationname, requestclientapplication, requestparameters, and requestcontext moved from the message data to the vendor namespace, with normalization added for the event start time and application name. The Imperva - SecureSphere parser received similar vendor-field coverage. These fields are now available in parsed records for search, filtering, and detection.

• DATA-3528: Improved the Penta Security WAPPLES WAF parser to normalize the destination IP address and port.

  Improved the Penta Security WAPPLES WAF (Web Application Firewall) parser to separate the destination IP address and port from the combined value that these logs carry. This value was previously retained only as a string, which left the normalized destination IP address and destination port fields empty. Parsing now also handles events in which the URI field is empty, a case that previously prevented the destination values from being extracted at all. Events from this device now support searching and filtering on the destination IP address and destination port.

• DATA-3512: Added Ubiquiti EdgeSwitch key-value pair log format support.

  Added support for the key-value pair (KVP) log format produced by Ubiquiti EdgeSwitch switches, including Netfilter log messages. The parser previously handled only the CSV format; both formats are now parsed and normalized into the Stellar Cyber schema.

• DATA-3511: Added Raw Log Capture support for Parser Studio v2 parsers.

  Added Raw Log Capture support for parsers built with Parser Studio v2. When Raw Log Capture is enabled for a sensor, records produced by v2 parsers now include the parser_raw_msg field containing the original raw log, matching the behavior of v1 parsers.

• DATA-3506: Added Apache HTTP Server (HTTPD) parser support for forwarded access-log messages.

  Added support for a forwarded log format in the Apache HTTP Server (HTTPD) parser, covering access-log messages embedded in forwarded syslog events. The parser extracts fields such as the source IP address, request path, URL, and user name from the embedded access-log entry, so these events can be searched, filtered, and used for investigations.

• DATA-3499: Added alert integration for Palo Alto Networks logs in LEEF format.

  Added alert integration support for Palo Alto Networks logs delivered in LEEF format. Alerts reported in LEEF-formatted events are now integrated in the same way as those in BSD format, and the LEEF format works with the existing unified threat management (UTM) enrichment.

• DATA-3486: Improved SonicWall IPS severity mapping to match SonicWall documentation.

  Improved the SonicWall Firewall parser so that intrusion prevention system (IPS) severities align with the documented SonicWall priority values. The ipspri value now maps 0 to critical, 1 to high, 2 to medium, and 3 to low, so alert severities are consistent with the SonicWall IPS signature ratings.

• DATA-3467: Improved the Citrix NetScaler parser with expanded event coverage.

  Improved the Citrix NetScaler parser to extract structured fields for approximately 30 additional event types, including login, logout, ICA session, SSL handshake, application firewall, device and monitor status, and OAuth, SAML, and AAA messages that were previously only partially parsed or dropped. An issue was fixed where quoted log messages, common in SSL handshake logs, were stored raw with no field extraction. Several vendor fields were renamed to descriptive names, such as citrix.partition, citrix.seq_num, and citrix.num, and parsed records can now include additional fields such as the user agent, protocol, duration, and URL.

• DATA-3462: Improved the F5 - ASM (CEF) parser to parse events consistently.

  Improved the F5 - ASM (CEF) parser to parse F5 BIG-IP ASM events consistently. Previously, some F5 events were parsed correctly while others were not. The parser now detects the request body reliably and parses JSON HTTP request bodies, so the reported event variations are handled uniformly.

• DATA-3442: Improved the Check Point - SmartConsole (CEF) parser to extract additional fields.

  Improved the Check Point - SmartConsole (CEF) parser to extract additional fields from Check Point log messages. Additional known fields carried in the message data are now parsed into structured fields for searching and correlation.

• DATA-2637: Improved the WatchGuard firewall parser to extract event description fields.

  Improved the WatchGuard firewall parser to parse the information contained in the event_description field into separate structured fields for known event types. The additional fields improve searching, filtering, and correlation for WatchGuard firewall events.

Usability

New Features

• AELDEV-73672: Added a Metadata Dictionary link in the Parser Studio normalization step.

  Added a Metadata Dictionary hyperlink next to the Use Template dropdown in Parser Studio Step 3 (Normalization) Field Mapping. The link opens the Standard Metadata Dictionary documentation, giving you a reference for mapping vendor fields to Stellar Cyber standard fields.

• AELDEV-70028: Added a timezone preference to Automated Threat Hunting (ATH) email recipients.

  Added an optional Timezone setting to the email recipient (System | Recipients) that can be used by Automated Threat Hunting (ATH) playbooks. The selected IANA timezone is stored with the recipient and can be set, updated, or cleared. Leaving the field empty indicates no preference. Invalid timezone values are reported as an inline validation error on the form.

  The ATH email template rendering was also updated so that timestamps appear in the preferred timezone of each recipient, in RFC 3339 format with a numeric offset and with daylight saving time transitions handled by the IANA timezone database. Recipients without a timezone preference continue to receive timestamps in UTC, unchanged from previous behavior.

• AELDEV-68354: Added API support for creating System Action Center (SAC) actions.

  Added the ability to create System Action Center (SAC) actions through the public API across all trigger categories: Case Management, Cluster Health, Data Storage Capacity, Disk Capacity, NFS Data Sink Capacity, Scheduled Report Monitoring, User Modifications, and License Usage. Triggers cover case activity, cluster health turning red, database and disk storage reaching capacity limits, NFS data sink capacity, scheduled report failures, user and role changes such as account lockouts and privilege escalation, and drops in the licensed asset count. Automated actions can now be provisioned programmatically in addition to through the user interface, so notification and response policies can be managed at scale across tenants.

• AELDEV-67820: Added a public API endpoint to initiate Server Sensor uninstall from the Stellar Cyber Platform.

  Added a public API endpoint, POST /connect/api/v1/data_sensors/{sensor_id}/uninstall, that initiates a remote uninstall of a Windows or Linux Server Sensor. The uninstall is asynchronous: the endpoint accepts the request immediately, but the sensor record is removed only after the server sensor confirms that the uninstall succeeded. Only connected Windows and Linux Server Sensors support remote uninstall; requests for other sensor types are rejected. Deleting a sensor of an unsupported type removes only the record on the Stellar Cyber Platform without uninstalling the software on the host. This allows automation of Server Sensor removal without using the user interface.

  Also added role-based access control (RBAC) enforcement to the sensor endpoints in the public API under /data_sensors. These endpoints are now gated by the same privileges that govern the equivalent actions in the user interface, so an API user whose privilege profile does not grant the required privilege receives a 403 response where the request previously succeeded. Review the privilege profiles assigned to API users and automation that call these endpoints before upgrading. Enforcement on the pre-existing endpoints is enabled by default and can be disabled for an organization as a transition measure; the privilege check on the new uninstall endpoint is always enforced.

• AELDEV-67002: Added Microsoft Defender for Endpoint response actions to Threat Hunting and Action History.

  Added support for new Microsoft Defender for Endpoint response actions on the Threat Hunting and Automation | Action History pages. The actions are: Collect Investigation Package, Restrict App Execution, Stop and Quarantine File, and Run Antivirus Scan. On the Threat Hunting page, the actions are offered when microsoft_defender.machineId (for Alerts data) and microsoft_defender.id (for Host data) is present in the alert or host event. Stop and Quarantine File additionally requires the field microsoft_defender.evidence[].sha1 (for Alerts data). On the Automation | Action History page, the new actions appear in the Endpoint Actions tab. See Configuring Microsoft Defender for Endpoint Connectors.

• AELDEV-66747: Added case metrics for measuring case operation times.

  Added case metrics, which let you measure how long case operations take. Each metric is a timer that Stellar Cyber starts, pauses, and stops based on conditions you define, such as the time from case creation to acknowledgment by an analyst or the total time from creation to resolution. Case metrics are configured in the Case Metrics tab of the case settings, letting you measure the response times of your SOC team against the operational targets you track.

• AELDEV-66489: Disabled the Add as excluding filter option on the parser page.

  Disabled the Add as excluding filter option on the parser list page under System | DATA SOURCE MANAGEMENT | Parser Studio | Parsers. The option did not filter the parser list for built-in fields; disabling it prevents confusion from a control that had no effect.

• AELDEV-62025: Added a public API endpoint to generate sensor installation tokens.

  Added a public API endpoint, POST /connect/api/v1/data_sensors/installation_tokens, that creates a sensor installation token for a given tenant and sensor profile. The request specifies cust_id, sifter_policy_id, and expire_days. The returned token is OS-agnostic, so it can be used for both device sensors and Windows or Linux Server Sensors to automate sensor onboarding. The endpoint is available on SaaS deployments only and requires the /token_management privilege.

Improvements

• AELDEV-73161: Updated the log filter Log Source field label to indicate Log Forwarder scope.

  Updated the log filter configuration so the Log Source field is labeled (Log Forwarder only). The field applies only when a filter targets a log forwarder and should be left empty for connectors or Windows sensor event logs, so the clarified label helps you avoid misconfiguration.

• AELDEV-71377: Improved original record queries for ML correlation detection alerts.

  Improved original record queries for machine learning correlation detections. When an alert document includes a correlation_info field, the referenced records are looked up by index and document ID and appended to the existing original record results. Analysts reviewing correlation-based alerts, such as pass-the-ticket detections, can see the correlated source records alongside the triggering record.

• AELDEV-70114: Improved API error messages to identify the failing downstream service.

  Improved API error responses so that the error label identifies the downstream service that actually failed. Previously, failures from services such as the Threat Intelligence Platform (TIP) controller were reported as originating from the central management service, which was misleading when diagnosing issues.

• AELDEV-69501: Added tenant mapping validation of the Stellar Cyber Tenant ID against the tenant name.

  Added validation on the tenant mapping page so that an entry cannot be submitted when the Stellar Cyber Tenant ID does not match the Stellar Cyber Tenant Name. This check prevents misconfigured tenant mapping entries from being saved, preserving the integrity of tenant mappings.

• AELDEV-68264: Added Cybereason support for alerts that span multiple machines.

  Added support to the Contain/Isolate Host response action on the Cybereason endpoint detection and response platform. A Cybereason detection correlates related malicious activity into a malicious operation, or Malop, which can involve multiple machines. The Target Value in the Contain Host action is now automatically populated with the ID of a single Cybereason machine (cybereason.pylumId) or a list of machines (cybereason.machines).

  The Stellar Cyber Platform now reads the machine identifiers recorded in the alert. For a Malop involving one machine, you can contain the host directly. For a Malop involving multiple machines, you can select the host to isolate. See Configuring Cybereason Connectors and Understanding Event Details.

• AELDEV-67803: Added yearly and past-month views to the Asset License Usage Data page.

  Added a yearly view and a past-month view to the Asset License Usage Data page. The Past 12 Months view charts monthly entity counts for the past 12 months, and a month selector displays daily counts for any month within the past year, with tenant and tenant group scoping and CSV export supported for both views. The existing Past 30 Days view continues to work unchanged.

• AELDEV-67525: Updated API error responses to rename the request identifier field.

  Updated API error responses to return the request identifier as request_id instead of requestId. This aligns error responses with the snake_case field naming convention used across the Stellar Cyber Platform APIs, such as cust_id, for consistent log correlation and client-side handling. The renamed field appears in server (5xx) error responses.

• AELDEV-28743: Updated the tenant group list API endpoint to exclude logo image data.

  Updated the tenant group list public API endpoint (/tenant_groups) so that responses no longer include the tgrp_logo image data. Logo images are instead retrieved on demand through the /tenant_group/{id}/logo endpoint, which reduces list response size and improves page load performance when working with tenant groups.

Early Access Program

If you're interested in testing out new features ahead of general availability, consider joining the Early Access Program (EAP) by contacting your Stellar Cyber Customer Success representative and telling them which EAP feature you want to test. Once you've agreed to the EAP terms and signed up, the EAP feature is unlocked for you.

The purpose of this program is to boost performance and reliability through real-world customer insights, giving you a hands-on role in shaping a Stellar Cyber feature. In return, you'll receive early access to upcoming releases and the chance to guide product development.

The following EAP features are in this release:

Exportable Dashboards — Report Integration

Exportable Dashboards lets you schedule dashboards created with the Dashboard Builder as recurring PDF reports. The schedule form includes a new Default PDF type that renders the dashboard as it appears in the Dashboard Builder, along with options to control table row counts, chart color palettes, and optional CSV exports. This capability lets you generate consistent, configurable reports from new dashboards while preserving the settings and PDF types used by existing scheduled reports.

XDR Connector Webhook Ingestion

This is a webhook framework that lets you post JSON data directly from any external system into Stellar Cyber, accelerating custom integrations and expanding your visibility across the entire security stack.

Customizable Case Correlation Strategies

This EAP feature introduces support for multiple case correlation strategies, allowing teams to evaluate and experiment with different approaches to grouping alerts into cases. Each strategy provides a distinct investigative perspective:

• Attacker-Centric Correlation groups alerts by the source (attacker) host, making it easier to track adversary behavior across multiple targets.

• Victim-Centric Correlation organizes alerts by the destination (victim) host, enabling focused protection and visibility on high-value assets.

• Multi-Entity Correlation links alerts across interconnected hosts and actions to form a single case, offering a holistic view of extended or lateral attack campaigns.

This flexibility enables security teams to tailor investigations based on their operational priorities—whether that’s identifying persistently targeted endpoints, tracing threat actor movements, or capturing full-scale intrusion campaigns.

Alert for Suspicious OCI Tenant-to-Tenant Communication

This EAP feature introduces a new alert type that detects cross-tenancy communications in the Oracle Cloud Infrastructure (OCI). By analyzing tenantId fields in audit logs, the feature identifies requests that target resources in a different tenancy. This provides accurate visibility into potentially unauthorized cross-tenancy activity and strengthens oversight in OCI environments.

To join the Early Access Program and begin testing these features, contact your Stellar Cyber Customer Success representative.

Resolved Issues

The following issues were resolved in this release.

• AELDEV-74798: Fixed SentinelOne Alerts and Deep Visibility (SDL) content types.

  Fixed SentinelOne Alerts and Deep Visibility (SDL) content types that were getting stuck with a stale checkpoint by capping the backlog catch-up time to 3 hours.

• AELDEV-73835: Fixed Linux Server Sensor disconnects on Ubuntu 26.04 that were caused by a removed system library.

  Fixed Linux Server Sensor disconnects on Ubuntu 26.04, which no longer ships the libcurl-gnutls.so.4 shared library that the Server Sensor control process required. The Server Sensor packaging now provides the dependency, so Server Sensor on Ubuntu 26.04 run without the removed system library.

• AELDEV-72281: Fixed repeated re-triggering of Automated Threat Hunting rules on query timeouts.

  Improved Automated Threat Hunting (ATH) rule execution so heavy queries that time out no longer re-trigger every two minutes. Rule progress is now tracked even when a query times out, preventing repeated execution of long-interval queries and saturation of the search queue.

• AELDEV-72117: Fixed Azure VTAP port mirroring producing no traffic records.

  Fixed an issue in which VXLAN port mirroring from an Azure virtual network TAP (VTAP) delivered packets to the sensor interface, but the traffic was never processed or recorded in the Traffic index. The VXLAN interface on the sensor is now bound to the network interface that receives the mirrored packets, so mirrored Azure traffic is parsed and recorded.

• AELDEV-71954: Fixed Acronis connector handling of HTTP 400 responses.

  Improved the Acronis connector to treat HTTP 400 responses as configuration issues rather than connector failures. Configuration problems, such as querying a tenant that is not a partner tenant, are no longer reported as connector reliability errors, making genuine connector failures easier to identify.

• AELDEV-71502: Corrected the MITRE ATT&CK mapping of the RDP Suspicious Logon alert type.

  Corrected the MITRE ATT&CK mapping of the RDP Suspicious Logon alert type from T1572 (Protocol Tunneling) to T1021.001 (Remote Services: Remote Desktop Protocol) to align with the observed activity. Because the Stellar Cyber Platform supports multiple techniques per detection, the tunneling context is retained as a secondary technique.

• AELDEV-70760: Fixed FortiGate administrative session exhaustion during automated response actions.

  Updated the Fortinet FortiGate responder to log out of the firewall after each block or unblock action instead of leaving the administrative session open until the device idle timeout. This prevents automated response rules that fire many actions from exhausting the FortiGate administrative session pool, matching the behavior of the other firewall responders.

• AELDEV-70235: Fixed Palo Alto Networks respond actions failing with timeouts.

  Fixed Palo Alto Networks firewall respond actions that could fail with a timeout and return a message referencing an incorrect IP address. The default action timeout was increased to 10 minutes, so long-running actions complete instead of timing out.

• AELDEV-69890: Fixed sensor log rotation to prevent unbounded log file growth.

  Fixed log rotation for the log collection service (td-agent) on sensors. Log files could previously grow to several gigabytes without rotating; the rotation configuration was corrected so rotation occurs as scheduled, preventing excessive disk usage on the sensor.

• AELDEV-62383: Fixed a Linux Server Sensor failure on Debian 12 caused by a library version mismatch.

  Fixed a Linux Server Sensor failure on Debian 12 in which services failed to start with a symbol lookup error because of a library version mismatch involving libcurl-gnutls.so.4 and the nghttp2 HTTP/2 library. The sensor now links against a compatible HTTP/2 stack and checks for the libnghttp2-14 package at runtime. Systems using minimal or custom Debian images must ensure that the libnghttp2-14 package is installed and not pinned to an incompatible version.

• AELDEV-46633: Fixed false positives in process_creation_commandline_15 rule.

  Fixed the rule to detect suspicious scan loop networks (process_creation_commandline_15 ), which matched specific commands in the command line. However the rule incorrectly triggered on the word "stopping" because it contained the substring ping. Command lines containing words such as "stopping" no longer trigger false positives.

• DATA-3634: Fixed log filter rules that never matched when the rule used a numeric equality or inequality operator.

  Fixed an issue in which a log filter rule that used the numeric == or != operator never matched, so the affected logs were forwarded instead of being filtered. The comparison for these two operators evaluated the value from the record and the value from the rule without first converting them to a common type. Because a parser emits field values as strings and a filter rule stores numeric values as numbers, the comparison always returned false and every record passed through the filter unchanged. The relational operators <, <=, >, and >= were not affected, because those comparisons already converted values before evaluating them. Log filter rules that use the numeric == and != operators now match as expected.