New Features
Palo Alto Networks Prisma Access feed is added to DataBee, enabling ingestion of network access, security threat, and CASB event data from Prisma Access SaaS deployments.
LogicGate feed is added to DataBee, enabling ingestion of business continuity management (BCM) data for reporting, dashboarding, and analytics.
A batch update endpoint is added to the entity management API, allowing multiple entity records to be updated in a single request instead of one at a time.
Feature Enhancements
Rapid7 Nexpose Vulnerability Scanner feed is updated to cache schema version 2.0 and supports the Test Connection button, allowing users to validate feed credentials before deployment.
JumpCloud feed is updated to cache schema version 2.0 and supports the Test Connection button, allowing users to validate feed credentials before deployment.
CrowdStrike Exposure Management feed supports an optional entity type filter (managed, unmanaged, or unsupported), giving users more control over which assets are ingested.
BlackKite feed supports filtering monitored companies by ecosystem group, reducing unnecessary API calls for large vendor portfolios.
Microsoft Defender for Endpoint Software Inventory feed mapping is improved to reduce memory utilization and improve processing efficiency.
Microsoft Intune feed adds retry handling for rate-limited requests to Microsoft Graph, improving ingestion reliability.
Data mapping efficiency is improved across data feeds, reducing the percentage of events classified under the generic base event.
Additional compliance reporting modules are available in the dashboard reporting view, delivered through an upgraded reporting backend.
Bug Fixes
The issue where users intermittently saw an "Error fetching config pages" timeout message during login is fixed by hardening authentication token verification against slow identity provider responses.
The issue where testing connectivity for a data feed failed when the credentials token field exceeded 255 characters is fixed.
The issue where the Data Overview page took up to 29 seconds to render before showing any content is fixed; sidebar navigation now loads independently of other startup steps, significantly reducing load time.
The issue where the Deadline date picker used when creating or editing a User Access Review campaign displayed with a light theme while Dark Mode was enabled is fixed.
The issue where creating a User Access Review campaign for an identity source with no available applications left excessive blank space before the Create Campaign button is fixed.
The issue where hovering over a worksheet tab when only one tab was open caused content below it to shift slightly is fixed.
The issue where compliance entity views required placeholder KPI values to be entered even when no KPIs applied is fixed by removing that requirement.
The issue where historical phishing simulation records were missing entitlement and row-access columns present on current records, causing schema drift in dashboard views, is fixed.
The issue where materialized dashboard views could render the entitlement name as an empty string even when correctly configured is fixed.
The issue where device and product records could retain an owner field pointing to an inactive or non-person account is fixed; a cleanup process now clears these stale owner values.
The issue where updating an entity through the entity management API applied changes using the full record history instead of an incremental update is fixed.
The issue where the Remediation Summary displayed a null ticket status and did not notify users when a compliance remediation campaign's ServiceNow ticket creation step failed is fixed.
The issue where the User Access Review campaign audit trail could show zero records for completed campaigns when the underlying data lake ingestion was delayed is fixed by adding a fallback that retrieves audit history in this scenario.
The issue where vulnerability-only evidence could incorrectly keep a device marked as active is fixed; device activity now depends only on authoritative presence signals.
The issue where a ServiceNow CMDB feed incorrectly classified some workstation configuration items as servers is fixed.
The issue where a vulnerability management feed could terminate unexpectedly due to excessive memory usage is fixed, improving feed reliability.
The issue where an AWS EC2 device mapping could associate a recycled hostname with the wrong device record is fixed; entity resolution now prioritizes the immutable instance ID ahead of hostname.
The issue where a software and vulnerability feed's pagination could lose events on API failures, and where vulnerability data used an unsupported time filter, is fixed.
The issue where a device feed could repeatedly re-ingest the same device using a stale timestamp, causing its "created" date to appear to change daily, is fixed.
Deprecations
The DataBee version number is no longer displayed in the application footer.