New Features
PingAccess log feed is added to DataBee, enabling ingestion and normalization of PingAccess authentication and access log events.
Users can create and delete custom control documentation independently of any configured compliance dashboard, allowing standalone compliance content to be managed without requiring a linked dashboard.
Users can create and delete compliance documentation via the REST API. Delete operations are restricted to non-out-of-the-box reports.
Feed semantic versioning is available in the DataBee interface. Users can view the version history and associated changes for each data feed release, improving traceability across development and support teams.
Feature Enhancements
Console pages can be deleted from the DataBee UI. Only user-created console pages can be deleted; out-of-the-box console pages cannot be removed.
RiskFlow is expanded to support User Access Review queries. Users can ask which applications have the most pending reviews, which managers have the highest review workloads, and which users have access to the most applications.
Device Inventory Compliance view is updated to apply ServiceNow Class prioritization when resolving custom device columns, improving accuracy for customers using ServiceNow CMDB as a device data source.
BambooHR feed employee data endpoint is updated to the current API version, with a test connection button added to validate feed configuration before deployment.
Vulnerability Compliance views include CVSS base score and severity rating sourced from OSINT vulnerability data, providing richer context alongside internally observed severity.
GitLab Security feed is updated with the required permissions and improved field mapping for more complete security event coverage.
GitLab Source Code Control feed is updated with the required permissions and improved field mapping for more complete code activity coverage.
AWS Macie feed is updated with test connection support, allowing users to validate their AWS Macie configuration before enabling ingestion.
Workday HR feed is extended to include city and postal code fields where available in the source data.
ServiceNow CMDB feed data mapping is improved, reducing the proportion of events routed to the base event class and increasing the number of supported events processed.
Device types are identified more accurately using operating system information when the reported device type is unknown. For example, a device reported as Unknown type with a macOS operating system is classified as a laptop.
The Workday Learning feed determines an appropriate initial lookback period to prevent ingestion failures caused by data volumes exceeding the WQL record limit.
The Contrast Security feed supports testing the connection during configuration, allowing users to validate feed credentials before enabling ingestion.
Bug Fixes
The issue where Force Owner Inference from the Entity Resolution page failed silently without displaying an error message is fixed.
The issue where API alerts for the Akamai API Security (NoName) feed did not auto-close when the triggering condition cleared is fixed.
The issue where device and user entities displayed backtrace stack traces instead of clean entity details in the UI is fixed.
The issue where Control Documentation PDF downloads contained incorrect content, UTC timestamps instead of the user's configured timezone, and missing sections is fixed.
The issue where vulnerability closure counts were lower than expected due to CVEs not being closed after a device was scanned by Qualys is fixed.
The issue where Troux application renames caused duplicate active application entity records in the platform is fixed. Renamed applications are correctly resolved to their existing entity.
The issue where the Intune-compliant device count on the Security Posture Compliance dashboard was inconsistent between runs is fixed.
The issue where compliance and entity views used incorrect record ordering, causing stale data to appear in Device Inventory Compliance, Device Entity, User Entity, and Security Training views is fixed.
The issue where User Access Review workflows did not update the data lake when all review items were approved or when a single application was denied is fixed.
The issue where completing a User Access Review campaign from the review interface returned a Bad Request error is fixed.
The issue where Nutanix feed incorrectly mapped VM hostnames to the device name field instead of the device hostname field is fixed.
The issue where the Microsoft Defender XDR feed missed records due to a null offset value in the pagination logic is fixed.
The Proofpoint Zenguide training feed mapping is updated to produce correct data output.
The issue where User Access Review retrieved inaccurate user group information due to sourcing from the incorrect CDP table is fixed. User group data is sourced from the Account Group table.
The issue where entity feed timestamps lost millisecond precision when writing first_seen and last_seen values to Snowflake CDPs is fixed.
The issue where the manager_id field was mapped inconsistently between Iceberg and Snowflake CDPs is fixed.
The issue where duplicate user records appeared in the Organizational Hierarchy CDP is fixed.
The issue where malformed field keys were silently ignored during entity field key reassignment is fixed. Malformed keys are removed.
The issue where Snowflake connections failed due to a missing schema configuration in cluster secrets is fixed.
The issue where Owner Discovery identified accounts instead of associated persons as discovered owners is fixed.
The issue where Azure Secure Score assessment records displayed missing subscription names is fixed.
The issue where the SailPoint IdentityNow feed experienced high data ingestion latency is fixed.
The issue where the Microsoft Defender for Cloud Apps feed experienced data ingestion delays is fixed.
The issue where the on-prem data collector failed to correctly parse API key headers containing AWS Secrets Manager ARN paths is fixed.
The issue where UUID values were mapped as device hostnames in the Microsoft Defender for Endpoint feed, resulting in incorrect device records, is fixed.