New Features
Data feeds can be configured to authenticate using OAuth2 Client Credentials, available alongside the existing OAuth2 authentication option.
DataBee supports ingesting user, device, patch state, and audit data from Automox via a new API-based data feed.
Microsoft Teams can be configured as an output type for Data Quality Alert and Remediation workflows.
Feature Enhancements
REST API keys generated from the Account Profile page expire after 90 days instead of one year.
The Data Catalog's Lineage view includes lineage for Report Provisioning's StarRocks and Snowflake views.
The Data Catalog's Lineage view shows feed-to-OCSF column-level lineage for each data feed.
The Atos feed supports a configurable historical lookback window (up to 365 days) instead of always fetching only the last day of data.
The Atos feed supports multiple comma-separated group names instead of requiring a separate feed instance per group.
The Session Management page displays helper text showing the maximum allowed session duration value.
Accuracy improvements were made to the data model that powers Vulnerability Compliance reporting.
The DataBee logo across the application, login and SSO pages, favicon, and email templates has been updated to the latest brand assets.
Cloud resource entities are now automatically removed from the asset inventory after a configurable period of inactivity, consistent with other entity types.
The Microsoft Intune feed maps additional audit event types to their proper OCSF event schemas instead of routing them to Base Event.
The Microsoft Entra feed maps additional directory audit event types to their proper OCSF event schemas instead of routing them to Base Event.
The Microsoft Entra Role Members feed supports a second event that reports PIM assignment details (assignment type, start/end time) for directory role members.
The Jamf Device Manager feed reports a device encryption flag when the device report indicates file or block encryption.
The DataBee version number is no longer displayed in the footer of the user interface.
Owner Discovery can now suggest device and account owners by matching full names against the data lake when no authentication history is available.
The Data Lineage view shows how many active entities were created per data feed.
ServiceNow remediation action tickets only expose an allow listed set of Incident and Ticket fields for users to configure.
Bug Fixes
Security Posture Coverage Compliance evaluates the SLA and criteria conditions independently so a stale device no longer masks a separate criteria failure.
Control module data refreshes reliably on its schedule after fixing issues that could leave Continuous Controls Monitoring dashboards showing outdated data.
Fixed an issue that caused the Inventory Value Breakdown widget to fail with an error when a vulnerability finding had no severity value.
Fixed a deduplication issue in the Cyber Vulnerabilities data that caused rows to be dropped, and added status, due date, fix-available date, remediated date, and vendor ID fields to support vulnerability remediation tracking.
Test Connection no longer fails with an HTTP 502 error when configuring the Tenable Vulnerability Management feed.
Test Connection correctly shows a success message for the Rapid7 Nexpose Vulnerability Scanner feed instead of appearing to do nothing.
Test Connection no longer intermittently times out when configuring the Workday HR feed.
Test Connection works correctly when configuring the BlackKite feed.
Test Connection reliability is improved during data feed onboarding after a pipeline-builder dependency update.
The Home Page preference dropdown in Profile Preferences includes User Access Review and DataBee RiskFlow as selectable options.
Customizing columns on an entity details page no longer redirects users back to Search, and saved default search filters are now preserved when viewing from the details page.
Pagination controls on the Feed History page correctly send page size and page number to the server.
To prevent intermittent authentication failures, the VMware vCenter, Informatica, Jamf Protect, Forescout EyeSight, Dataminr, Delinea Privilege Manager, Palo Alto Prisma Cloud, ThreatX WAF, Wiz, CyberArk Privilege Access Manager, CyberArk EPM, Salesforce, Google Apigee, Google Cloud Identity, CyberArk Privilege Cloud, Entrust, and Armis feeds refresh their access token immediately before each API call.
The Cisco Umbrella, Illumio Core, and Delinea Privilege Manager feeds no longer crash when the HTTP status code field is null or empty.
Tenable Vulnerability Management data includes FIXED vulnerabilities again, along with rescan-confirmed status and vendor advisory IDs.
The Palo Alto Prisma Access feed ingests data correctly from S3 files that include a plain-text metadata header before the compressed content.
Re-enabling a data collector no longer shows an incorrect confirmation message about re-enabling its data feeds, which now correctly remain disabled.
Applications that have never been recorded by a configured CMDB or discovery tool are no longer incorrectly reported as retired in Application Management.
Devices with a correctly configured CMDB source no longer incorrectly fail the CMDB coverage test in Device Management.
The user management Resend Invite action for Okta-managed accounts behaves consistently in every environment.
An issue preventing tenant users from logging in to DataHub due to a mismatched authentication cookie name is fixed.
Clicking the first seen date link on the entity 'User Not Found' alert now correctly navigates to the entity details page instead of reloading the same alert.
The Save button on the Data Quality Workflow creation form stays disabled until all required fields, including empty array values, are properly populated.
The Iceberg Data Lake page no longer fails to render with a JavaScript error when only one data lake type is configured.
Entity age-out calculations use the correct activity timestamp, preventing entities from being retained or removed from inventory incorrectly.
The Microsoft XDR feed overlaps query timeframes between ingestion cycles and adds a retry delay after errors to prevent missed records.
The Test Connection button for the LogicGate feed no longer returns a 404 error during onboarding.
Vulnerability records from the Wiz feed keep a stable, consistent vulnerability ID across scans instead of generating a new one each time, preserving historical lineage.
UAR Review Items for Okta SSO applications display the application's description instead of the full raw Okta application object.
The Tenable Vulnerability Management feed no longer crashes with an out-of-memory error during ingestion.
The Test Connection button is available again for the ServiceNow Business Continuity Management and ServiceNow Hardware Asset Management feeds.
The Azure AD feed handles skip-token expiration errors so ingestion does not fail partway through pagination.
Device Type values for virtual machines across several feeds reflect the device's functional role (such as server or desktop) instead of showing Virtual, with virtualization tracked separately.
Stale devices from the Illumio Core and Halcyon feeds age out correctly instead of staying active indefinitely from repeated daily snapshot ingestion.
User entity names across several feeds are parsed consistently, fixing malformed guest-account and object-ID-prefixed usernames shown across multiple tenants.
The Microsoft Defender for Endpoint feed handles skip-token expiration errors so ingestion does not fail partway through pagination.
The Tenable Vulnerability Management feed derives a device's hostname from its FQDN when Tenable's API returns an empty hostname, preventing duplicate device entities.
An issue preventing custom control documentation from being deleted on the Knowledge Base page is fixed.
An issue causing the invalid owners data health metric to be calculated incorrectly for Iceberg-backed tenants is fixed.
Snowflake Data Export no longer intermittently stops writing data without logging an error.
Application descriptions shown in the access review campaign application picker are correctly aligned with the underlying data.
Admins can create a Data Quality Workflow without encountering an Internal Server Error.