SGNL Release Notes

CAEP Hub

• Workflow previews now include additional detail, and workflows can be duplicated with a new clone action
• Added an “Add to New Workflow” shortcut on Protected System Actions to accelerate workflow creation
• Fixed a dashboard gap so Rules and Workflows are consistently surfaced

Systems of Record

• Fixed LDAP add and modify operations to correctly handle scalar string attribute values

Protected Systems

• Access API now returns HTTP 499 for requests that are cancelled by the client, making it easier to distinguish client-side aborts from server errors

Administration

• Audit log entries now include display names alongside resource IDs, making history easier to read at a glance

CAEP Hub

• Workflow test results now surface the step-level error message when a step fails, making failures actionable at a glance.
• Added bulk retry and bulk remove-from-queue for the CAEP Hub failed queue.
• Action outputs are now easier to discover: the UI surfaces action nameKey and fixes several output-reference discoverability issues.

CAEP Hub

• The CAEP Hub test action now includes LDAP and HTTP transaction capture, so authors can inspect exactly what an action sent and received during a test run.

Systems of Record

• The on-prem connector detail page now includes a Usage tab, so operators can see which SORs, Protected Systems, and directories depend on a given connector before making changes.
• Endpoint labels on connectors now show the endpoint type name instead of a generic Endpoint N, making configuration much easier to scan.
• Active Directory group deletes are now protected against mass member removal, preventing accidental full-group deletions from propagating.
• Fixed a mismatch between the dashboard entity count and the Systems of Record list count.

Administration

• Policy Lens decision responses now include ipAddress and deviceId for richer context.

CAEP Hub

• The custom-action Git ref discovery flow now warns when the Git reference is changed on an existing custom action, so operators don’t silently swap out the code behind a live action.
• Fixed the Retrieve Refs button so it enables correctly after entering a URL with No Authentication selected.

Systems of Record

• Added a new Advanced / Copy JSON view to the Directory editor, making it easy to inspect and share the raw directory configuration.

Administration

• Policy Lens now shows the full directory query response as JSON, making it easier to inspect exactly what the query returned during a decision.
• The provider Hook Endpoint field is now hidden when enhanced provider hook routing is disabled, matching the effective behavior.

Administration

• Policy Lens deep-links from logs now carry the associated directory context, so a click from a log entry lands on the fully-hydrated policy view.
• Policy Lens decision responses now include the missing ipAddress and deviceId fields, restoring full request context on lens replays.

CAEP Hub

• Custom actions in the Action Catalog now enforce uniqueness on url + ref, preventing accidental duplicate catalog entries.

Systems of Record

• Added a Clone directory modal to the integration directory list, so operators can spin up a directory pre-populated from an existing one.

Administration

• Policy Lens now includes a Directory Context section with the underlying directory query and a transform preview, giving reviewers full context on why a decision looked the way it did.
• Log queries against nested JSON fields with dotted names are now sanitized correctly on the query path.

Policy

• Fixed a bug where a directory time-condition duration expression could render as [object Object].
• Directory property conditions now backfill the missing nodeName, so older snippets continue to evaluate correctly.

Improvements and Bug Fixes

• The CAEP Hub failed queue now offers an Include successful retries filter, so operators can see the full retry history when triaging.

CAEP Hub

• Action Catalog is now live – Rules and workflow builders now use the new catalog by default, with Git ref discovery and repository authentication surfaced directly in the Action Catalog form

Policy

• Snippet canvas now visualizes condition grouping (AND / OR / NOT), making complex logic easier to read at a glance.
• Time-based conditions are now available in the Directory snippet builder.
• Transform mapped-field values are auto-trimmed on save, eliminating a common source of “invisible whitespace” bugs.

Improvements and Bug Fixes

• Ingestion failure logs now include the full task context, making failed ingests easier to diagnose.

CAEP Hub

• The redesigned Workflow Builder now supports a test-workflow modal and per-step test-action button, so authors can validate steps without a full end-to-end run.
• CAEP Hub Failed Queue now shows a visual indicator when a failed workflow has been retried successfully.

Administration

• OIDC setup now supports assigning JIT provisioning permission sets, so users provisioned via OIDC get the right access on first login.
• New Action Catalog admin section for viewing and managing CAEP Hub actions.

Policy

• Logs V2 now includes a View in Policy Lens hover action, letting you jump from a log entry into a full-context decision replay.
• The snippet builder now dedupes the green/yellow relationship lines that could otherwise stack on complex charts.

CAEP Hub

• Triggers for intermediate PATH-node changes now work with SCIM 2.0 sources, and source ViewTasks are marked changed when an intermediate node is ingested — so downstream rules re-evaluate correctly.

Administration

• Permission sets can now be assigned to a user at creation time, removing the extra step of assigning after the user exists.
• New Falcon SGNL visual identity across the UI — refreshed icons, spinners, interstitial, and favicon.
• Fixed OIDC integration setup so optional scopes are no longer incorrectly marked as required.

Policy

• Snippets now surface attribute-insert with VSCode editing

CAEP Hub

• Added a first look at a dedicated Workflows experience — a workflows list, add-workflow modal, and read-only + editable builder pages with an inline preview chart.

Systems of Record

• Shared Signals streams now handle dynamic event types from the generic SSE transmitter, expanding the range of upstream sources you can consume.

CAEP Hub

• Failed workflow chains can now be resolved manually, with support for resolving all failed workflows tied to a given execution ID.
• Added a Remove from queue button for failed CAEP Hub workflows, so operators can clear items that shouldn’t be retried.
• Trigger evaluation now fires on intermediate PATH node changes, so views are re-processed when relationships along a path change — not just the endpoints.
• Editing an action-only field on a rule no longer surfaces a re-evaluation warning; the warning still shows for changes that genuinely require re-evaluation (including in the Snippet Builder).
• Rules now have an Enable rule toggle directly on the create/edit form.

Systems of Record

• OAuth2 token exchange now routes through the connector proxy for on-prem data sources, so on-prem SORs using OAuth2 work end-to-end without additional network egress.

Administration

• Transform response and error logs now include the principal ID and IP address, matching the earlier addition to request logs.
• Dotted JSON field names in log queries are now sanitized correctly, resolving a Loki filter bug that could break searches against nested fields.
• Logs V2 now includes filter pills, field typeahead, saved queries, and URL-synced state.

Policy

• The Access Service Directory API now returns the evaluationTime field, which was previously omitted from some responses.

CAEP Hub

• Disabling or deleting a rule or workflow now cancels its in-flight workflows, so state stays consistent with configuration.

Systems of Record

• Added CrowdStrike NGSIEM as a log stream destination, so you can forward SGNL logs directly into NGSIEM.

Administration

• New workflow permission sets give finer-grained control over who can create, edit, and operate workflows.
• Transform request logs now include the principal ID and IP address for improved auditability.
• The Entra hook endpoint now surfaces the provider-specific URL, making it clearer which endpoint to register on the identity-provider side.
• Log queries now backtick-quote dotted field names, so filters against nested fields work reliably.
• Log rows are now uniquely keyed per entry, resolving cases where entries sharing a request ID could visually collapse.

Policy

• Rule versions are now bumped automatically when the content of a referenced snippet changes, so rule history reflects meaningful policy changes.

CAEP Hub

• Added support for manually completing workflows that failed, so operators can move a stuck workflow forward without having to re-run it from the start.
• Workflow step failure policies are now honored end-to-end, giving you finer-grained control over how the system reacts when an individual step fails.
• executionPolicy=new is now respected even when a view task hasn’t been processed yet, so newly configured triggers behave consistently on first run.
• Triggers and Rules tables are now sorted alphabetically for easier scanning.
• CAEP Hub insights action counts now include skipped steps, giving a more accurate picture of workflow activity.

Policy

• Snippet builder no longer produces ID collisions between condition nodes on complex charts.

CAEP Hub

• Workflow Actions now validate arbitrary input parameters before execution, catching bad inputs before they reach downstream systems.
• Workflow output extraction now supports CEL bracket notation, making it easier to reference fields whose names aren’t valid identifiers.
• Workflow retries now pick up the latest action and integration configuration, so fixes to a misconfigured action take effect on the next retry without recreating the workflow.

Administration

• Log search now uses a new multi-value log search API, delivering faster and more expressive queries.
• Integration action addresses are now validated as full URLs when configured, so mistakes are caught earlier.

Administration

• We now provide capabilities for enhanced searching of SGNL Logs
• We’ve made improvements to managing snippets, triggers, and directory in the SGNL Console

Improvements and Bug Fixes

• Fixed a bug where Protected System Administrators could not modify transforms
• We improved the size and visibility of nodes in Data Lens

Policy

• The look and feel of creating relationship conditions has been improved

Administration

• AWS Assume Role with Web Identity is now Generally Available for Action authentication

Policy

• We’ve made it easier to view and manage applied Policies in the Protected System details pages
• We’ve made improvements to Snippet builder when modifying conditions

Systems of Record

• We’ve added improvements to how entities are managed within Systems of Record

Policy

• We’ve made minor improvements to the Snippet building experience

Policy

• We’ve launched Relationship Conditions, enabling you to put constraints or conditions on relationships that exist in Policy creation

Administration

• We now support Lists in Data Lens, enabling you to search for values that might exist in your entities and attributes
• We improved the size and visibility of nodes in Data Lens

Improvements and Bug Fixes

• We improved how we handle logs in the console

Administration

• Added support for HTTP Log Stream sinks, providing more flexibility in log destination configuration
• Enhanced action testing functionality to automatically use integration authentication and address when not explicitly provided

Improvements and Bug Fixes

• Improved handling of array values in Data Lens

Systems of Record

• Added sync status indicators on the dashboard for better visibility into data synchronization

Policy

• Enhanced custom context support across Protected Systems, Policy Lens, and Reports

Improvements and Bug Fixes

• Fixed a pagination bug in Access Reporting

Administration

• Improved parent-child entity relationship management with automation at entity creation time

Improvements and Bug Fixes

• Enhanced entity metrics to properly include nested children in counts

CAEP Hub

• Enhanced AWS Actions to support new authentication method ‘Assume Role with Web Identity’

Administration

• Added support for configuring additional OIDC scopes in admin security settings for enhanced identity provider integration

Improvements and Bug Fixes

• Improved S3 as an SoR data transfer efficiency

Systems of Record

• Added support for AWS STS Assume Role with Web Identity authentication for enhanced cloud integration

Protected Systems

• Added the ability to include context in Evaluations and Search requests

Administration

• Added session permission sets display in the admin header and tables for better permission visibility
• Enhanced snippet management with assignments view to track where snippets are being used
• Added triggers and rules to admin labels for improved resource organization and filtering

Administration

• Minor improvements to Provider Hook Visualizer experience