What's Changed
- feat(azure): authenticate with a pre-issued ARM access token by @kunaals in #3375
- feat(microsoft): authenticate Entra with a pre-issued Graph access token by @kunaals in #3376
- fix(rules): report delegated-admin GuardDuty findings once by @kunaals in #3378
- fix(aws): delete orphaned pre-data-model nodes after AWS sync by @kunaals in #3379
- fix(aws): skip a Glue region on transient failures instead of failing the account by @kunaals in #3381
- fix(rules): report one Tailscale device per hostname by @kunaals in #3383
- fix(rules): only flag in-scope accounts as missing CloudTrail by @kunaals in #3384
- docs(github): repo webhooks need only the repo scope by @kunaals in #3380
- fix(rules): keep framework display names in their original casing by @kunaals in #3385
- feat(azure): add --azure-requested-syncs for selective sync by @kunaals in #3387
- refactor(tenable)!: model CVEs as TenableCve nodes instead of an indexed list by @serge-wq in #3310
- feat(azure): expand default permission relationship mappings by @kunaals in #3389
- feat(opsgenie): add account, team, user, and schedule inventory by @kunaals in #3251
- fix(crowdstrike): make large-tenant syncs finish by @kunaals in #3390
- feat(rules): cover runtime GuardDuty threats, public RDS, admin static keys by @kunaals in #3394
- docs(crowdstrike): document required API scopes and console location by @kunaals in #3397
- fix(aws): link GuardDuty findings to their own account and to ECS clusters by @kunaals in #3399
- fix(snowflake): skip a schema on an intermittent 400 for every per-schema listing by @kunaals in #3402
- fix(orca): keep short-but-ended fetches and skip cleanup instead of failing by @kunaals in #3403
- perf: run each index query once per session; pick up google-api-core import fix by @kunaals in #3391
- ci: run unit tests across processes with pytest-xdist by @kunaals in #3393
- ci: shard integration tests across jobs; run mypy in its own job by @kunaals in #3392
- ci: refresh integration shard durations monthly by @kunaals in #3400
- feat(aws): sync AWS Organizations service control policies by @kunaals in #3401
- fix(microsoft): stream Intune report exports instead of materializing them by @kunaals in #3405
- refactor(aws): migrate resourcegroupstaggingapi to the data model by @kunaals in #3404
- refactor(okta): model AWS role mappings by @kunaals in #3227
- feat(microsoft): ingest Defender endpoint machines and unresolved alerts by @kunaals in #3276
- fix(aws): batch permission relationship writes by @kunaals in #3413
- feat(rules): add Kubernetes storage security findings by @kunaals in #3204
- fix(ontology): normalize DNS hostnames at ingestion by @kunaals in #3231
- feat(ontology): link DNS records to Railway domains by @kunaals in #3222
- feat(railway): resolve deployed images by digest by @kunaals in #3223
- feat(ontology): link DNS records to Modal, Cloud Run, Netlify, and Scaleway endpoints by @kunaals in #3416
- fix(orca): bound vulnerability cleanup transaction size by @kunaals in #3314
- fix(orca): skip closed and dismissed alerts by @kunaals in #3412
- fix(supply-chain): read supply-chain data in retried read transactions by @kunaals in #3411
- fix(neo4j): consume index-creation results inside the retry by @kunaals in #3410
- fix(dns): decode Route53 wildcards and close DNS ontology gaps by @kunaals in #3418
- fix(microsoft): retry Intune export jobs that complete without a URL by @kunaals in #3420
- feat(entra): sync MFA registration, identity risk, and tenant domains by @kunaals in #3419
- fix(crowdstrike): sync hosts when the API client cannot read Spotlight by @kunaals in #3428
- test(ontology): resample DNSRecord indexes before asserting index seeks by @kunaals in #3432
- perf(matchlinks): check sub-resource scope with EXISTS so endpoints seek their index by @kunaals in #3433
- feat(okta): authenticate with an OAuth service app by @kunaals in #3434
- perf(analysis): gate incremental_on variables inside their own pattern by @kunaals in #3435
- docs(okta): explain how the service app's admin role and scopes combine by @kunaals in #3439
- fix(ontology): stop projecting CrowdstrikeFinding AFFECTS Device by @kunaals in #3447
- fix(ontology): drop the CrowdstrikeFinding AFFECTS Device rel from DeviceSchema by @kunaals in #3448
- chore: bump types-requests from 2.33.0.20260906 to 2.33.0.20261006 by @dependabot[bot] in #3431
- chore: bump aiohttp from 3.14.3 to 3.14.4 by @dependabot[bot] in #3449
- chore: bump the minor-and-patch group with 14 updates by @dependabot[bot] in #3430
- chore: bump the minor-and-patch group across 1 directory with 5 updates by @dependabot[bot] in #3450
- fix(rules): key AI third-party app facts on the app node, not its client id by @kunaals in #3451
- fix(crowdstrike): restart Spotlight paging when the cursor expires by @kunaals in #3452
- feat(semgrep): Add AI findings by @heryxpc in #3438
- fix(semgrep): load findings page by page instead of buffering every page by @kunaals in #3461
- docs(semgrep): require the Web API token scope by @kunaals in #3462
- fix(trivy): canonicalize Alpine-suffixed CVE ids by @kunaals in #3463
- fix(orca): skip vulnerability rows without a canonical CVE id by @kunaals in #3464
- perf(cleanup): delete stale nodes in one scan per million rows by @kunaals in #3455
- fix(tenable): link CVEs through plugins and scope TenableCve to the tenant by @kunaals in #3437
- feat(cloudflare): ingest Access applications, policies, and DNS links by @Swayam-code in #3445
- feat(rules): flag Defender machines without Intune enrollment by @kunaals in #3466
- chore: bump the minor-and-patch group with 11 updates by @dependabot[bot] in #3470
- chore: bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 in the minor-and-patch group by @dependabot[bot] in #3469
- chore: bump azure-mgmt-network from 32.0.0 to 33.0.0 by @dependabot[bot] in #3471
- chore: bump certifi from 2026.1.4 to 2026.10.19 by @dependabot[bot] in #3472
- chore: bump virtualenv from 21.7.13 to 21.14.9 by @dependabot[bot] in #3473
- feat(kube): Connect GKE and Kubernetes inventory, workload identity, and load balancers by @kunaals in #3270
- fix(gcp): set returnPartialSuccess on Compute aggregatedList request URI by @kunaals in #3475
- fix(gcp): bound Vertex AI list calls with a per-request deadline by @jychp in #3478
- fix(gcp): bound Artifact Registry list calls with a per-request deadline by @jychp in #3479
- fix(github): detect secret references in compound expressions by @Swayam-code in #3468
- feat(digitalocean): firewall improvements by @damixen in #3245
- feat(aws): add EC2 root filesystem targets and Trivy VM ingestion by @t-dang-dot in #3474
- fix(azure): read current SDK shape in application gateway transforms by @kunaals in #3481
- feat(azure): link application gateway backend pools to App Services by @kunaals in #3482
- feat(ontology): link DNS address records to PublicIP by @kunaals in #3484
- fix(azure): normalize current SDK shape for load balancers and firewalls by @kunaals in #3485
- feat(aws): model trust-policy conditions on the role trust edge (#3078 tier 1) by @Dashtid in #3088
- feat(aws): record whether a role trust requires an external ID by @achantavy in #3487
- fix(okta): retry 5xx responses in collect_paginated by @kunaals in #3496
- fix(entra): fetch group owners and members concurrently by @kunaals in #3498
- feat(databricks): split loading from cleanup and scope Unity Catalog to the metastore by @kunaals in #3488
- fix(databricks): stable workspace identity across workspace and account paths by @kunaals in #3492
- feat(databricks): authenticate Azure workspaces with Entra ID service principals by @kunaals in #3493
- fix(rules): pair Azure IAM facts with the subscription's own role definition by @jychp in #3497
- feat(kubernetes): link AWS target groups to services via TargetGroupBinding by @kunaals in #3504
- feat(semgrep): let orchestrators defer dependency cleanup until every deployment has loaded by @kunaals in #3500
- fix(salesforce): scope node ids to the org so sandboxes don't merge with production by @kunaals in #3499
- feat(gcp,kubernetes): link GKE network endpoint groups to services by @kunaals in #3505
New Contributors
- @Swayam-code made their first contribution in #3445
- @t-dang-dot made their first contribution in #3474
- @Dashtid made their first contribution in #3088
Full Changelog: 0.143.0...0.144.0