Stellar Cyber 7.0.0s Release Notes

Software Release Date:
Release Note Updated:

The Stellar Cyber 7.0.0s release delivers the following updates to the Stellar Cyber Open XDR platform.

The release notes are organized into these following sections:

Highlights

The following features are the highlights of this release.

Actions Required

There are no actions required in this release.

Behavior Changes

Changes that affect the way users interact with the product or interpret results are listed below.

  • AELDEV-67525: API error responses return the request identifier under a new name – The API error responses to return the request_id field in place of requestId were updated. After upgrading to 7.0.0s, integrations and scripts that parse the requestId field in server error responses no longer find it and might fail or lose log correlation. Update any integration that reads the error identifier to use the request_id field.

  • AELDEV-67820: Public API endpoints for sensors now require RBAC privileges – Role-based access control (RBAC) privilege enforcement was added to the public sensor endpoints under /data_sensors, which were previously reachable by any authenticated API user regardless of privilege profile. After upgrading to 7.0.0s, an API user whose privilege profile does not grant the privilege that governs the equivalent action in the user interface receives a 403 response where the request previously succeeded. Review the privilege profiles assigned to API users and automation that call these endpoints before upgrading. Enforcement on the pre-existing endpoints can be disabled for an organization as a transition measure; the privilege check on the new uninstall endpoint is always enforced.

  • AELDEV-28743: The tenant group list API no longer returns logo image data – The tgrp_logo field was removed from tenant group list API responses. After upgrading to 7.0.0s, integrations that read the logo image from the list response no longer receive the image data. Update these integrations to retrieve logo images on demand through the /tenant_group/{id}/logo endpoint.

Deprecated Features

The following features are deprecated.

Upcoming Deprecation: SentinelOne Deep Visibility API – The Deep Visibility content type in the SentinelOne connector will be migrated to the Deep Visibility (SDL) content type in 7.0.0 due to a SentinelOne API being deprecated. Refer to the following dates:

  • Standard SaaS: Feb 15, 2027

  • GovCloud: April 26, 2027

Make sure to migrate content types from Deep Visibility to Deep Visibility (SDL) before the API is deprecated.

Upcoming Deprecation: Trend Micro Cloud One v2.0 API – The Trend Micro Cloud One v2.0 API is being deprecated. If you previously used the Trend Micro Cloud One connector, you should now use the Trend Micro Vision One connector in 7.0.0 and the Endpoint Inventory content type, which is only supported in the v3.0 API. The Trend Micro Vision One v3.0 API covers what previously required two separate connectors: Trend Micro Vision One and Trend Micro Cloud One. The Endpoint Inventory content type replaces the Computers content type previously collected through the Trend Micro Cloud One connector.

Migration is available in 7.0.0 to customers who request it.

Autonomous SOC

New Features

  • ASOC-152: Added per-queue AI case summary and auto-triage settings for case queues.

    Added a Case Summary and Analysis section to the case queue create and edit workflow. The Case Summary setting enables AI-generated case summaries and analysis for cases in the queue, and the Auto-Triage setting enables the auto-triage agent for cases matching the queue conditions. Default queues, previously not editable, can now be edited for these two settings, and a new default AI Analyst queue for critical cases is created with the settings enabled.

    Case Summary is available to all customers. The Auto-Triage setting is available to licensed Autonomous SOC customers, and both settings appear only when the corresponding administrative setting is enabled. Added a dedicated case queue service that notifies the Autonomous SOC engine about case changes that need AI analysis, replacing the earlier mechanism that monitored the case database directly.

Detection/ML

New Features

  • AELDEV-69344: Added Cisco AMP alert integration.

    Added third-party alert integration for Cisco Advanced Malware Protection (AMP). Detection events reported by Cisco AMP, such as Threat Detected and Execution Blocked, are mapped into Stellar Cyber alerts, so you can centrally monitor endpoint detections, correlate them with other data sources, and use them for case creation without manual analysis. See Integration of Third Party Native Alerts.

    Also added connector normalization that maps Cisco AMP host, user, and file fields to Stellar Cyber canonical fields, enabling alert detection and asset extraction for endpoint events. The Cisco AMP event ID is emitted as a string to preserve full 64-bit precision, so the Find Original Record search links each alert back to its original events correctly.

  • AELDEV-68929: Added Ironscales alert integration.

    Added third-party alert integration for the Ironscales email security platform. Phishing, spam, attack, compromised, and account takeover detections reported by Ironscales are normalized into Stellar Cyber alerts and are available for correlation, case creation, and reporting. See Integration of Third Party Native Alerts.

    Also added normalization that promotes the incident classification, sender and recipient email addresses, and email subject to Stellar Cyber canonical fields, enabling Ironscales incidents to generate the alerts. This integration lets you monitor and investigate email-borne threats alongside alerts from your other security tools.

  • AELDEV-68306: Added an alert type for MS365 Login From New ASN.

    Added an alert type for Microsoft 365 sign-ins from never-before-seen networks. Added a customizable detection that triggers when a Microsoft 365/Entra ID account signs in from an autonomous system number (ASN) not previously observed in the historical sign-in activity. The detection supports a configurable lookback period and a training period, and applies tenant-scoped suppression for frequently observed ASNs to reduce alert noise. This detection helps you identify potential account compromise early while keeping alert volume manageable. See All Alert Types by Name and Using the Detection Management System.

  • Added case correlation based on the correlation_info fields carried by alerts generated from Automated Threat Hunting correlation rules. The case correlation engine identifies the entities in these alerts and groups alerts that share the same normalized value in supported correlation_info fields, such as a common user principal name, into the same case, including across correlation rule alerts and native detections. Safeguards such as time windows and alert type compatibility prevent unrelated alerts from being over-correlated. This enhancement ensures that alerts with explicitly shared correlation context are grouped together automatically, reducing the manual effort needed to connect related activity.

  • AELDEV-61066: Added Memcyco alert integration.

    Added Memcyco third-party alert integration with the Memcyco API to collect security events, including failed logins, platform changes, and compromise detections. The connector collects events through read-only API access and reports a clear error when an invalid API key is supplied. See Integration of Third Party Native Alerts.

    Also added normalization that promotes Memcyco vendor fields, such as event name, IP address, URL, and username, to Stellar Cyber canonical fields across the events, attacks, and spoofing content types, enabling the alert integration. Asset normalization ingests Memcyco device and user records as Stellar Cyber assets, so Memcyco device and user data populates asset analytics. This integration lets you monitor and investigate Memcyco security events alongside your other data sources.

  • AELDEV-59279: Added an alert type for Possible Pass-the-Ticket Attack.

    Added Active Directory detection for pass-the-ticket attacks. The detection tracks Kerberos ticket activity and raises an alert when a Ticket Granting Service (TGS) request is observed from an IP address that never obtained a Ticket Granting Ticket (TGT) for the same account, a pattern that indicates the reuse of a stolen ticket. Customizable /24 subnet matching on the Detection Management System page lets you tune how source addresses are compared. This detection helps you identify the malicious reuse of Kerberos tickets in Active Directory environments. See All Alert Types by Name and Using the Detection Management System.

Improvements

  • Improved the Sophos alert integration to correctly process Real-time Protection Disabled (Event::Endpoint::SavDisabled) and Outbreak Detected (Event::Endpoint::CoreOutbreak) events. Previously, these events were present in ingested Sophos logs but did not generate alerts. The alert filtering was adjusted so that these events now generate the corresponding Stellar Cyber alerts, ensuring that you no longer miss these high-severity Sophos events.

  • Improved fidelity scoring for the Successful Login After Brute Force detection when the source is an internal IP address. Internal IP addresses carry no Autonomous System Number (ASN) information, which previously inflated the fidelity score. The scoring now accounts for the missing srcip_asn field, so alert fidelity is more accurate for internal traffic and you can triage these alerts with greater confidence.

  • Improved the ESET Protect alert integration so that ESET Inspect detections are deduplicated by machine and rule instead of the per-occurrence eset.eialarmid identifier. Recurring Inspect detections on the same host within the suppression window are now collapsed into a single alert, significantly reducing duplicate alert volume. See Integration of Third Party Native Alerts.

  • AELDEV-68309: Improved three alert types to add subtypes for aborted SSH sessions.

    Improved the brute-force detection logic to account for SSH sessions that terminate in the Aborted state. Previously, these sessions were ignored and did not contribute to login_result evaluation, even though they are common during scanning and automated brute-force attacks that do not complete the full authentication handshake. These sessions are now evaluated, so brute-force behavior is no longer under-reported or missed in environments where attack tools terminate sessions prematurely. The following alert types have a subtype for Aborted SSH Network Events: External User Login Failure Anomaly, Internal User Login Failure Anomaly, and Internal Account Login Failure Anomaly. See All Alert Types by Name.

Stellar Cyber Platform

New Features

  • : Added support for the new credential management workflow.

    Added platform-level support for a new credential management workflow, including key exchange between the Data Analyzer and Data Lake and handling for Data Processor disaster-recovery and high-availability deployments. The data sink workflow and the connector framework were updated to use the same mechanism, and all services adopt the workflow together through the Early Access Program. This change establishes consistent credential handling across Stellar Cyber services.

  • Added support for sending data sink output to HTTPS endpoints without running SSL certificate validation. Previously, the data sink could not send output to storage devices that require HTTPS but present certificates that fail validation. This option lets the data sink connect to such devices, including S3-compatible storage systems that accept only HTTPS connections.

Improvements

  • Updated the query_window_start field to use a consistent datetime format across indexes, including the syslog, scans, and traffic indexes. Previously, the field was stored as a datetime in the window index but as a numeric timestamp elsewhere. The consistent format supports the expanded set of connectors that report query_window_start in 7.0.0s, ensuring uniform datetime handling for searches and analysis.

  • Improved the Office 365 Multiple Users Deleted alert to include the total number of deleted users and the list of deleted usernames detected within the alert time window. The alert now populates the deleted_user_count and deleted_user_list fields, which are shown in the alert details and available through the API. The displayed user list is capped at 50 entries to preserve performance, while the count reflects the full total. This enhancement lets you assess the scope of the activity without pivoting to raw logs.

  • Improved the time required to load user interface settings when a user signs in. A check of the mail server status ran as part of the settings request and could take approximately 15 seconds to complete, delaying the interface for every user. Stellar Cyber now retrieves the mail server status separately and in parallel with the settings request, so a slow response from the mail server no longer holds up the interface. Measured response times for the settings request are now approximately 0.7 seconds on SaaS deployments and approximately 1.1 seconds on on-premises deployments. Controls that depend on the mail server continue to be disabled when the mail server is unavailable, and no configuration change is required.

Sensors

New Features

  • AELDEV-72713: Added a printable payload field on IDS alerts with inline display in alert details.

    Added the printable payload of matched traffic as a searchable Interflow field (ids.payload_details.payload_printable) on intrusion detection system (IDS) alerts generated by the Modular Sensor, with inline display in the alert details panel. You can view, copy, and expand the printable payload directly on the alert for faster triage, and the field is available for threat hunting and case context. The existing PCAP retrieval path on the sensor is unchanged and remains available for full forensic analysis.

    Modular Sensors must be running 7.0.0 for this feature.

  • Added sensor CLI commands to display the heartbeat connection of the sensor to the managing DP, as well as the time and status of the last phone-home and support log upload. Refer to the show cm heartbeat and show support upload commands in Available Commands in the Sensor CLI Access Window. This gives administrators visibility into sensor-to-DP connectivity when troubleshooting from the sensor console.

  • Added a new upgrade command to the sensor CLI. This command upgrades a sensor's software directly from the CLI, retrieving the upgrade image via ACPS or the Data Processor. This provides a recovery path for upgrading a sensor when the standard upgrade workflow is unavailable.

Improvements

Connectors

New Features

  • The Trend Micro Vision One connector now uses the Trend Micro Vision One v3.0 API and covers what previously required two separate connectors: Trend Micro Vision One and Trend Micro Cloud One.

    The Trend Micro Cloud One v2.0 API is being deprecated. If you previously used the Trend Micro Cloud One connector, you should now use the Trend Micro Vision One connector and the Endpoint Inventory content type, which is only supported in the v3.0 API. See Configuring Trend Micro Vision One Connectors.

    Migration is available in 7.0.0 to customers who request it.

  • AELDEV-71574: Introduced the ThreatDown Nebula connector.

    Added the ThreatDown Nebula connector to ingest detections, endpoints, endpoint scans, events, and suspicious activity through the ThreatDown API. See Configuring ThreatDown Nebula Connectors.

  • AELDEV-67465, AELDEV-63463, AELDEV-66973: Added blocking and unblocking of domains and URLs on FortiGate firewalls.

    Added actions for blocking and unblocking domains and URLs on FortiGate firewalls. This complements the existing block and unblock IP address capability, letting analysts manage domain and URL blocking directly from the Stellar Cyber Platform. To run Block URL actions, create a Web Filter and apply it to a firewall policy in the Fortigate Firewall connector.

    The Block URL and Unblock URL actions are available on the Threat Hunting page when records contain url or event.url and on the Automation | Action History page under the Firewall Actions tab. See Configuring Fortigate Firewall Connectors and Understanding Event Details.

  • Added full normalization and enrichment support for incoming security events to the XDR Connector webhook ingestion by converging the webhook ingest workflow with a new user interface and additional functionality. Incoming event data is standardized into the Stellar Cyber Platform event schema, mapped to a unified taxonomy, and enriched with metadata. This convergence improves data consistency across integrated security tools. See Configuring XDR Connector.

    This is an Early Access Program (EAP) feature.

Improvements

Parsers

New Features

  • Added a built-in parser for ingesting Apache APISIX API gateway logs in RFC 3164 syslog format on port 6219. The parser extracts API gateway access event data, including client IP addresses, request URLs and methods, HTTP status codes, response sizes, user names, user agent strings, and upstream server addresses and ports, and normalizes it into the Stellar Cyber schema. This parser improves visibility into API gateway traffic and supports investigation of client requests and upstream service activity.

  • Added a built-in parser for ingesting Cisco Secure Workload logs in Cisco custom header, key-value pair, and JSON format on port 6216. The parser extracts workload security event data, including source and destination IP addresses, ports, and protocol information. This parser provides log coverage for Secure Workload deployments, which do not support CEF or LEEF export, and supports investigation of workload traffic and segmentation policy activity.

  • Added a built-in parser for ingesting Extreme Networks ExtremeCloud IQ logs in RFC 3164 syslog format on port 6217, covering the AP230, AP250, AP305C, AP410C, AP510C, and AP650 models. The parser extracts wireless access point event data and normalizes it into the Stellar Cyber schema. This parser improves visibility into wireless infrastructure activity and supports investigation of wireless client and access point events.

  • Added a built-in parser for ingesting BeyondTrust Privileged Remote Access (PRA) logs in BeyondTrust custom format on port 6214. The parser extracts privileged remote access event data, including session activity, user identities, and endpoint access details, and normalizes it into the Stellar Cyber schema. This parser improves visibility into privileged remote sessions and supports auditing and investigation of vendor and administrator access to critical systems.

  • Added a built-in parser for ingesting Check Point CloudGuard WAF logs, forwarded through Infinity Portal Event Forwarding, in RFC 5424 syslog format with a CEF payload on port 6213. The parser extracts web application firewall event fields including source IP address, HTTP host name, method, URI path and query, WAF action, override action, user reputation score, and event severity. This parser improves visibility into the prevention decisions that CloudGuard WAF makes and supports investigation of blocked web requests and reputation-based enforcement.

  • Added a built-in parser for ingesting IBM TS4500 tape library logs in RFC 3164 syslog format on port 6212. The parser extracts tape library event data, including system and operational messages, and normalizes it into the Stellar Cyber schema. This parser improves visibility into tape library operations and supports monitoring and investigation of events on backup and archival storage infrastructure.

  • Added a built-in parser for ingesting Dell PowerMax storage system logs in Dell custom header with syslog format on port 6211. The parser extracts storage system event data, including source and destination network details where present, and normalizes it into the Stellar Cyber schema. This parser improves visibility into storage array activity and supports monitoring and investigation of events on PowerMax arrays.

  • DATA-3502: Introduced a parser for ingesting Claude Code OpenTelemetry telemetry.

    Added a built-in parser for ingesting Claude Code OpenTelemetry data in JSON format over HTTP on port 6210. The parser extracts log events, including user prompts, API requests and errors, tool executions, permission decisions, and authentication events, along with metric series covering sessions, token and cost usage, and code changes. This parser gives SOC teams visibility into AI coding-assistant activity in their environments.

Improvements

  • AELDEV-71125: Added bulk enable/disable of parsers with 7-day ingestion visibility in Parser Studio.

    Added bulk enable and disable of modular parsers in the Parser Studio list view, along with a new 7d Ingestion column showing the rolling 7-day ingested volume of each parser and a threshold filter to surface low-traffic parsers. A confirmation dialog warns when any selected parser is currently ingesting data. This lets administrators relieve sensor memory pressure by retiring parsers that are not receiving data. The 7-day metric is a periodically refreshed per-tenant snapshot and is not shown in the All-Tenants view.

    Added the Disable Inactive Parsers workflow, which uses the ingestion threshold to select the parsers to disable. Parser state changes follow the per-tenant model and apply consistently regardless of the sensor technology in use, and bulk parser state management is also supported through the API.

  • Added activity information for legacy built-in parsers in the Parser Studio list view, together with bulk enable and disable actions that follow the existing per-tenant model. Administrators can see whether a parser is actively ingesting data before disabling it, and a confirmation step warns of potential impact when disabling an active parser. Disabling unused parsers reduces parser memory usage on sensors.

  • AELDEV-70204: Added download of modular parser configurations for cross-tenant reuse.

    Added a download action for modular parsers in the Parser Studio list view. A downloaded parser configuration can be re-uploaded to another tenant using the existing parser upload workflow, so parsers can be reused across tenants without recreating them from scratch. This capability is available for modular parsers only.

  • AELDEV-70203: Added the option to create a parser from scratch in Parser Studio.

    Added a Parser Studio entry point for creating a parser from scratch without cloning an existing parser. The parser creation workflow is unchanged; the new option starts from a blank configuration, giving you a clean starting point for building custom parsers.

  • Improved the Ignore Values selection on the Parser Studio Normalization Parameters page. Multiple ignore values can now be selected with check boxes and added or removed in a single operation instead of one value at a time.

  • Added custom legacy and modular parsers created in Parser Studio to the Name drop-down list in the Add Log Source Configuration dialog box. You can now choose custom parsers defined for a tenant as a log source in the same way as built-in parsers.

  • : Added Root Tenant support for modular custom parsers in on-premises deployments.

    Added support for the Root Tenant to create and deploy modular custom parsers in on-premises deployments. The parser create, update, delete, deploy, and dry-run operations now accept the Root Tenant scope, providing feature parity with tenant-scoped parser management.

    The Root Tenant option was also added to the tenant selection in the Parser Studio connection settings step on Data Processors that serve only the root tenant, matching the tenant choices already offered by the Upload Custom Parser workflow.

  • Added support for ManageEngine PAM360 resource-audit session log messages in the ManageEngine PAM360 parser. These messages, received on port 6062, previously failed with an Unsupported format parser error because their syslog timestamp format was not recognized. The parser now supports additional syslog timestamp formats, and session events such as session start records are parsed and normalized into the Stellar Cyber schema.

  • Expanded the Barracuda firewall parser (port 5524) to parse the web filter logs that Barracuda CloudGen Firewall produces. These logs use a different structure from the firewall activity logs that the parser already supported, and previously failed to parse. The parser now extracts the source and destination IP addresses, the requested URL, and the URL category, and derives the action taken on the request from the numeric action code in the log. Parsed events are normalized into the schema for search, correlation, and detection.

  • Updated the Citrix ADC parser to map the citrix_adc.client_ip value to the top-level srcip field when the value is a valid IP address, while retaining the original citrix_adc.client_ip field. Placing the client IP address in srcip enables geolocation enrichment and standard source-IP-based filtering and detections for Citrix ADC events.

  • Improved modular parsers to emit a searchable error record when parsing or normalization fails, matching legacy parser behavior. The record carries the raw message in parser_raw_msg and the failure reason in parser_err_msg, so failed records can be found and investigated in Threat Hunting.

  • Improved the Barracuda firewall parser to enhance field extraction from Barracuda firewall logs, adding support for a new log header format and additional log instance type content. Parsed events are normalized into the Stellar Cyber schema for search, correlation, and detection.

  • Improved the ColorTokens parser so that values carried inside the metadata object of an event are normalized to top-level fields. The destination IP address arrived enclosed in curly braces, which prevented the value from passing IP address validation and left the normalized destination IP address field empty. The parser now removes the enclosing characters before assigning the value, and also promotes the source IP address, the protocol, and the port to their normalized fields. Events from ColorTokens now support searching and filtering on these fields.

  • Updated the Linux Audit parser to support auditd end-of-event (EOE) records. Parsed audit events are normalized into the Stellar Cyber schema for search and correlation.

  • Extended the Imperva log parsers to extract additional fields. In the Imperva - SecureSphere (CEF) parser, fields such as description, reason, requestmethod, applicationname, requestclientapplication, requestparameters, and requestcontext moved from the message data to the vendor namespace, with normalization added for the event start time and application name. The Imperva - SecureSphere parser received similar vendor-field coverage. These fields are now available in parsed records for search, filtering, and detection.

  • Improved the Penta Security WAPPLES WAF (Web Application Firewall) parser to separate the destination IP address and port from the combined value that these logs carry. This value was previously retained only as a string, which left the normalized destination IP address and destination port fields empty. Parsing now also handles events in which the URI field is empty, a case that previously prevented the destination values from being extracted at all. Events from this device now support searching and filtering on the destination IP address and destination port.

  • Added support for the key-value pair (KVP) log format produced by Ubiquiti EdgeSwitch switches, including Netfilter log messages. The parser previously handled only the CSV format; both formats are now parsed and normalized into the Stellar Cyber schema.

  • Added Raw Log Capture support for parsers built with Parser Studio v2. When Raw Log Capture is enabled for a sensor, records produced by v2 parsers now include the parser_raw_msg field containing the original raw log, matching the behavior of v1 parsers.

  • Added support for a forwarded log format in the Apache HTTP Server (HTTPD) parser, covering access-log messages embedded in forwarded syslog events. The parser extracts fields such as the source IP address, request path, URL, and user name from the embedded access-log entry, so these events can be searched, filtered, and used for investigations.

  • Added alert integration support for Palo Alto Networks logs delivered in LEEF format. Alerts reported in LEEF-formatted events are now integrated in the same way as those in BSD format, and the LEEF format works with the existing unified threat management (UTM) enrichment.

  • Improved the SonicWall Firewall parser so that intrusion prevention system (IPS) severities align with the documented SonicWall priority values. The ipspri value now maps 0 to critical, 1 to high, 2 to medium, and 3 to low, so alert severities are consistent with the SonicWall IPS signature ratings.

  • Improved the Citrix NetScaler parser to extract structured fields for approximately 30 additional event types, including login, logout, ICA session, SSL handshake, application firewall, device and monitor status, and OAuth, SAML, and AAA messages that were previously only partially parsed or dropped. An issue was fixed where quoted log messages, common in SSL handshake logs, were stored raw with no field extraction. Several vendor fields were renamed to descriptive names, such as citrix.partition, citrix.seq_num, and citrix.num, and parsed records can now include additional fields such as the user agent, protocol, duration, and URL.

  • Improved the F5 - ASM (CEF) parser to parse F5 BIG-IP ASM events consistently. Previously, some F5 events were parsed correctly while others were not. The parser now detects the request body reliably and parses JSON HTTP request bodies, so the reported event variations are handled uniformly.

  • Improved the Check Point - SmartConsole (CEF) parser to extract additional fields from Check Point log messages. Additional known fields carried in the message data are now parsed into structured fields for searching and correlation.

  • Improved the WatchGuard firewall parser to parse the information contained in the event_description field into separate structured fields for known event types. The additional fields improve searching, filtering, and correlation for WatchGuard firewall events.

Usability

New Features

  • Added a Metadata Dictionary hyperlink next to the Use Template dropdown in Parser Studio Step 3 (Normalization) Field Mapping. The link opens the Standard Metadata Dictionary documentation, giving you a reference for mapping vendor fields to Stellar Cyber standard fields.

  • : Added a timezone preference to Automated Threat Hunting (ATH) email recipients.

    Added an optional Timezone setting to the email recipient (System | Recipients) that can be used by Automated Threat Hunting (ATH) playbooks. The selected IANA timezone is stored with the recipient and can be set, updated, or cleared. Leaving the field empty indicates no preference. Invalid timezone values are reported as an inline validation error on the form.

    The ATH email template rendering was also updated so that timestamps appear in the preferred timezone of each recipient, in RFC 3339 format with a numeric offset and with daylight saving time transitions handled by the IANA timezone database. Recipients without a timezone preference continue to receive timestamps in UTC, unchanged from previous behavior.

  • AELDEV-68354: Added API support for creating System Action Center (SAC) actions.

    Added the ability to create System Action Center (SAC) actions through the public API across all trigger categories: Case Management, Cluster Health, Data Storage Capacity, Disk Capacity, NFS Data Sink Capacity, Scheduled Report Monitoring, User Modifications, and License Usage. Triggers cover case activity, cluster health turning red, database and disk storage reaching capacity limits, NFS data sink capacity, scheduled report failures, user and role changes such as account lockouts and privilege escalation, and drops in the licensed asset count. Automated actions can now be provisioned programmatically in addition to through the user interface, so notification and response policies can be managed at scale across tenants.

  • AELDEV-67820: Added a public API endpoint to initiate Server Sensor uninstall from the Stellar Cyber Platform.

    Added a public API endpoint, POST /connect/api/v1/data_sensors/{sensor_id}/uninstall, that initiates a remote uninstall of a Windows or Linux Server Sensor. The uninstall is asynchronous: the endpoint accepts the request immediately, but the sensor record is removed only after the server sensor confirms that the uninstall succeeded. Only connected Windows and Linux Server Sensors support remote uninstall; requests for other sensor types are rejected. Deleting a sensor of an unsupported type removes only the record on the Stellar Cyber Platform without uninstalling the software on the host. This allows automation of Server Sensor removal without using the user interface.

    Also added role-based access control (RBAC) enforcement to the sensor endpoints in the public API under /data_sensors. These endpoints are now gated by the same privileges that govern the equivalent actions in the user interface, so an API user whose privilege profile does not grant the required privilege receives a 403 response where the request previously succeeded. Review the privilege profiles assigned to API users and automation that call these endpoints before upgrading. Enforcement on the pre-existing endpoints is enabled by default and can be disabled for an organization as a transition measure; the privilege check on the new uninstall endpoint is always enforced.

  • AELDEV-67002: Added Microsoft Defender for Endpoint response actions to Threat Hunting and Action History.

    Added support for new Microsoft Defender for Endpoint response actions on the Threat Hunting and Automation | Action History pages. The actions are: Collect Investigation Package, Restrict App Execution, Stop and Quarantine File, and Run Antivirus Scan. On the Threat Hunting page, the actions are offered when microsoft_defender.machineId (for Alerts data) and microsoft_defender.id (for Host data) is present in the alert or host event. Stop and Quarantine File additionally requires the field microsoft_defender.evidence[].sha1 (for Alerts data). On the Automation | Action History page, the new actions appear in the Endpoint Actions tab. See Configuring Microsoft Defender for Endpoint Connectors.

  • AELDEV-66747: Added case metrics for measuring case operation times.

    Added case metrics, which let you measure how long case operations take. Each metric is a timer that Stellar Cyber starts, pauses, and stops based on conditions you define, such as the time from case creation to acknowledgment by an analyst or the total time from creation to resolution. Case metrics are configured in the Case Metrics tab of the case settings, letting you measure the response times of your SOC team against the operational targets you track.

  • Disabled the Add as excluding filter option on the parser list page under System | DATA SOURCE MANAGEMENT | Parser Studio | Parsers. The option did not filter the parser list for built-in fields; disabling it prevents confusion from a control that had no effect.

  • Added a public API endpoint, POST /connect/api/v1/data_sensors/installation_tokens, that creates a sensor installation token for a given tenant and sensor profile. The request specifies cust_id, sifter_policy_id, and expire_days. The returned token is OS-agnostic, so it can be used for both device sensors and Windows or Linux Server Sensors to automate sensor onboarding. The endpoint is available on SaaS deployments only and requires the /token_management privilege.

Improvements

  • Updated the log filter configuration so the Log Source field is labeled (Log Forwarder only). The field applies only when a filter targets a log forwarder and should be left empty for connectors or Windows sensor event logs, so the clarified label helps you avoid misconfiguration.

  • Improved original record queries for machine learning correlation detections. When an alert document includes a correlation_info field, the referenced records are looked up by index and document ID and appended to the existing original record results. Analysts reviewing correlation-based alerts, such as pass-the-ticket detections, can see the correlated source records alongside the triggering record.

  • Improved API error responses so that the error label identifies the downstream service that actually failed. Previously, failures from services such as the Threat Intelligence Platform (TIP) controller were reported as originating from the central management service, which was misleading when diagnosing issues.

  • Added validation on the tenant mapping page so that an entry cannot be submitted when the Stellar Cyber Tenant ID does not match the Stellar Cyber Tenant Name. This check prevents misconfigured tenant mapping entries from being saved, preserving the integrity of tenant mappings.

  • Clarified the Session Idle Timeout setting, which supports a tenant-specific override that lets individual tenants set a different timeout value from the system-level default. The clarified control reduces the risk of inconsistent authentication policies across tenants.

  • AELDEV-68264: Added Cybereason support for alerts that span multiple machines.

    Added support to the Contain/Isolate Host response action on the Cybereason endpoint detection and response platform. A Cybereason detection correlates related malicious activity into a malicious operation, or Malop, which can involve multiple machines. The Target Value in the Contain Host action is now automatically populated with the ID of a single Cybereason machine (cybereason.pylumId) or a list of machines (cybereason.machines).

    The Stellar Cyber Platform now reads the machine identifiers recorded in the alert. For a Malop involving one machine, you can contain the host directly. For a Malop involving multiple machines, you can select the host to isolate. See Configuring Cybereason Connectors and Understanding Event Details.

  • Added a yearly view and a past-month view to the Asset License Usage Data page. The Past 12 Months view charts monthly entity counts for the past 12 months, and a month selector displays daily counts for any month within the past year, with tenant and tenant group scoping and CSV export supported for both views. The existing Past 30 Days view continues to work unchanged.

  • AELDEV-67525: Updated API error responses to rename the request identifier field.

    Updated API error responses to return the request identifier as request_id instead of requestId. This aligns error responses with the snake_case field naming convention used across the Stellar Cyber Platform APIs, such as cust_id, for consistent log correlation and client-side handling. The renamed field appears in server (5xx) error responses.

  • AELDEV-28743: Updated the tenant group list API endpoint to exclude logo image data.

    Updated the tenant group list public API endpoint (/tenant_groups) so that responses no longer include the tgrp_logo image data. Logo images are instead retrieved on demand through the /tenant_group/{id}/logo endpoint, which reduces list response size and improves page load performance when working with tenant groups.

Early Access Program

If you're interested in testing out new features ahead of general availability, consider joining the Early Access Program (EAP) by contacting your Stellar Cyber Customer Success representative and telling them which EAP feature you want to test. Once you've agreed to the EAP terms and signed up, the EAP feature is unlocked for you.

The purpose of this program is to boost performance and reliability through real-world customer insights, giving you a hands-on role in shaping a Stellar Cyber feature. In return, you'll receive early access to upcoming releases and the chance to guide product development.

The following EAP features are in this release:

Exportable Dashboards — Report Integration

Exportable Dashboards lets you schedule dashboards created with the Dashboard Builder as recurring PDF reports. The schedule form includes a new Default PDF type that renders the dashboard as it appears in the Dashboard Builder, along with options to control table row counts, chart color palettes, and optional CSV exports. This capability lets you generate consistent, configurable reports from new dashboards while preserving the settings and PDF types used by existing scheduled reports.

XDR Connector Webhook Ingestion

This is a webhook framework that lets you post JSON data directly from any external system into Stellar Cyber, accelerating custom integrations and expanding your visibility across the entire security stack.

Customizable Case Correlation Strategies

This EAP feature introduces support for multiple case correlation strategies, allowing teams to evaluate and experiment with different approaches to grouping alerts into cases. Each strategy provides a distinct investigative perspective:

  • Attacker-Centric Correlation groups alerts by the source (attacker) host, making it easier to track adversary behavior across multiple targets.

  • Victim-Centric Correlation organizes alerts by the destination (victim) host, enabling focused protection and visibility on high-value assets.

  • Multi-Entity Correlation links alerts across interconnected hosts and actions to form a single case, offering a holistic view of extended or lateral attack campaigns.

This flexibility enables security teams to tailor investigations based on their operational priorities—whether that’s identifying persistently targeted endpoints, tracing threat actor movements, or capturing full-scale intrusion campaigns.

Alert for Suspicious OCI Tenant-to-Tenant Communication

This EAP feature introduces a new alert type that detects cross-tenancy communications in the Oracle Cloud Infrastructure (OCI). By analyzing tenantId fields in audit logs, the feature identifies requests that target resources in a different tenancy. This provides accurate visibility into potentially unauthorized cross-tenancy activity and strengthens oversight in OCI environments.

To join the Early Access Program and begin testing these features, contact your Stellar Cyber Customer Success representative.

Resolved Issues

The following issues were resolved in this release.

Upgrading Sensors

Depending on the type of server sensor, you can upgrade your sensors directly to version 7.0.0 from these previous versions:

  • Linux Server Sensors: 6.5.0 or 6.6.0

  • Windows Server Sensors: 5.1.0 through 6.6.0

Upgrade the sensors to version 7.0.0 using the following process:

  1. Prepare for the upgrade.

  2. Upgrade the sensors.

  3. Verify the upgrade.

About Sensor Release Timing

Sensor upgrade packages release a few weeks after the corresponding DP release. Staggering the releases helps Stellar Cyber confirm whether any issues found after a DP upgrade come from the DP or the sensor and fix critical bugs before the new sensor is released.

If a sensor upgrade link in the docs doesn't resolve yet, the package simply isn't available yet — check back in a few weeks!

Prepare for the Upgrade

To prepare for the upgrade:

  • Make sure the sensors are up and running
  • Take note of the ingestion rate for the sensors to be upgraded in the Sensor Details page
  • Make sure the system health indicators in the Sensor Details page all show green.

Upgrade the Sensors

New features, updated ML algorithms, and enhanced configurations may change ingestion and detection patterns. We recommend the following to ensure a smooth upgrade:

  • Upgrade sensors with the Sandbox and IDS features enabled before sensors with the only the Network Traffic feature enabled. Sensors with Network Traffic enabled send data to sensors with Sandbox and IDS enabled for additional processing.
  • Upgrade sensors in batches instead of all at once.
  • For server sensors (agents):
    • Upgrade a small set of sensors that cover non-critical assets.
    • After 24 hours, ensure that your ingestion is as expected, then upgrade a larger set.
    • After 24 hours, ensure that your ingestion is as expected, then upgrade the remaining server sensors.

CentOS 7.1 Prerequisite – Update curl to 7.29.0-59.el7_9.2 or Higher

Before upgrading any Linux Server Sensors running in CentOS 7.1, you must check your curl version and update it to 7.29.0-59.el7_9.2 or higher to use the strong encryption required by the Stellar Cyber Platform.

  1. Check your curl version as shown below:

    yum list installed curl

    \* Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile Installed Packages curl.x86_64 7.29.0-19.el7

  2. If the listed version is lower than 7.29.0-59.el7_9.2 (as it is in the example above), use the following commands to update the curl package:

    yum makecache

    yum install curl

  3. If installation of the curl package fails, it is most likely because CentOS is trying to use a repo that has reached its end of life. Try updating the base URL and then reinstall curl. The following sed command makes the necessary changes for most environments to ensure that the updated curl package can be installed:

    sudo sed -i.bak -e 's|^mirrorlist=|#mirrorlist=|' -e 's|^#baseurl=http://mirror.centos.org/centos/\$releasever|baseurl=http://archive.kernel.org/centos-vault/7.9.2009|' /etc/yum.repos.d/CentOS-Base.repo

To upgrade sensors:

You can upgrade a sensor to the most recent release from the two previous releases. This means that you can upgrade a sensor to the 6.6.0 release from any 6.4.x or 6.5.x release.

If you are upgrading a Windows Server Sensor, complete any pending updates for the host Windows machine before upgrading the Server Sensor.

  1. Select System | DATA SOURCE MANAGEMENT | Sensors | Sensors.

    The Sensor List appears.

  2. Select Manage | Software Upgrade.

    The Sensor Software Upgrade page appears.

  3. Choose the target software version.

  4. Choose the target sensors.

  5. Select Submit.

Verify the Upgrade

To verify that the upgrade was successful:

  • Check the Software Version in the Sensor List.
  • Check the Sensor Status LED in the Sensor List.
  • Check the ingestion rate in the Sensor Details page for upgraded sensors and make sure it is as expected.