New Features
- Windows Event Forwarding (WEF): Windows event logs can now be collected without an agent. Windows machines forward their own logs to Logsign over WinRM/HTTPS, so nothing has to be installed on the endpoints and no Windows credentials are stored anywhere.
- WEF setup is guided end to end: a new WEF device type in Add Device, collector certificate authority and server certificate generation from the interface, per-subnet enrollment of forwarders, a client certificate per machine with mutual TLS, per-source channel subscriptions with common channel presets, and setup guides in English and Turkish. WEF sources are licensed under the existing WMI quota.
- WEF events are normalized exactly like WMI events, and every dropped event is accounted for by reason, so collection gaps are visible instead of silent.
- Multiline log aggregation for syslog sources: events spread over several lines can now be joined into a single log using a key and a time window, configured directly in the syslog source form.
- Scheduled reports can now be sent to external e-mail addresses that do not belong to a Logsign user ("To Others").
- Report exports can now carry an optional free-text note.
- Data Policy now applies to poller sources as well, so unwanted API-collected logs can be filtered at input level.
Plugin & Integration Updates
- Added Microsoft Defender for Cloud API poller.
- Added Microsoft Defender Vulnerability Management API poller.
- Added Symantec DLP incident API poller.
- CrowdStrike Falcon: Case Management records are now collected, and Spotlight vulnerability paging, result ordering and position tracking are corrected.
- Symantec Brightmail: a mail transaction spread over several log lines is now parsed as a single event.
- Fortinet FortiGate: IPsec VPN fields are now mapped to canonical columns.
- Veritas NetBackup: audit logs in RFC 5424 syslog format are now parsed.
- Microsoft 365: TLS verification is now configurable and enabled by default, message trace requests verify TLS, and timestamps without fractional seconds are accepted.
- Microsoft Graph Mail: HTTP error responses are now treated as failures, token requests are bounded with timeouts and retries, and the TLS verification setting is honoured on both endpoints.
- Kaspersky Security Center: SHA256 and MD5 hashes are extracted into Object columns, and previously unmapped event types are now categorized.
- Seclore EDRM: share and unprotect events are mapped to the correct canonical event types.
- ESET PROTECT: notification messages are parsed without their boilerplate preamble, and field extraction is more precise.
- Stormshield / NETASQ: block, SSL filtering, monitoring and filter statistics logs are now categorized.
- VMware VeloCloud SD-WAN: the JSON-encoded detail field is decoded and the event map is aligned with the canonical list.
- NXLog Windows agent: DOMAIN\user values in event 4697 are split into domain and account.
- HarfangLab EDR: missing process and endpoint fields are now mapped.
- Palo Alto Networks Cortex XDR: the configured authentication ID is now sent in the request header.
- Cisco ISE: the quarantine address field is now labelled MAC Address.
- Ribbon GSX: hyphenated subsystem names are accepted.
- Barracuda F600: a "-" in transferred-byte fields no longer produces a zero value.
- Symantec DLP: report-relevant fields moved out of the Details group.
- FileZilla: log lines that do not match a known format no longer stall parsing.
- Sobe Yazılım Asger and Kapi: IP address and mobile number anomaly patterns corrected.
- WatchGuard AD360: cursor-based collection and event mapping enabled.
- Zoho Desk: the data center host is now configurable, and obsolete required fields were removed.
- SMB poller: files are no longer re-read from the beginning on every collection cycle.
- MSSQL poller: rows that share the same checkpoint timestamp are no longer skipped, and the batch limit is enforced.
- Response integrations: corrected request formats, argument names, endpoints and region labels for Arbor APS, Cortex XDR, CrowdStrike Falcon, FastNAC, Maltiverse, Malwation AIMA, Mimecast Email, PagerDuty and SonicWall.
- Resolved event source prefix ID collisions between pollers.
Other Improvements
- The correlation rule engine is faster and more predictable under load: hot-path CPU use is reduced, lookup caches are sharded, rule and list updates now take effect reliably, and a rule that fails to compile is removed instead of leaving an outdated version running.
- Log indexing no longer drops events when the pipeline is saturated: it applies backpressure, detects stalls, adapts its batch size to the search engine's response, and rate-limits repetitive failure messages.
- Cluster and upgrade reliability: internal coordination waits for readiness before running migrations, migrations are cluster-safe and crash-safe, and log parsing recovers automatically after an internal message broker restart.
- Signed log and archive transfer failures are now visible: previously silent failures raise maintenance events, and transfer state is reconciled across every cluster node.
- Large searches over wide indices no longer fail because of query clause limits, including on cluster nodes.
- The System Update check no longer hangs when the package repository is unreachable.
- Interface access restriction methods can now be combined (subnet, IP list and IP range together), and the generated web server configuration is validated before it is applied.
- Credential handling hardened: log source and integration secrets are stripped from API responses and audit records, encryption key distribution fails closed instead of continuing silently, and each installation now uses its own integration encryption key.
- Additional configuration and settings endpoints now require authentication and the matching permission, and credentialed connection checks verify TLS.
- Replacing the WEF certificate authority now requires explicit confirmation when machines are already enrolled.
Bug Fixes
- An alarm whose severity is not scored no longer silently drops its incident, and unmapped severities receive a default risk score.
- Incidents raised by any cluster member are now attributed to the correct organisation.
- Dashboards: dashboard permissions are respected in the widget interface, nested row sizes are honoured, and widget queries are preserved on drill-down.
- UEBA: entities whose asset or identity record has been removed are displayed instead of failing, their UEBA records are deleted together with the asset or identity, and the overview user and host counters are read from the correct index.
- Configuration backup and restore: node-local search engine settings are preserved and topology sections are skipped on import, so importing a backup no longer overwrites cluster-specific configuration.
- Cluster synchronization no longer fails on traffic direction entries without a subnet.
- Cluster file distribution now applies file permissions correctly and keeps /etc/hosts readable, preventing name resolution failures across the cluster.
- A transient network error in the browser is no longer treated as a session timeout, so you are no longer logged out unexpectedly.
- Requests with an invalid time range now return a clear validation error instead of an unhelpful failure.
- Deleting a log source that has no host or description no longer fails.
- Alarm processing now reports the current host id instead of the one captured at start-up.