[7.1.0] - 2026-11-11

Added

• Tanium sync_stig_benchmarks imports DISA STIG results as STIG checklists, and sync_benchmarks imports CIS benchmark and STIG results together, each under its own checklist tool
• An overall file progress bar for the Nessus import, which also logs one line per file instead of three
• Trivy and Grype imports now remember which scan files were imported and skip them on the next run, with --reprocess to import everything again; a run that skips scan files does not close findings
• Burp CSV and XLSX import command, regscale burp import_burp_csv, which imports a Burp scan held as a CSV or an XLSX (the Burp XML export with one row for each issue) and offers a --dry-run preview
• Settings tab in the interactive GUI for browsing and editing every CLI configuration key, grouped by integration with secrets masked
• New regscale risks export_risks and import_risks commands copy risks, with their attachments, between RegScale instances. Each risk's risk model is matched by title (or set with --risk_model_id), each imported risk is owned by the importing user (or the user given with --risk_owner_id), and re-running an import does not duplicate risks.
• Databricks sync_assets and sync_findings commands that load the CIS checks and CVE findings of a Databricks export into a security plan as assets, vulnerabilities and issues, either into one plan or routed to many plans by an export column and a customer-supplied CSV; a CVE finding that the export marks closed is written closed, its assets carry the operating system and internet exposure the export gives, and --severity-field picks which export column sets each finding's severity
• Option to have tenable io sync_findings read DISA STIG audit results from the Tenable.io compliance export and send them to the matching control objectives, off by default (tenableIoStigComplianceExport)
• Vulnerabilities synced by scanner integrations now carry a finding type so non-CVE findings can be told apart from CVEs
• New wizHeldFindingsQuietSeconds setting (default 30 seconds) sets how long wiz vulnerabilities waits, once no new asset appears, for a concurrent wiz inventory to write the assets of findings it holds

Changed

• Tanium sync_cis_benchmarks now writes checklists only to assets in the security plan given by --regscale_id or in one of that plan's components; endpoints whose assets are all in other plans or their components are skipped instead of being written to a copy elsewhere, and the run reports how many were skipped
• A removed init.yaml key the CLI no longer reads (the gRPC ingest keys, cisaKev, jiraDefaultIssueType, jiraDefaultPriority) now logs a warning on every run that names what to use instead, rather than being ignored silently, unless it still holds the value an older CLI wrote into every init.yaml; regscale config validate reports these keys as removed_key
• Trust Center requests are now refused if they would leave the configured Trust Center host, API errors no longer echo the request's query string, and each request writes one debug log line without headers, bodies or query strings
• Memory use when importing a large SARIF file for compliance mapping is roughly halved, because the file is now read in a stream instead of being loaded whole
• Breaking change for custom scanner integrations: the ScannerIntegration flag that turns on closing outdated findings is now named close_outdated_findings_enabled, and the old close_outdated_findings name is no longer accepted as a flag because it is the inherited close method. Passing it to set_keys or to sync_findings/sync_assets on a ScannerIntegration subclass now raises TypeError. Two cases fail silently instead, so audit custom code for them: a class-level or instance-level close_outdated_findings = True assignment overwrites the inherited close method with a bool, and reading close_outdated_findings as a flag (if x.close_outdated_findings:) now returns the method, which is always truthy. Use close_outdated_findings_enabled for both.
• A refused token now names its likely cause: an expired token says when it expired, and an unexpired one lists the RegScale 6.36 events that revoke tokens (password change or reset, administrator sign-out or deactivation, local sign-in turned off) with the fix for a service account or a person. A refused XCCDF benchmark import now logs the server's status, error code and message, such as the 409 that asks you to delete a benchmark with assessment results before replacing it
• Nessus import reads large scan files faster and no longer loads the CPE dictionary when a scan names no CPE
• Scanner imports make fewer requests to RegScale at start-up and spend less time per finding
• The Nessus import is faster on folders with many files because it frees memory after a set amount of input instead of after every file
• Trivy and Grype findings no longer start with the CVE in their title, and carry more of the scan data where the scan provides them: references, layers, CWE ids, EPSS and known-exploited flags, fix advice and image details
• regscale jobs names each run's log file with its start time first, in UTC (20261108T070012Z-<job>-<run id>.log), so a plain ls of job_logs/ lists runs in the order they started. Logs from earlier runs keep their old names
• Databricks sync_findings --mop-up now closes CIS checks and CVE findings separately, each under its own source (Databricks CIS Benchmark and Databricks CVE), so an export of one type no longer closes the other type's records, sync_assets --mop-up is refused unless the export holds both types, because the two types share hosts, and a plan that already holds issues under the earlier source Databricks gets a second set of issues on its first run, so close or delete the old ones first
• Synqly connector prompts hide any value that the Synqly schema marks as a password, such as a client secret
• Aqua imports use less memory on large reports
• Each Xray vulnerability is now stored under a key that includes its CVE. The first Xray import after the upgrade creates new vulnerabilities with a new first seen date and closes the old ones, which keep their history.
• On defender export_resources, -n now means --query_name only, so a script that used -n to skip the upload must use --no_upload instead
• When a scanner sync stops because its vendor source fails partway through, the findings read before the failure are now sent without closing any findings, and a later error while sending them is logged at ERROR so the vendor failure still sets the exit code
• If all rules of a control are in the conformance pack, aws sync_config_compliance --conformance_pack_name now closes its fixed findings and issues

Fixed

• The interactive terminal GUI no longer fills the console with random characters when a file upload fails and the server returns a non-text error response
• jcamValueMapping accepts @drop for a value, declining it: the value writes nothing and leaves the destination as it is, instead of being written literally as the text @drop; a value mapped to @unmapped still works and is noted once per run in favour of @drop
• jcam import_ssp no longer stops for every plan when JCAM returns an undated SORN notice beside dated ones; undated notices go in the last slots, and an unexpected error in one plan's privacy data now fails only that plan
• jcam import_ssp now sets each child plan's parent from JCAM's FISMA rollup, including a first parent and a change of parent, instead of every change being refused, and leaves the parent alone when JCAM's parent system has no RegScale plan instead of writing 0
• jcam import_ssp no longer creates a plan a second time, without its compliance setting, in the front-matter step after RegScale refused to create it; the system is skipped and the refusal stays recorded
• regscale jcam import_parameters counts a failed read of a plan's controls, or of a control's parameters, as a failure in the run summary, instead of treating the plan as having no controls or the control as having no parameters
• jcam import_assessments and import_ssp count each assessment or system role RegScale's batch create did not return as a failure, instead of counting a refused batch or item as written
• tenable nessus import_nessus now sets each asset's type from the host instead of creating every asset as "Other": an asset-type host tag (any asset type value, case and spacing ignored) wins, otherwise the standard system-type property is mapped (router, switch, firewall, load-balancer, hypervisor, mobile, general-purpose, and now embedded and printer as Appliance). The asset category follows the type (Software for application, database, container and cloud types, Hardware otherwise), assets created for findings use the same type, and a host with no type information no longer resets the type already stored for it when a newer scan is imported (its category is still sent as Hardware) (requires RegScale platform 6.35.1.0 or newer)
• jcam import_poam matches an existing POA&M only among the importing plan's issues, instead of taking any issue in the tenant with the same otherIdentifier and moving it onto the plan
• Tanium Cloud CIS benchmark checklists now show the rule title and the last scan date instead of only the rule ID
• ServiceNow incident sync now copies attachments between incidents and RegScale issues instead of always reporting zero
• AWS asset console links now open the AWS GovCloud console for resources in GovCloud regions
• AWS Lambda layer version assets are now named by their layer and version instead of the bare version number
• Jira evidence sync lists the Jira Tasks named in a repeated-failure log line in sorted order, so the line reads the same on every run
• axonius_v2 commands give up on an Axonius request that times out after one attempt instead of four, and exit 6 with one timestamped log line naming the endpoint, the limit and axoniusTimeout, instead of a traceback or an unlogged error; the connect wait is capped at 30 seconds, as for other vendors, and axoniusTimeout is the read limit
• jcam import_ssp skips JCAM's placeholder information type 'Other: Other' unless the tenant has a type of that name, instead of counting a plan that lists only the placeholder as failed and offering it in missing_info_types.json
• The final step of a long import, where the RegScale server finishes the sync run, now logs when it starts, every 30 seconds while it runs and when it is done, instead of going silent for minutes
• Interactive imports that send many batches, such as a Nessus folder import, no longer fill the terminal with finished sync progress bars that pushed the log output off screen part-way through the run
• Trivy and Grype findings are dated from their scan file instead of the import time, and with import_scans first seen and last seen no longer move the wrong way when a newer or older scan is imported
• --s3-bucket and --s3-prefix now read the bucket for Trivy and Grype imports, using the AWS profile or keys given on the command line
• Compliance integrations, including AWS Security Hub compliance and Wiz compliance_report, count a compliance item that fails to process as a partial failure, so the run exits 3 under REGSCALE_STRICT_EXIT_CODES=1 instead of 0
• Commands run without a terminal (regscale jobs run-due, cron, a redirected shell) now log a progress line at INFO at most once a minute during long loops, and a closing line with the count and elapsed time, where they used to stay silent until the loop ended
• regscale jcam import_controls creates a plan's new control implementations 100 per request instead of one request each, and sends a control the report repeats once
• Databricks sync_findings and sync_assets with --regscale-ssp-id use less memory on a large export, because they no longer keep one object for every distinct host of the whole file while they stream it
• Tenable.io sync_compliance_controls no longer stops on a compliance check with a null see_also, description or other descriptive field, and skips a check it cannot read instead of ending the run
• FedRAMP Appendix A import no longer stops when a control in the document has no implementation status selected
• The FedRAMP POA&M Excel import now accepts workbooks built from template v3.x. It no longer requires the removed Resources Required, Planned Milestones, Milestone Changes and Operational Requirement columns, and it reads Remediation Plan in place of Overall Remediation Plan. It skips a POA&M sheet that has no POAM ID header, with a warning, instead of stopping. Typing a quoted answer such as 'skip' at the mapping prompt no longer loops.
• Trivy, Grype, SARIF, OpenText, Qualys Total Cloud and Tenable SC file imports no longer fail with "cannot pickle '_queue.SimpleQueue' object" when the staged findings file is larger than 500 MB
• Compliance syncs now fill in the control and security plan on each control assessment, and the control and assessment on issues whose finding maps to a single control. A new issue gets its assessment on the first sync and its control on the next
• Critical RegScale issues synced to Salesforce now create cases with High priority instead of Low
• JCAM milestone import reports an unrecognized or undated completed status instead of guessing, and export sends a milestone's own status to JCAM when it is one JCAM uses instead of always Completed or Not Started
• JCAM milestone import no longer gives a milestone JCAM sent no due date the import time; RegScale sets the date from the POA&M's severity
• Reminder emails no longer fail for users who have no upcoming or overdue items, and the run now reports when nobody has any
• Qualys scanner no longer fails on a finding with no detection data and now gives such findings a unique id
• regscale tenable io sync_compliance_controls now creates a control implementation for each matched control that passed or failed a check and that the security plan does not have, gives an enhancement control (for example AC-2(1)) the status Tenable.io reported, and exits 1 when it matches controls but RegScale saves none of them
• The stored size of an uploaded file, such as a Jira attachment or evidence file, is now its byte count
• AWS sync_assets on plans with assets in more than one region now marks a deleted resource as not in the latest scan and keeps edits made to it during the run, and the AWS compliance commands keep an Inactive status a user set and give S3 buckets the Cloud Storage type without replacing their description
• On platforms before 6.36.0.0, regscale aws sync_config_compliance now closes the issues that CLI 6.x stored under the bare AWS account ID when it retires those records, instead of leaving them open, with issueCreation: Consolidated (the default)
• regscale aws sync_config_compliance --conformance_pack_name no longer closes the findings and issues of controls that pass, so the findings and issues of failing rules outside the conformance pack stay open
• Scan History Date Scanned now shows the scan date instead of the import time for integrations that import vulnerabilities in batches
• Asset syncs no longer log a duplicate asset that RegScale saved from a later row of the same batch as "not saved", and the "Successfully submitted" and "asset(s) synced" counts now show distinct assets
• Synqly connector syncs create their Synqly account and integration with the installed Synqly SDK
• Amazon Inspector syncs through Synqly build an AWS access key credential and ask for the access key ID and the secret access key, instead of stopping with an attribute error
• Synqly ticketing syncs create tickets and upload attachments with the installed Synqly SDK
• The error that follows a rejected Synqly integration setup no longer shows the credential values that Synqly echoes back
• Synqly vulnerability syncs such as Amazon Inspector, Wiz and Tenable Security Center no longer stop with a filter validation error before they fetch findings
• The file comparison command now names the supported file types, CSV, XLSX or XLS, when it refuses a pair of files
• If another import saves the same plan, an asset import no longer adds a second copy of an asset. It reports the asset as not saved, with the reason
• The FedRAMP OSCAL SSP import now ends with one clear error line and exit code 6, or 4 when the host refuses access, when the host of the profile that the SSP names cannot be reached or answers with an HTTP error, instead of a traceback
• The FedRAMP OSCAL SSP import now reads a profile that its host sends compressed, such as the FedRAMP profiles published on GitHub, instead of failing with a decoding error
• The FedRAMP OSCAL SSP import now ends with one clear error line and exit code 1, instead of a traceback, when the profile that the SSP names is not a readable JSON document, and it no longer leaves a copy of the profile in the system temporary directory
• The eMASS POA&M workbook import now stores each POA&M with an Issue status the tenant offers (Ongoing as Open, Completed as Closed with its completion date, Risk Accepted as Exception/Waiver or Open, and Open or Closed as Ongoing or Completed on a tenant that uses the eMASS statuses) instead of losing rows.
• Tenable.io commands now honor the sslVerify setting, and Tenable.io and Tenable.sc commands now verify against the CA bundle set in customCaCert
• Tenable.io asset sync stores an asset's MAC addresses in the same order on every run
• tenable io info shows the Tenable.io user, account email and scanners instead of always reporting a connection error, and exits with a non-zero code when it cannot get them
• regscale tenable sc list_tags now lists the Tenable.sc tags. It asked pyTenable for a tags endpoint that does not exist, logged an error and exited 0. It now reads GET /rest/tag, prints "No tags found in Tenable.sc." when there are none, and exits 4 when Tenable.sc refuses the keys, 6 when it does not answer or reports an error, and 1 when the reply is not a list of tags.
• Prisma CSV import removes repeated rows before importing, so the logged counts are of distinct findings
• Wiz add_report_evidence now fails with an error naming the refused upload, instead of logging that the file was uploaded
• Jira commands that use basic authentication now honor the sslVerify setting, and a blank sslVerify key verifies the certificate
• OpenSCAP imports no longer leave two open issues for each failed rule, and the one issue that remains is linked to the vulnerability but not to the affected controls
• axonius_v2 commands print one error line that names the Axonius host and the failure, and exit with code 1, instead of a traceback when Axonius cannot be reached, drops the connection or answers with an error or an unreadable reply; a timeout still exits with code 6
• axonius_v2 now prints one error line that names the input, and writes nothing, when a saved query config file is missing or invalid, a saved query is not in Axonius, a regscaleSspId is not an integer, or --offset or --limit is negative
• Axonius asset sync no longer imports nothing when one device has no preferred hostname or name, or one flat-file row has no CDM Unique ID; such a device is synced under another identifier, and a device with no identifier at all is skipped with a warning that names it
• Fixed axonius sync_assets --regscale_ssp_id to stop with an error when the security plan does not exist instead of writing assets under it
• Axonius asset sync now stops with an error and a non-zero exit code when RegScale refuses an asset batch, for example when the token has expired, instead of reporting completion
• Axonius pull_data_axonius gives up when Axonius sends nothing for the axoniusTimeout setting (exit 6) instead of a fixed 3600 seconds, and reports a refused connection, an unknown host or a reply that is not a JSON object as one error line naming the host (exit 1) instead of a traceback
• Axonius pull_data downloads only the S3 object that the key names and fails when no object, or several objects, match the key
• axonius combine_data_parts merges a part that holds one JSON object as one record instead of writing its field names, and stops with a usage error for a part that is not a list or object
• axonius file commands and combine_data_parts report a missing, unreadable, non-UTF-8, empty, non-JSON or non-list input file, and a tenant without the "FISMA Id" security plan field, as one Error: line with exit code 1 instead of a traceback; the sync commands now check the input file before they query RegScale
• Report a missing security plan in the Axonius V2 sync commands as one error line instead of a traceback
• prisma sync_sbom (and panw sync_sbom) now fails when the SBOM download fails or the archive cannot be read, with exit 4 when Prisma Cloud refuses the credentials and exit 6 otherwise, instead of reporting success and exiting 0
• The Prisma Cloud and Palo Alto sync_sbom commands now accept --no-bulk-download to sync the SBOM of one host or image
• Prisma authenticate (and panw authenticate) now stops with exit status 4 when the login reply holds no usable token and with exit status 6 when the reply is not JSON, caches nothing, and ignores a tokenless session that an older release cached
• Prisma Cloud syncs now wait for each Retry-After value, at most 30 seconds, log every retry wait and fail at once when the console asks for a longer wait
• Burp Suite imports no longer stop when an issue has no background or a request and response pair has no request
• Importing a Burp Suite export now maps a vulnerability to each host that reports an issue type, where only the first host got it; the issue names every such host, and the stored vulnerability key does not change
• The Burp import now names a file that is empty, cut short or not a Burp export, and exits with an error when no file in the folder could be imported
• Burp import no longer prints a time zone warning for an export time that ends in a zone abbreviation such as EDT
• The Acunetix and Prisma CSV imports, and the other flat-file imports, now print one line for each file they cannot read and exit 1 when no file in the folder could be imported
• Importing a JFrog Xray report now stores one vulnerability for each CVE that a finding lists, where it stored only the first
• Fix the JFrog Xray import storing a finding as Low when its CVE has no CVSS v3 score: it now uses the severity Xray gives the finding, or the band of the CVSS v2 score
• Fix the JFrog Xray import skipping a finding that has no CVE identifier. The import now stores such a finding under its Xray issue id. A warning now names each finding that the import skips
• Importing a JFrog Xray or AWS Inspector JSON report with no findings now completes and says the report holds no findings instead of asking for a column mapping or failing, and an Xray report page that lists none of its rows is skipped so it closes no findings
• JFrog Xray import of a report that holds one finding as a single object instead of a list
• The Xray, Snyk and other JSON imports now name a .json file that is empty, cut short, not valid JSON, not readable or not a list of records, skip it, and import the other reports in the folder. A JSON report that starts with a UTF-8 byte-order mark is now read
• Prisma CSV import keeps findings identified by a Prisma Cloud or GitHub advisory ID instead of skipping them
• Prisma CSV import stores a finding with no CVSS score, or a score of 0.0, at the severity in its Severity column instead of Low
• A mapping file that is empty, not UTF-8 text, not valid JSON or not a JSON object now stops show_mapping with a message that names the file, instead of a traceback or a printed value
• Scanner file imports and other commands that check their security plan or component now stop with an authentication error when RegScale refuses the account (exit status 4, or 78 when the token cannot be renewed), instead of reporting an invalid plan and exiting 0
• Defender commands now report that Azure refused the credentials, with Azure's error description, instead of a missing access_token key and a traceback; the exit code stays 1
• Defender export_resources now reports the HTTP status and the request that failed when Azure refuses or fails the saved query request, instead of a traceback
• defender export_resources -n "<name>" now exports the named saved query and no longer prints five duplicate-option warnings
• Microsoft Defender alerts are no longer skipped when an activity time cannot be reformatted, and a time with an offset now shows its UTC date
• Entra evidence collection logs one error line for each evidence type that Microsoft Graph refuses, in place of a traceback and a bare exit code
• regscale emass_api authenticate, push_poam and sync_system now stop after one wait when eMASS does not answer, print the line eMASS at <host> did not answer in time (<n> seconds). and exit 6. push_poam no longer sends a new POA&M when its search for an existing POA&M gets no answer, a bidirectional sync_poams prints how many POA&Ms it pushed before the timeout, and authenticate no longer exits 0 when its connection test fails
• regscale emass_api commands no longer wait without a limit when eMASS accepts the connection and does not answer. The CLI now uses the emass.timeout setting (or EMASS_API_TIMEOUT, default 300 seconds) for each eMASS request. After that time the command prints one line, eMASS at <host> did not answer in time (<n> seconds)., and exits 6. When the request was a change, the line adds eMASS may have applied the change., so check eMASS before you run the command again. A command that sends many items, such as sync_controls or upload_artifacts_bulk, stops at the first timeout. The time limit applies to each phase of a request, not to the whole request, so a server that sends a little data at a time can still keep a command waiting. A large artifact upload to a slow eMASS server can now stop at 300 seconds; raise emass.timeout for it. A value of emass.timeout that is not a positive number, such as 0, -5 or abc, uses 300 seconds and logs a warning.
• regscale emass_api sync_controls no longer exits 0 when no control synced because eMASS could not be reached or refused the request. When no control synced and at least one control failed because of eMASS, the command prints one error line with the eMASS host and exits 4 if eMASS answered 401 Unauthorized or 403 Forbidden for any control, and 6 for an unreachable host, a TLS failure, any other error status or an answer it cannot read. It used to print [OK] Control sync complete with every control counted as an error. When eMASS refuses only the content of controls (400 Bad Request, 409 Conflict, 422 Unprocessable Content), or when some controls synced, the failed controls stay partial failures: the command prints how many controls were not synced, with the synced and error counts, and no longer prints [OK]. The DEBUG log message for a failed control push no longer carries the eMASS response body.
• regscale emass_api upload_artifacts_bulk and add_milestones_bulk no longer print tracebacks or the eMASS response headers and body when eMASS fails, sync_poams prints one error line that names the eMASS host when its pull fails, and import_xml prints one error line without a traceback for a file that is not XML
• The regscale emass_api commands now print one error line that names the problem and the eMASS host, for example eMASS at emass.example.mil rejected the API key: 401 Unauthorized., instead of one to three tracebacks. emass_api test_connection no longer ends with an empty Error: line and Aborted!. The line and the warnings never carry the API key, the response headers or the response body. A 401 Unauthorized or 403 Forbidden answer exits 4. An unreachable host, a failed TLS connection, any other HTTP error status or an unreadable answer exits 6. Both used to exit 1. A local or RegScale error still exits 1.
• The regscale emass_api commands delete_milestones, add_milestones_bulk and upload_artifacts_bulk accept --yes (or -y) to skip the confirmation question, so a scheduler, a pipeline or the Orchestration Hub can run them. Without --yes and without a terminal, each command now prints one Error: line that names --yes and exits 2 before it calls eMASS, instead of a traceback and Aborted!.
• regscale emass import_slcm now reports a file that is empty or is not an Excel workbook as one error line that names the file, and exits 1, instead of printing a traceback
• The eMASS import commands and detect_workbook now report a file that they cannot read as one error line that names the file and exit 1, instead of a traceback or exit 0
• regscale emass import_slcm now exits 1 when the security plan or the catalogue is not found, 4 when RegScale refuses the lookup and 6 when RegScale does not answer it, instead of exiting 0 after logging "Aborting!"
• If a control has the Implementation Status Manually Inherited, a blank status or an unknown status, the regscale emass import_slcm command no longer marks it Not Applicable. Manually Inherited is now saved as Manually Inherited, as regscale emass import_slcm_workbook does. The Implementation Status is matched without regard to case. A blank or unknown status keeps the control status and its N/A Justification, and logs a warning that names the control. The command applies Not Applicable from the Implementation Status or Compliance Status column only with an N/A Justification. Without one, the control keeps its status and the command logs a warning.
• The eMASS hardware and software inventory import now reports each row it skips and counts each asset RegScale refuses as an error
• eMASS POA&M workbook import now stops and names the rows that share a POA&M Item ID, instead of merging them into one issue
• eMASS control test results import now names the row and value of an unreadable Date Tested when the CCI does not resolve
• eMASS control test results import no longer sends an unreadable Date Tested to RegScale and names the CCI number in its errors
• OpenSCAP import_csv now names a CSV file that is cut off, has a header that matches no supported layout, is not UTF-8 or has a field over the CSV size limit, and exits non-zero instead of importing part of the file or nothing
• OpenSCAP imports now name each missing, empty, truncated or non-XML scan file, and a folder with no scan file, and exit non-zero, while the other files in the folder are still imported
• OpenSCAP CSV import now reads files that start with a UTF-8 byte-order mark, such as files saved by Excel as CSV UTF-8, and imports the same findings as the file without the mark
• cci_importer prints one error line that names the file, with no traceback, when the CCI file is empty, truncated, not XML or cannot be read
• regscale stig cci_assessment and regscale stig_mapper run now stop with an error and a non-zero exit status when the security plan does not exist, in place of reporting that they found nothing to do
• The jira_dc commands now log one error line that names the problem and the Jira Data Center URL, with exit code 4, 5 or 6, when the first request to Jira Data Center fails, and a server that does not answer fails after jiraDcTimeoutSeconds instead of about six minutes
• Jira commands jira issues and jira tasks now end with one error line and a non-zero exit code when Jira refuses the credentials, cannot be reached or answers with an error, and they report an unset jiraUrl, instead of printing a traceback
• Qualys scan import no longer stops when a row's severity is empty, not a number or outside 1 to 5; it logs a warning naming the row and imports that row at low severity
• The example Qualys URL in the init.yaml template is now a host only, and an existing init.yaml that keeps the old example path no longer doubles it or triggers config validation warnings
• Qualys diagnostics and CSV validation now exit with a non-zero status when a check fails, and a failed request no longer prints a traceback
• The Qualys import_policy command now reports a one-line error and exits with status 2 when the file is not a Qualys policy export or an option value is not valid, and no longer creates an Untitled Policy from a JSON object that has no policy ID
• Qualys import-vm-report now stops with a usage error when both --report-file and --report-title are given, instead of silently importing the file and ignoring the title
• A mapping file that is not valid JSON, not UTF-8 text or of the wrong shape now stops the import with exit status 2 and one line that names the file, instead of a traceback
• Import a Qualys VM scan row that has no QG Host ID as an asset keyed on its IP address, and skip a row with neither
• A Wiz token URL that ends in any mix of slashes and whitespace, such as a space or a tab followed by a slash, is now accepted, as one that ends in a slash or a space already was
• Wiz commands now name the token endpoint when its answer is not a token, instead of a redacted placeholder
• regscale wiz attach_sbom now attaches an SBOM whose document has no version, and when RegScale refuses one SBOM it still attaches the others and then exits 1
• A compliance sync that stops on a usage error, such as a Wiz compliance report that is not UTF-8 text, prints one "Error:" line and no longer also logs the same message with a traceback
• Wiz inventory, issues and vulnerabilities help now names the --filter_by_override option and shows an example that is valid JSON
• The deprecated wiz sync_compliance command no longer lists --list-frameworks in its help, and using that option now stops with a usage error (exit code 2) that points to wiz compliance_report instead of exiting 0 after printing a message
• The tenable was sync_findings command no longer exits 1 before it sends a request to Tenable.io when the security plan already holds assets
• A Tenable.io --tags value without key:value pairs, an --asset-filter-file that is not a JSON object, and a Tenable.sc sync_jsonl --mapping_file that is not a JSON object now end with a usage error that names the option and the expected format. A file passed as a pipe, such as a shell process substitution, still works
• Tenable.io CIS checklist syncs and Tenable.io STIG compliance results now send asset tag filters in the form Tenable.io accepts, so a run with --tags no longer fails and syncs nothing
• Tenable.sc file import with --file-path now stops with an error and a non-zero exit status when no file in the folder can be read as Tenable.sc data
• Negative --offset and --limit values are now refused with a usage error instead of stopping a sync or processing the wrong records
• Log redaction no longer hides the start of a connection error after a sign-in URL that ends in /token, so "[Errno 111] Connection refused" stays readable
• When Microsoft Defender keeps failing or does not answer, the error now names the request URL again, without its query string or any credential
• A request that keeps failing with an HTTP error such as 500 Internal Server Error or 429 Too Many Requests now logs one error without a Python traceback, and Microsoft Defender reports a sustained failure once
• A missing required setting, such as wizUrl, now ends a command with one error line and exit code 5 instead of a Python traceback
• tenable io sync_compliance_controls keeps the control owner of each control implementation it updates
• Qualys import-vm-report now saves Re-Opened and Fixed detections with a RegScale vulnerability status, and exits non-zero when it saves no asset or vulnerability or a request fails
• The eMASS asset, POA&M and test result integration classes now read the eMASS responses and sync the systems, POA&Ms and test results they return instead of failing with an error
• Tanium benchmark and ports syncs stop with an error when RegScale refuses or fails the read of the plan's components, instead of skipping the assets under those components
• Tanium ports and protocols sync in an Orchestration Hub split job now reads ports for the same endpoints that the job's asset step writes
• Tanium ports and protocols sync now writes ports only to the endpoint's asset in the selected plan or its components, not to copies of the endpoint in other or deleted plans
• eMASS and FedRAMP imports that update control implementations no longer reset the inherited record permissions or clear the last assessment, the parent control and the approval state of those control implementations
• If two rows of an asset sync differ only in letter case, the sync writes the software and SBOM of their asset once
• The jira_dc sync_tasks command no longer creates two RegScale tasks when the Jira search returns the same ticket on more than one result page
• FedRAMP OSCAL SSP imports now store the ports and protocols of each component, which RegScale rejected before because their Service and Used By values were empty
• Compliance syncs on RegScale 6.36+ read each control's newest same-day assessment from POST /api/v3/assessments/byParents, so a control assessed more than once today merges with its latest result instead of its earliest.
• AWS sync_assets now shows the valid from date, the valid until date and the number of resources in use on each ACM certificate asset
• Qualys sync keeps a consolidated issue and vulnerability open while any host or web application still reports the vulnerability as open
• Qualys WAS findings that Qualys reports as fixed now close their issue and vulnerability during sync
• env_info now prints its full report in the container image, under an unknown user id and in a read-only directory
• Pipeline report_scan no longer stops before it creates the issues for a failed scan when the SSP-level control update fails, and RegScale no longer refuses that update because the control origination is missing
• Pipeline setup_component and report_scan now link the repository component to the security plan, so it appears in the plan's Components tab
• regscale wiz vulnerabilities now names every finding it did not write when it exits 1 because regscale wiz inventory had not written the plan, one line for each finding with its asset
• aws sync_findings without --generate-evidence or --format now sends the findings it read before a failed Security Hub page, instead of none of them
• A scanner sync that the server did not start, because another sync of the same source was still running, no longer sends its checklist results or changes the status of a control or control objective
• Checklist roll-ups send only valid assessed dates, and a Tenable STIG result whose scan date is missing or not a valid date is dated by its last seen date, so one bad date no longer stops every result in the sync from updating control status
• Tenable STIG imports send a passing check's vulnerability as closed and any other result as open, instead of sending the check result, which the server rejected with a warning for every passing check
• Wiz vulnerabilities and issues incremental syncs run with --offset or --limit no longer move the saved pull watermark past findings they did not write
• Stop logging an error and stack trace when the catalog update cannot read the platform feature flags
• A Tenable.io asset or vulnerability sync now stops before it sends any record from a cached export that is corrupt, and an export that stops partway is no longer cached for the next run
• A truncated Tenable.io asset or vulnerability export cache is now removed and fetched again on the next run instead of failing every run until it expires
• Updated the pyasn1 dependency to a release that fixes known security vulnerabilities
• BigQuery asset sync now reports a rejected query as a single error line instead of a Python traceback
• Issues from a component compliance report are now saved under the component and no longer rejected as a missing security plan
• A Qualys CSV import whose column changes type after the first 10,000 rows now stops with a one-line message that names the file instead of a traceback
• A Qualys file import with a negative --skip_rows value, or one that reads a title row as the column headers, now stops with a message that names --skip_rows instead of a traceback
• Tenable compliance sync gives a failing control its planned implementation date and steps to implement, and sets a passing control to Fully Implemented, on platforms that take bulk control updates
• Qualys import_total_cloud no longer logs that it imported findings RegScale refused, and reports how many vulnerabilities RegScale stored
• Re-importing a Qualys VMDR report into a security plan now updates each host's existing asset instead of creating a second asset for every host
• The eMASS POA&M workbook import now stores the controls, devices affected, impact description and security plan of each POA&M it creates, and fills the false positive, operational requirement, auto-approved and risk adjustment flags with No when they are empty. A row the batch upload refuses, such as a Risk Accepted row stored as Exception/Waiver, is now written on its own, or reported with the server's reason, instead of being dropped with "see the log".
• FedRAMP CIS/CRM imports store every control and part inheritance model when the RegScale platform does not accept them all in one bulk request, and fail with an error line when RegScale refuses a model
• Evidence and scan results now map to every control of a security plan with more than 500 control implementations when RegScale leaves out the next page marker on a full page
• Evidence and scan results now map to control enhancements on a RegScale platform with the bulk compliance routes, and evidence also maps when the source names a control enhancement in the AC-2(1) form
• On RegScale 6.36 and later, a compliance sync no longer replaces the result of an assessment from another day
• Control implementation syncs and imports on RegScale 6.36.0.0 or later now retry or report a control implementation that the bulk update did not write, instead of finishing as if it succeeded
• Wiz syncs that run longer than the Wiz access token lasts get a new token and keep going, instead of failing with an HTTP 401 and exit code 4

[7.1.0] - 2026-11-11

Added

• Tanium sync_stig_benchmarks imports DISA STIG results as STIG checklists, and sync_benchmarks imports CIS benchmark and STIG results together, each under its own checklist tool
• An overall file progress bar for the Nessus import, which also logs one line per file instead of three
• Trivy and Grype imports now remember which scan files were imported and skip them on the next run, with --reprocess to import everything again; a run that skips scan files does not close findings
• Burp CSV and XLSX import command, regscale burp import_burp_csv, which imports a Burp scan held as a CSV or an XLSX (the Burp XML export with one row for each issue) and offers a --dry-run preview
• Settings tab in the interactive GUI for browsing and editing every CLI configuration key, grouped by integration with secrets masked
• New regscale risks export_risks and import_risks commands copy risks, with their attachments, between RegScale instances. Each risk's risk model is matched by title (or set with --risk_model_id), each imported risk is owned by the importing user (or the user given with --risk_owner_id), and re-running an import does not duplicate risks.
• Databricks sync_assets and sync_findings commands that load the CIS checks and CVE findings of a Databricks export into a security plan as assets, vulnerabilities and issues, either into one plan or routed to many plans by an export column and a customer-supplied CSV; a CVE finding that the export marks closed is written closed, its assets carry the operating system and internet exposure the export gives, and --severity-field picks which export column sets each finding's severity
• Option to have tenable io sync_findings read DISA STIG audit results from the Tenable.io compliance export and send them to the matching control objectives, off by default (tenableIoStigComplianceExport)
• Vulnerabilities synced by scanner integrations now carry a finding type so non-CVE findings can be told apart from CVEs
• New wizHeldFindingsQuietSeconds setting (default 30 seconds) sets how long wiz vulnerabilities waits, once no new asset appears, for a concurrent wiz inventory to write the assets of findings it holds

Changed

• Tanium sync_cis_benchmarks now writes checklists only to assets in the security plan given by --regscale_id or in one of that plan's components; endpoints whose assets are all in other plans or their components are skipped instead of being written to a copy elsewhere, and the run reports how many were skipped
• A removed init.yaml key the CLI no longer reads (the gRPC ingest keys, cisaKev, jiraDefaultIssueType, jiraDefaultPriority) now logs a warning on every run that names what to use instead, rather than being ignored silently, unless it still holds the value an older CLI wrote into every init.yaml; regscale config validate reports these keys as removed_key
• Trust Center requests are now refused if they would leave the configured Trust Center host, API errors no longer echo the request's query string, and each request writes one debug log line without headers, bodies or query strings
• Memory use when importing a large SARIF file for compliance mapping is roughly halved, because the file is now read in a stream instead of being loaded whole
• Breaking change for custom scanner integrations: the ScannerIntegration flag that turns on closing outdated findings is now named close_outdated_findings_enabled, and the old close_outdated_findings name is no longer accepted as a flag because it is the inherited close method. Passing it to set_keys or to sync_findings/sync_assets on a ScannerIntegration subclass now raises TypeError. Two cases fail silently instead, so audit custom code for them: a class-level or instance-level close_outdated_findings = True assignment overwrites the inherited close method with a bool, and reading close_outdated_findings as a flag (if x.close_outdated_findings:) now returns the method, which is always truthy. Use close_outdated_findings_enabled for both.
• A refused token now names its likely cause: an expired token says when it expired, and an unexpired one lists the RegScale 6.36 events that revoke tokens (password change or reset, administrator sign-out or deactivation, local sign-in turned off) with the fix for a service account or a person. A refused XCCDF benchmark import now logs the server's status, error code and message, such as the 409 that asks you to delete a benchmark with assessment results before replacing it
• Nessus import reads large scan files faster and no longer loads the CPE dictionary when a scan names no CPE
• Scanner imports make fewer requests to RegScale at start-up and spend less time per finding
• The Nessus import is faster on folders with many files because it frees memory after a set amount of input instead of after every file
• Trivy and Grype findings no longer start with the CVE in their title, and carry more of the scan data where the scan provides them: references, layers, CWE ids, EPSS and known-exploited flags, fix advice and image details
• regscale jobs names each run's log file with its start time first, in UTC (20261108T070012Z-<job>-<run id>.log), so a plain ls of job_logs/ lists runs in the order they started. Logs from earlier runs keep their old names
• Databricks sync_findings --mop-up now closes CIS checks and CVE findings separately, each under its own source (Databricks CIS Benchmark and Databricks CVE), so an export of one type no longer closes the other type's records, sync_assets --mop-up is refused unless the export holds both types, because the two types share hosts, and a plan that already holds issues under the earlier source Databricks gets a second set of issues on its first run, so close or delete the old ones first
• Synqly connector prompts hide any value that the Synqly schema marks as a password, such as a client secret
• Aqua imports use less memory on large reports
• Each Xray vulnerability is now stored under a key that includes its CVE. The first Xray import after the upgrade creates new vulnerabilities with a new first seen date and closes the old ones, which keep their history.
• On defender export_resources, -n now means --query_name only, so a script that used -n to skip the upload must use --no_upload instead
• When a scanner sync stops because its vendor source fails partway through, the findings read before the failure are now sent without closing any findings, and a later error while sending them is logged at ERROR so the vendor failure still sets the exit code
• If all rules of a control are in the conformance pack, aws sync_config_compliance --conformance_pack_name now closes its fixed findings and issues

Fixed

• The interactive terminal GUI no longer fills the console with random characters when a file upload fails and the server returns a non-text error response
• jcamValueMapping accepts @drop for a value, declining it: the value writes nothing and leaves the destination as it is, instead of being written literally as the text @drop; a value mapped to @unmapped still works and is noted once per run in favour of @drop
• jcam import_ssp no longer stops for every plan when JCAM returns an undated SORN notice beside dated ones; undated notices go in the last slots, and an unexpected error in one plan's privacy data now fails only that plan
• jcam import_ssp now sets each child plan's parent from JCAM's FISMA rollup, including a first parent and a change of parent, instead of every change being refused, and leaves the parent alone when JCAM's parent system has no RegScale plan instead of writing 0
• jcam import_ssp no longer creates a plan a second time, without its compliance setting, in the front-matter step after RegScale refused to create it; the system is skipped and the refusal stays recorded
• regscale jcam import_parameters counts a failed read of a plan's controls, or of a control's parameters, as a failure in the run summary, instead of treating the plan as having no controls or the control as having no parameters
• jcam import_assessments and import_ssp count each assessment or system role RegScale's batch create did not return as a failure, instead of counting a refused batch or item as written
• tenable nessus import_nessus now sets each asset's type from the host instead of creating every asset as "Other": an asset-type host tag (any asset type value, case and spacing ignored) wins, otherwise the standard system-type property is mapped (router, switch, firewall, load-balancer, hypervisor, mobile, general-purpose, and now embedded and printer as Appliance). The asset category follows the type (Software for application, database, container and cloud types, Hardware otherwise), assets created for findings use the same type, and a host with no type information no longer resets the type already stored for it when a newer scan is imported (its category is still sent as Hardware) (requires RegScale platform 6.35.1.0 or newer)
• jcam import_poam matches an existing POA&M only among the importing plan's issues, instead of taking any issue in the tenant with the same otherIdentifier and moving it onto the plan
• Tanium Cloud CIS benchmark checklists now show the rule title and the last scan date instead of only the rule ID
• ServiceNow incident sync now copies attachments between incidents and RegScale issues instead of always reporting zero
• AWS asset console links now open the AWS GovCloud console for resources in GovCloud regions
• AWS Lambda layer version assets are now named by their layer and version instead of the bare version number
• Jira evidence sync lists the Jira Tasks named in a repeated-failure log line in sorted order, so the line reads the same on every run
• axonius_v2 commands give up on an Axonius request that times out after one attempt instead of four, and exit 6 with one timestamped log line naming the endpoint, the limit and axoniusTimeout, instead of a traceback or an unlogged error; the connect wait is capped at 30 seconds, as for other vendors, and axoniusTimeout is the read limit
• jcam import_ssp skips JCAM's placeholder information type 'Other: Other' unless the tenant has a type of that name, instead of counting a plan that lists only the placeholder as failed and offering it in missing_info_types.json
• The final step of a long import, where the RegScale server finishes the sync run, now logs when it starts, every 30 seconds while it runs and when it is done, instead of going silent for minutes
• Interactive imports that send many batches, such as a Nessus folder import, no longer fill the terminal with finished sync progress bars that pushed the log output off screen part-way through the run
• Trivy and Grype findings are dated from their scan file instead of the import time, and with import_scans first seen and last seen no longer move the wrong way when a newer or older scan is imported
• --s3-bucket and --s3-prefix now read the bucket for Trivy and Grype imports, using the AWS profile or keys given on the command line
• Compliance integrations, including AWS Security Hub compliance and Wiz compliance_report, count a compliance item that fails to process as a partial failure, so the run exits 3 under REGSCALE_STRICT_EXIT_CODES=1 instead of 0
• Commands run without a terminal (regscale jobs run-due, cron, a redirected shell) now log a progress line at INFO at most once a minute during long loops, and a closing line with the count and elapsed time, where they used to stay silent until the loop ended
• regscale jcam import_controls creates a plan's new control implementations 100 per request instead of one request each, and sends a control the report repeats once
• Databricks sync_findings and sync_assets with --regscale-ssp-id use less memory on a large export, because they no longer keep one object for every distinct host of the whole file while they stream it
• Tenable.io sync_compliance_controls no longer stops on a compliance check with a null see_also, description or other descriptive field, and skips a check it cannot read instead of ending the run
• FedRAMP Appendix A import no longer stops when a control in the document has no implementation status selected
• The FedRAMP POA&M Excel import now accepts workbooks built from template v3.x. It no longer requires the removed Resources Required, Planned Milestones, Milestone Changes and Operational Requirement columns, and it reads Remediation Plan in place of Overall Remediation Plan. It skips a POA&M sheet that has no POAM ID header, with a warning, instead of stopping. Typing a quoted answer such as 'skip' at the mapping prompt no longer loops.
• Trivy, Grype, SARIF, OpenText, Qualys Total Cloud and Tenable SC file imports no longer fail with "cannot pickle '_queue.SimpleQueue' object" when the staged findings file is larger than 500 MB
• Compliance syncs now fill in the control and security plan on each control assessment, and the control and assessment on issues whose finding maps to a single control. A new issue gets its assessment on the first sync and its control on the next
• Critical RegScale issues synced to Salesforce now create cases with High priority instead of Low
• JCAM milestone import reports an unrecognized or undated completed status instead of guessing, and export sends a milestone's own status to JCAM when it is one JCAM uses instead of always Completed or Not Started
• JCAM milestone import no longer gives a milestone JCAM sent no due date the import time; RegScale sets the date from the POA&M's severity
• Reminder emails no longer fail for users who have no upcoming or overdue items, and the run now reports when nobody has any
• Qualys scanner no longer fails on a finding with no detection data and now gives such findings a unique id
• regscale tenable io sync_compliance_controls now creates a control implementation for each matched control that passed or failed a check and that the security plan does not have, gives an enhancement control (for example AC-2(1)) the status Tenable.io reported, and exits 1 when it matches controls but RegScale saves none of them
• The stored size of an uploaded file, such as a Jira attachment or evidence file, is now its byte count
• AWS sync_assets on plans with assets in more than one region now marks a deleted resource as not in the latest scan and keeps edits made to it during the run, and the AWS compliance commands keep an Inactive status a user set and give S3 buckets the Cloud Storage type without replacing their description
• On platforms before 6.36.0.0, regscale aws sync_config_compliance now closes the issues that CLI 6.x stored under the bare AWS account ID when it retires those records, instead of leaving them open, with issueCreation: Consolidated (the default)
• regscale aws sync_config_compliance --conformance_pack_name no longer closes the findings and issues of controls that pass, so the findings and issues of failing rules outside the conformance pack stay open
• Scan History Date Scanned now shows the scan date instead of the import time for integrations that import vulnerabilities in batches
• Asset syncs no longer log a duplicate asset that RegScale saved from a later row of the same batch as "not saved", and the "Successfully submitted" and "asset(s) synced" counts now show distinct assets
• Synqly connector syncs create their Synqly account and integration with the installed Synqly SDK
• Amazon Inspector syncs through Synqly build an AWS access key credential and ask for the access key ID and the secret access key, instead of stopping with an attribute error
• Synqly ticketing syncs create tickets and upload attachments with the installed Synqly SDK
• The error that follows a rejected Synqly integration setup no longer shows the credential values that Synqly echoes back
• Synqly vulnerability syncs such as Amazon Inspector, Wiz and Tenable Security Center no longer stop with a filter validation error before they fetch findings
• The file comparison command now names the supported file types, CSV, XLSX or XLS, when it refuses a pair of files
• If another import saves the same plan, an asset import no longer adds a second copy of an asset. It reports the asset as not saved, with the reason
• The FedRAMP OSCAL SSP import now ends with one clear error line and exit code 6, or 4 when the host refuses access, when the host of the profile that the SSP names cannot be reached or answers with an HTTP error, instead of a traceback
• The FedRAMP OSCAL SSP import now reads a profile that its host sends compressed, such as the FedRAMP profiles published on GitHub, instead of failing with a decoding error
• The FedRAMP OSCAL SSP import now ends with one clear error line and exit code 1, instead of a traceback, when the profile that the SSP names is not a readable JSON document, and it no longer leaves a copy of the profile in the system temporary directory
• The eMASS POA&M workbook import now stores each POA&M with an Issue status the tenant offers (Ongoing as Open, Completed as Closed with its completion date, Risk Accepted as Exception/Waiver or Open, and Open or Closed as Ongoing or Completed on a tenant that uses the eMASS statuses) instead of losing rows.
• Tenable.io commands now honor the sslVerify setting, and Tenable.io and Tenable.sc commands now verify against the CA bundle set in customCaCert
• Tenable.io asset sync stores an asset's MAC addresses in the same order on every run
• tenable io info shows the Tenable.io user, account email and scanners instead of always reporting a connection error, and exits with a non-zero code when it cannot get them
• regscale tenable sc list_tags now lists the Tenable.sc tags. It asked pyTenable for a tags endpoint that does not exist, logged an error and exited 0. It now reads GET /rest/tag, prints "No tags found in Tenable.sc." when there are none, and exits 4 when Tenable.sc refuses the keys, 6 when it does not answer or reports an error, and 1 when the reply is not a list of tags.
• Prisma CSV import removes repeated rows before importing, so the logged counts are of distinct findings
• Wiz add_report_evidence now fails with an error naming the refused upload, instead of logging that the file was uploaded
• Jira commands that use basic authentication now honor the sslVerify setting, and a blank sslVerify key verifies the certificate
• OpenSCAP imports no longer leave two open issues for each failed rule, and the one issue that remains is linked to the vulnerability but not to the affected controls
• axonius_v2 commands print one error line that names the Axonius host and the failure, and exit with code 1, instead of a traceback when Axonius cannot be reached, drops the connection or answers with an error or an unreadable reply; a timeout still exits with code 6
• axonius_v2 now prints one error line that names the input, and writes nothing, when a saved query config file is missing or invalid, a saved query is not in Axonius, a regscaleSspId is not an integer, or --offset or --limit is negative
• Axonius asset sync no longer imports nothing when one device has no preferred hostname or name, or one flat-file row has no CDM Unique ID; such a device is synced under another identifier, and a device with no identifier at all is skipped with a warning that names it
• Fixed axonius sync_assets --regscale_ssp_id to stop with an error when the security plan does not exist instead of writing assets under it
• Axonius asset sync now stops with an error and a non-zero exit code when RegScale refuses an asset batch, for example when the token has expired, instead of reporting completion
• Axonius pull_data_axonius gives up when Axonius sends nothing for the axoniusTimeout setting (exit 6) instead of a fixed 3600 seconds, and reports a refused connection, an unknown host or a reply that is not a JSON object as one error line naming the host (exit 1) instead of a traceback
• Axonius pull_data downloads only the S3 object that the key names and fails when no object, or several objects, match the key
• axonius combine_data_parts merges a part that holds one JSON object as one record instead of writing its field names, and stops with a usage error for a part that is not a list or object
• axonius file commands and combine_data_parts report a missing, unreadable, non-UTF-8, empty, non-JSON or non-list input file, and a tenant without the "FISMA Id" security plan field, as one Error: line with exit code 1 instead of a traceback; the sync commands now check the input file before they query RegScale
• Report a missing security plan in the Axonius V2 sync commands as one error line instead of a traceback
• prisma sync_sbom (and panw sync_sbom) now fails when the SBOM download fails or the archive cannot be read, with exit 4 when Prisma Cloud refuses the credentials and exit 6 otherwise, instead of reporting success and exiting 0
• The Prisma Cloud and Palo Alto sync_sbom commands now accept --no-bulk-download to sync the SBOM of one host or image
• Prisma authenticate (and panw authenticate) now stops with exit status 4 when the login reply holds no usable token and with exit status 6 when the reply is not JSON, caches nothing, and ignores a tokenless session that an older release cached
• Prisma Cloud syncs now wait for each Retry-After value, at most 30 seconds, log every retry wait and fail at once when the console asks for a longer wait
• Burp Suite imports no longer stop when an issue has no background or a request and response pair has no request
• Importing a Burp Suite export now maps a vulnerability to each host that reports an issue type, where only the first host got it; the issue names every such host, and the stored vulnerability key does not change
• The Burp import now names a file that is empty, cut short or not a Burp export, and exits with an error when no file in the folder could be imported
• Burp import no longer prints a time zone warning for an export time that ends in a zone abbreviation such as EDT
• The Acunetix and Prisma CSV imports, and the other flat-file imports, now print one line for each file they cannot read and exit 1 when no file in the folder could be imported
• Importing a JFrog Xray report now stores one vulnerability for each CVE that a finding lists, where it stored only the first
• Fix the JFrog Xray import storing a finding as Low when its CVE has no CVSS v3 score: it now uses the severity Xray gives the finding, or the band of the CVSS v2 score
• Fix the JFrog Xray import skipping a finding that has no CVE identifier. The import now stores such a finding under its Xray issue id. A warning now names each finding that the import skips
• Importing a JFrog Xray or AWS Inspector JSON report with no findings now completes and says the report holds no findings instead of asking for a column mapping or failing, and an Xray report page that lists none of its rows is skipped so it closes no findings
• JFrog Xray import of a report that holds one finding as a single object instead of a list
• The Xray, Snyk and other JSON imports now name a .json file that is empty, cut short, not valid JSON, not readable or not a list of records, skip it, and import the other reports in the folder. A JSON report that starts with a UTF-8 byte-order mark is now read
• Prisma CSV import keeps findings identified by a Prisma Cloud or GitHub advisory ID instead of skipping them
• Prisma CSV import stores a finding with no CVSS score, or a score of 0.0, at the severity in its Severity column instead of Low
• A mapping file that is empty, not UTF-8 text, not valid JSON or not a JSON object now stops show_mapping with a message that names the file, instead of a traceback or a printed value
• Scanner file imports and other commands that check their security plan or component now stop with an authentication error when RegScale refuses the account (exit status 4, or 78 when the token cannot be renewed), instead of reporting an invalid plan and exiting 0
• Defender commands now report that Azure refused the credentials, with Azure's error description, instead of a missing access_token key and a traceback; the exit code stays 1
• Defender export_resources now reports the HTTP status and the request that failed when Azure refuses or fails the saved query request, instead of a traceback
• defender export_resources -n "<name>" now exports the named saved query and no longer prints five duplicate-option warnings
• Microsoft Defender alerts are no longer skipped when an activity time cannot be reformatted, and a time with an offset now shows its UTC date
• Entra evidence collection logs one error line for each evidence type that Microsoft Graph refuses, in place of a traceback and a bare exit code
• regscale emass_api authenticate, push_poam and sync_system now stop after one wait when eMASS does not answer, print the line eMASS at <host> did not answer in time (<n> seconds). and exit 6. push_poam no longer sends a new POA&M when its search for an existing POA&M gets no answer, a bidirectional sync_poams prints how many POA&Ms it pushed before the timeout, and authenticate no longer exits 0 when its connection test fails
• regscale emass_api commands no longer wait without a limit when eMASS accepts the connection and does not answer. The CLI now uses the emass.timeout setting (or EMASS_API_TIMEOUT, default 300 seconds) for each eMASS request. After that time the command prints one line, eMASS at <host> did not answer in time (<n> seconds)., and exits 6. When the request was a change, the line adds eMASS may have applied the change., so check eMASS before you run the command again. A command that sends many items, such as sync_controls or upload_artifacts_bulk, stops at the first timeout. The time limit applies to each phase of a request, not to the whole request, so a server that sends a little data at a time can still keep a command waiting. A large artifact upload to a slow eMASS server can now stop at 300 seconds; raise emass.timeout for it. A value of emass.timeout that is not a positive number, such as 0, -5 or abc, uses 300 seconds and logs a warning.
• regscale emass_api sync_controls no longer exits 0 when no control synced because eMASS could not be reached or refused the request. When no control synced and at least one control failed because of eMASS, the command prints one error line with the eMASS host and exits 4 if eMASS answered 401 Unauthorized or 403 Forbidden for any control, and 6 for an unreachable host, a TLS failure, any other error status or an answer it cannot read. It used to print [OK] Control sync complete with every control counted as an error. When eMASS refuses only the content of controls (400 Bad Request, 409 Conflict, 422 Unprocessable Content), or when some controls synced, the failed controls stay partial failures: the command prints how many controls were not synced, with the synced and error counts, and no longer prints [OK]. The DEBUG log message for a failed control push no longer carries the eMASS response body.
• regscale emass_api upload_artifacts_bulk and add_milestones_bulk no longer print tracebacks or the eMASS response headers and body when eMASS fails, sync_poams prints one error line that names the eMASS host when its pull fails, and import_xml prints one error line without a traceback for a file that is not XML
• The regscale emass_api commands now print one error line that names the problem and the eMASS host, for example eMASS at emass.example.mil rejected the API key: 401 Unauthorized., instead of one to three tracebacks. emass_api test_connection no longer ends with an empty Error: line and Aborted!. The line and the warnings never carry the API key, the response headers or the response body. A 401 Unauthorized or 403 Forbidden answer exits 4. An unreachable host, a failed TLS connection, any other HTTP error status or an unreadable answer exits 6. Both used to exit 1. A local or RegScale error still exits 1.
• The regscale emass_api commands delete_milestones, add_milestones_bulk and upload_artifacts_bulk accept --yes (or -y) to skip the confirmation question, so a scheduler, a pipeline or the Orchestration Hub can run them. Without --yes and without a terminal, each command now prints one Error: line that names --yes and exits 2 before it calls eMASS, instead of a traceback and Aborted!.
• regscale emass import_slcm now reports a file that is empty or is not an Excel workbook as one error line that names the file, and exits 1, instead of printing a traceback
• The eMASS import commands and detect_workbook now report a file that they cannot read as one error line that names the file and exit 1, instead of a traceback or exit 0
• regscale emass import_slcm now exits 1 when the security plan or the catalogue is not found, 4 when RegScale refuses the lookup and 6 when RegScale does not answer it, instead of exiting 0 after logging "Aborting!"
• If a control has the Implementation Status Manually Inherited, a blank status or an unknown status, the regscale emass import_slcm command no longer marks it Not Applicable. Manually Inherited is now saved as Manually Inherited, as regscale emass import_slcm_workbook does. The Implementation Status is matched without regard to case. A blank or unknown status keeps the control status and its N/A Justification, and logs a warning that names the control. The command applies Not Applicable from the Implementation Status or Compliance Status column only with an N/A Justification. Without one, the control keeps its status and the command logs a warning.
• The eMASS hardware and software inventory import now reports each row it skips and counts each asset RegScale refuses as an error
• eMASS POA&M workbook import now stops and names the rows that share a POA&M Item ID, instead of merging them into one issue
• eMASS control test results import now names the row and value of an unreadable Date Tested when the CCI does not resolve
• eMASS control test results import no longer sends an unreadable Date Tested to RegScale and names the CCI number in its errors
• OpenSCAP import_csv now names a CSV file that is cut off, has a header that matches no supported layout, is not UTF-8 or has a field over the CSV size limit, and exits non-zero instead of importing part of the file or nothing
• OpenSCAP imports now name each missing, empty, truncated or non-XML scan file, and a folder with no scan file, and exit non-zero, while the other files in the folder are still imported
• OpenSCAP CSV import now reads files that start with a UTF-8 byte-order mark, such as files saved by Excel as CSV UTF-8, and imports the same findings as the file without the mark
• cci_importer prints one error line that names the file, with no traceback, when the CCI file is empty, truncated, not XML or cannot be read
• regscale stig cci_assessment and regscale stig_mapper run now stop with an error and a non-zero exit status when the security plan does not exist, in place of reporting that they found nothing to do
• The jira_dc commands now log one error line that names the problem and the Jira Data Center URL, with exit code 4, 5 or 6, when the first request to Jira Data Center fails, and a server that does not answer fails after jiraDcTimeoutSeconds instead of about six minutes
• Jira commands jira issues and jira tasks now end with one error line and a non-zero exit code when Jira refuses the credentials, cannot be reached or answers with an error, and they report an unset jiraUrl, instead of printing a traceback
• Qualys scan import no longer stops when a row's severity is empty, not a number or outside 1 to 5; it logs a warning naming the row and imports that row at low severity
• The example Qualys URL in the init.yaml template is now a host only, and an existing init.yaml that keeps the old example path no longer doubles it or triggers config validation warnings
• Qualys diagnostics and CSV validation now exit with a non-zero status when a check fails, and a failed request no longer prints a traceback
• The Qualys import_policy command now reports a one-line error and exits with status 2 when the file is not a Qualys policy export or an option value is not valid, and no longer creates an Untitled Policy from a JSON object that has no policy ID
• Qualys import-vm-report now stops with a usage error when both --report-file and --report-title are given, instead of silently importing the file and ignoring the title
• A mapping file that is not valid JSON, not UTF-8 text or of the wrong shape now stops the import with exit status 2 and one line that names the file, instead of a traceback
• Import a Qualys VM scan row that has no QG Host ID as an asset keyed on its IP address, and skip a row with neither
• A Wiz token URL that ends in any mix of slashes and whitespace, such as a space or a tab followed by a slash, is now accepted, as one that ends in a slash or a space already was
• Wiz commands now name the token endpoint when its answer is not a token, instead of a redacted placeholder
• regscale wiz attach_sbom now attaches an SBOM whose document has no version, and when RegScale refuses one SBOM it still attaches the others and then exits 1
• A compliance sync that stops on a usage error, such as a Wiz compliance report that is not UTF-8 text, prints one "Error:" line and no longer also logs the same message with a traceback
• Wiz inventory, issues and vulnerabilities help now names the --filter_by_override option and shows an example that is valid JSON
• The deprecated wiz sync_compliance command no longer lists --list-frameworks in its help, and using that option now stops with a usage error (exit code 2) that points to wiz compliance_report instead of exiting 0 after printing a message
• The tenable was sync_findings command no longer exits 1 before it sends a request to Tenable.io when the security plan already holds assets
• A Tenable.io --tags value without key:value pairs, an --asset-filter-file that is not a JSON object, and a Tenable.sc sync_jsonl --mapping_file that is not a JSON object now end with a usage error that names the option and the expected format. A file passed as a pipe, such as a shell process substitution, still works
• Tenable.io CIS checklist syncs and Tenable.io STIG compliance results now send asset tag filters in the form Tenable.io accepts, so a run with --tags no longer fails and syncs nothing
• Tenable.sc file import with --file-path now stops with an error and a non-zero exit status when no file in the folder can be read as Tenable.sc data
• Negative --offset and --limit values are now refused with a usage error instead of stopping a sync or processing the wrong records
• Log redaction no longer hides the start of a connection error after a sign-in URL that ends in /token, so "[Errno 111] Connection refused" stays readable
• When Microsoft Defender keeps failing or does not answer, the error now names the request URL again, without its query string or any credential
• A request that keeps failing with an HTTP error such as 500 Internal Server Error or 429 Too Many Requests now logs one error without a Python traceback, and Microsoft Defender reports a sustained failure once
• A missing required setting, such as wizUrl, now ends a command with one error line and exit code 5 instead of a Python traceback
• tenable io sync_compliance_controls keeps the control owner of each control implementation it updates
• Qualys import-vm-report now saves Re-Opened and Fixed detections with a RegScale vulnerability status, and exits non-zero when it saves no asset or vulnerability or a request fails
• The eMASS asset, POA&M and test result integration classes now read the eMASS responses and sync the systems, POA&Ms and test results they return instead of failing with an error
• Tanium benchmark and ports syncs stop with an error when RegScale refuses or fails the read of the plan's components, instead of skipping the assets under those components
• Tanium ports and protocols sync in an Orchestration Hub split job now reads ports for the same endpoints that the job's asset step writes
• Tanium ports and protocols sync now writes ports only to the endpoint's asset in the selected plan or its components, not to copies of the endpoint in other or deleted plans
• eMASS and FedRAMP imports that update control implementations no longer reset the inherited record permissions or clear the last assessment, the parent control and the approval state of those control implementations
• If two rows of an asset sync differ only in letter case, the sync writes the software and SBOM of their asset once
• The jira_dc sync_tasks command no longer creates two RegScale tasks when the Jira search returns the same ticket on more than one result page
• FedRAMP OSCAL SSP imports now store the ports and protocols of each component, which RegScale rejected before because their Service and Used By values were empty
• Compliance syncs on RegScale 6.36+ read each control's newest same-day assessment from POST /api/v3/assessments/byParents, so a control assessed more than once today merges with its latest result instead of its earliest.
• AWS sync_assets now shows the valid from date, the valid until date and the number of resources in use on each ACM certificate asset
• Qualys sync keeps a consolidated issue and vulnerability open while any host or web application still reports the vulnerability as open
• Qualys WAS findings that Qualys reports as fixed now close their issue and vulnerability during sync
• env_info now prints its full report in the container image, under an unknown user id and in a read-only directory
• Pipeline report_scan no longer stops before it creates the issues for a failed scan when the SSP-level control update fails, and RegScale no longer refuses that update because the control origination is missing
• Pipeline setup_component and report_scan now link the repository component to the security plan, so it appears in the plan's Components tab
• regscale wiz vulnerabilities now names every finding it did not write when it exits 1 because regscale wiz inventory had not written the plan, one line for each finding with its asset
• aws sync_findings without --generate-evidence or --format now sends the findings it read before a failed Security Hub page, instead of none of them
• A scanner sync that the server did not start, because another sync of the same source was still running, no longer sends its checklist results or changes the status of a control or control objective
• Checklist roll-ups send only valid assessed dates, and a Tenable STIG result whose scan date is missing or not a valid date is dated by its last seen date, so one bad date no longer stops every result in the sync from updating control status
• Tenable STIG imports send a passing check's vulnerability as closed and any other result as open, instead of sending the check result, which the server rejected with a warning for every passing check
• Wiz vulnerabilities and issues incremental syncs run with --offset or --limit no longer move the saved pull watermark past findings they did not write
• Stop logging an error and stack trace when the catalog update cannot read the platform feature flags
• A Tenable.io asset or vulnerability sync now stops before it sends any record from a cached export that is corrupt, and an export that stops partway is no longer cached for the next run
• A truncated Tenable.io asset or vulnerability export cache is now removed and fetched again on the next run instead of failing every run until it expires
• Updated the pyasn1 dependency to a release that fixes known security vulnerabilities
• BigQuery asset sync now reports a rejected query as a single error line instead of a Python traceback
• Issues from a component compliance report are now saved under the component and no longer rejected as a missing security plan
• A Qualys CSV import whose column changes type after the first 10,000 rows now stops with a one-line message that names the file instead of a traceback
• A Qualys file import with a negative --skip_rows value, or one that reads a title row as the column headers, now stops with a message that names --skip_rows instead of a traceback
• Tenable compliance sync gives a failing control its planned implementation date and steps to implement, and sets a passing control to Fully Implemented, on platforms that take bulk control updates
• Qualys import_total_cloud no longer logs that it imported findings RegScale refused, and reports how many vulnerabilities RegScale stored
• Re-importing a Qualys VMDR report into a security plan now updates each host's existing asset instead of creating a second asset for every host
• The eMASS POA&M workbook import now stores the controls, devices affected, impact description and security plan of each POA&M it creates, and fills the false positive, operational requirement, auto-approved and risk adjustment flags with No when they are empty. A row the batch upload refuses, such as a Risk Accepted row stored as Exception/Waiver, is now written on its own, or reported with the server's reason, instead of being dropped with "see the log".
• FedRAMP CIS/CRM imports store every control and part inheritance model when the RegScale platform does not accept them all in one bulk request, and fail with an error line when RegScale refuses a model
• Evidence and scan results now map to every control of a security plan with more than 500 control implementations when RegScale leaves out the next page marker on a full page
• Evidence and scan results now map to control enhancements on a RegScale platform with the bulk compliance routes, and evidence also maps when the source names a control enhancement in the AC-2(1) form
• On RegScale 6.36 and later, a compliance sync no longer replaces the result of an assessment from another day
• Control implementation syncs and imports on RegScale 6.36.0.0 or later now retry or report a control implementation that the bulk update did not write, instead of finishing as if it succeeded
• Wiz syncs that run longer than the Wiz access token lasts get a new token and keep going, instead of failing with an HTTP 401 and exit code 4

FedRAMP authorization carries ongoing reporting obligations: vulnerability reports, significant change notifications, incident reports, and recurring certification reports, each with its own deadline. The data behind them is sensitive, so providers need a secure system of record for managing these obligations and precise control over who can see what.

RegScale Trust Center 1.0.0 is now available in Beta. For cloud service providers (CSPs) pursuing or maintaining FedRAMP Rev 5 or 20x authorization, Trust Center provides a secure place to manage reporting obligations and share the appropriate view of their authorization data with assessors, customers, and partners.

Availability

Trust Center 1.0.0 is ready for production data, so you can use it with your live FedRAMP information. The Beta designation reflects that many features are in minimum viable product (MVP) form: they support the core workflow from start to finish, with less depth, configuration, and refinement than we plan for general availability. Screens, defaults, and workflows may change before general availability.

Core Capabilities

KSI Management

• Record the status, narrative, and evidence of each Key Security Indicator (KSI), with completion rolled up by family.
• Select pre-configured measurement methods from Automation Packs, or write your own. AI-assisted drafting is available when AI is turned on for your organization.
• Report on completed KSI's in the Trust Portal or Auditor Portal.

FRR Management

• Under the FedRAMP Consolidated Rules for 2026 (CR26), set each FedRAMP Rule (FRR) that applies to your certification class to Compliant, Partial, Non-Compliant, or Not Applicable, and add a narrative and evidence.
• Walkthroughs in the application explain each rule family.

VER/VDR Reporting

• Evaluate vulnerabilities in Core Platform, including each finding's potential agency impact (N1 to N5) rating. Trust Center generates the Vulnerability Evaluation and Reporting (VER) and Vulnerability Detection and Response (VDR) reports and artifacts from that analysis. Track each reporting obligation with its next due date and status.
• Choose how findings reach Trust Center. Route scanner data through the RegScale Orchestration Hub (ROH) into Core Platform and sync it to Trust Center, or load findings, with their evaluations, directly into Trust Center through its API.
• Publish the monthly Vulnerability Detail, Accepted Vulnerability Information, and overview reports as a single package, validated against FedRAMP's schemas. Preview each publish before it goes out, and download the published month as a PDF. Historical VER Activity is available as a separate, all-time report.

Rev 5 Artifact Management

• Import an existing Rev 5 Word SSP, its Appendix A, or an OSCAL JSON SSP. Then maintain control implementations, inventory, POA&Ms, the Customer Responsibility Matrix, and five narrative appendices through guided wizards, with completion tracked in one view.
• Publish signed OSCAL files and a human-readable SSP from the same source data. A guided workflow supports migrating an existing Rev 5 authorization into Trust Center.

Trust Portal

• Registration is self-service or by invitation, with an optional NDA. Visitors request document access with a justification. Your team approves with view-only or view-and-download access, or domain rules decide by email domain.
• Share a system that is not yet visible to everyone with one named viewer, such as a pilot customer.
• Choose which of the portal's 13 tabs appear, and in what order.

Auditor Portal

• Invite an assessor firm to audit a system with a defined scope and access window. Assessors see only the systems you enable for them.
• Assessors record Met or Not met verdicts, raise findings, and request and review evidence.

Customizable UI

• Use the CR26 Guided Tours to educate your users on how requirements align with capabilities in the application.
• Use the Hide Features settings to turn off any sidebar or profile-menu items for users in your organization. New tenants start with a core capabilities feature set, with the option to enable additional features at any time.
• Each FedRAMP system has its own Hide Features setting; new systems start with a focused core set.
• Apply your branding to the portal for a cohesive user experience.

[7.0.1] - 2026-11-04

No changes to CLI commands or behavior from 7.0.0

Risk Management

Enterprise Risk Rollup: The Risk Rollup status board has been redesigned to allow for a single, scoped view of enterprise risk. Set the scope to consistently apply filters across every view in the board, so risk leads can better evaluate where risk is concentrated, and which treatments deliver the most value for the budget. Enhancements include:

• Scope bar and KPI cards: A new scope bar filters every view, and six new KPI cards summarize scoped risks, risk appetite, KRI health and annual loss expectancy.
• New risk views added: Three new tabs have been added to the status board:
  • By Lens: A spider chart of scores by impact area
  • Concentration Matrix: In-scope risks presented in a two-dimensional heatmap
  • Business Case & ROI: Risk treatments ranked by return on security investment against your budget
• Risk inspector: Open any risk row in a slide-over inspector, enabling you to preview a risk's details without leaving the board.
• More accurate totals: Closed and Cancelled risks are excluded by default, risks recorded on a system now roll up to its organization, and results respect each user's app and record access.

Security Plans

Streamlined Setup, Import and Export: This release streamlines how security plans are created, imported, exported and maintained.

• Setup Wizard Improvements: The RMF path of the security plan wizard offers an optional Categorization step and now automatically assigns the Wayfinder of the chosen compliance setting.
• Bulk Profile Import: The Profile Importer now accepts several security profile files at once, so you no longer need to repeat the import for each profile.
• Navy eMASS Exports: Security plan exports for eMASS now follow eMASS's current designated formats, making it easier to submit your security plan data to eMASS without rework.
  • SCF export: Matches the USN SCF v1.6 template.
  • SLCM export: Includes a Control Set column and completed assignment values.
  • System Details exports: New exports for each supported eMASS template.
  • Pre-export validation: Flags any required information missing from the security plan before you download a System Details export.
  • eMASS formatting: System Details exports use eMASS's own wording and formatting, such as multiple selections separated by semicolons.
• Asset Import from the Excel Template: The Excel template used by the Import Security Plan wizard has been updated to include a dedicated tab for capturing asset details. On import, each asset entry is created and linked to the security plan automatically, so you no longer have to add them one at a time.
• Large Record Deletion: Deleting large security plans and assessments is now faster and more reliable, with less impact on other users working in the platform while the deletion completes.

Wayfinder

Wayfinder Usability: The Wayfinder side panel and builder have been enhanced to make them easier to read and organize.

• Simpler side panel: The Wayfinder side panel on a record now shows one progress summary, one status icon per step and one primary action, so users can see where a record stands and what to do next at a glance.
• Builder: Activities can now be moved to a different stage from the activity's menu, making it quicker to reorganize a Wayfinder as your process changes.

Questionnaires

Questionnaire Date Entry: Date columns in Table questions now open a calendar picker when selected, giving questionnaire respondents a predictable, consistent way to choose a date.

User Experience

Navigation and Usability Improvements: A variety of changes have been made to the user interface to improve the user experience and usability. These include but are not limited to the following:

• Searchable pickers: Dropdown and selection fields with 10 or more options now include a search box, so users can find the value they need by typing instead of scrolling through a long list.
• Back button: The Back button now takes users to the page they were just on, or up to the parent page if there isn't one, so moving through the platform is more predictable and users don't lose their place.
• Breadcrumbs: Clicking a record's name in the breadcrumb trail now takes you to that record's main page, so you can return to it from any sub-page in one click.

Bug Fixes and General Maintenance

This release includes security hardening, patching, and fixes that improve reliability, performance, and overall platform stability.

[6.55.3] - 2026-11-02

Changed

• Nessus import treats every severity 0 item as informational, so an item with no risk factor no longer becomes a Low vulnerability and Low vulnerabilities that earlier imports created from such items are closed on the next import
• Nessus import leaves the CVSS v3 score of a vulnerability empty when the plugin has no v3 score instead of storing 0.0
• Nessus vulnerabilities show the Nessus plugin name as their plugin name instead of the CVE, which stays in the CVE field
• Nessus import reads large scan files faster and uses far less memory
• Minimum versions of pyasn1 and setuptools raised to 0.6.5 and 84.1.0 so installs always include their security fixes, and the dependency lock is updated so virtualenv is on 21.14.13

Fixed

• tenable nessus import_nessus now sets each asset's type from the host instead of creating every asset as "Other": an asset-type host tag (any asset type value, case and spacing ignored) wins, otherwise the standard system-type property is mapped (router, switch, firewall, load-balancer, hypervisor, mobile, general-purpose, and now embedded and printer as Appliance). The asset category follows the type (Software for application, database, container and cloud types, Hardware otherwise), assets created for findings use the same type, and a host with no type information is still created as "Other"
• Tanium Cloud vulnerability sync now uses a descriptive title instead of the CVE ID and populates last seen date, remediation, CISA KEV, EPSS score and exploit availability
• Tanium Cloud compliance sync now includes each rule's title in the finding title and uses it as the plugin name, where findings previously showed only the rule ID
• Nessus import no longer moves a scan file to the processed folder before its upload and compliance issue sync finish, so a file whose upload or compliance issue sync raised an error is imported again on the next run
• Nessus import no longer fails the run when the processed folder is read-only
• Nessus import now reports a finding it could not read as an error, naming the exception
• Nessus findings now include their port and protocol
• Nessus STIG and CIS check findings each get their own plugin name instead of sharing the scan plugin's name

[7.0.0] - 2026-10-30

Added

• Optional OpenTelemetry and Datadog observability across all CLI commands, outbound HTTP/GraphQL requests, sync item counters and secret-redacted structured logs over OTLP/gRPC, installed with the telemetry extra (also part of all) and configured only through REGSCALE_OTEL_*, OTEL_* and DD_* environment variables, never init.yaml
• ServiceNow PySNC SDK support is now installed with regscale-cli[all]
• New regscale appdetectivepro import_appdetectivepro command imports AppDetectivePRO XML database scan exports as assets, vulnerabilities and issues
• Jira Cloud evidence mode for regscale jira tasks --to-evidence that syncs Jira Tasks with Security Plan Evidence records, including attachments and comments, in both directions
• Qualys sync_qualys options --tc-tag-by and --tc-tag-include-selector, with the init.yaml keys totalCloudTagSetBy and totalCloudTagIncludeSelector, to select Total Cloud tags by name or by tag ID and to match any or all of the include tags
• Orchestration Hub can run the Microsoft Defender sync commands and Entra ID evidence collection through a new defender command group
• Tenable SC JSONL sync accepts --no-skip-validation to check that the security plan can be read before syncing
• Wiz finding family filters for wiz vulnerabilities: --finding-families imports only the named families and --exclude-finding-families imports all others (for example --exclude-finding-families network_exposure); all eight families (vulnerability, configuration, host, data, secret, network exposure, end-of-life and excessive access findings) still import by default as before; a run with a filter warns that mop-up may close the findings of skipped families already in RegScale as no longer reported; and an option that names no family, such as ' , ', is a usage error
• Published GraphQL usage manifest, scripts/model_sync/graphql_usage_manifest.json, which lists the platform GraphQL types and fields the CLI uses (its mapped models' fields plus the root fields, collection envelopes and navigations its own queries select) and the fields whose CLI models reject null, so platform PR CI can flag a breaking schema change that would break the CLI before it merges; regenerate it with python -m scripts.model_sync.usage_manifest (also run by make regen-model-fields)
• axoniusRebaselineHours setting that forces a full Axonius sync, which closes what Axonius no longer reports, once the last full sync is 168 hours old by default

Changed

• Files encrypted with this release cannot be decrypted by earlier regscale-cli releases, so upgrade every installation that reads a shared encrypted file before encrypting it with this release
• Scripts that run regscale change_passkey must now pass --file once per encrypted file
• regscale encrypt, decrypt and change_passkey now replace the file instead of writing into it, so they need write access to its folder and do not keep its hard links or its owner when someone else owns it
• Files encrypted by earlier releases will not decrypt while the key files in .secrets are writable by their group or by others, and the error now names the chmod 600 command that fixes it
• regscale-cli 7.0 now needs RegScale platform 6.35.1.0 or newer with the Client API enabled, instead of 6.36.0.0
• The regscale-rest Flask REST API server and the regscale-cli[server] install extra are removed; run CLI commands through the regscale executable instead
• CrowdStrike integration no longer carries a BETA label in its help text and documentation
• HTTP error messages and HTTP client log lines for requests to your RegScale instance now keep their query string (paging, filters and flags), while credential-shaped values and other hosts' query strings stay redacted
• jcam import_controls reports a JCAM status it cannot read once per run at WARNING, with a count and the jcamValueMapping key that maps it, instead of once per control
• Newly generated and upgraded init.yaml files no longer carry the deprecated per-integration TLS verification keys, so a deprecation warning now appears only when your own configuration still sets one; existing configurations keep loading and are still warned
• Nessus import treats every severity 0 item as informational, so an item with no risk factor no longer becomes a Low vulnerability and Low vulnerabilities that earlier imports created from such items are closed on the next import
• Nessus import leaves the CVSS v3 score of a vulnerability empty when the plugin has no v3 score instead of storing 0.0
• Nessus vulnerabilities show the Nessus plugin name as their plugin name instead of the CVE, which stays in the CVE field
• Nessus import reads large scan files faster and uses far less memory
• Aqua imports use less memory on large reports
• RegScale API request errors and the API call summary now appear in the CLI's console output and log file instead of only on stderr
• A configured customCaCert now keeps TLS verification on even when sslVerify is false, with a warning, and the Microsoft Sentinel integration, remote jobs configuration and GraphQL client now resolve sslVerify, customCaCert, SSL_CERT_FILE and REQUESTS_CA_BUNDLE the same way as the rest of the CLI
• regscale nist sort_control_ids now asks the platform to normalize a catalog's control sort ids in one request (POST /api/SecurityControls/sortByCatalog/{catalogId}, RegScale 6.34.5.0 or newer) and reports the per-control outcome, saving the server's result object as regscale-catalog-{catalogId}-sort-results.json in the artifacts directory in place of the former regscale-catalog-{id}-controls.json, catalog-{id}-sorted-control-ids.json and failed-/retry-*-controls.json files, instead of re-deriving the sort ids client-side and updating every control one PUT at a time
• Scanner asset and issue syncs now check that the RegScale platform is 6.34.1.0 or newer (the release that ships the Client API asset and issue batch endpoints) before the first request, and a 404/405 from an older platform reports the required release instead of a bare HTTP error
• CLI version line moved to 7.0.0; this major line requires the RegScale Client API to be deployed and enabled on the target instance
• Asset and Issue records no longer carry client-side audit stamps (dateCreated, dateLastUpdated, createdById, lastUpdatedById) or a client-side isPublic default on Issue: the RegScale platform stamps every create and update itself, so the values the CLI used to compute were never persisted
• Links, component mappings, milestones, tasks, comments, asset mappings, data records, evidence mappings, properties and components are now created or updated through the RegScale Client API, which matches existing records on the server instead of the CLI listing and comparing a parent's records locally; the get-or-create paths (the GitHub and GitLab project components and their plan mappings) send only the fields the CLI set, so an existing component keeps the status, owner and compliance settings it has on the server instead of taking the CLI's defaults for them, as in 6.x
• Scanner integrations now create and update assets through the RegScale Client API, so the CLI and direct API callers produce the same assets from the same data
• An asset's explicitly supplied tracking number is now kept instead of being replaced by the integration's identifier
• Assets missing from a scan are marked Off-Network, and assets the server rejects are reported individually with the reason
• regscale aws sync_assets now warns when init.yaml still sets ingestBackend: grpc, naming the removed gRPC ingest keys, since asset sync always writes through the RegScale API
• The gRPC asset ingest option for AWS (ingestBackend: grpc and its ingestTarget, ingestInsecure and ingestToken settings) has been removed; AWS asset sync always uses the RegScale API
• Scanner integrations now attach assets to components through the RegScale Client API, which finds or creates each component in the security plan and links it to the plan and the asset in one request per batch instead of one call per asset
• Scanner integrations now create and update issues through the RegScale Client API issue batch endpoint, which applies the platform's defaults for status, owner, identification, organization and risk rating and normalizes severity aliases server-side
• Severity values a scanner reports that RegScale does not recognise are stored as "IV - Not Assigned" and listed once per value in the sync log, instead of being silently defaulted
• Issue titles, descriptions and compliance references are no longer truncated by the CLI before upload; the platform's own limits apply and an over-long value is reported per issue
• Issues reported by scanners now carry their affected controls and asset identifiers directly in the batch upload
• Issues created in bulk from scanner findings are now linked to the control implementations the finding named, as issues created one at a time already were
• Syncing issues requires the RegScale Client API to be enabled on the instance; when it is not, the sync stops with a message naming it instead of falling back to the legacy endpoints
• Issues created or updated one at a time now go through the RegScale Client API, which applies the platform's defaults for status, owner, identification, organization and risk rating, normalizes severity and status aliases, and reports in the CLI log any field the instance's form configuration stopped the platform from storing; this requires a RegScale platform at or above 6.34.1.0 with the Client API enabled
• Scanner integrations now send a finding's control labels, control implementation ids and CCI reference on each issue and let the RegScale Client API resolve and link them to the security plan's controls, instead of resolving labels and CCIs client-side and re-applying fields with a second update pass
• Scanner integrations no longer compute issue due dates client-side: an issue is sent without a due date unless the scanner supplied one, and the per-severity day counts, useKev and kevDueDate under issues.<integration> in init.yaml (merged over the same defaults as before, so every severity carries a count) travel with the batch and RegScale dates every undated issue from them (the CISA KEV date first, then the configured count) while the security plan's remediation SLA is not consulted for scanner-created issues; noPastDueDates is honored as the batch option of the same name
• Wiz retention reconciliation lets the RegScale platform close the issues whose findings aged out of the retention window when the run's findings are posted in a single final vulnerability batch request (same protections, audit note and control-status refresh; the sync logs "Closed N outdated issues." from the platform's count), and keeps closing them from the CLI as before on an older platform or when a run is posted in several flushes or requests
• Scanner integrations now let the RegScale Client API close issues that are absent from a scan (once per run, on the final request, skipping issues protected from automatic closure and recording an audit note on each issue it closes) instead of closing them client-side; preventAutoClose in init.yaml keeps its 6.x meaning and does not affect that server-side mop-up
• Vulnerability descriptions and plug-in text are no longer cut at 4000 characters by the CLI: the full text is stored up to the RegScale column, any free text the platform does shorten is reported in the sync log as "normalized", and the Qualys VMDR and CIS report imports create vulnerabilities through the RegScale Client API like every other scanner
• Scanner integrations now create and update vulnerabilities through the RegScale Client API, which validates every record and reports each rejected or adjusted one, and require a RegScale platform at or above 6.35.0.0 with the Client API enabled
• Compliance integrations now record control assessment results and control test results through the RegScale Client API, which keeps one assessment per control per day and derives each control's implementation status from the plan's compliance settings server-side, so the CLI and direct API callers write the same assessments and statuses from the same results (requires a RegScale platform that ships the Client API control-result routes with the Client API enabled; an older platform is refused with guidance naming the required release)
• Issue descriptions, remediation text and other free-text fields are sent to RegScale exactly as the scanner produced them: the platform's Client API wrappers now own length handling, report every truncation per record (surfaced in the sync log as "normalized"), and reject an over-long identifier by name instead of the CLI silently cutting Issue descriptions at 4000 characters
• Issues, assets, control objectives, controls and links under a security plan or component now load completely and in fewer requests, so large plans no longer stop at the first page or time out while syncing
• These reads now require RegScale platform 6.35 or newer; against an older platform they stop with an upgrade message naming the required release instead of returning nothing
• Security plan creates and updates now go through the RegScale Client API, which drops any field disabled by the instance's form configuration server-side and reports each dropped field in the CLI log, replacing the CLI's silent retry without those fields and its FedRAMP deployment-flag pre-zeroing, and require a RegScale platform at or above 6.34.5.0 with the Client API enabled
• Scripts that call Api.graph() directly now receive a GraphQLQueryError when a query fails instead of an empty or partial result, and paginated fetches raise IncompleteFetchError instead of returning a short list; see docs/upgrade-to-7.0.md
• Jira tasks and issues sync now exits with code 5 instead of 0 when the issue type is not available in the Jira project, or cannot be confirmed because the project's issue types cannot be read
• The single issue that an earlier version created for a whole AWS compliance run (or, in PerAsset issue mode, for each resource, unless an AWS S3, KMS, IAM, Systems Manager or GuardDuty sync finds that resource still failing) is no longer updated by later runs and can be closed by hand
• jira tasks now maps To Do and every other open Jira status as jira issues does, to the issues.jira.status setting when it is Backlog or Open and to Open otherwise, instead of Backlog or Open by status name
• Deprecated the --use_security_hub and --no_use_security_hub options of regscale aws sync_config_compliance because they change nothing, with removal planned for 8.0.0 and regscale aws sync_securityhub_compliance as the command for Security Hub compliance data
• Removed the jiraDefaultIssueType and jiraDefaultPriority settings, which the Jira commands never read; delete them from init.yaml, because config validate now reports them
• The ingestClosedIssues init.yaml key is deprecated because no integration reads it, and setting it now logs a warning; delete the key, because it will be removed in 8.0.0
• The CLI now asks the RegScale platform for its version once per command and reuses that answer for every version check in the run, instead of each check resolving it on its own
• regscale nist sort_control_ids again writes the artifact files every 6.x release wrote (regscale-catalog-{id}-controls.json, catalog-{id}-sorted-control-ids.json and, when a control is rejected, the failed/retry control files) alongside the new regscale-catalog-{id}-sort-results.json, logs the 6.x summary lines and exits with the 6.x messages when the catalog cannot be read
• A scanner integration reads the per-severity day counts, useKev and kevDueDate from its issues.<integration> block in init.yaml again and sends them with each issue batch, and warns once per run about a value that is not a positive whole number of days (the 6.x default is used in its place)
• Scanner asset, issue and vulnerability syncs and compliance assessments log the same summary lines as CLI 6.x (Successfully submitted N ... in batch, Sending N assets to RegScale via batch API, Issue batch results: N items returned, Successfully created N control assessments), with the per-outcome breakdown appended
• Scanner and compliance integrations send and print what 6.x did: issues are marked public, a closed issue is completed when its finding was last seen, a vulnerability's plug-in name is its CVE when it has one, long Azure resource-path asset names are shortened to their meaningful parts, preventAutoClose no longer turns off the platform's issue mop-up, control assessments carry the source control id in their title and the run's date stamps, get_or_create never rewrites a record it finds, insert_issue/update_issue use the Client API once the platform accepts the custom-field switch, and the "Closed N outdated issues", per-control test-result and bulk update/creation log lines are back; scanner issue syncs, compliance assessment recording and get_or_create now require RegScale platform 6.35.0.0 or newer and stop with an upgrade message on an older platform
• Scanner syncs on RegScale 7 log the same INFO lines as 6.x for every batch submission (assets, vulnerabilities with their id range, issues and their asset mappings, the plan's remediation SLAs and the compliance cache summary); the Client API's per-batch breakdown moved to DEBUG
• Scanner syncs such as Tenable SC vulnerability queries save large asset batches as quickly as earlier releases again instead of taking several times longer
• Scanner syncs such as Tenable SC vulnerability queries send their asset and vulnerability batches to RegScale concurrently again, restoring the sync speed of earlier releases
• Microsoft Defender sync commands (365 alerts, 365 recommendations, Cloud alerts and Cloud recommendations) now name each record they could not map to an issue, exit 1 when they retrieve records but none can be compared or mapped to issues or RegScale creates none of the mapped issues, and report item-level failures under REGSCALE_STRICT_EXIT_CODES
• Microsoft Defender sync commands treat resolved and dismissed alerts and healthy Defender for Cloud assessments as no longer reported, so they close the matching open issues and create no new ones
• Qualys import_total_cloud now imports nothing and exits 1 when a page of the host detection list fails, cannot be requested, or is truncated without a continuation URL, and exits 6 on a Qualys timeout, as sync_qualys with --include-total-cloud now does too
• Qualys sync_qualys now exits 2 when an asset group is combined with Total Cloud tags, from the command line, init.yaml or the environment, under --include-total-cloud or when --tc-exclude-tags (or init.yaml exclude-only tags) is used without --include-total-cloud, and skips Total Cloud containers on asset group runs and on runs whose exclude tags are applied client-side
• Rapid7 InsightVM requests now follow the CLI-wide proxy rule, so proxy environment variables such as HTTPS_PROXY apply to them only when REGSCALE_USE_PROXY_ENV is set
• regscale-cli 7.x requires RegScale platform 6.35.1.0 or later
• When the platform's catalog migrator is enabled, the catalog update command (catalog update_via_platform) uses the platform's tracked background update and waits for it, reporting whether a new catalog version was created, the catalog was already up to date, or the update failed; otherwise it updates synchronously as before
• Qualys syncs whose host list stops early, because of an API error or because it exceeds 500 pages, now sync the hosts they read and close nothing, with a warning
• AWS Config compliance syncs file new issues under the source AWS Config, so issues filed by earlier syncs under Scanner Integration are no longer closed automatically and the next failing sync files a new issue beside each, which must be closed by hand
• Tanium sync_cis_benchmarks stores a CIS benchmark title or rule id that holds <, > or quotes whole, with those characters in their fullwidth forms (＜Level 1＞), so RegScale no longer cuts it at a tag and two CIS profiles named inside a tag keep separate checklists; a checklist an earlier run stored with a cut title is left as it is and the next run adds it once with its full title
• Wiz syncs that find another Wiz sync still running on the same plan now wait up to one hour for it to finish instead of stopping at once
• Wiz vulnerability syncs on a plan with no assets now exit 1 and name the count and the missing assets when findings stay skipped, instead of reporting success with nothing written
• When a vulnerability's own IP address or DNS name is one of the assets left out over maxAssetIdentifiersPerVulnerability, the vulnerability now records one of its linked assets there instead, or no IP address when none of them has one, so it links no more than that many assets
• When RegScale refuses to map an evidence record to its security plan or a control implementation, the error now names each refused target, found with RegScale's read-only access check, and lists every id the check could not answer for
• AWS sync_directory_services exits with an authentication failure when its AWS credential cannot be resolved, instead of returning cached data
• Control IDs from QRadar, JCAM, CI/CD pipeline scans, CrowdStrike evidence, Tenable control compliance and the Wiz STIG control flip are now matched to security plan controls by the RegScale platform, which also resolves AC-2-1 to AC-2(1) (previously read as AC-2) and AC.2.1 (previously matched only as a CMMC practice)
• Scanner syncs with incrementPoamIdentifier now let RegScale assign POA&M ids per security plan or component, so two runs no longer give the same id to different issues
• Scanner syncs now report each run to RegScale as one sync run, so stale records and Wiz findings past their retention window are closed once by the server when the run ends, and a sync whose batches failed exits with status 1 instead of closing records it could not confirm
• Integrations that save evidence now keep one evidence record per security plan and source, refreshing its status and due date and adding each run's file to it, instead of creating a new record on every run
• Jira, Jira Data Center, ServiceNow, Salesforce, Archer, GitLab, Microsoft Defender and Synqly ticketing syncs now let RegScale match each ticket to its issue by the ticket's id, taking over the issues earlier versions synced instead of creating new ones, and the ticket id is no longer stored in Other Identifier
• Control implementations are now created through the server's create-or-update route, which fills status, responsibility, owner, implementation, source, status flags and the Planned and Not Applicable fields with one platform policy; a control implementation the server refuses counts as an item-level failure, and a request that fails makes the command exit 1
• Checklist results are now created or updated by the server, which matches them on asset, tool and vulnerability ID and fills blank fields itself; checklists it refuses count as item-level failures, and a checklist request that fails makes the command exit 1
• cisa ingest_cisa_kev, scanner kevList and the FedRAMP POA&M v5 KEV due dates now use the RegScale platform's CISA KEV store instead of a catalog the CLI downloads or bundles, KEV Threats are stored with Source "CISA KEV" instead of "Open Source", the cisaKev init.yaml key is no longer read, and each exits 1 when the KEV store cannot answer
• Removed the standalone FedRAMP parameter ID migration script, which called API routes the platform does not serve
• Removed the unused Issue.set_is_poam SDK method and the ISO_DATETIME_FORMAT constant in the issue model module
• Removed the unused internal.workflow.create_workflow SDK function; use create_regscale_workflow_from_template instead
• Removed the unused ComplianceIssueHandler methods for updating existing issues, since compliance issues are now updated by server-side deduplication
• Removed the unused catalog_utils.update_catalog and update_catalog_v2 SDK modules; use update_catalog_v3.import_catalog instead
• regscale model new, generate and load now use the RegScale Client API for assessments, control implementations, issues, assets and components, send only the cells changed since generate, report each row or cell that was not applied with its spreadsheet row number wherever RegScale identifies the row, and exit non-zero when any row or cell is not applied or the pre-change workbook is missing
• regscale model load for assessments, control implementations, issues, assets and components no longer exits non-zero when the edit workbook is unchanged, and still logs the totals for rows created from the new workbook
• regscale model load no longer sends edits to read-only columns such as CreatedBy, and reports each one with its spreadsheet row number and exits non-zero
• regscale model load keeps the existing differences.txt when no existing record was changed
• regscale model generate greys out the read-only columns of the edit workbook and notes on their header that load does not send changes to them
• regscale model new no longer adds an Id column to the new-records workbook, and load refuses a new-records row with an Id filled in, naming its row number, instead of creating a duplicate record
• catalog sync_security_plans now syncs plan controls, objectives and parameters on the RegScale platform instead of in the CLI
• catalog sync_security_plans --all syncs every plan in one platform job that keeps going past a plan that fails, reports each failed plan and the number of skipped plans, and exits non-zero when any plan fails
• catalog sync_security_plans --all keeps waiting for the platform job through up to three consecutive connection or server errors while checking its status
• cve-cleanup fix --confirm now runs on the RegScale platform and always keeps the first valid CVE in the field, and discover and fix --dry-run list each issue's CVEs in that same order
• cve-cleanup fix --confirm now applies the whole repair as one all-or-nothing change
• cve-cleanup fix --confirm now names the missing Issue Update permission when RegScale refuses the repair
• cve-cleanup discover and fix now reject a --parent-id below 1 as a usage error, where 0 previously ran unfiltered across every issue and a negative id silently reported no issues
• cve-cleanup fix --confirm now exits non-zero when a repair errors or a split copy is not created, while issues skipped for having no valid CVE still exit zero
• evidence start now has RegScale evaluate the evidence rules and create each project's child assessment from that project's own evidence folder, stops before sending anything when a config.json rule or score cannot be read, skips a list.json project whose id or folder name cannot be read, skips with a warning a project that has no evidence folder, and exits non-zero when any readable project with evidence does not get an assessment or any list.json entry cannot be read
• evidence build_package now downloads the evidence package RegScale assembles for the security plan and exits non-zero when the plan does not exist or the package cannot be built, instead of logging and exiting successfully
• The issue_linker, assessment_linker and risk_linker commands now link record lineage in a single pass on the RegScale server, report how many records were linked and how many have no parent record, and exit non-zero when the server does not confirm the pass completed
• When the issue_linker, assessment_linker or risk_linker command gets no answer, or a gateway error, from the RegScale server, it now says the server may still have completed the pass and that re-running the command is safe
• The deprecated migrations process_data helper works again when called directly, without the progress and counter globals the linker commands no longer create
• The issuelinker, assessment_linker and risk_linker commands now log the real module and path of the RegScale.json file they write, instead of always naming a risk list file that was never written
• cleanup delete_issues, delete_assets and delete_vulnerabilities now delete through the RegScale platform in one request, check before the prompt and again before deleting that the platform would delete exactly the records listed, delete nothing and exit non-zero when it would not, and exit non-zero when the number deleted differs from the number confirmed
• cleanup delete_issues now deletes only the issues whose parent is the security plan or component, and reports issues only linked to it through another record (such as an asset or a mapped component) as left in place
• cleanup delete_vulnerabilities with --include-scans now deletes the linked scan history records that belong to the same security plan or component and that nothing outside it still uses, and keeps and reports the rest
• cleanup delete_vulnerabilities --no-mappings now stops before deleting anything when the vulnerabilities still have mappings, because a vulnerability that still has mappings cannot be deleted
• cleanup delete_issues, delete_assets and delete_vulnerabilities --dry-run and --preview still print their listing when the platform does not confirm it, and then exit 1
• cleanup delete_vulnerabilities now keeps scan history records by default, and deletes them only when --include-scans is passed
• set_permissions load now applies spreadsheet permissions through the RegScale Client API instead of the record permission routes the platform has retired
• set_permissions load now reports each row that was skipped, forbidden or failed with its spreadsheet row number
• set_permissions load and --preview now reject a row whose id is not a whole number or whose visibility is blank or unrecognized or whose R/RU value is unrecognized instead of applying it as public or no-access, and read R/RU in any case
• set_permissions load now exits non-zero when any row is not applied
• cve-cleanup discover and fix --dry-run now run on the RegScale platform with only Issue Read permission, and name the missing permission when RegScale refuses a run
• regscale model load writes what RegScale applied back into the workbooks, putting each created record's id on its row, so re-running it sends only what is still to apply, sends later edits to created rows as updates, and no longer skips or duplicates rows when rows are inserted, deleted or sorted between runs
• regscale model load puts back an Id cleared from an otherwise unchanged edit-workbook row instead of refusing the workbook's new rows, and names the missing Ids when it still refuses them
• Control results, control test results, CVE cleanup and security plan writes now use the platform's final Client API routes and mop-up counts, which require RegScale 6.35.1.0 or newer
• Checklist scanner results are rolled up into control and objective status by the server, where a failing check lowers a control to In Remediation and a passing check no longer marks it Fully Implemented
• STIG mapper rules are now applied by the RegScale platform in one request, existing rules files that name a stig keep working, and stig_mapper run exits 1 when the rules are refused or not confirmed
• cleanup delete_issues, delete_assets and delete_vulnerabilities now send the confirmed record ids with the delete, so when the records under the security plan or component change after the prompt the RegScale platform deletes nothing and the command prints the ids on each side and exits 1
• In PerAsset issue mode, the AWS S3, KMS, IAM, Systems Manager and GuardDuty syncs now close the per-resource issue a 6.x release left open once the resource has one issue per failing control, and that closed issue keeps its due date, basis for adjustment and false-positive status, which the new per-control issues do not inherit
• An aws sync-config-compliance run with --tags or --conformance-pack-name no longer closes the findings of controls that pass on those rules, because the controls can still fail on other rules
• aws sync_findings now reads the findings below issues.amazon.minimumSeverity from Security Hub before dropping them, so a high setting no longer shortens the read, and the setting now also applies when the CLI falls back to its basic Security Hub read
• Compliance syncs and imports adopt the v3 compliance bulk endpoints on RegScale 6.36+ (control implementation bundles, bulk patch, objective batch updates, bulk inheritance provider models, multi-parent properties/links/comments/assessments, evidence batchUpsert, and OSCAL catalog child batches) with automatic fallback on older servers

Fixed

• jcam import_artifacts records an artifact RegScale refused, or whose local copy is missing, as a failure instead of a success, so the run summary and strict exit codes see it
• regscale encrypt on a file that is already encrypted, regscale decrypt on a file that is not encrypted and regscale change_passkey with a wrong passkey now exit with status 1 and leave the file unchanged, instead of exiting with status 0
• Encrypted files no longer depend on keys stored on disk: regscale encrypt now derives the key from a passkey of at least 12 characters that you enter, regscale encrypt refuses files already encrypted by earlier releases, those files still decrypt and can be upgraded with regscale change_passkey --file (then delete the old .secrets folder), and change_passkey now asks for the file to re-key
• set_permissions load now sets each group's grant as 6.x did: an R row over RU lowers the group to read, and a blank R/RU cell in an otherwise filled row removes the group's grant (requires RegScale platform 6.35.1.0 or newer)
• Commands that re-read configuration mid-run, such as secret migration, no longer fail later RegScale requests with "Cannot send a request, as the client has been closed"
• Scanner syncs stopped with SIGTERM, such as a scheduled job that times out, now let their in-flight batches finish (normally a few seconds), close their open sync run and then end by the signal as before, instead of blocking the next sync of the same plan for up to 7 days; a sender that escalates to SIGKILL first, as regscale jobs run-due does after 10 seconds, still leaves the run open
• Acunetix import keeps each scanned host as its own asset when the export lists the start URL without https://
• regscale tenable nessus import_nessus now fills the Azure identifier on Azure hosts with the Azure resource ID (falling back to the VM ID), matching the Defender and Wiz integrations, and records the VM ID, subscription, resource group and instance name in the asset notes
• regscale sarif import now keeps a rule's remediation guidance as the finding's recommendation (the solution OWASP ZAP writes, or the SARIF help text from other tools) along with the rule's reference links; previously the recommendation held the rule description instead
• Scanner syncs refused because another sync of the same plan and source is still open now stop at once and report the refusal a single time, instead of reading the whole vendor inventory, logging an error per batch and ending with advice to run the sync again
• jcam import_controls leaves a new control's Implementation Status and Control Origin unset when JCAM gives none, so RegScale fills the plan's defaults instead of the importer writing Not Implemented
• aws commands no longer exit 1 with a traceback when STS answers the credential check with something other than its own response, such as a proxy page; the check warns and the command goes on
• The "PySNC SDK not installed" warning now appears only when the ServiceNow use_sdk option is enabled
• Tanium Cloud vulnerability sync now uses a descriptive title instead of the CVE ID and populates last seen date, remediation, CISA KEV, EPSS score and exploit availability
• Nessus import no longer moves a scan file to the processed folder before its upload and compliance issue sync finish, so a file whose upload failed is imported again on the next run
• Nessus import no longer fails the run when the processed folder is read-only
• Nessus import no longer closes the existing record of a finding it could not read and now reports that finding as an error
• Nessus findings now include their port and protocol
• Nessus STIG and CIS check findings each get their own plugin name instead of sharing the scan plugin's name
• Tenable findings no longer put the CVE in the title, so the platform no longer shows it twice; the title is the synopsis, else the plugin name
• The sync_compliance commands and the AWS evidence commands built on them, such as aws sync_inspector and aws sync_guardduty, now refuse a security plan or component that does not exist before anything is read or written, in one ERROR line; a --dry-run warns and still counts
• aws sync_findings_and_assets now refuses a security plan that does not exist before AWS is read, aws sync_findings reports that refusal in one ERROR line instead of a traceback, and crowdstrike sync_incidents / query_incidents and jira warn when their --regscale_module parent cannot be checked
• Comparing two security controls, or looking one up in a list or set, no longer fails with an AttributeError
• Grype, Trivy, SAP Concur Tenable, Wiz and flat-file imports now log a warning naming the date field when a scan date cannot be read instead of silently substituting the current time, and a Wiz issue with an unreadable creation date no longer counts as its earliest creation date
• Scanner syncs now check the Assets and Issues forms for required custom fields on every tenant, so a required field is reported before the sync writes instead of the check being skipped
• Log redaction no longer rewrites the log lines of an application that loads the CLI as a library, apart from its HTTP client request lines, whose URL query strings are now always redacted
• A STIG or compliance checklist result with no CCI, from a .nessus file or a .ckl checklist, no longer changes the CCI-000366 (CM-6) control objective, and the issue for a failing one names no CCI; the checklist row and the finding's external id keep CCI-000366 as before, so existing records still match
• tenable sync_vulns (Tenable Security Center) and tenable io sync_findings (Tenable Vulnerability Management) now send each DISA STIG result's CCI and pass or fail to the RegScale control objective roll-up, as the Nessus and checklist imports do, while still creating its vulnerability and issue; a STIG result with no CCI changes no objective, and a passing STIG check from Tenable Security Center is no longer dropped by the severity filter
• tenable sc sync_jsonl now sends each DISA STIG result's CCI and pass or fail to the RegScale control objective roll-up, as tenable sync_vulns does, and no longer drops a passing STIG check at the severity filter; Tenable STIG results sent to the roll-up are now dated by their scan rather than by the STIG content
• Orchestration Hub can run the Tanium ports and protocols sync and the Tanium CIS benchmark sync
• Microsoft Defender alert and recommendation syncs run with --offset or --limit no longer close RegScale issues outside the selected range
• Tanium ports and protocols dry run reports the number of endpoints, the same unit --offset and --limit select, so split runs cover every endpoint
• RegScale platform version checks now require the release that actually contains each server-side change, so a 6.35.0.0 platform is no longer offered Client API behaviour that first ships in a later release
• Issues whose asset identifier is an IP address, ARN, or hostname that differs from the asset name are now linked to their assets instead of being silently dropped from scanner imports
• GraphQL-backed queries now report server-side query errors instead of silently returning partial results, and every paginated collection is fetched to completion
• Importing the observability package no longer reconfigures the CLI logger as an import side effect; callers that want structured JSON logging call configure_logging() explicitly
• Synqly integrations no longer stop fetching partway through paginated results when the provider's numeric cursor does not match the number of records returned
• Single-object lookups no longer error when the platform reports a missing record with an empty response body
• Jira tasks and issues sync checks the issue type against the Jira project's own issue types on Jira Cloud, so a type the project has is no longer rejected
• Tenable.io and Tenable SC CIS checklist sync now records each run as an assessment on the security plan, with the counts of passed, failed, not reviewed and not applicable checks and an overall result, instead of finishing with no CIS record, and a refused assessment counts as a partial failure, so the sync exits with code 3 when REGSCALE_STRICT_EXIT_CODES is set
• aws sync_assets now records the real diskStorage of every EC2 instance when one attached volume no longer exists, instead of giving every volume in the batch the 8 GB floor because AWS refused the whole batch of 200 volumes
• aws sync_findings, sync_findings_and_assets and the ten AWS compliance commands (sync_s3, sync_kms, sync_cloudtrail, sync_cloudwatch, sync_iam, sync_guardduty, sync_ssm, sync_org, sync_config_compliance, sync_compliance) accepted --dry-run but synced anyway, so an Orchestration Hub split job wrote everything twice (in the count run and again in the children); a dry run now only counts and echoes the splitter's JSON summary; the findings commands count the raw Security Hub findings that --offset/--limit slice and parse nothing; and a compliance dry run stops before the scan history and writes no assets, assessments, issues or evidence
• Compliance commands for AWS, GCP, Tanium, CrowdStrike, Qualys CIS, PAN-OS and QRadar now create one issue for each failing control instead of one issue per run
• The AWS compliance commands that write a bucket, KMS key, GuardDuty detector or account asset (sync_s3, sync_kms, sync_iam, sync_ssm, sync_guardduty, sync_config_compliance, sync_compliance and sync_securityhub_compliance) now send those assets under sync_assets' source with their region recorded, and sync_assets on a plan that holds assets in more than one region keeps other regions' assets active while still marking Inactive the regional resources deleted from the region it ran in (on such plans, global assets such as IAM roles and assets with no recorded region are not marked Inactive; compliance reruns reactivate any mopped-up Inactive assets)
• AWS sync_assets on plans with assets in more than one region now marks a deleted resource as not in the latest scan and keeps edits made to it during the run, and the AWS compliance commands keep an Inactive status a user set and give S3 buckets the Cloud Storage type without replacing their description
• AWS load balancers from Security Hub findings now get the Load Balancer asset type and name that aws sync_assets gives them, instead of Other
• aws and gcp asset syncs type each component from its assets' category, and a re-sync retypes an existing Hardware or Software component when all its assets agree, so a GCP service account, firewall rule, service or bucket component an earlier version made Hardware becomes Software and the aws "AWS Account" component becomes Hardware to match its asset
• GCP sync_findings and sync_compliance now map a finding to the same NIST controls, so sync_findings no longer writes a passed row for a control that sync_compliance fails: both commands read NIST 800-53 tags however Security Command Center spells the standard and ignore tags of other NIST standards such as CSF and 800-171; both map an untagged finding by one shared category table and an untagged CVE finding to SI-2; and sync_compliance also assesses a tagged control that its framework table does not list
• gcp sync_compliance and gcp collect_evidence no longer add a second project asset when Resource Manager refuses the project lookup or when gcpSccUrl overrides the endpoint, because the compliance pass now reads the project number from Cloud Asset Inventory with the same endpoint and credentials as gcp sync_assets
• jira issues and jira tasks now sync the remaining attachments of a Jira issue when one attachment fails to download, instead of stopping the attachment sync for the whole issue, and name that attachment in a warning; while that attachment fails to download, they hold back the RegScale files they would send to that Jira issue, so that they add no duplicates, and name each file they hold back
• jira issues now reports how many Jira issues RegScale did not save in its summary line, instead of reporting only "created 0, updated 0" when RegScale refuses the issues
• jira issues now dates a Done, Closed or Cancelled issue from Jira's status-change date, else its resolution date, else its created date, as jira tasks does, and a malformed Jira date no longer stops the other issues from syncing
• jira tasks gives a task created closed and a task closed on a later run the same close date when Jira's status change date is missing or unreadable, using the resolution or creation date instead, and keeps a closed task's close date when other fields change
• BigQuery asset sync no longer reports success when rows have no assetId value, and fails when no row has one
• AWS S3, CloudTrail, CloudWatch and Systems Manager syncs now accept an --account_id with surrounding spaces and treat a blank one as no account filter
• AWS S3, CloudTrail, CloudWatch and Systems Manager syncs no longer reuse cached data from a run with a different AWS credential or different filters, and keep that cache in the artifacts directory instead of the shared temporary directory
• Jira task syncs no longer create a RegScale task or Jira attachment twice when RegScale answers slowly or with a gateway error, and the run summary counts only the tasks RegScale stored
• With REGSCALE_STRICT_EXIT_CODES, an asset sync no longer exits 3 for a row RegScale merged into a later row with the same identifier in the same request
• Scanner and BigQuery asset syncs no longer send an asset batch a second time after a gateway error, timeout or dropped connection, and fail the run so that a rerun lands the batch (except with REGSCALE_USE_LEGACY_REQUESTS)
• BigQuery asset sync dry run in table mode counts the rows of a table whose metadata has no row count instead of failing
• GCP sync_findings help and the GCP page now say that findings land as vulnerabilities, and the page lists the extra control mappings sync_compliance applies
• Wiz issue sync now asks Wiz for open, in-progress, resolved and rejected issues when the filter names no status, instead of leaving the statuses to Wiz
• Corrected the Wiz documentation for the default inventory entity types and the default issue status filter
• On a RegScale platform that supports it, aws sync-config-compliance updates and closes the issues an earlier version opened instead of adding a second issue per failing control, and closes the duplicate issues those versions left
• Asset syncs now name each asset RegScale refused beside the reason RegScale gave, and say an asset came back with no reason only when none was given
• Nessus and other scanner imports no longer fail with an empty HTTP 400 when creating issues through the Client API
• A compliance batch response (POST /api/client/v1/assessments/control-results, POST /api/client/v1/control-test-results/batch) whose saved entry names no submitted index is now reported as a Client API contract error, with the earlier chunks attached as the partial result, instead of being silently credited to the first submitted row
• Scanner syncs split large vulnerability submissions by the number of affected assets again, so imports with many hosts per finding are not lost to a timed-out request
• Tanium vulnerability sync now picks the same representative endpoint for a consolidated finding on every run, so the issue description, asset identifiers, DNS and IP address no longer change between syncs of the same data
• Vulnerability batches again send an empty plugInText, as 6.x did, when a finding has neither plug-in text nor observations, instead of omitting the field
• CLI v7 prints the 6.x log lines a Nessus import and the AWS compliance syncs printed (issue-asset mapping count, records-cache summary) and moves the lines 6.x never printed (nothing closed by mop-up, control-reference link notes, the per-scan vulnerability success line) to DEBUG
• Issues created from scanner findings again carry the Current/Planned milestone note that the 6.x releases wrote
• CLI v7 reports the wrapper normalizations that store exactly what 6.x stored (a defaulted placeholder, a value accepted as sent, a dns stored as 6.x's own "unknown") at DEBUG, worded for what happened; a truncation still warns
• CLI v7 prints the plan's remediation-SLA line only on the commands 6.x printed it on (Nessus imports and Wiz issues), not on the Wiz vulnerability, Qualys and Tenable syncs that dated their own findings in 6.x
• Findings that --skip-assets leaves out because no matching asset exists are no longer closed as remediated
• Prisma sync_hosts and sync_images with --skip-assets no longer create or update assets
• aws sync_assets skips AWS services that the target region does not offer, such as App Runner, Lightsail, AppSync, CloudFront, Global Accelerator and Audit Manager in GovCloud and Rekognition, Comprehend and Timestream in us-gov-east-1, with an INFO line instead of retrying and logging each at ERROR
• Microsoft Defender 365 recommendations with no severity score are created as Moderate issues instead of being dropped, and reopening an issue from such a recommendation keeps its severity and due date
• Microsoft Defender sync commands now close issues Defender no longer reports and reopen closed issues it reports again, keeping their control links, and a Defender for Cloud sync closes an issue whose record it no longer receives only when the issue's other identifier is an Azure resource id in the subscription it reads, and warns about issues without one
• Microsoft Defender for Cloud recommendation issues for a resource with no resource details are no longer titled with a trailing "on"
• Tanium Cloud vulnerability and compliance syncs no longer stop with a pagination data limit error, reducing the request size automatically when the Tanium API Gateway rejects it
• Tanium Cloud vulnerability, compliance, ports and SBOM syncs no longer stop early when a page of endpoints has no matching data
• Qualys Total Cloud sync now reads every page of the host detection list instead of only the first, and a run that stops early on a later page no longer closes assets or findings it did not read
• Qualys sync_qualys no longer fails when Qualys truncates the host detection list without a continuation URL, and closes nothing it did not read on that run
• Qualys Total Cloud sync now scopes hosts to the asset group, excludes tagged hosts when only exclude tags are given, accepts numeric tag IDs, and keeps the asset group or tag filter when it falls back to VMDR
• Rapid7 findings with an InsightVM risk score above 10 are no longer rejected by the Client API, and the risk score is no longer saved as the VPR score; a VPR score already stored on an existing vulnerability is kept
• aws sync_iam now exits 4 (authentication failure) when AWS refuses its credentials, checking them before it writes anything to RegScale, instead of reporting "completed successfully" having read nothing
• Tenable SC query_vuln and sync_vulns now exit with a non-zero status when the import fails, instead of reporting success
• Tenable SC query and sync commands now import every vulnerability a query returns, instead of importing nothing for small queries and dropping the last results of larger ones
• Tanium sync_compliance --dry-run now honors --offset and --limit, and a dry run of sync_compliance or sync_all fails when the Tanium Comply fetch fails instead of reporting 0 items
• Tanium sync_all --dry-run no longer writes compliance assets and assessments to RegScale; it logs how many compliance items, one per finding and mapped control, it would sync
• Tanium sync-all in security plan mode now links compliance results to the endpoint's existing asset instead of creating a duplicate, and the compliance step of sync-all and sync-compliance no longer marks endpoint assets Inactive
• Qualys fetch-vm-report, import-vm-report and import-cis-report now exit non-zero instead of 0 when the report cannot be fetched or parsed, the CIS report has no results, the security plan is not accessible, or no report option is given
• Tenable SC JSONL sync now fails when the Tenable SC login or query download fails, instead of syncing nothing and reporting success
• Tenable SC JSONL sync accepts a query id of 0 instead of reporting that no query id was provided
• Tenable SC JSONL sync now fails when neither a query id nor a file path is given or when the sync itself fails, instead of reporting success
• Qualys vulnerabilities now carry the CVSS v3 and v2 base scores and vectors from the Qualys knowledge base, and each sync fills in or updates them on existing vulnerabilities
• Slow start-up of every command, most noticeable on short AWS, Microsoft Defender and Wiz runs
• Scanner syncs that return no findings, or whose findings exactly fill the last batch, now close the findings and issues the vendor no longer reports, which previously stayed open after such a sync, while Nessus imports close only what the reports they contain no longer list
• Asset syncs that return no assets now mark the assets the vendor no longer lists, which previously stayed active after such a sync
• OpenSCAP syncs whose run produced no issues now close the compliance issues the vendor no longer reports, which previously stayed open after such a sync
• Nessus imports of a named scan whose every host was fully scanned now close the findings and issues that scan no longer reports, even when the scan has no findings, which previously stayed open after such an import
• Prisma Cloud sync_hosts and sync_images runs no longer retire each other's assets or close each other's vulnerabilities and issues when both use the standard API mode: each run now tells the RegScale server which asset type it covers so its clean-up touches only those records (assets written by a CSV download-mode run share one type, so a plan that has used CSV mode for either command is still not separated)
• Compliance syncs store the issue's organisation on the first run; the RegScale Client API issue wrapper resolves it from the issue owner, the plan owner or the plan, where earlier releases left it empty until the next run
• A Rapid7 sync now retries a brief connection drop and stops with the host named if Rapid7 stays unreachable, and a console sync whose asset load fails now stops instead of finishing with missing findings
• SentinelOne sync commands now check the URL, token, timeout and page size before they contact RegScale, print a configuration error that names the setting without a traceback, and trim leading or trailing whitespace from a token instead of sending it as is, so the token no longer appears in an error
• CrowdStrike incident syncs now record the device serial number on each asset they create for an alert's device
• Qualys vulnerabilities whose knowledge-base record carries no CVSS v2 or v3 vector are stored with an empty vector, as they were before, instead of a null one
• Prisma Cloud host and container image syncs no longer overwrite each other's record for a CVE found on both: each command keeps its own vulnerability and issue
• aws sync_iam again caches its IAM data in artifacts/aws/iam_data.json and stores its account asset's scanning tool and its issues' source as 6.x did, so existing records are updated rather than duplicated
• The AWS compliance commands sync_s3, sync_org, sync_cloudtrail, sync_kms, sync_ssm, sync_cloudwatch, sync_directory_services and sync_compliance again store their account asset's scanning tool and their issues' source as 6.x did, so the existing account asset is updated rather than duplicated and issue due dates again follow the issues.scanner integration block of init.yaml
• Scanner integrations once again send each asset's type exactly as the scanner reported it; the RegScale platform now resolves vendor terms such as Server, Workstation and Virtual Machine to the same asset types the 6.52 CLI stored, so the saved asset types do not change
• A vulnerability, asset or issue batch chunk the RegScale server could not process is retried item by item through the same Client API route, as 6.x did, instead of being reported as rejected and dropped
• CrowdStrike compliance sync no longer warns that partially supported controls read as a full pass; the platform records them with the framework's partial implementation status
• crowdstrike sync_compliance now keeps the exit code and message of a usage error or a CrowdStrike timeout instead of reporting every failure as exit 1
• Qualys syncs of an account with no hosts, or with hosts that report no detections, now complete instead of failing and close the findings, issues and assets Qualys no longer reports
• AWS Security Hub, AWS Config compliance and AWS Inspector syncs that report no failing control, no failing rule or no active finding now close the findings and issues an earlier sync created, unless the sync was filtered, AWS returned an error, every result was inconclusive, or a Security Hub compliance-only sync ran with --no-collect-evidence
• Scan file imports whose file holds only the expected header row are now accepted as a report with no findings and close the findings, issues and assets an earlier import created, instead of being rejected as invalid
• Intune, Splunk, Axonius plan-field and full Synqly vulnerability syncs that report no devices, alerts or vulnerabilities now close the findings and issues an earlier sync created, and an Intune sync with no devices also retires the Intune assets it created
• AWS Config compliance syncs now close the issues of the findings they close, and a sync filtered by account or tags no longer closes findings outside the filter
• Prisma sync_images now attaches the findings of an image whose name the Prisma API reports as empty or null to that image's asset, instead of skipping them
• Prisma sync_hosts now reports the findings --skip-assets skipped, and the assets it created or updated, in the --output json run summary, and its failed records count toward REGSCALE_STRICT_EXIT_CODES
• A platform refusal that stops a vulnerability, asset or issue batch now reports every record the server already saved, however the batch's parallel requests completed
• Tanium sync_all in components mode now assesses the component's controls and files its ports roll-up on the component
• Wiz vulnerabilities resolved in Wiz now record the date Wiz resolved them as their close date, instead of the date of the sync that first saw them closed
• Commands now stop with an error naming the module when RegScale refuses to let the account read it, instead of continuing as if no records existed
• GraphQL responses that carry an empty or null errors value alongside their data are no longer treated as failed pages, and a malformed errors value is reported as the query error it is instead of crashing the error summary
• Qualys Total Cloud and VMDR host detection pagination now preserves tag and asset group filters across continuation pages
• Scanner findings with an unassigned severity are stored as Low vulnerabilities with Low issues again, instead of Informational vulnerabilities with Not Assigned issues
• Microsoft Defender for Cloud recommendation syncs no longer raise an issue for an assessment Defender marks not applicable to the resource, and close the open issue of one
• Tanium CIS benchmark and ports/protocols syncs now stop with a clear error when RegScale refuses or fails the asset lookup, instead of treating the assets they could not read as missing and creating duplicates
• The Policies Tested table of a compliance assessment report now shows Not Applicable, Inconclusive or No Result for a policy whose checks did not pass or fail, instead of Pass with a passing count of zero
• Tanium sync_cis_benchmarks now writes its CIS checklists, updates them on a rerun instead of adding copies, and exits with an error when none of its checklists could be written
• Qualys sync_qualys now reads every page of the Container Security container list instead of the first page only, and closes no hosts, containers or findings in a run that could not read the container list or a container's vulnerabilities in full
• Tanium sync_cis_benchmarks no longer adds a copy of a CIS checklist on every rerun when its benchmark title or rule holds an HTML-like tag such as <Level 1>
• DRF imports now read every column correctly when the header row has blank cells, no longer fail on an issue whose DR Number is empty, and log a missing column once instead of on every row
• tanium sync_compliance on a plan last synced with CLI 6.x no longer leaves each endpoint with two Active assets: the endpoint asset 6.x created is set Off-Network once the endpoint's current asset is on the plan
• aws sync_guardduty --create_vulnerabilities now writes a vulnerability for each GuardDuty finding that names a CVE, and --create_issues a record for each finding without one; both are vulnerability records, and the server makes each one's issue; these records close when GuardDuty archives the finding, not by mop-up, because each region's run shares the "AWS GuardDuty" source
• aws sync_assets and aws sync_cloudtrail no longer hang when AWS returns the same page of CloudTrail trails twice; they log an error instead
• Wiz syncs on a plan that a killed Wiz sync left held now close that sync's run after 4 hours and continue, instead of waiting for it until the server releases it after 7 days
• Wiz vulnerability syncs run at the same time as a Wiz inventory sync on one plan now wait until the inventory sync has written its assets before they skip the findings on assets that are not in the plan
• Microsoft Defender 365 recommendation syncs no longer raise or reopen an issue for a recommendation with an exception (risk accepted) in Defender, and close the open issue of one
• Nessus STIG and other compliance issues whose due date has already passed are saved as POA&Ms again, as 6.x saves them: the CLI asks RegScale to mark a past-due issue as a POA&M when RegScale computes its due date (not in IssueOnly mode)
• Scanner syncs now send a vulnerability that affects thousands of assets in several smaller requests, so a slow server no longer drops the request and every asset up to maxAssetIdentifiersPerVulnerability is linked
• A vulnerability found on more assets than maxAssetIdentifiersPerVulnerability now links at most that many assets in a sync, with a warning that says how many it left out
• aws sync_findings --generate-evidence now refuses an empty --control-ids value, or a part that is not a whole number from 1 to 2147483647, before it reads AWS or writes evidence, and without --generate-evidence the command logs that it ignores --control-ids
• AWS sync_directory_services no longer reuses Directory Services data cached by another credential or region
• AWS sync_directory_services now keys its account asset and evidence record by the AWS account its credentials belong to and the region, and renames an existing ds-service asset to that key in place, so each account and region keeps its own asset and record
• AWS sync_directory_services with --account-id or --tags now updates control assessments, and its --help and logs no longer say those options filter its data; AWS sync_compliance --help no longer lists account ID among its filters
• AWS evidence commands now link evidence to the controls named by --evidence_control_ids when a run skips the control assessment step, such as with --no_update_control_status, --account_id, --tags, or --offset and --limit, and on every run a NIST control id given to --evidence_control_ids also links on a plan of another framework, such as SOC2, through that framework's crosswalk
• Flat-file scan imports, such as Aqua, now send each asset once instead of once per row and keep the values of its last row, so rows that repeat an asset are no longer rejected as duplicates
• The file comparison command now names the supported file types, CSV, XLSX or XLS, when it refuses a pair of files
• regscale model generate now exports every assessment and control implementation linked to the parent instead of only the first 50
• regscale model load exits non-zero and warns that the import may already be committed when RegScale returns a record id that is not a number, instead of showing a traceback
• regscale model dropdowns whose values join to exactly 256 characters now use a lookup sheet, since Excel rejects an inline list longer than 255 characters
• regscale model load exits non-zero with "no workbook found" when neither the new nor the edit workbook is in the given path, instead of reporting that files were uploaded
• regscale model load no longer sends a new row whose only filled cells are read-only, which could create a blank record, and reports it with its row number
• regscale model load refuses the edit workbook's new rows, naming each row number, when an Id from the pre-change copy was removed, instead of risking a duplicate record
• regscale model load skips new rows that an earlier load already created, using the workbook's Ids sheet, so re-running it after a partial failure no longer creates duplicate records
• cve-cleanup discover --output now writes the CSV export instead of failing after the header row
• evidence start signature checks now read each PDF from its program folder, so a signed document in a program sub-folder no longer fails the signature-required test
• evidence start now reads config.json and list.json when evidenceFolder is a relative path such as the default ./evidence, instead of falling back to default rules and creating no assessments
• fedramp import-drf treats a cell as the export's empty-value text only in the column the export writes it to, as the platform's DRF import does: the same text in another column is stored as written, "N/A" in Remediation Level Explanation keeps the stored value, a Risk Adjustment row no longer needs a Justification, and a new deviation with an empty or placeholder Operational Impact Statement or Justification is created without one instead of "N/A" or "Unknown Justification"
• Scanner syncs now exit 1 and hold back closing findings when RegScale saves a batch but cannot finish applying it, and count records RegScale refuses as item-level failures under REGSCALE_STRICT_EXIT_CODES
• Saving a single issue no longer warns that a control label it could not link was changed to an empty value, since the label is stored as sent
• Trivy, Grype, OpenText WebInspect, SAP Concur Tenable, Sicura, Splunk, STIG, Acunetix and Synqly vulnerabilities imports no longer log the security plan remediation SLAs, which they do not use to date their findings
• Scan history after a Snyk import no longer counts twice two findings that RegScale stores as one vulnerability
• Orca commands now report that the Orca host could not be reached, naming the host, instead of saying the API token was rejected, and exit without a traceback
• The cisa ingest_cisa_alerts command now reports that it could not reach the CISA site and exits with an error, instead of crashing with an AttributeError, when www.cisa.gov is unreachable
• Evidence that Wiz sync_compliance, the eMASS importers and other integrations write is now created, owned by the signed-in user, on tenants whose Evidence form requires an Evidence Owner instead of failing for the missing owner, and on those tenants a refreshed evidence record also becomes the signed-in user's
• Scanner imports into a security plan date new issues from the plan's compliance-setting remediation SLAs again, ahead of init.yaml's issues.<integration> day counts, as 6.x did, so a high OpenSCAP issue under the RegScale Default Setting is due 30 days after it is first detected rather than 60
• regscale gitlab sync_issues reports that it could not connect to GitLab, naming the host, and exits with an error instead of ending with a connection-error traceback
• Salesforce sync now reports that the Salesforce login failed, with the reason, and exits with an error when the connection is refused or a credential is rejected, instead of stopping with a traceback
• Microsoft Sentinel sync_content now names the content type that failed to load, such as watchlists or bookmarks, instead of reporting every failed read as an incident page
• AWS sync commands save their evidence records and link them to the security plan instead of exiting with an Evidence Owner is required error
• When one checklist is empty or damaged, stig sync_assets now syncs the hosts of every other checklist and sync_assets_and_findings and process_checklist now import every other checklist, naming each unreadable checklist in one error line and exiting 1, instead of stopping at that file with a traceback
• stig sync_assets, sync_findings, sync_assets_and_findings and process_checklist now reject a --stig_directory that does not exist with a usage error (exit 2), instead of reporting success and exiting 0
• regscale qualys get_asset_groups, export_scans, save_results, sync_qualys, list_policies and export_policy now end with one error line and exit 6 when Qualys cannot be reached, instead of a traceback
• regscale qualys export_scans now exits 6, or 4 when Qualys refuses the credentials, when Qualys answers with an HTTP error, instead of failing with a traceback while reading the error as scan data
• regscale qualys save_results now exits 6, or 4 when Qualys refuses the credentials, when Qualys answers every scan list with an HTTP error, instead of failing with a traceback
• Qualys get_asset_groups and list_scans now exit with an error when Qualys refuses, fails or does not answer a request, instead of reporting an empty result, and list_scans honours qualysTimeout
• Qualys save_results now saves the scan results as a .json file in the given directory, keeps the scans of every scan list, and handles a scan list with no scan or one scan
• Qualys VM report import now saves a vulnerability for a finding without a CVE, and its issue stays open
• wiz sync_benchmarks exiting 0 when Wiz refused the framework or rule query or a benchmark import failed; it now exits 4 when Wiz refuses the token, 6 on another HTTP or connection failure, 1 on a GraphQL error or a failed import, and reports a malformed --framework_id as a usage error
• A second scanner import on the same day, for example a Tanium findings sync, now closes the findings it no longer reports: each run tags its vulnerability batch with its own id instead of the date
• When the evidence form requires an Evidence Owner and the signed-in user cannot be read from the login token, integration evidence records are owned by the userId in init.yaml instead of failing for the missing owner
• Scanner asset syncs no longer reset an asset status set in RegScale, such as Off-Network or Decommissioned, back to Active (On Network) on RegScale 6.35.1.0 and later
• AWS Security Hub findings now name a CloudWatch log group asset by its full log group name, including any "/" path, instead of "" or a shortened name such as "api:"
• AWS Lambda assets named by a version or alias ARN now take the function name and link to the function's console page
• aws sync_assets now resolves the AWS account ID via STS (or the collector's configured account) for Redshift clusters whose DescribeClusters response omits ClusterNamespaceArn, keeping the account segment in the cluster ARN and preserving the cluster when --account_id matches
• AWS findings and assets sync now renames assets an earlier version named by their full ARN, fixing their name, description and console link (requires RegScale 6.35.1.0 or later, not on a dry run; versioned or aliased Lambda functions, Lambda layer versions and log groups ending in ":*" keep their ARN name for now)
• regscale aws sync_guardduty now keeps GuardDuty findings read before or around a failed ListFindings page or GetFindings chunk and leaves IR-4 unassessed with a warning instead of passing IR-4 on an incomplete findings read
• The pre-release workflow's extract-version step now receives the workflow_dispatch tag_name input through env instead of inline ${{ }} expansion and rejects multi-line values before the tag format check, so a crafted dispatch tag cannot break out of quotes or bypass validation
• jira issues now syncs RegScale attachments to a linked Jira issue even when that Jira issue has no attachments of its own yet
• gcp sync_compliance now classifies a Cloud SQL instance (//cloudsql.googleapis.com/projects/<p>/instances/<i>) as Hardware, matching gcp sync_assets (sqladmin.googleapis.com/Instance)
• The jira tasks command no longer creates two RegScale tasks, and the jira issues command no longer counts a ticket twice, when the Jira search returns the ticket on more than one result page
• AWS sync_guardduty and sync_assets no longer create a second asset for a GuardDuty detector when the account lookup fails on one run and succeeds on a later one; detector assets that earlier versions keyed without an account are not yet merged
• aws sync_config_compliance now closes the record an earlier version kept under the bare account id, so an account keeps one open record per failing control, and the remaining record keeps the original first-seen date
• aws sync-config-compliance no longer closes the findings and issues of another AWS account synced into the same plan
• regscale aws sync_config_compliance --conformance_pack_name no longer closes the findings and issues of controls that pass, so the findings and issues of failing rules outside the conformance pack stay open
• Asset syncs no longer name an asset refused, or fail the run, when RegScale merged it into a later row of the same request whose identifier differs only in letter case
• Repeat Axonius syncs no longer close vulnerabilities and issues, or mark assets Inactive, that Axonius still reports
• prisma sync_hosts and panw sync_hosts now refuse a security plan that does not exist and exit 1 naming it, before they read Prisma Cloud or write to RegScale
• aws sync_findings_by_plan_field and the aws Security Hub pipeline commands (sync_securityhub, sync_securityhub_by_plan_field, sync_securityhub_by_component_map) now log, for each security plan, how many findings below issues.aws.minimumSeverity they dropped
• aws sync_findings now logs how many findings issues.amazon.minimumSeverity left out, as it already did for issues.aws.minimumSeverity
• The http2 setting now takes its value from the REGSCALE_HTTP2 environment variable, and reads 0 as off
• An empty environment variable named like a configuration key no longer overwrites the value saved in init.yaml
• maxAssetIdentifiersPerBatch now takes its value from the REGSCALE_MAX_ASSET_IDENTIFIERS_PER_BATCH environment variable, as maxAssetIdentifiersPerVulnerability does
• Wiz compliance report evidence attachment is now skipped with a warning when --regscale_module components is used, instead of failing the run after writing assessments, issues, and assets
• Wiz sync_compliance now rejects an unsupported --regscale_module value, naming the module, instead of silently running as securityplans
• AWS sync_assets no longer creates a duplicate Athena workgroup asset with an empty account ARN (::workgroup/) when sts:GetCallerIdentity fails on one run and succeeds (or --account_id is supplied) on another
• AWS Security Hub findings sync now names a CloudWatch log group asset by its log group name, matching the CloudWatch sync
• AWS Security Hub findings now name an ECR repository asset and build its console URI from the full repository name, including any "/" path, instead of only the segment after the last "/"
• aws sync_securityhub, aws sync_securityhub_by_plan_field and aws sync_securityhub_by_component_map no longer rename inventory assets or rewrite their description, notes and asset type: assets the plan already holds keep what aws sync_assets wrote, and only resources the inventory lacks (or rows an earlier build named by their full ARN) are written
• AWS sync_assets and sync_guardduty re-key GuardDuty detector assets that releases up to 6.55.0 stored with an empty account (arn:aws:guardduty:<region>::detector/<id>) to the full detector ARN instead of creating a second asset on upgrade
• A folder import of several scan files (for example snyk import_snyk or veracode import_veracode with a folder) no longer closes the findings of every file but the last: the whole folder now reports to one RegScale sync run per record type, closed once after the last file
• Control implementation imports (eMASS, FedRAMP) no longer wipe a control implementation's approval workflow state (approval status, date, notes, version and workflow instance) or other stored columns the CLI does not model when they write fields the create-or-update route does not carry
• FedRAMP CIS/CRM imports update control implementations created by applying a profile again: an update now sends "N/A" when the stored implementation statement is blank, instead of being refused with HTTP 400 "Implementation Statement is required", and a failed implementation update makes the command exit non-zero instead of 0
• STIG CCI assessments record a test result for each CCI instead of failing on plans with control implementations
• Dated evidence file names now keep a compressed file's full type: findings.jsonl.gz is stored as findings_<timestamp>.jsonl.gz instead of findings.jsonl_<timestamp>.gz
• defender import_alerts now stores every CVE of a multi-CVE alert row as its own vulnerability instead of keeping only the first; single-CVE rows keep their existing identity
• ControlImplementation.save() preserves nextAssessmentDueDate instead of clearing it to null on PUT /api/controlImplementation/{id}
• aws sync_findings stops with exit code 6 when a Security Hub page fails partway through the pull, instead of reporting success and closing findings it never read
• AWS Security Hub pipeline commands (sync_securityhub, sync_securityhub_by_plan_field and sync_securityhub_by_component_map) now sync active non-control findings and their assets instead of skipping every one
• A folder import of several scan files (for example snyk import_snyk or veracode import_veracode with a folder, or a Qualys file folder) no longer fails on the second file with "Another ... sync is still open" and exit code 1: every file now reports its assets to the folder's one asset sync run, as the first file does, so the second file's assets and findings are written
• FedRAMP OSCAL SSP import (fedramp import_oscal and fedramp ssp import-oscal) no longer stops with "Object of type PortsProtocol is not JSON serializable" when the platform rejects a component port and protocol; it logs the rejected record and continues
• Fixed an error when syncing ServiceNow change requests for a specific parent record
• jira issues again dates a Jira issue with no due date by its Jira priority as 6.x did (Highest 7, High 30, Medium 90, Low 180, Lowest 365 days by default) instead of the severity policy, and the issue description names its due date on the Due Date line again, including the stored date on a re-sync
• jira issues and jira tasks fall back to the medium count with a warning, instead of failing, when an issues.jira day count is not a positive whole number
• fedramp export_poam_v5 and fedramp poam export no longer stop with exit 1 when the RegScale platform's KEV catalog is empty or unreadable; as in 6.x they warn once, write N/A in the KEV Due Date column and finish the workbook
• Jira task sync no longer fails when updating a task whose Jira issue has no due date
• Compliance syncs such as aws sync_config_compliance, sync_ec2 and sync_ecr record a scan history again when their run saves no vulnerability, as 6.x did; 7.0 recorded no scan history for such a run
• Fixed ServiceNow change sync: change requests map onto the RegScale change fields, reruns update the synced change instead of creating duplicates, and a request with no planned dates no longer gets 0001-01-01 written into them
• wiz vulnerabilities exits 1 and names the findings it did not write when the plan holds no asset that wiz inventory wrote, instead of reporting success after a wiz inventory started too late
• aws sync_guardduty now writes a finding's CVE to its vulnerability and issue, and keys an EC2 instance or account-level finding the way aws sync_assets keys that asset (arn:aws:ec2:<region>:<account>:instance/<id>, AWS::::Account:<id>), so the record links to the inventory asset
• aws sync_assets now records a load balancer listener's port with its transport protocol (TCP, UDP, TCP/UDP or Other) and puts the listener protocol, such as HTTPS, in the port's service, instead of storing HTTP or HTTPS as the protocol
• The RegScale API client's SSL verification is DISABLED warning is logged once per command even when several threads build their client at the same time (for example qualys list_scans --module all), where it could print twice
• Prisma CSV import with software inventory now creates inventory for each host from the files it imported, and exits with an error when no file was imported or the inventory could not be created
• Prisma software inventory now reads the security plan's assets, and exits with an error when they cannot be fetched
• JFrog Xray imports send one asset per impacted artifact, so rows sharing an artifact are no longer refused as duplicates
• ServiceNow change sync no longer creates a change made in RegScale again as a new change request on every run
• AWS asset sync no longer reuses an inventory cached for another region, account ID, tag filter, profile or credential, which wrote other assets into the plan and set its own assets inactive
• AWS sync_findings no longer closes the open issues of a service turned off in aws.inventory.enabled_services while their findings are still active, and logs how many findings each turned-off service skipped
• regscale aws inventory collect now honours aws.inventory.enabled_services in init.yaml and collects the same services as regscale aws sync_assets
• AWS asset sync removes a load balancer's old AwsElbv2LoadBalancers component mapping once the asset is mapped to Load Balancers
• Jira attachment download warnings now show the whole file name, so two failed attachments with similar long names can be told apart
• Compliance syncs that create control tests, such as wiz sync_compliance, save their control test results again on platforms that do not yet create those control tests themselves
• Updated the pyasn1 dependency to a release that fixes known security vulnerabilities

ROH 6.35.0.1 Release

Release Overview

• Release Name: ROH Hotfix Release.
• Release Type: Hotfix.
• Release Number: 6.35.0.1

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This hotfix release keeps the features of 6.35.0.0. For the stability of current customer deployments, classic integration jobs go back to the previous CLI engine. The recent changes to the CLI engine move to an upcoming release. This release also updates the web server and the Python dependencies to versions that fix known vulnerabilities.

What's Changed

• Classic integration jobs use the earlier CLI engine. The recent CLI engine changes are reverted and move to an upcoming release. Next Gen jobs do not use the CLI and do not change.

Maintenance and Updates

• Updated web server. The application image now ships nginx 1.30.6 from nginx.org. The earlier image shipped the operating system nginx build, which contains known vulnerabilities that its vendor does not fix.
• Updated Python dependencies. This release updates several Python dependencies, including aiohttp, pillow, certifi, filelock, graphql-core, virtualenv, mako and OpenTelemetry, to versions that fix known vulnerabilities.

Deployment Notes

• Upgrade all Orchestration Hub containers. The changes are in both the application image and the worker image. Upgrade every Orchestration Hub container to 6.35.0.1.
• The CLI items in the previous release's Deployment Notes no longer apply. After you upgrade, review the classic jobs that you changed for them. If a classic job does not run, contact RegScale support.

No other configuration change is required.

ROH 6.34.3.2 Release

Release Overview

• Release Name: ROH Hotfix Release.
• Release Type: Hotfix.
• Release Number: 6.34.3.2.

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This hotfix release is for customers who stay on the 6.34.3 line. It updates the web server and the Python dependencies in Orchestration Hub to versions that fix known vulnerabilities. It does not change how Orchestration Hub works.

Maintenance and Updates

• Updated web server. The application image now ships nginx 1.30.6 from nginx.org. The earlier image shipped nginx 1.20.1, which contains known vulnerabilities that its operating system vendor does not fix.
• Updated Python dependencies. This release updates several Python dependencies, including PyJWT, aiohttp, pillow, urllib3, tornado, graphql-core and OpenTelemetry, to versions that fix known vulnerabilities.

Deployment Notes

This release has the same platform requirement as 6.34.3.0: RegScale 6.34.3.0 or newer.

• Upgrade all Orchestration Hub containers. The dependency updates are in both the application image and the worker image. Upgrade every Orchestration Hub container to 6.34.3.2.
• Upgrading from 6.34.2.0 or 6.34.2.1 includes 6.34.3.0. Read the 6.34.3.0 Deployment Notes before you upgrade.

No other configuration change is required.

[6.55.0] - 2026-10-22

Added

• DevSecOps release and deploy Change records can now be completed directly, sent for policy approval, or always routed to the CCB per change type with change.approval_by_type or --approval-mode
• Added Python 3.15 support and updated CI test matrices and wheel bounds
• otxUrl setting (environment variable REGSCALE_OTX_URL) that points alienvault ingest_pulses at another AlienVault OTX server, defaulting to https://otx.alienvault.com

Changed

• • Packaging and dependency management migrated from Poetry (poetry-core and poetry.lock) to uv (hatchling and uv.lock) for faster dependency resolution and container builds
• DevSecOps Emergency release and deploy Change records now go to the CCB by default (change.approval_by_type.Emergency: ccb), where a policy reject is reported but does not fail the job; set it to request to keep the policy engine's decision
• Removed the unused regscale-dev update_docs command, which pushed per-integration markdown to readme.io and Confluence
• Behavior change: set_permissions load now exits with an error after trying every row when the platform rejects a row or a row holds an invalid value, where it previously logged a warning and exited 0
• The set_permissions load command now keeps a record's current visibility when its public | private cell is blank and rejects rows with an unrecognized visibility, access level or ID, where a blank or mistyped visibility previously made the record public
• A wiz compliance_report run whose failing controls all span several resources now sends its issues, so like other runs it closes open "Scanner Integration" issues on the plan that it does not report, including issues for controls that now pass and those of the AWS compliance commands on the same plan

Fixed

• • Dependency lock updated so virtualenv is on its latest release
• devsecops change request-approval now reports the Change status and policy mode the platform returns, fails the job only for a rejection the platform enforced, and never leaves the JSON status empty
• JCAM imports now report records they could not import, so REGSCALE_STRICT_EXIT_CODES=1 exits 3 for those instead of 0
• The set_permissions load command now applies group permissions and public visibility on platform 6.29 and later
• regscale import assessment_linker now exits 1 with an error when RegScale returns only part of the assessment list, instead of linking a partial set and exiting 0
• The qualys diagnostics command keeps working after its supporting module has been imported
• AWS Security Hub syncs now report assets and findings they could not process, so REGSCALE_STRICT_EXIT_CODES=1 exits 3 for those instead of 0
• • A second import on the same day now closes the findings it no longer reports: integrations on the shared scanner vulnerability builder (CrowdStrike, Rapid7, Tenable.io and others), the legacy Axonius sync and the direct (non-scanner) vulnerability path of the Qualys CIS report import scope mop-up to one run instead of the date. Trivy, Grype, Nessus, Qualys VMDR and the scanner-integration path of the Qualys CIS report import keep their existing source-and-day scope
• The legacy Axonius sync sends all FISMA ids of a plan together and asks for mop-up once, on the plan's last batch, and not at all when a batch was rejected, so one FISMA id or batch no longer closes records another still reports
• Flat-file folder imports (Nexpose, Snyk, Aqua, Veracode, XRay, ECR, Inspector, Qualys file scans, etc.) are one run: every file shares one batch id and only the last file closes or retires what the import did not report, so one file no longer retires another file's assets
• gcp sync_findings no longer lands a passed control assessment for a control that an open Security Command Center finding in the same run maps to, or for a category that has an open finding; before, only the finding's own control-and-category check was withheld, so the control's other checks landed passed while gcp sync_compliance failed it. The run now logs how many passed control assessments it withheld.
• wiz vulnerabilities now imports cloud configuration findings that Wiz returns with no resource, such as Microsoft Defender for Cloud findings on AKS pods and containers, against the plan with the affected workloads listed on the finding, instead of dropping them and sometimes their whole rule without a trace
• wiz compliance_report now raises an issue for a failing control whose failing checks name several resources
• A run that reads only part of its source no longer sets the plan's other assets Inactive. Each child of an Orchestration Hub split job (--offset / --limit) of bigquery sync_assets_bq, wiz inventory or aws sync_assets, a wiz inventory --filter_by_override run, and an aws sync_assets --account_id / --tags run now leave alone the assets outside their slice or scope. A full, unscoped run still sets Inactive the assets that left the source.
• AWS sync_findings in consolidated mode now creates one vulnerability per Inspector CVE and one per GuardDuty finding type instead of merging each product's findings into a single record, and the next unscoped sync closes those old catch-all records
• The AWS compliance commands (aws sync_s3, sync_kms, sync_cloudtrail and the rest) and wiz compliance_report no longer close each other's open issues or set each other's assets Inactive on a shared plan, and aws sync_findings_and_assets no longer sets Inactive the aws sync_assets assets its findings do not name. Because these compliance commands share one source, they also no longer close their own issues for controls that now pass; close those by hand until each command gets a source of its own
• Compliance commands that run one after another on the same day and assess the same control (for example aws sync_s3 and then aws sync_kms on SC-28) no longer overwrite each other's assessment. The assessment fails when any command failed the control, its title names each command and its result, and a command that runs again that day replaces only its own result. Two commands that run at the same time can still overwrite each other.
• Fixed aws sync_cloudwatch --account_id, which collected no log groups and still reported success; it now keeps the log groups in that account, and an unexpected error while reading log groups now fails the sync instead of being logged and dropped (denied access and a log group deleted mid-run are still skipped)
• AWS sync_ssm now reads every page of each managed node's patches, so SI-2 fails when a node's missing patch is past the first 50 records
• AWS sync_cloudwatch and sync_cloudwatch_ex now fail a control when more than 20 % of log groups fail it, the same rule as the other AWS compliance commands, so AU-6, AU-9, AU-11, AU-12 and SI-4 assessments that passed only because one log group passed are rewritten as Fail on the first run after upgrading
• gcp sync_compliance no longer marks a control Pass or Fully Implemented when no SCC finding maps to it, and fails SI-2 while active CVE (SOFTWARE_VULNERABILITY) findings exist
• Wiz inventory and stig_checks now leave an asset's Disk Storage (GB) at 0 instead of filling it with the virtual machine's disk count, so existing Wiz assets show 0 after their next sync
• gcp sync_findings now imports SCC findings that map to no NIST 800-53 control, including every SOFTWARE_VULNERABILITY (CVE) finding, instead of dropping them with a DEBUG log line. CVE findings carry their CVE id and CVSS v3 base score and are keyed on their SCC finding name, so CVE findings that share a console link stay separate. CVE findings are linked to the asset for their resource, and the run reports at INFO how many findings had no control mapping. Findings SCC marks INACTIVE (remediated) now land Closed instead of Open and no longer fail their mapped control tests.
• Every aws command now exits 4 (authentication failure) when AWS refuses its credentials, none are found or the named profile does not exist, before it reads or writes anything, instead of reporting "completed successfully" and syncing an empty inventory
• Scanner syncs with issueCreation: PerAsset now create one issue per affected asset instead of one issue per CVE linked to every asset
• Nessus imports of several historical scans on one day now close findings that a newer scan no longer reports
• Qualys sync_qualys --include-was now keeps each web application finding's severity (5 Critical, 4 High, 3 Moderate, 2 and 1 Low, matching VMDR) instead of landing every one as Medium
• Qualys sync_qualys --include-was now dates each WAS vulnerability first and last seen, and its issue first detected, from the finding's firstDetectedDate / lastDetectedDate instead of the time of the run
• Tenable.io finding sync now honours the --severity option and syncs only findings of the chosen severity, without closing findings of other severities
• • Prisma Cloud sync_hosts / sync_images --use-csv no longer create a "Prisma Cloud Vulnerability" vulnerability and issue for a host or image with no vulnerability; the export's blank-CVE row now yields only the asset
• Wiz inventory no longer uses the raw lower-case provider resource type (for example microsoft.app/containerapps/containers) as the software name of a container Wiz has not classified yet; it falls back to the parent-based name until Wiz reports the technology
• Tenable.io compliance sync now marks a control as failing when any check citing it fails, not only the first check
• Prisma sync_hosts and sync_images with --enable-software-inventory now create software inventory from each asset's SBOM instead of only logging a note to run sync_sbom
• AWS asset syncs now record a Lambda function's language and its full runtime version, such as python and 3.12, instead of only the last part of the runtime
• tanium sync_compliance and tanium sync_all assess a control whose only Tanium Comply findings are not applicable (any spelling, such as NotApplicable, NOT_APPLICABLE or NA) as Not Applicable, instead of failing it for NotApplicable or passing it for NOT_APPLICABLE and NA, and tanium sync_findings no longer raises an open issue for a NotApplicable finding
• aws sync_compliance --no_use_enhanced_analyzer now assesses controls from AWS Security Hub evidence: passing checks (PASSED) count as compliant, and evidence status values match regardless of case
• wiz vulnerabilities no longer closes a Wiz rule while it is still failing on any of its resources
• A findings run that reads only part of its source (--offset / --limit, as an Orchestration Hub split job passes to each child) no longer closes the plan's vulnerabilities and issues outside that slice. Before this fix, wiz vulnerabilities --limit 1 closed every other open Wiz vulnerability on the plan along with its issue. A run with no slice, or with --offset 0 alone, still closes what the source stopped reporting.
• Tenable.sc imports now create one vulnerability per CVE for a finding that lists several CVEs, instead of one vulnerability carrying a CVE that changed from run to run
• • Tenable.sc sync_jsonl no longer lands a record below tenableMinimumSeverityFilter (such as an Info record under the default low) as a Low vulnerability; it is skipped, as query_vuln already does, and is not counted as a parse failure
• The AWS compliance commands (aws sync_s3, sync_kms, sync_iam, sync_cloudtrail, sync_cloudwatch and the rest) no longer set the plan's other assets, Off-Network ones included, to Inactive when a re-run creates an asset. They no longer retire assets at all, so an asset whose resource AWS stops reporting stays as it is: run aws sync_assets (on a schedule if needed) to retire those.
• A repeat tenable io sync_assets run no longer marks Inactive the assets Tenable has not changed since the previous sync; each run now reads the full Tenable asset inventory before retiring missing assets
• tenable io sync_findings no longer misses Tenable findings on a plan that other connectors also sync: its incremental findings export now starts from Tenable's own last sync rather than the newest scan by any connector. A run that closes findings not in the scan now exports every open finding, so findings Tenable has not re-observed since the last sync are no longer closed.
• The AWS compliance sync commands no longer update control assessments or implementation statuses when a run reads only part of the plan, scoped by --account_id, --tags, a name filter (--bucket_name_filter, --trail_name_filter, --log_group_prefix, Audit Manager --resource_tags) or an --offset/--limit slice; such a run still syncs assets, findings and evidence, and a run without those options assesses the controls as before
• Re-running a compliance command (wiz compliance_report, the AWS sync_s3, sync_kms, sync_cloudtrail, sync_iam, sync_ssm and sync_org evidence commands, and the other compliance integrations) no longer resets what a user set on its existing issues: a basis for adjustment and a due date are kept, and an issue closed as a false positive stays closed
• AWS sync_s3 now judges AU-9 only on buckets that store S3 access logs, which pass when versioned with public access blocked and a private policy, instead of passing every bucket
• AWS sync_guardduty now fails IR-5 when no GuardDuty detector is enabled instead of passing it on every run
• AU-9 results that earlier versions of aws sync_s3 recorded as Pass for buckets that do not store S3 access logs are not removed by a new sync, so review those assessments after upgrading
• Tenable.io asset sync now stores the first IPv4 address in IP Address and the first IPv6 address in IPv6 Address instead of a comma-joined list of every address
• AWS asset sync with --tags now collects the Inspector coverage and findings of the tagged resources instead of none, and an Inspector request the AWS SDK rejects now fails the run rather than ending in success
• regscale aws sync_findings and sync_findings_and_assets now honour the simple category form of aws.inventory.enabled_services (for example storage: false), which they used to ignore: findings on resources of a category turned off that way are no longer imported
• regscale aws sync_assets now honours aws.inventory.enabled_services: a category or service turned off in init.yaml is no longer collected or synced as assets, and its existing assets are kept rather than marked Inactive
• AWS asset and GuardDuty syncs run with --account_id now keep the account's GuardDuty detector instead of dropping it
• Fixed aws sync_assets --account_id and --tags, and aws sync_s3 --account_id, so S3 buckets, load balancers and ACM certificates outside the chosen account or tags are no longer imported
• AWS evidence syncs (KMS, IAM, Organizations, EC2, GuardDuty, ECR, Inspector and Directory Services) now assess the plan's controls when --framework differs from the plan's framework, and warn when no AWS check maps to a control in the plan
• Updated certifi to 2026.10.19 to remove trust in compromised root certificate authorities (GHSA-6q48-6c7w-9gw2)
• Updated pillow to 13.0.0 to fix eight security vulnerabilities, six rated high
• DRF import now matches a DR Number cell with leading spaces to its trimmed value, and reports a non-empty row whose DR Number cell is empty, not text or not a DR number as skipped (with the reason) instead of dropping it silently
• Updated virtualenv to 21.14.7 to fix two security vulnerabilities (CVE-2026-113725, CVE-2026-113726)
• • Veracode XML import now brings in the CWEs of every severity and category in the detailed report, each at its own severity, and no longer fails on a severity with two categories or a category with one CWE
• • show_mapping for aqua, aws, ecr, veracode and every other vendor registered without a file type now reports a missing --file_path as a usage error instead of failing with a TypeError
• Snyk JSON imports no longer skip a vulnerability that has no CVE
• Snyk JSON imports now carry each vulnerability's description and its upgrade and patch remediation
• Uploaded .xml files are stored as application/xml on every host and .sarif files are accepted for upload
• oscal catalog now imports the catalog on Click 8.3 and later instead of failing with "'int' object has no attribute 'strip'" before contacting RegScale when --obj_to_controls or --fedramp is left out
• FedRAMP Appendix A import now creates control implementations for catalogs whose control IDs are lowercase or zero-padded, such as OSCAL catalogs
• OpenText WebInspect import now imports the finding from a scan file that holds a single issue
• OpenText WebInspect import no longer drops an issue that has a single report section, or the issues that follow it in the same scan file
• alienvault ingest_pulses now ends with a clear error instead of a traceback when the request to AlienVault OTX fails or returns an error status, and no longer stops on an existing threat that has no notes
• • RSA Archer commands now print one error line and exit 4, 5 or 6 instead of a traceback when Archer rejects the login, a setting or mapping file is invalid, or Archer cannot be reached; upgrading now adds the archer* settings to an existing init.yaml
• SSP XML import now saves the same, complete set of catalog implementation options on every run instead of a varying number with duplicates
• Databricks pull_data now accepts read-only queries that mention words such as created_at, start with WITH or a comment, while still refusing every statement that writes, and, when no HTTPS proxy is in use, fails within seconds on a host that does not resolve or refuses the connection instead of waiting about 15 minutes
• SAP Concur Tenable import now links each issue to the asset of its row when the row has a Host ID. With issueCreation set to PerAsset, the first sync after upgrading closes the existing issues for rows with a Host ID and recreates them keyed by Host ID; these closures are a one-time re-key, not remediations.
• FedRAMP SSP imports now log a failed step and continue with the remaining steps instead of stopping with an AttributeError