[6.47.0] - 2026-09-16

Added

• JCAM import: NIST 800-63 digital identity data now imports -- the assessed and implemented Identity, Authenticator and Federation assurance levels, the rationale for any difference between them, the comparability demonstrations, and the rationale for not accepting federated identities
• Source control evidence can now be harvested into Evidence records mapped to NIST 800-53 Rev5 controls
• GitHub repositories can now be discovered and recorded as RegScale components and assets
• GitHub code scanning, Dependabot and secret scanning alerts can now be synced into RegScale issues and vulnerabilities
• GitHub repository dependency graphs can now be imported as SBOM records with their software inventory
• GitLab projects can now be discovered and recorded as RegScale components and assets
• GitLab security findings can now be harvested into a security plan, with automatic fallback to pipeline security reports on non-Ultimate tiers
• GitLab dependency inventory can now be harvested into a security plan as a CycloneDX software bill of materials
• Shared OCSF normalization layer so integrations map findings, assets, software inventory, and control evidence through one vendor-neutral schema
• CrowdStrike sync can exclude sensitive hosts by tag, host group, or hostname so they are never returned by the Falcon API
• New crowdstrike preview_filter command reports exactly which CrowdStrike records an exclusion removes, without writing anything
• CrowdStrike sync commands accept a --filter option to narrow a single run with an ad-hoc Falcon Query Language expression
• Axonius asset sync now supports selecting between the legacy flat-file export format and the vendor's raw API export format via a schema option
• Sensitive configuration values can now resolve at runtime from the RegScale platform's encrypted secret store instead of plaintext init.yaml, with a new regscale config push-secrets command to migrate existing secrets
• A jcamValueMapping or jcamFieldMapping override that reaches more than one mapping now says so, naming the source and every destination it was applied to. Overrides are addressed by source and a source is not always unique -- JCAM's control Status column is read both as an implementation status and as a Control Origin -- so one line of config can change two vocabularies. The override still applies to all of them; it is no longer silent.
• Scheduling guides covering configuration, cron schedules, deployment options, and troubleshooting for scheduled CLI jobs
• Scheduled CLI jobs (beta): define cron-scheduled RegScale CLI commands in jobs.yaml and run them with the new regscale jobs command group, including a daemon mode for containers, one-shot modes for external schedulers, run history, and per-run logs
• Scheduled jobs can email per-job recipients on failure, timeout, or success through a configurable SMTP relay, with run metadata and a credential-redacted excerpt of the job log in the message body
• The interactive terminal GUI can schedule any command as a recurring job from its form and manage jobs in a new Jobs tab with run-now, schedule editing, enable/disable, delete, per-job run history, and YAML export
• Scheduled jobs can pull their configuration from a remote HTTPS source such as an Azure Blob SAS URL via --config-url, with ETag caching and automatic fallback to the last known-good copy when the source is unreachable
• Daemon --grace-period option to bound the shutdown grace given to an in-flight scheduled job
• RegScale Trust Center KSI automation via regscale trust-center ksi commands

Changed

• PyPI releases are published with PEP 740 digital attestations so the published wheel can be verified against its source build
• The scheduler daemon fetches its configuration once at startup instead of twice, and reports each job's next fire time as a readable local timestamp
• CrowdStrike Spotlight vulnerability status is now configurable instead of always being limited to open findings
• Corrected the JCAM readme, which described the per-control control-retrieval path as still in use when control implementations come from the report endpoint
• import_artifacts now imports every artifact type when jcamArtifactTypes is not set, instead of exiting. The key ships as a placeholder, so the command could not run at all out of the box; naming types still narrows the import, and jcamFilter already bounds which systems are read. An unfiltered run reports how many files it is about to download before it starts, and local copies are removed once they are in RegScale rather than accumulating. A single string rather than a list keeps working and is still matched by substring, with a warning showing the list to write instead. Also fixed on this path: an artifact with no description, one whose download returns no content, one with no filename, and one RegScale refuses to store no longer end the import, two artifacts sharing a filename no longer overwrite each other, and an artifact already attached to the plan is no longer re-downloaded and re-attached on every run.
• Scheduled job Run Now in the terminal GUI now records run history and sends outcome email notifications
• Broader redaction of secret-shaped configuration values in scheduled-job logs and outcome emails

Fixed

• Scheduled job run history no longer hides a legitimate flag that follows a credential option
• The job log pump now releases its output pipe safely when a job leaves a child process behind
• A disk or permission error while recording scheduled job run history no longer stops the job or the scheduler daemon
• Scheduled job run history is no longer lost when a manual run and the scheduler write to the same job's history at the same time
• The jobs run command now accepts --config-url so a single job can be run from a remotely hosted configuration
• The terminal GUI now refuses to start a second command while a scheduled job launched with Run Now is still running, keeps the Jobs tab usable when a run history file cannot be read, and no longer garbles accented or symbol characters in live job output
• Scheduled job outcome emails now redact credential-shaped text in a job description
• JCAM imports no longer end when RegScale refuses a single record. Every write the integration makes -- security plans, interconnections, POA&Ms, milestones, control implementations, inheritance records, info types, FISMA rollups, points of contact, system roles, assessments and custom field values -- now records the refusal against the run report and carries on, and the end-of-run summary names every refused record so a partial import is visible rather than silent. A refused batch write reports how many records it was carrying, so an incomplete batch reads as one rather than as a single missing field. These commands still exit zero on a partial import, so read the summary rather than gating automation on the exit code. Also fixes a related silent loss: a newly created milestone's custom fields were never written, because the created record's id was discarded
• JCAM imports now treat an answer of nothing as an answer. If JCAM returns a null, a blank, or one of the words it sends in place of a null, the field is cleared; if the key is absent or the call failed, the field is left alone and the run reports it. This means a value deleted in JCAM now reaches RegScale, where previously a field could be set by an import and never un-set. Absence is shaped for its destination -- a checkbox records no answer rather than a "no", and a typed field is cleared with the kind of empty its own type holds rather than a null. Where the mapping declares an alternative source or a value for the unmapped case, that still wins over clearing. Also fixes JCAM's absence words being written as data: the four-character "None" across the SSP tabs, "NoTestTypeDefined" on the contingency and incident-response test types, and "{}" in milestone notes. The clearing rule applies to the recommended mapping profile only; on legacy the one change is that a null is no longer written as the word "None"
• A jcamValueMapping override no longer drops the case-insensitivity of the vocabulary it merges into, which had made every other control status stop matching JCAM's report
• JCAM control status Applicable no longer overwrites a control's recorded implementation status, and the status vocabulary is now read from the resolved mapping profile so a jcamValueMapping override of controls.Status governs what the importer reads as well as what it writes
• JCAM import: an information type's confidentiality, integrity and availability are now recorded as adjusted only where JCAM differs from the information type's own baseline, and an information type already on a plan is updated on later imports instead of being skipped
• JCAM import: the recommended mapping now reads each System of Records Notice's current flag into the matching "SORN x - Current" checkbox. Five notices previously arrived with nothing recording which one is in force. The fifteen SORN fields must exist before the first import_privacy_info run on the modern profile, or the command exits without importing
• A JCAM custom field value RegScale refuses no longer costs the rest of the plan's values, and each refusal is reported individually rather than as one failure for the whole write
• JCAM import: a milestone or interconnection field the mapping does not carry now keeps the value RegScale already held, instead of reverting to a default on every import
• JCAM import: artifact types can now be set to "@drop" to import no artifacts at all, and an unset setting means no artifacts on the legacy mapping profile and every type on the recommended one
• Prevent concurrent run-due and daemon passes from double-firing scheduled jobs
• Scheduler now shuts down promptly on termination signals instead of waiting out the idle interval
• Restore redaction of all-lowercase credential configuration keys such as accesskey and clientsecret in logs and scheduled-job emails
• Scheduled jobs no longer reject commands that take a public identifier option such as --project_key

[6.34.1.0] 09-14-2026

Enhancements

Control Guidance, Assessments & Compliance

• Control Guidance: Control guidance now separates base guidance from supplemental profile guidance, so users can distinguish the standard requirement from framework-specific additions during assessment and authoring.
• SSP and Control Assessment Navigation: Clearer control status indicators and streamlined navigation in the control assessment workflow reduce the clicks needed to move between controls during authoring and review.

Report Builder & Compliance Reporting

• Report Builder Module Support: Report Builder now supports tenant-renamed modules (reports display the tenant's custom module name instead of the default) and adds Control Implementations and Interconnections as reportable modules.

Workflow & Automation

• Webhook Reliability: Improved webhook management and event-subscription handling for a more reliable automation experience.

Artifact, Catalog & Import Workflows

• Data Import and Integration Reliability: Improved reliability across vulnerability, checklist, OCSF, catalog, and other data-import workflows to reduce duplicate or incomplete records.

Form & Questionnaire Management

• Form Builder: Enhanced validation and conditional-field behavior to provide more immediate and accurate feedback when building and completing forms.

Accessibility

• Enhanced accessibility through improved table semantics, ARIA support, dark-mode color contrast, report tables, and form validation messaging.

Fixes

Authentication, SSO & Session Management

• Login and Authentication: Resolved multiple issues that could prevent users from logging in correctly, including incorrect errors for deactivated users and authentication configuration and validation issues.
• SSO Session Handling: Resolved issues affecting SAML session handoff and identity-provider session handling.
• Logout Behavior: Resolved an issue where logging out of RegScale did not terminate the associated identity-provider session, which could cause the next SSO login to reuse the previous identity.
• OIDC Configuration: Resolved issues involving OIDC audience comparisons and encryption-key configuration that could cause valid configurations to fail.
• Login Diagnostics: Improved authentication logging and diagnostics to make OIDC and other login failures easier to troubleshoot.
• Login Username Handling: Resolved an issue where usernames entered through an SSO login form were not consistently handled during authentication.

Security

• Input & Log Handling: Improved sanitization and handling of user-provided input in logs and application content to prevent malformed log entries and unsafe content from being persisted or interpreted.
• AI Prompt Protection: Strengthened handling of untrusted content supplied to AI processing to reduce the risk of unintended prompt manipulation.
• Security Dependencies: Updated application dependencies and container components as part of routine vulnerability patching.

POA&M & Compliance Reporting

• POA&M Export Reliability: Resolved issues that could cause POA&M exports to time out or consume excessive resources in environments with large volumes of POA&M records.
• Reporting: Resolved formatting and data-display issues affecting nested parameters. Resolved an issue requiring users to run the Control Framework Gap Report twice before results were displayed.

Assessments, SSPs & Controls

• SSP Risk Assessment Utility: Resolved an issue that prevented the SSP Risk Assessment Utility from functioning correctly.
• Control Owner Updates: Resolved an issue where updates to CI Control Owners were not saving the correct information.
• Assessment Restore: Restored the ability to create a new SSP record through the applicable restore workflow.
• Assessment Authoring: Resolved an issue where plan authoring could complete with blank statements when an unreadable document was uploaded.
• Checklist Re-import: Resolved an issue where re-importing a checklist could update only one asset per rule and fail to create records for newly introduced rules.
• Requirements Mapping: Resolved an issue where attempting to remap an already-mapped control resulted in an error.
• Continuous Monitoring Assessments: Resolved an issue where Lightning Assessments launched from Continuous Monitoring Assessments did not display the Control Preview pane.
• SSP Wizard: Resolved multiple issues affecting SSP wizard navigation, validation, and data handling.
• Control Implementation Parameters: Resolved an issue where control implementations created through certain API paths did not persist associated parameter records.
• Component Type Display: Corrected Component Type dropdown options that were displayed in lowercase.

Forms & Questionnaires

• Form Validation: Resolved an issue where field validation messages were not displayed until a dropdown was opened.
• Conditional Fields: Resolved an issue where conditional fields remained hidden when a form was initially loaded until the triggering field was changed.
• Custom Checkbox Values: Corrected inconsistent rendering of custom checkbox fields when stored values used representations other than the expected string format.
• Custom Organization Fields: Resolved an issue where Custom Fields using the Organizations type did not display saved values in the user interface.
• Questionnaire Assignment: Resolved issues with questionnaire assignment and removal, including validation behavior and authorization handling.
• Questionnaire Access & Permissions: Improved permission enforcement for questionnaire operations and resolved issues that could allow unauthorized users to access questionnaire information.
• Self-Assignment URLs: Resolved an issue where opening the Self-Assign URL dialog for an already-enabled questionnaire could unexpectedly save the questionnaire and report success.

Navigation & User Interface

• Control & Module Navigation: Resolved issues with side navigation, workspace tooltips, module naming, and other navigation elements that could obscure or incorrectly display application controls.
• Dark Mode: Resolved visual issues affecting the Security Plan Control Bulk Editor and improved text contrast for dark-mode users.
• Calendar Navigation: Resolved an issue where navigating between months from dates near the end of a month could require an extra click.
• RegML AI Generator: Resolved an issue where the RegML AI Generator menu item was displayed for Components even though the functionality was unavailable.

Attachments, Records & Saving

• WYSIWYG Attachments: Resolved an issue where the WYSIWYG editor could report that an attachment was uploaded successfully even though the file was not added to the record.
• Unexpected Record Saves: Resolved issues where navigation or preview actions could unexpectedly save record changes.
• Artifact & Evidence Association: Corrected file and version associations to ensure content is linked to the appropriate audit cycle and record.

Accessibility & Application Behavior

• Accessibility & Reduced Motion: Resolved issues affecting animations and accessibility behavior for users with operating-system motion-reduction settings enabled.
• Application Startup: Resolved issues with configuration values containing accidental whitespace that could prevent an instance from starting correctly.

Added

• jcam check_config now names any role declared in jcamSystemRoles that matches no point-of-contact position in any JCAM system in scope, so a role that will be created and stay empty is visible before anyone builds it.
• Ability to create and manage RegScale service accounts from the CLI and the interactive TUI, with a warning before an existing service account token is replaced by a user login
• An agency-defined item can declare what its JCAM values mean in RegScale, so a field whose two systems word the same answer differently now imports
• A JCAM field mapping can name a JCAM key the shipped profile does not read, so a tenant can import one more field without waiting for a release

Changed

• Several JCAM values addressed to one custom field are now combined instead of the last one silently replacing the rest
• A JCAM collection spread across several fields now reports values with no field to land in, and clears fields a shorter run no longer fills
• All of a system SORN notices are imported across the available slots, instead of only the most recent one
• A JCAM destination matching a form heading is reported by check_config instead of failing once per record during an import
• JCAM answers Financial or Non-Financial for a system, and the recommended mapping now translates it so a checkbox destination accepts it
• Custom field save failures now name the record and the fields that were sent
• JCAM report names are configurable, so an instance whose reports are named differently no longer needs a code change
• JCAM request timeouts are configurable, and report endpoints get a longer budget than the rest so a large report has time to build
• The JCAM connection test now probes the control parameters endpoint, so a credential that cannot run import_parameters is reported before the import instead of during it
• A JCAM control status this importer cannot read now leaves the existing status alone instead of recording the control as Not Implemented
• The CLI now says when it creates an init.yaml in the current directory, instead of silently running against template defaults
• JCAM imports resolve the mapping profile and the plans in scope through one shared entry point, so a plan with no JCAM system id is reported the same way by every import instead of three different ways.
• The JCAM dry run separates values a field would refuse from values written without fitting the field, and exits non-zero for either
• The JCAM dry run shows the value a field would actually store, so a checkbox plan reads "true" rather than "Yes"
• The JCAM dry run reports values a destination field would refuse, instead of listing them as writes it would perform
• The JCAM assessment import says why a control produced no assessment, naming any result values it does not recognise
• JCAM values addressed to a field that holds one value are no longer joined into it, and check_config reports a mapping that would do so
• A JCAM collection now writes every slot it declares on every run, so a slot with no value is emptied rather than keeping an answer the source has stopped giving

Fixed

• SARIF sync now links findings to the asset given on the command line no matter which identifier field that asset uses
• A scan whose findings match no asset now stops with an explanation instead of finishing quietly having imported nothing
• SARIF compliance sync against a component now finishes in seconds rather than minutes
• Controls that a SARIF scan checked and found clean are now marked as planned instead of being left untouched
• SARIF findings for generic injection, forced browsing, incorrect privilege assignment, and active debug code now map to ASVS controls
• Control implementation status updates that fail are now reported in the run summary instead of being silently discarded
• Control implementations set to a planned status by a compliance scan now save successfully instead of being rejected for missing required fields
• A JCAM field mapping override now moves the fallback that shared its destination, so one value needs only one custom field
• Agency-defined JCAM values are now written through the same mapping layer as everything else, so they find their field wherever it sits on the module and are shaped to what that field accepts, instead of being refused for sitting on the wrong tab or stopping the import with an unexplained server error.
• JCAM control import no longer refuses a tenant over an acronym custom field the recommended field layout does not use
• An inherited JCAM control no longer fails to import on a plan whose Control Origin list spells it "Inherited from Provider"
• A JCAM value mapping now applies to the pre-rename key as well, so a tenant vocabulary is not ignored on deployments that send it

[6.45.10] - 2026-09-11

Added

• jcamPositionRoleNames and jcamAgencyDefinedDataItems now accept @drop, so a tenant can record that a point of contact or an agency-defined attribute deliberately does not import, rather than expressing that decision by leaving it out.

Changed

• The recommended JCAM profile now writes the JCAM-computed POA&M criticality to a custom field named Derived Severity Level, and writes the human-set value only to RegScale's native severity rather than duplicating it into a second custom field. The legacy profile is unchanged.

Fixed

• AWS Inspector command help no longer lists CM-6 among the controls it assesses
• Fixed intermittent HTTP/2 connection errors and silent vulnerability-mapping data loss during concurrent scanner syncs
• Scanner runs of more than 1000 issues now close stale records again instead of silently skipping mop-up
• A JCAM import no longer refuses to run because a custom field named by an older version of the importer is absent, and jcam check_config no longer reports those fields as missing. What an import needs is now derived from the mapping profile in use, so the readiness report and the import cannot disagree.
• A JCAM import no longer refuses to run because a point-of-contact custom field is missing where a system role already carries that position, or where the position is declared as @drop. A position with none of the three still stops the import.
• A JCAM value bound for a RegScale checkbox is now written as a boolean the platform accepts, rather than as the word "Yes" or "No", which it answered with an unexplained server error that stopped the import.
• License check failures now name the actual cause, such as a rejected session or an unreachable host, instead of always reporting an Enterprise license problem
• Credentials written as quoted JSON keys are now redacted from log output
• Retry after re-authentication now uses the refreshed token instead of the rejected one
• Axonius pull_data command now reports the actual API error instead of a generic failure when credentials or the connection are invalid
• Axonius v2 now distinguishes a permissions error from other API errors so operators can tell an unauthorized key apart from a malformed request
• Axonius v1 and v2 commands now accept either set of credential key names, with a one-time notice pointing to the preferred key name
• Azure AD App sync now reads group membership, administrator, and pending statuses from the correct App Management endpoints, matches Entra users to existing RegScale accounts instead of re-creating them, and leaves users with open access requests for manual review

[6.45.8] - 2026-09-10

Added

• JCAM imports can now create the system roles a plan is missing. Declare them in the new jcamSystemRoles init.yaml key along with the five values RegScale requires and JCAM does not send; without that key nothing is created and behaviour is unchanged.

Changed

• The recommended JCAM mapping profile now writes to spelled-out field names such as "Maximum Tolerable Downtime (MTD)" and "Authorization Status" rather than abbreviations, matching the names JCAM and RegScale tenants already use. The legacy profile is unchanged.
• The recommended JCAM mapping profile no longer assumes what an agency calls its agency-defined items. A new jcamAgencyDefinedHandling setting names which of your attributes carry a High Value Asset flag or a cloud descriptor, so the built-in handling applies whatever your agency named them. The legacy profile is unchanged.
• jcam check_config now reads every JCAM system in scope rather than the first one when reporting system roles, and names any position that no role covers.

Fixed

• JCAM mapping no longer reports a false "RegScale has no module named 'milestones'" error, reads the module list once per run instead of once per module, stops rather than continuing when the module list cannot be read, and no longer describes unresolved destinations as a tab problem
• A JCAM field mapping destination may contain a slash, so a RegScale field whose name contains one can now be mapped
• JCAM imports no longer fail when a JCAM field holds a numeric value
• JCAM POA&M severity is no longer filled from JCAM's computed criticality when no human-set value exists, since the two are different facts
• JCAM POA&M import now reads the pre-rename criticality key, so tenants that predate the CSAM to JCAM rename populate the derived criticality field
• jcam preview_poc_roles no longer refuses to run on a tenant whose mapping profile does not fully resolve. Building the import scope needs one destination, the JCAM system id, so it no longer demands the whole profile. Every importer and exporter still refuses a half-configured tenant on its own.

ROH 6.34.0.0 Release

Release Overview

Release Name: ROH Beta Minor Release

Release Type: Minor

Release Number: 6.34.0.0

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This beta release is intended for early adopters and validation of core orchestration capabilities. Functionality, supported integrations, and performance characteristics may change before General Availability (GA). This minor release delivers reliability, usability, and maintenance improvements for early adopters, summarized below.

What's Included

• Single sign-on updated for RegScale's hardened OAuth/SSO authentication. RegScale 6.34.0.1 strengthened the platform's OAuth and SAML single sign-on controls so that a RegScale session cannot be established without successful authentication and validation through the configured identity provider. Orchestration Hub has been updated to work with those controls, and the two changes are designed to be deployed together.
• Updated bundled RegScale user interface. The bundled interface uses a secure seed for completing OAuth-based single sign-on authentication because the platform verifier now requires it from 6.34.0.1 onward. Both halves of this change ship in ROH 6.34.0.0 and are required together.
• No configuration change is required. This change does not affect existing OAuth and SAML single sign-on configuration settings.

Known Limitations

• SAML single sign-on redirects: Orchestration Hub will redirect to the URL of the linked RegScale instance in some cases, not the Orchestration Hub.

Maintenance and Updates

Deployment Notes

The Orchestration Hub 6.34.0.0 Release requires RegScale 6.34.0.1 or newer. An environment running ROH 6.34.0.0 against a platform build older than 6.34.0.1 will fail single sign-on authentication, because the versioned authentication endpoint ROH calls does not exist on that build. Confirm the platform version before rolling out ROH 6.34.0.0.

[6.34.0.1] 09-09-2026

Enhancements

Artifact Hub

Artifact Hub streamlines the creation and recurring update of standardized artifacts. Create a reusable template once, identify fields that change over time, and generate updated artifacts through a guided workflow.

• Includes 16 ready-to-use templates, including Business Impact Analysis, POA&M Action Plan, and Significant Change Request.
• Import existing DOCX, PDF, Markdown, or TXT files up to 50 MB and convert them into reusable templates.
• Define variable fields through a guided interface and generate new artifacts using a simple wizard.
• Generated artifacts are retained in version history for traceability.
• Access Artifact Hub from the Workspaces menu within a Security Plan or Component.

Evidence Management

Evidence Versioning
Evidence files can now be associated with specific audit cycles, making it easier to distinguish current-cycle evidence from evidence used in previous cycles. Cycle assignments can also be corrected without re-uploading the file.

Evidence-to-Control Correlation
The By Control view now groups evidence by unique control rather than individual control instances, reducing duplicate entries and providing a consolidated view of evidence associated with each control.

Evidence Module UI Modifications
On the Evidence Locker Mappings screen, cards and graphs are now clickable, exposing the summary data underlying each visual.

SSP Approval Workflows

Use Workflow Designer to facilitate the approval of a Security Plan. Approval history is retained for visibility. In addition, workflows now support the process of re-approving a Security Plan after modifications were made.

SSP Excel Template Import

A new Excel-based import process simplifies the creation of Security Plans from existing data. Users can download the provided template, populate Security Plan metadata, and upload the completed file instead of entering the information manually through the UI. In this release version, only Security Plan metadata is supported.

Bug Fixes & Security Hardening

• Attention: If you use OAuth for SSO, note that we've released a security update that may introduce a breaking change depending on your configuration. This update is necessary to improve the overall security of the RegScale platform. If you're concerned about potential impacts, work with your CS representative to schedule the upgrade during non-critical business hours.
• This version includes security patches and hardening improvements to address vulnerabilities.
• Fixed an issue where selecting Update Catalog could redirect users to an incorrect screen before the catalog update process completed.

[6.45.0] - 2026-09-09

Added

• Configurable console log format via logFormat / logDateFormat in init.yaml, or REGSCALE_LOG_FORMAT / REGSCALE_LOG_DATEFORMAT environment variables (environment takes precedence)

Changed

• jcam --help no longer lists the pre-rename spellings check_custom_fields and test_jcam; both still run, so existing runbooks keep working
• jcam check_config now checks for a required custom field across the whole module rather than on one tab, and reports fields that resolved somewhere else as a note rather than a failure
• CLI console logs now include a timestamp on each line by default

Fixed

• QRadar sync now rejects fractional time windows instead of silently truncating them and consistently applies the configured API version
• S3 file access no longer crashes on a default configuration and now honors documented AWS credential settings
• JCAM readiness check now calls out a missing system-id custom field as a blocker instead of omitting it
• JCAM test_connection now checks the systems, system detail, controls, and POA&M endpoints imports actually use, reporting each endpoint's status separately instead of one pass/fail
• JCAM import and export commands now surface configuration and connection failures instead of silently treating them as an empty or unchanged result
• JCAM system-to-plan lookups no longer drop plans beyond the first page of results
• JCAM configuration defaults in init.yaml.example that made every JCAM run exit with "No results match filter in JCAM"
• Wiz vulnerabilities and issues now capture the CVE when it appears alongside other text in the finding name
• JCAM control import now writes implementation status and control origin values allowed by the plan's compliance settings, and reports when it substitutes an equivalent label or when a plan offers no labels to constrain a field
• Axonius dry-run syncs no longer advance the incremental sync watermark
• Credentials named with the platform's own camelCase config keys are now redacted from log output instead of being written in the clear
• jcam check_config on a tenant whose mapping profile does not fully resolve now reports that once instead of three times, and reads the tenant's fields once instead of three times
• Corrected the JCAM mapping documentation and init.yaml.example, which still described the old Tab/Field destination syntax that the CLI now refuses
• A custom field the tenant put on a different tab than the mapping profile names now resolves instead of being reported missing, so renaming or rearranging a Form Builder tab no longer needs a jcamFieldMapping line for every field on it
• FedRAMP POA&M import now resolves asset lists pointed at a POAM Assets sheet and flags truncated Asset Identifier cells instead of importing partial data
• Integrations now stop with the field named when a module requires a custom field they cannot supply, instead of failing with an unclear server error
• Axonius saved-query sync now actually queries the configured saved query and raises a clear error instead of silently syncing zero records when it cannot be found
• Corrected the seconds separator in the CLI log file timestamp format

[6.44.5] - 2026-09-03

Fixed

• JCAM interconnection import now correctly detects VPN connections and pulls authorization type from JCAM data instead of a fixed value
• Axonius asset count now sends a valid request body instead of always failing
• Microsoft Defender for Cloud resource sync now targets the correct Azure Government Cloud endpoint instead of falling back to the commercial one

[6.44.0] - 2026-09-02

Added

• JCAM: jcam check_config now checks the jcamAgencyDefinedDataItems mappings against what
  JCAM actually carries, naming entries configured for attributes JCAM does not have -- each of
  which demands a custom field for nothing -- and attributes JCAM does have that are mapped
  nowhere. These names are matched exactly, so a single character apart means the item silently
  does not import.
• JCAM: Business Identifiable Information now imports without any tenant configuration. It is on
  the mapping sheet, but the sheet named an endpoint that does not carry it, so until its real
  source was confirmed it could only be mapped by hand in jcamAgencyDefinedDataItems. The
  recommended profile now carries it alongside the other attributes that endpoint feeds.
• SARIF import accepts --regscale_ssp_id and --component_id to choose the record that receives the findings
• jcam list_fields now also reports each field's type and, for a select, the values it accepts. That is what decides whether a value can be written at all, and it was the missing half of the picture when diagnosing a rejected import.
• jcam list_fields reports every form field a tenant has, per module and tab, with each field's id, system name, and whether it is native or custom. check_config says what the mapping profile cannot find; this says what is there to point a jcamFieldMapping override at, which previously meant reading the Form Builder in a browser one tab at a time.

Changed

• JCAM: jcam check_custom_fields is now jcam check_config, and jcam test_jcam is now
  jcam test_connection, matching the name eight other integrations already use. The old names
  still work. check_config answers the whole readiness question rather than the part its old
  name described: it now also names the mapping profile in use and why it was chosen, says
  whether a control catalogue can be resolved, and lists the system roles a plan will need for
  JCAM's points of contact to import. The sections that need JCAM say so when they cannot reach
  it, rather than failing the rest of the report.
• JCAM: a tab the tenant does not have is now reported with what to do about it -- a tab of a
  similar name if one exists, and where the fields the profile wants there actually are.
  Previously each absent tab was listed bare, so a tenant that had rearranged or renamed its
  forms saw a list of separate problems rather than one cause.
• SARIF import requires the asset to link findings to, instead of guessing one from the file
• SARIF import prompts for the asset when it is not supplied, instead of failing after the fact
• Assessment results that no configured status label matches now resolve to the least-compliant available status instead of whichever label is listed first

Fixed

• JCAM: the shipped configuration template no longer causes import commands to fail with a
  traceback. Unconfigured settings now read as empty rather than as nothing at all, so a tenant
  that has no agency-defined data items, no artifact types or no framework catalogue gets a
  clear result instead of an AttributeError; jcamArtifactTypes accepts a list or a
  space-separated string as well as a mapping; and an instance with only one control catalogue
  loaded no longer takes the other one down with it.
• JCAM: a configuration value left as a placeholder by an older version of the CLI is treated as
  unconfigured rather than as a deliberate setting, so it no longer shadows the pre-rename key it
  was meant to replace. Where an upgrade adds a settings key that differs only in capitalisation
  from one already present, the CLI now says which pair to reconcile instead of silently
  preferring the new one.
• JCAM: the framework catalogue setting is spelled the same way in the configuration template as
  in the code that reads it. Previously 800-53R5 was written into init.yaml while 800-53r5
  was read, so filling in the placeholder as instructed had no effect.
• JCAM: a tenant that rearranges its Security Plan forms no longer breaks the import. Native
  fields are found by their internal id, which RegScale keeps unique across a module, rather
  than by the tab the mapping profile expects them on -- writing one is an attribute assignment
  that does not care which tab displays it. Custom fields still require the tab, because a
  custom field is addressed by a name its owner chose and the same name on another tab is a
  different field. Previously, moving stock fields to a different tab made every native
  destination unresolvable, and an incomplete resolution refuses to import.
• SARIF findings with the same rule in different files are now kept as separate vulnerabilities
• Scanner imports no longer fail with a missing-directory error when the configured artifacts directory does not yet exist
• SARIF findings are now titled with the rule description instead of repeating the rule or CVE identifier
• Large scanner batches no longer run four times over when the server reports success in its streaming format
• SARIF sync now reports when it can only run the compliance phase instead of skipping the import silently
• SARIF import now records vulnerabilities against the security plan or component instead of duplicating them per asset
• Vulnerability and other scanner imports no longer fall back to slow per-item processing when the server deduplicates records within a batch
• FedRAMP import_interconnects and import_cryptography commands are now available in the CLI
• Implementation statuses written by Wiz, CrowdStrike and compliance assessments now respect the status picklist configured on a plan's compliance settings
• Wiz compliance sync no longer skips updating control status for controls that have no objectives
• Compliance imports no longer fail to save control implementations that are set Not Applicable
• Databricks query failures now report the actual database error instead of an unrelated internal error
• JCAM no longer sends a custom field value the field cannot hold. A field's type and choice list belong to the tenant, so the profile cannot know them, and nothing was checking: free text could go to a Select and a value to a section heading, with the only objection arriving from the platform as an HTTP 500 naming neither the field nor the reason. Values outside a declared choice list, and values bound for a field type that holds no data, are now reported by field name and skipped rather than sent -- one bad value used to fail the whole batch and cost every other value on the record.