CLI 6.37.69

[6.37.69] - 2026-07-30

Added

• Option to sync Qualys and Prisma vulnerabilities and issues without creating or updating assets
• Tanium open ports and protocols synchronization to assets and the system Ports, Protocols, and Services table

Changed

• Tanium ports and protocols sync now recognizes many more service names (VNC, Redis, MongoDB, Elasticsearch, Kafka, and others), falling back to the operating system service list before labeling a port Unknown
• SARIF import summary now reports the number of vulnerabilities created or updated rather than splitting the two, since the batch endpoint does not report which records were new
• Nessus findings are now labeled with the scan name from each .nessus file, so imports of multiple scans can be told apart instead of all showing a generic Nessus source

Fixed

• GCP inventory collection now gathers Compute, GKE, Cloud Run, Cloud Functions, Filestore, IAM, networking, and DNS resources that previously failed to load
• Qualys asset tracking numbers no longer carry a security-plan suffix, and Qualys syncs now rewrite previously suffixed tracking numbers so existing assets keep their vulnerability and issue links instead of being duplicated
• Qualys asset re-syncs no longer overwrite an asset's tracking number with a different value than the one used when the asset was created, which had prevented vulnerabilities and issues from linking to the asset
• Qualys import_scans no longer fails immediately with an unexpected keyword argument error, and now honors --dry-run and the AWS credential options when downloading files from S3
• Qualys sync_qualys now applies the --asset_group_id and --asset_group_name filters instead of silently syncing every asset
• Nessus finding and issue titles no longer end in "None" when a plugin provides no synopsis
• AWS asset sync no longer creates a duplicate AWS account asset for every IAM role, which had forced the batch upload into slow one-at-a-time processing
• Tanium ports and protocols sync no longer creates duplicate rows when the same port is reported more than once for an endpoint
• GitPython version security patch for high-severity security advisory
• Wiz STIG import no longer creates duplicate assessments when the same asset and benchmark are imported more than once in a day
• Bulk control implementation and software inventory updates now persist instead of silently failing
• FedRAMP document imports no longer silently drop stakeholders that are missing a job title
• FedRAMP stakeholder import no longer fails with an authorization error when creating stakeholders or reading existing ones, which had prevented stakeholders from importing and could create duplicates
• eMASS SLCM import no longer fails to read control implementations due to a dropped authorization header
• FedRAMP stakeholder imports preserve street address details in notes when a country is not provided
• SARIF imports now flag findings as Known Exploited Vulnerabilities when their CVE is on the CISA KEV catalog; previously the CVE was discarded and the records bypassed the ingestion path that applies KEV matching
• SARIF findings now take their severity from the file's level value, mapping error to High, warning to Medium, note to Low, and none to Informational; previously every level was stored as Low regardless of what the file said
• SARIF imports no longer store a value in the CVE field when it is not a well-formed CVE identifier
• Run and step timing summaries ("Completed: ... in ...") are now logged in non-interactive runs (redirected or containerized output), not only when attached to a terminal