Changelog
Back to All

CLI 6.39.0

August 11th, 2026

[6.39.0] - 2026-08-10

Added

  • Splunk integration with search, streaming export, saved searches, search job management, asset and finding processing, and evidence ingestion
  • splunk sync command that runs the saved searches listed in splunkSavedSearches and imports assets, findings, and control evidence in one pass, running each saved search only once no matter how many import targets are enabled
  • Splunk evidence ingestion driven by named saved searches, so control evidence can be collected on a schedule without exporting search results by hand
  • Splunk HTTP Event Collector upload command for pushing JSON, CSV, or raw log files into Splunk
  • Splunk advanced export command supporting JSON, CSV, TSV, XML, and raw output with optional gzip, bzip2, or LZMA compression and chunked files
  • Splunk support for instances behind an Entra ID Application Proxy, including Azure Government
  • Splunk saved searches can name the controls their evidence attests to, overriding the control identifier in the search results, so evidence still maps when a search is labelled in a different control framework than the security plan
  • Splunk evidence can map to several controls at once, and results can name several controls in one field, comma-separated, space-separated, or as a multivalue field
  • Splunk result fields holding the control and evidence title are configurable, so searches naming them anything other than control_id and control_evidence work without changes
  • Splunk evidence can map control labels from another framework onto the security plan's controls using the crosswalks shipped with the CLI, so a search labelled in CMMC, CSF, SOC 2, ISO 27001, or CIS can attach evidence to a NIST plan; off by default via splunkCrossFrameworkMapping, with every translation logged
  • Splunk evidence control matching ignores zero-padding differences between catalogs, so a result naming AC-2 maps correctly in a plan that labels the same control AC-02
  • Splunk evidence ingestion reports when a source carries no control fields versus when a control ID doesn't exist in the target plan, naming the plan's actual controls so a framework mismatch is obvious
  • Splunk assets record the operating system reported by the search
  • Splunk process and ingest-evidence accept -m / --regscale_module to attach records to a component instead of a security plan
  • Splunk connection credentials can be supplied through the SPLUNK_USERNAME and SPLUNK_PASSWORD environment variables, keeping secrets out of the command line
  • Splunk commands run unattended without interactive prompts, using configured or sensible default values for connection port, scheme, timeout, result limit, output mode, and TLS verification
  • Splunk sync and process report a failing exit code when Splunk returns data but nothing is written to RegScale, so scheduled runs don't report success when nothing was actually imported
  • Splunk logs and audit records omit the Splunk account name and replace search text with a non-reversible fingerprint by default, so personal data in a query is not written to disk; set splunkLogQueryText to true to record the full text
  • FedRAMP Key Security Indicator (KSI) and Zero Trust Architecture (ZTA) control crosswalks, so evidence and findings labelled in either framework can map to NIST 800-53 controls

Changed

  • Imported scan files now keep their original name and are filed under a dated folder, processed/YYYY-MM-DD/, instead of having a timestamp appended to the filename
  • Re-importing a file on a day it was already imported now saves it alongside the earlier copy as name_2 rather than leaving it behind in the scan folder
  • The log line after an import now reports where the scan file was actually moved and uploaded from
  • CSAM is now JCAM throughout the CLI, following the DoJ's rename of the product; use regscale jcam and the jcam* settings in init.yaml
  • Existing CSAM setups keep working without changes — regscale csam, the csam* init.yaml settings, and the "CSAM Id" field on the system Basic Info tab are all still honored, with a warning pointing to the new names
  • The JCAM API route prefix can now be set with the jcamBasePath setting for tenants whose route has been renamed

Fixed

  • Snyk findings now record the date from the FIRST_INTRODUCED column as their first seen date, falling back to the scan file's date when the column is empty or unreadable
  • Snyk XLSX imports no longer fail with a type error when the FIRST_INTRODUCED column is populated; dates, times, and blank values are all accepted, with the scan date used when a value cannot be read
  • Flat file imports no longer report a parsing error for Microsoft Office lock files (~$name.xlsx) or hidden sidecar files left in the scan folder; they are now skipped
  • Qualys API errors are now reported with their real meaning instead of "Unknown error code", so rate limits, bad credentials, and rejected filter parameters are each named and can be acted on
  • Qualys authentication failures are now recognized as fatal and stop the run rather than being reported as a missing response
  • Records that fail validation now report the specific field and reason instead of being silently sent to RegScale as empty requests and rejected
  • Jira task sync now skips and reports individual issues that cannot be mapped to a RegScale task, instead of stopping the rest of the sync
  • Security patch for the bundled HTTP/2 dependency, resolving a request smuggling advisory
  • Security patches for the bundled GitPython, python-multipart, Ansible, and Airflow SMTP provider dependencies, resolving multiple high-severity advisories
  • Qualys VMDR scan report imports now record the CVE, CVSS v3 and v2 base scores, Qualys ID, and first and last detected dates on each vulnerability, which were previously left blank
  • Qualys VMDR scan report vulnerabilities are now kept as separate records per Qualys ID instead of collapsing into a single record per security plan
  • Qualys Web Application Scanning imports no longer fail with a validation error when creating vulnerabilities
  • Bulk vulnerability and issue imports no longer fail with stream or connection errors when a single finding affects many assets, which prevented AWS Security Hub syncs from saving vulnerabilities; requests are now sized by the number of affected assets and can be tuned with maxAssetIdentifiersPerBatch in init.yaml
  • eMASS CAC authentication on macOS no longer terminates the CLI without an error message; a versioned OpenSSL library is now located explicitly, and a clear message is shown when OpenSSL 3 is not installed