Changelog
Back to All

CLI 6.41.0

August 20th, 2026

[6.41.0] - 2026-08-19

Changed

  • A custom CA bundle path that does not exist now fails immediately with a message naming the file and the setting that configured it, instead of failing later without either
  • Per-integration TLS verification settings such as taniumVerifySsl, splunkSSLVerify, splunkHecSSLVerify, and snowVerifySsl are no longer read and each logs a warning at startup naming the top-level sslVerify that replaces it, so a configuration that relied on one of them to reach a self-signed endpoint must set sslVerify: false to keep connecting
  • A deprecated qradar.verify_ssl setting is now migrated to the top-level sslVerify at startup with a deprecation warning, so existing QRadar configurations keep working
  • Splunk, QRadar, and Axonius V2 now read TLS certificate verification from the shared top-level sslVerify setting instead of their own per-integration keys
  • CrowdStrike integration now requires FalconPy 1.6.4

Fixed

  • FedRAMP SSP import now reports when OSCAL validation could not run instead of attaching an empty validation report and logging success
  • AWS EventBridge inventory now honors the configured account ID and tag filters instead of returning rules from all accounts
  • eMASS DoD CA bundle (emass.ssl_ca_cert) is now applied to all API connections, resolving SSL certificate verification failures against DoD-signed eMASS servers
  • QRadar commands no longer fail with a header type error when the API version or API token is written without quotes in the configuration file
  • QRadar event sync no longer fails on deployments without the AWS DSM extension, and event properties can now be selected explicitly with the qradar event_fields setting
  • SSL verification and custom CA bundle settings now take effect on every HTTP client, and clients no longer report verification as disabled while it is enabled
  • Response bodies are only decoded for debug logging when debug logging is enabled, reducing memory use on large API responses
  • Configured connect, write, and connection-pool timeouts are now applied to every API request instead of being overridden by the read timeout
  • Relative API paths such as /api/files are no longer rewritten to an invalid host, restoring Prisma SBOM evidence upload
  • Sicura, Rapid7 cloud, Tanium CIS benchmark and ports/protocols syncs, ServiceNow, eMASS, and catalog file downloads now honor the top-level sslVerify setting instead of verifying certificates unconditionally
  • CrowdStrike alert sync now fixed a pagination issue for alerts
  • CrowdStrike alert tagging now applies every supplied tag rather than only the first
  • CrowdStrike incident tables now render alerts returned by the current Alerts API
  • CrowdStrike compliance notes are now written for frameworks mapped from NIST, such as CMMC, ISO, and SOC 2
  • CrowdStrike authentication failures now report a credential error instead of an unrelated internal error
  • AWS security collector now passes configured tag filters to CloudTrail, AWS Config, IAM, and KMS sub-collectors