Changelog
Back to All

CLI 7.1.0

November 11th, 2026

[7.1.0] - 2026-11-11

Added

  • Tanium sync_stig_benchmarks imports DISA STIG results as STIG checklists, and sync_benchmarks imports CIS benchmark and STIG results together, each under its own checklist tool
  • An overall file progress bar for the Nessus import, which also logs one line per file instead of three
  • Trivy and Grype imports now remember which scan files were imported and skip them on the next run, with --reprocess to import everything again; a run that skips scan files does not close findings
  • Burp CSV and XLSX import command, regscale burp import_burp_csv, which imports a Burp scan held as a CSV or an XLSX (the Burp XML export with one row for each issue) and offers a --dry-run preview
  • Settings tab in the interactive GUI for browsing and editing every CLI configuration key, grouped by integration with secrets masked
  • New regscale risks export_risks and import_risks commands copy risks, with their attachments, between RegScale instances. Each risk's risk model is matched by title (or set with --risk_model_id), each imported risk is owned by the importing user (or the user given with --risk_owner_id), and re-running an import does not duplicate risks.
  • Databricks sync_assets and sync_findings commands that load the CIS checks and CVE findings of a Databricks export into a security plan as assets, vulnerabilities and issues, either into one plan or routed to many plans by an export column and a customer-supplied CSV; a CVE finding that the export marks closed is written closed, its assets carry the operating system and internet exposure the export gives, and --severity-field picks which export column sets each finding's severity
  • Option to have tenable io sync_findings read DISA STIG audit results from the Tenable.io compliance export and send them to the matching control objectives, off by default (tenableIoStigComplianceExport)
  • Vulnerabilities synced by scanner integrations now carry a finding type so non-CVE findings can be told apart from CVEs
  • New wizHeldFindingsQuietSeconds setting (default 30 seconds) sets how long wiz vulnerabilities waits, once no new asset appears, for a concurrent wiz inventory to write the assets of findings it holds

Changed

  • Tanium sync_cis_benchmarks now writes checklists only to assets in the security plan given by --regscale_id or in one of that plan's components; endpoints whose assets are all in other plans or their components are skipped instead of being written to a copy elsewhere, and the run reports how many were skipped
  • A removed init.yaml key the CLI no longer reads (the gRPC ingest keys, cisaKev, jiraDefaultIssueType, jiraDefaultPriority) now logs a warning on every run that names what to use instead, rather than being ignored silently, unless it still holds the value an older CLI wrote into every init.yaml; regscale config validate reports these keys as removed_key
  • Trust Center requests are now refused if they would leave the configured Trust Center host, API errors no longer echo the request's query string, and each request writes one debug log line without headers, bodies or query strings
  • Memory use when importing a large SARIF file for compliance mapping is roughly halved, because the file is now read in a stream instead of being loaded whole
  • Breaking change for custom scanner integrations: the ScannerIntegration flag that turns on closing outdated findings is now named close_outdated_findings_enabled, and the old close_outdated_findings name is no longer accepted as a flag because it is the inherited close method. Passing it to set_keys or to sync_findings/sync_assets on a ScannerIntegration subclass now raises TypeError. Two cases fail silently instead, so audit custom code for them: a class-level or instance-level close_outdated_findings = True assignment overwrites the inherited close method with a bool, and reading close_outdated_findings as a flag (if x.close_outdated_findings:) now returns the method, which is always truthy. Use close_outdated_findings_enabled for both.
  • A refused token now names its likely cause: an expired token says when it expired, and an unexpired one lists the RegScale 6.36 events that revoke tokens (password change or reset, administrator sign-out or deactivation, local sign-in turned off) with the fix for a service account or a person. A refused XCCDF benchmark import now logs the server's status, error code and message, such as the 409 that asks you to delete a benchmark with assessment results before replacing it
  • Nessus import reads large scan files faster and no longer loads the CPE dictionary when a scan names no CPE
  • Scanner imports make fewer requests to RegScale at start-up and spend less time per finding
  • The Nessus import is faster on folders with many files because it frees memory after a set amount of input instead of after every file
  • Trivy and Grype findings no longer start with the CVE in their title, and carry more of the scan data where the scan provides them: references, layers, CWE ids, EPSS and known-exploited flags, fix advice and image details
  • regscale jobs names each run's log file with its start time first, in UTC (20261108T070012Z-<job>-<run id>.log), so a plain ls of job_logs/ lists runs in the order they started. Logs from earlier runs keep their old names
  • Databricks sync_findings --mop-up now closes CIS checks and CVE findings separately, each under its own source (Databricks CIS Benchmark and Databricks CVE), so an export of one type no longer closes the other type's records, sync_assets --mop-up is refused unless the export holds both types, because the two types share hosts, and a plan that already holds issues under the earlier source Databricks gets a second set of issues on its first run, so close or delete the old ones first
  • Synqly connector prompts hide any value that the Synqly schema marks as a password, such as a client secret
  • Aqua imports use less memory on large reports
  • Each Xray vulnerability is now stored under a key that includes its CVE. The first Xray import after the upgrade creates new vulnerabilities with a new first seen date and closes the old ones, which keep their history.
  • On defender export_resources, -n now means --query_name only, so a script that used -n to skip the upload must use --no_upload instead
  • When a scanner sync stops because its vendor source fails partway through, the findings read before the failure are now sent without closing any findings, and a later error while sending them is logged at ERROR so the vendor failure still sets the exit code
  • If all rules of a control are in the conformance pack, aws sync_config_compliance --conformance_pack_name now closes its fixed findings and issues

Fixed

  • The interactive terminal GUI no longer fills the console with random characters when a file upload fails and the server returns a non-text error response
  • jcamValueMapping accepts @drop for a value, declining it: the value writes nothing and leaves the destination as it is, instead of being written literally as the text @drop; a value mapped to @unmapped still works and is noted once per run in favour of @drop
  • jcam import_ssp no longer stops for every plan when JCAM returns an undated SORN notice beside dated ones; undated notices go in the last slots, and an unexpected error in one plan's privacy data now fails only that plan
  • jcam import_ssp now sets each child plan's parent from JCAM's FISMA rollup, including a first parent and a change of parent, instead of every change being refused, and leaves the parent alone when JCAM's parent system has no RegScale plan instead of writing 0
  • jcam import_ssp no longer creates a plan a second time, without its compliance setting, in the front-matter step after RegScale refused to create it; the system is skipped and the refusal stays recorded
  • regscale jcam import_parameters counts a failed read of a plan's controls, or of a control's parameters, as a failure in the run summary, instead of treating the plan as having no controls or the control as having no parameters
  • jcam import_assessments and import_ssp count each assessment or system role RegScale's batch create did not return as a failure, instead of counting a refused batch or item as written
  • tenable nessus import_nessus now sets each asset's type from the host instead of creating every asset as "Other": an asset-type host tag (any asset type value, case and spacing ignored) wins, otherwise the standard system-type property is mapped (router, switch, firewall, load-balancer, hypervisor, mobile, general-purpose, and now embedded and printer as Appliance). The asset category follows the type (Software for application, database, container and cloud types, Hardware otherwise), assets created for findings use the same type, and a host with no type information no longer resets the type already stored for it when a newer scan is imported (its category is still sent as Hardware) (requires RegScale platform 6.35.1.0 or newer)
  • jcam import_poam matches an existing POA&M only among the importing plan's issues, instead of taking any issue in the tenant with the same otherIdentifier and moving it onto the plan
  • Tanium Cloud CIS benchmark checklists now show the rule title and the last scan date instead of only the rule ID
  • ServiceNow incident sync now copies attachments between incidents and RegScale issues instead of always reporting zero
  • AWS asset console links now open the AWS GovCloud console for resources in GovCloud regions
  • AWS Lambda layer version assets are now named by their layer and version instead of the bare version number
  • Jira evidence sync lists the Jira Tasks named in a repeated-failure log line in sorted order, so the line reads the same on every run
  • axonius_v2 commands give up on an Axonius request that times out after one attempt instead of four, and exit 6 with one timestamped log line naming the endpoint, the limit and axoniusTimeout, instead of a traceback or an unlogged error; the connect wait is capped at 30 seconds, as for other vendors, and axoniusTimeout is the read limit
  • jcam import_ssp skips JCAM's placeholder information type 'Other: Other' unless the tenant has a type of that name, instead of counting a plan that lists only the placeholder as failed and offering it in missing_info_types.json
  • The final step of a long import, where the RegScale server finishes the sync run, now logs when it starts, every 30 seconds while it runs and when it is done, instead of going silent for minutes
  • Interactive imports that send many batches, such as a Nessus folder import, no longer fill the terminal with finished sync progress bars that pushed the log output off screen part-way through the run
  • Trivy and Grype findings are dated from their scan file instead of the import time, and with import_scans first seen and last seen no longer move the wrong way when a newer or older scan is imported
  • --s3-bucket and --s3-prefix now read the bucket for Trivy and Grype imports, using the AWS profile or keys given on the command line
  • Compliance integrations, including AWS Security Hub compliance and Wiz compliance_report, count a compliance item that fails to process as a partial failure, so the run exits 3 under REGSCALE_STRICT_EXIT_CODES=1 instead of 0
  • Commands run without a terminal (regscale jobs run-due, cron, a redirected shell) now log a progress line at INFO at most once a minute during long loops, and a closing line with the count and elapsed time, where they used to stay silent until the loop ended
  • regscale jcam import_controls creates a plan's new control implementations 100 per request instead of one request each, and sends a control the report repeats once
  • Databricks sync_findings and sync_assets with --regscale-ssp-id use less memory on a large export, because they no longer keep one object for every distinct host of the whole file while they stream it
  • Tenable.io sync_compliance_controls no longer stops on a compliance check with a null see_also, description or other descriptive field, and skips a check it cannot read instead of ending the run
  • FedRAMP Appendix A import no longer stops when a control in the document has no implementation status selected
  • The FedRAMP POA&M Excel import now accepts workbooks built from template v3.x. It no longer requires the removed Resources Required, Planned Milestones, Milestone Changes and Operational Requirement columns, and it reads Remediation Plan in place of Overall Remediation Plan. It skips a POA&M sheet that has no POAM ID header, with a warning, instead of stopping. Typing a quoted answer such as 'skip' at the mapping prompt no longer loops.
  • Trivy, Grype, SARIF, OpenText, Qualys Total Cloud and Tenable SC file imports no longer fail with "cannot pickle '_queue.SimpleQueue' object" when the staged findings file is larger than 500 MB
  • Compliance syncs now fill in the control and security plan on each control assessment, and the control and assessment on issues whose finding maps to a single control. A new issue gets its assessment on the first sync and its control on the next
  • Critical RegScale issues synced to Salesforce now create cases with High priority instead of Low
  • JCAM milestone import reports an unrecognized or undated completed status instead of guessing, and export sends a milestone's own status to JCAM when it is one JCAM uses instead of always Completed or Not Started
  • JCAM milestone import no longer gives a milestone JCAM sent no due date the import time; RegScale sets the date from the POA&M's severity
  • Reminder emails no longer fail for users who have no upcoming or overdue items, and the run now reports when nobody has any
  • Qualys scanner no longer fails on a finding with no detection data and now gives such findings a unique id
  • regscale tenable io sync_compliance_controls now creates a control implementation for each matched control that passed or failed a check and that the security plan does not have, gives an enhancement control (for example AC-2(1)) the status Tenable.io reported, and exits 1 when it matches controls but RegScale saves none of them
  • The stored size of an uploaded file, such as a Jira attachment or evidence file, is now its byte count
  • AWS sync_assets on plans with assets in more than one region now marks a deleted resource as not in the latest scan and keeps edits made to it during the run, and the AWS compliance commands keep an Inactive status a user set and give S3 buckets the Cloud Storage type without replacing their description
  • On platforms before 6.36.0.0, regscale aws sync_config_compliance now closes the issues that CLI 6.x stored under the bare AWS account ID when it retires those records, instead of leaving them open, with issueCreation: Consolidated (the default)
  • regscale aws sync_config_compliance --conformance_pack_name no longer closes the findings and issues of controls that pass, so the findings and issues of failing rules outside the conformance pack stay open
  • Scan History Date Scanned now shows the scan date instead of the import time for integrations that import vulnerabilities in batches
  • Asset syncs no longer log a duplicate asset that RegScale saved from a later row of the same batch as "not saved", and the "Successfully submitted" and "asset(s) synced" counts now show distinct assets
  • Synqly connector syncs create their Synqly account and integration with the installed Synqly SDK
  • Amazon Inspector syncs through Synqly build an AWS access key credential and ask for the access key ID and the secret access key, instead of stopping with an attribute error
  • Synqly ticketing syncs create tickets and upload attachments with the installed Synqly SDK
  • The error that follows a rejected Synqly integration setup no longer shows the credential values that Synqly echoes back
  • Synqly vulnerability syncs such as Amazon Inspector, Wiz and Tenable Security Center no longer stop with a filter validation error before they fetch findings
  • The file comparison command now names the supported file types, CSV, XLSX or XLS, when it refuses a pair of files
  • If another import saves the same plan, an asset import no longer adds a second copy of an asset. It reports the asset as not saved, with the reason
  • The FedRAMP OSCAL SSP import now ends with one clear error line and exit code 6, or 4 when the host refuses access, when the host of the profile that the SSP names cannot be reached or answers with an HTTP error, instead of a traceback
  • The FedRAMP OSCAL SSP import now reads a profile that its host sends compressed, such as the FedRAMP profiles published on GitHub, instead of failing with a decoding error
  • The FedRAMP OSCAL SSP import now ends with one clear error line and exit code 1, instead of a traceback, when the profile that the SSP names is not a readable JSON document, and it no longer leaves a copy of the profile in the system temporary directory
  • The eMASS POA&M workbook import now stores each POA&M with an Issue status the tenant offers (Ongoing as Open, Completed as Closed with its completion date, Risk Accepted as Exception/Waiver or Open, and Open or Closed as Ongoing or Completed on a tenant that uses the eMASS statuses) instead of losing rows.
  • Tenable.io commands now honor the sslVerify setting, and Tenable.io and Tenable.sc commands now verify against the CA bundle set in customCaCert
  • Tenable.io asset sync stores an asset's MAC addresses in the same order on every run
  • tenable io info shows the Tenable.io user, account email and scanners instead of always reporting a connection error, and exits with a non-zero code when it cannot get them
  • regscale tenable sc list_tags now lists the Tenable.sc tags. It asked pyTenable for a tags endpoint that does not exist, logged an error and exited 0. It now reads GET /rest/tag, prints "No tags found in Tenable.sc." when there are none, and exits 4 when Tenable.sc refuses the keys, 6 when it does not answer or reports an error, and 1 when the reply is not a list of tags.
  • Prisma CSV import removes repeated rows before importing, so the logged counts are of distinct findings
  • Wiz add_report_evidence now fails with an error naming the refused upload, instead of logging that the file was uploaded
  • Jira commands that use basic authentication now honor the sslVerify setting, and a blank sslVerify key verifies the certificate
  • OpenSCAP imports no longer leave two open issues for each failed rule, and the one issue that remains is linked to the vulnerability but not to the affected controls
  • axonius_v2 commands print one error line that names the Axonius host and the failure, and exit with code 1, instead of a traceback when Axonius cannot be reached, drops the connection or answers with an error or an unreadable reply; a timeout still exits with code 6
  • axonius_v2 now prints one error line that names the input, and writes nothing, when a saved query config file is missing or invalid, a saved query is not in Axonius, a regscaleSspId is not an integer, or --offset or --limit is negative
  • Axonius asset sync no longer imports nothing when one device has no preferred hostname or name, or one flat-file row has no CDM Unique ID; such a device is synced under another identifier, and a device with no identifier at all is skipped with a warning that names it
  • Fixed axonius sync_assets --regscale_ssp_id to stop with an error when the security plan does not exist instead of writing assets under it
  • Axonius asset sync now stops with an error and a non-zero exit code when RegScale refuses an asset batch, for example when the token has expired, instead of reporting completion
  • Axonius pull_data_axonius gives up when Axonius sends nothing for the axoniusTimeout setting (exit 6) instead of a fixed 3600 seconds, and reports a refused connection, an unknown host or a reply that is not a JSON object as one error line naming the host (exit 1) instead of a traceback
  • Axonius pull_data downloads only the S3 object that the key names and fails when no object, or several objects, match the key
  • axonius combine_data_parts merges a part that holds one JSON object as one record instead of writing its field names, and stops with a usage error for a part that is not a list or object
  • axonius file commands and combine_data_parts report a missing, unreadable, non-UTF-8, empty, non-JSON or non-list input file, and a tenant without the "FISMA Id" security plan field, as one Error: line with exit code 1 instead of a traceback; the sync commands now check the input file before they query RegScale
  • Report a missing security plan in the Axonius V2 sync commands as one error line instead of a traceback
  • prisma sync_sbom (and panw sync_sbom) now fails when the SBOM download fails or the archive cannot be read, with exit 4 when Prisma Cloud refuses the credentials and exit 6 otherwise, instead of reporting success and exiting 0
  • The Prisma Cloud and Palo Alto sync_sbom commands now accept --no-bulk-download to sync the SBOM of one host or image
  • Prisma authenticate (and panw authenticate) now stops with exit status 4 when the login reply holds no usable token and with exit status 6 when the reply is not JSON, caches nothing, and ignores a tokenless session that an older release cached
  • Prisma Cloud syncs now wait for each Retry-After value, at most 30 seconds, log every retry wait and fail at once when the console asks for a longer wait
  • Burp Suite imports no longer stop when an issue has no background or a request and response pair has no request
  • Importing a Burp Suite export now maps a vulnerability to each host that reports an issue type, where only the first host got it; the issue names every such host, and the stored vulnerability key does not change
  • The Burp import now names a file that is empty, cut short or not a Burp export, and exits with an error when no file in the folder could be imported
  • Burp import no longer prints a time zone warning for an export time that ends in a zone abbreviation such as EDT
  • The Acunetix and Prisma CSV imports, and the other flat-file imports, now print one line for each file they cannot read and exit 1 when no file in the folder could be imported
  • Importing a JFrog Xray report now stores one vulnerability for each CVE that a finding lists, where it stored only the first
  • Fix the JFrog Xray import storing a finding as Low when its CVE has no CVSS v3 score: it now uses the severity Xray gives the finding, or the band of the CVSS v2 score
  • Fix the JFrog Xray import skipping a finding that has no CVE identifier. The import now stores such a finding under its Xray issue id. A warning now names each finding that the import skips
  • Importing a JFrog Xray or AWS Inspector JSON report with no findings now completes and says the report holds no findings instead of asking for a column mapping or failing, and an Xray report page that lists none of its rows is skipped so it closes no findings
  • JFrog Xray import of a report that holds one finding as a single object instead of a list
  • The Xray, Snyk and other JSON imports now name a .json file that is empty, cut short, not valid JSON, not readable or not a list of records, skip it, and import the other reports in the folder. A JSON report that starts with a UTF-8 byte-order mark is now read
  • Prisma CSV import keeps findings identified by a Prisma Cloud or GitHub advisory ID instead of skipping them
  • Prisma CSV import stores a finding with no CVSS score, or a score of 0.0, at the severity in its Severity column instead of Low
  • A mapping file that is empty, not UTF-8 text, not valid JSON or not a JSON object now stops show_mapping with a message that names the file, instead of a traceback or a printed value
  • Scanner file imports and other commands that check their security plan or component now stop with an authentication error when RegScale refuses the account (exit status 4, or 78 when the token cannot be renewed), instead of reporting an invalid plan and exiting 0
  • Defender commands now report that Azure refused the credentials, with Azure's error description, instead of a missing access_token key and a traceback; the exit code stays 1
  • Defender export_resources now reports the HTTP status and the request that failed when Azure refuses or fails the saved query request, instead of a traceback
  • defender export_resources -n "<name>" now exports the named saved query and no longer prints five duplicate-option warnings
  • Microsoft Defender alerts are no longer skipped when an activity time cannot be reformatted, and a time with an offset now shows its UTC date
  • Entra evidence collection logs one error line for each evidence type that Microsoft Graph refuses, in place of a traceback and a bare exit code
  • regscale emass_api authenticate, push_poam and sync_system now stop after one wait when eMASS does not answer, print the line eMASS at <host> did not answer in time (<n> seconds). and exit 6. push_poam no longer sends a new POA&M when its search for an existing POA&M gets no answer, a bidirectional sync_poams prints how many POA&Ms it pushed before the timeout, and authenticate no longer exits 0 when its connection test fails
  • regscale emass_api commands no longer wait without a limit when eMASS accepts the connection and does not answer. The CLI now uses the emass.timeout setting (or EMASS_API_TIMEOUT, default 300 seconds) for each eMASS request. After that time the command prints one line, eMASS at <host> did not answer in time (<n> seconds)., and exits 6. When the request was a change, the line adds eMASS may have applied the change., so check eMASS before you run the command again. A command that sends many items, such as sync_controls or upload_artifacts_bulk, stops at the first timeout. The time limit applies to each phase of a request, not to the whole request, so a server that sends a little data at a time can still keep a command waiting. A large artifact upload to a slow eMASS server can now stop at 300 seconds; raise emass.timeout for it. A value of emass.timeout that is not a positive number, such as 0, -5 or abc, uses 300 seconds and logs a warning.
  • regscale emass_api sync_controls no longer exits 0 when no control synced because eMASS could not be reached or refused the request. When no control synced and at least one control failed because of eMASS, the command prints one error line with the eMASS host and exits 4 if eMASS answered 401 Unauthorized or 403 Forbidden for any control, and 6 for an unreachable host, a TLS failure, any other error status or an answer it cannot read. It used to print [OK] Control sync complete with every control counted as an error. When eMASS refuses only the content of controls (400 Bad Request, 409 Conflict, 422 Unprocessable Content), or when some controls synced, the failed controls stay partial failures: the command prints how many controls were not synced, with the synced and error counts, and no longer prints [OK]. The DEBUG log message for a failed control push no longer carries the eMASS response body.
  • regscale emass_api upload_artifacts_bulk and add_milestones_bulk no longer print tracebacks or the eMASS response headers and body when eMASS fails, sync_poams prints one error line that names the eMASS host when its pull fails, and import_xml prints one error line without a traceback for a file that is not XML
  • The regscale emass_api commands now print one error line that names the problem and the eMASS host, for example eMASS at emass.example.mil rejected the API key: 401 Unauthorized., instead of one to three tracebacks. emass_api test_connection no longer ends with an empty Error: line and Aborted!. The line and the warnings never carry the API key, the response headers or the response body. A 401 Unauthorized or 403 Forbidden answer exits 4. An unreachable host, a failed TLS connection, any other HTTP error status or an unreadable answer exits 6. Both used to exit 1. A local or RegScale error still exits 1.
  • The regscale emass_api commands delete_milestones, add_milestones_bulk and upload_artifacts_bulk accept --yes (or -y) to skip the confirmation question, so a scheduler, a pipeline or the Orchestration Hub can run them. Without --yes and without a terminal, each command now prints one Error: line that names --yes and exits 2 before it calls eMASS, instead of a traceback and Aborted!.
  • regscale emass import_slcm now reports a file that is empty or is not an Excel workbook as one error line that names the file, and exits 1, instead of printing a traceback
  • The eMASS import commands and detect_workbook now report a file that they cannot read as one error line that names the file and exit 1, instead of a traceback or exit 0
  • regscale emass import_slcm now exits 1 when the security plan or the catalogue is not found, 4 when RegScale refuses the lookup and 6 when RegScale does not answer it, instead of exiting 0 after logging "Aborting!"
  • If a control has the Implementation Status Manually Inherited, a blank status or an unknown status, the regscale emass import_slcm command no longer marks it Not Applicable. Manually Inherited is now saved as Manually Inherited, as regscale emass import_slcm_workbook does. The Implementation Status is matched without regard to case. A blank or unknown status keeps the control status and its N/A Justification, and logs a warning that names the control. The command applies Not Applicable from the Implementation Status or Compliance Status column only with an N/A Justification. Without one, the control keeps its status and the command logs a warning.
  • The eMASS hardware and software inventory import now reports each row it skips and counts each asset RegScale refuses as an error
  • eMASS POA&M workbook import now stops and names the rows that share a POA&M Item ID, instead of merging them into one issue
  • eMASS control test results import now names the row and value of an unreadable Date Tested when the CCI does not resolve
  • eMASS control test results import no longer sends an unreadable Date Tested to RegScale and names the CCI number in its errors
  • OpenSCAP import_csv now names a CSV file that is cut off, has a header that matches no supported layout, is not UTF-8 or has a field over the CSV size limit, and exits non-zero instead of importing part of the file or nothing
  • OpenSCAP imports now name each missing, empty, truncated or non-XML scan file, and a folder with no scan file, and exit non-zero, while the other files in the folder are still imported
  • OpenSCAP CSV import now reads files that start with a UTF-8 byte-order mark, such as files saved by Excel as CSV UTF-8, and imports the same findings as the file without the mark
  • cci_importer prints one error line that names the file, with no traceback, when the CCI file is empty, truncated, not XML or cannot be read
  • regscale stig cci_assessment and regscale stig_mapper run now stop with an error and a non-zero exit status when the security plan does not exist, in place of reporting that they found nothing to do
  • The jira_dc commands now log one error line that names the problem and the Jira Data Center URL, with exit code 4, 5 or 6, when the first request to Jira Data Center fails, and a server that does not answer fails after jiraDcTimeoutSeconds instead of about six minutes
  • Jira commands jira issues and jira tasks now end with one error line and a non-zero exit code when Jira refuses the credentials, cannot be reached or answers with an error, and they report an unset jiraUrl, instead of printing a traceback
  • Qualys scan import no longer stops when a row's severity is empty, not a number or outside 1 to 5; it logs a warning naming the row and imports that row at low severity
  • The example Qualys URL in the init.yaml template is now a host only, and an existing init.yaml that keeps the old example path no longer doubles it or triggers config validation warnings
  • Qualys diagnostics and CSV validation now exit with a non-zero status when a check fails, and a failed request no longer prints a traceback
  • The Qualys import_policy command now reports a one-line error and exits with status 2 when the file is not a Qualys policy export or an option value is not valid, and no longer creates an Untitled Policy from a JSON object that has no policy ID
  • Qualys import-vm-report now stops with a usage error when both --report-file and --report-title are given, instead of silently importing the file and ignoring the title
  • A mapping file that is not valid JSON, not UTF-8 text or of the wrong shape now stops the import with exit status 2 and one line that names the file, instead of a traceback
  • Import a Qualys VM scan row that has no QG Host ID as an asset keyed on its IP address, and skip a row with neither
  • A Wiz token URL that ends in any mix of slashes and whitespace, such as a space or a tab followed by a slash, is now accepted, as one that ends in a slash or a space already was
  • Wiz commands now name the token endpoint when its answer is not a token, instead of a redacted placeholder
  • regscale wiz attach_sbom now attaches an SBOM whose document has no version, and when RegScale refuses one SBOM it still attaches the others and then exits 1
  • A compliance sync that stops on a usage error, such as a Wiz compliance report that is not UTF-8 text, prints one "Error:" line and no longer also logs the same message with a traceback
  • Wiz inventory, issues and vulnerabilities help now names the --filter_by_override option and shows an example that is valid JSON
  • The deprecated wiz sync_compliance command no longer lists --list-frameworks in its help, and using that option now stops with a usage error (exit code 2) that points to wiz compliance_report instead of exiting 0 after printing a message
  • The tenable was sync_findings command no longer exits 1 before it sends a request to Tenable.io when the security plan already holds assets
  • A Tenable.io --tags value without key:value pairs, an --asset-filter-file that is not a JSON object, and a Tenable.sc sync_jsonl --mapping_file that is not a JSON object now end with a usage error that names the option and the expected format. A file passed as a pipe, such as a shell process substitution, still works
  • Tenable.io CIS checklist syncs and Tenable.io STIG compliance results now send asset tag filters in the form Tenable.io accepts, so a run with --tags no longer fails and syncs nothing
  • Tenable.sc file import with --file-path now stops with an error and a non-zero exit status when no file in the folder can be read as Tenable.sc data
  • Negative --offset and --limit values are now refused with a usage error instead of stopping a sync or processing the wrong records
  • Log redaction no longer hides the start of a connection error after a sign-in URL that ends in /token, so "[Errno 111] Connection refused" stays readable
  • When Microsoft Defender keeps failing or does not answer, the error now names the request URL again, without its query string or any credential
  • A request that keeps failing with an HTTP error such as 500 Internal Server Error or 429 Too Many Requests now logs one error without a Python traceback, and Microsoft Defender reports a sustained failure once
  • A missing required setting, such as wizUrl, now ends a command with one error line and exit code 5 instead of a Python traceback
  • tenable io sync_compliance_controls keeps the control owner of each control implementation it updates
  • Qualys import-vm-report now saves Re-Opened and Fixed detections with a RegScale vulnerability status, and exits non-zero when it saves no asset or vulnerability or a request fails
  • The eMASS asset, POA&M and test result integration classes now read the eMASS responses and sync the systems, POA&Ms and test results they return instead of failing with an error
  • Tanium benchmark and ports syncs stop with an error when RegScale refuses or fails the read of the plan's components, instead of skipping the assets under those components
  • Tanium ports and protocols sync in an Orchestration Hub split job now reads ports for the same endpoints that the job's asset step writes
  • Tanium ports and protocols sync now writes ports only to the endpoint's asset in the selected plan or its components, not to copies of the endpoint in other or deleted plans
  • eMASS and FedRAMP imports that update control implementations no longer reset the inherited record permissions or clear the last assessment, the parent control and the approval state of those control implementations
  • If two rows of an asset sync differ only in letter case, the sync writes the software and SBOM of their asset once
  • The jira_dc sync_tasks command no longer creates two RegScale tasks when the Jira search returns the same ticket on more than one result page
  • FedRAMP OSCAL SSP imports now store the ports and protocols of each component, which RegScale rejected before because their Service and Used By values were empty
  • Compliance syncs on RegScale 6.36+ read each control's newest same-day assessment from POST /api/v3/assessments/byParents, so a control assessed more than once today merges with its latest result instead of its earliest.
  • AWS sync_assets now shows the valid from date, the valid until date and the number of resources in use on each ACM certificate asset
  • Qualys sync keeps a consolidated issue and vulnerability open while any host or web application still reports the vulnerability as open
  • Qualys WAS findings that Qualys reports as fixed now close their issue and vulnerability during sync
  • env_info now prints its full report in the container image, under an unknown user id and in a read-only directory
  • Pipeline report_scan no longer stops before it creates the issues for a failed scan when the SSP-level control update fails, and RegScale no longer refuses that update because the control origination is missing
  • Pipeline setup_component and report_scan now link the repository component to the security plan, so it appears in the plan's Components tab
  • regscale wiz vulnerabilities now names every finding it did not write when it exits 1 because regscale wiz inventory had not written the plan, one line for each finding with its asset
  • aws sync_findings without --generate-evidence or --format now sends the findings it read before a failed Security Hub page, instead of none of them
  • A scanner sync that the server did not start, because another sync of the same source was still running, no longer sends its checklist results or changes the status of a control or control objective
  • Checklist roll-ups send only valid assessed dates, and a Tenable STIG result whose scan date is missing or not a valid date is dated by its last seen date, so one bad date no longer stops every result in the sync from updating control status
  • Tenable STIG imports send a passing check's vulnerability as closed and any other result as open, instead of sending the check result, which the server rejected with a warning for every passing check
  • Wiz vulnerabilities and issues incremental syncs run with --offset or --limit no longer move the saved pull watermark past findings they did not write
  • Stop logging an error and stack trace when the catalog update cannot read the platform feature flags
  • A Tenable.io asset or vulnerability sync now stops before it sends any record from a cached export that is corrupt, and an export that stops partway is no longer cached for the next run
  • A truncated Tenable.io asset or vulnerability export cache is now removed and fetched again on the next run instead of failing every run until it expires
  • Updated the pyasn1 dependency to a release that fixes known security vulnerabilities
  • BigQuery asset sync now reports a rejected query as a single error line instead of a Python traceback
  • Issues from a component compliance report are now saved under the component and no longer rejected as a missing security plan
  • A Qualys CSV import whose column changes type after the first 10,000 rows now stops with a one-line message that names the file instead of a traceback
  • A Qualys file import with a negative --skip_rows value, or one that reads a title row as the column headers, now stops with a message that names --skip_rows instead of a traceback
  • Tenable compliance sync gives a failing control its planned implementation date and steps to implement, and sets a passing control to Fully Implemented, on platforms that take bulk control updates
  • Qualys import_total_cloud no longer logs that it imported findings RegScale refused, and reports how many vulnerabilities RegScale stored
  • Re-importing a Qualys VMDR report into a security plan now updates each host's existing asset instead of creating a second asset for every host
  • The eMASS POA&M workbook import now stores the controls, devices affected, impact description and security plan of each POA&M it creates, and fills the false positive, operational requirement, auto-approved and risk adjustment flags with No when they are empty. A row the batch upload refuses, such as a Risk Accepted row stored as Exception/Waiver, is now written on its own, or reported with the server's reason, instead of being dropped with "see the log".
  • FedRAMP CIS/CRM imports store every control and part inheritance model when the RegScale platform does not accept them all in one bulk request, and fail with an error line when RegScale refuses a model
  • Evidence and scan results now map to every control of a security plan with more than 500 control implementations when RegScale leaves out the next page marker on a full page
  • Evidence and scan results now map to control enhancements on a RegScale platform with the bulk compliance routes, and evidence also maps when the source names a control enhancement in the AC-2(1) form
  • On RegScale 6.36 and later, a compliance sync no longer replaces the result of an assessment from another day
  • Control implementation syncs and imports on RegScale 6.36.0.0 or later now retry or report a control implementation that the bulk update did not write, instead of finishing as if it succeeded
  • Wiz syncs that run longer than the Wiz access token lasts get a new token and keep going, instead of failing with an HTTP 401 and exit code 4