Attributed metadata history
Up to 100 retained publisher events per page for a0a5d46d2b6454fa4c22ce891fd928787b3a2c8d494deb636d8e837e3e82f1ed. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_ae9b2b6332b3346bf0
observed · 2026-10-12 14:03:03 UTC
available
Fingerprint: cddf44e995d297d992af3bad423cabb5019940d89b6cae97856c128438ca314e
intelligence_src_ae9b2b6332b3346bf0
observed · 2026-10-12 14:03:03 UTC
This release is a bug fix release and addresses the CVEs published in the 0.77.3 release cycle. Detailed change log below (AI generated). Artifact changes Added Azure.Monitor.Upload, which uploads server-side artifact results to an Azure Monitor Log Analytics workspace. Takes a table name, a Data Collection Rule id, and either a client secret or a managed identity. (#4974, 2026-09-04) Server.Utils.BackupDirectory, Server.Utils.BackupGCS and Server.Utils.BackupS3 now emit only ClientId, FlowId and the fields derived from them, rather than all columns. Downstream consumers reading a column that is no longer emitted will need updating. (#4999, 2026-09-04) Windows.Forensics.Prefetch reads VolumeSerialNumber at offset 16 rather than 12. (#5000, 2026-09-09) Windows.Registry.EnableUnsafeClientMailRules reads the target user's NTUser path rather than the collector's OSPath. (#5016, 2026-09-17) Bug fixes The registry accessor parses MULTI_SZ values correctly. (#4972, 2026-08-12) Flow completion now waits for the final FlowStats write. (#4982, 2026-08-25) ArtifactName is read from the cell environment rather than passed as a parameter. (#4990, 2026-08-25) Pool clients report the correct h
Fingerprint: 9934340e28a39fd3c1e0f5eff06b6c5271f22b0197dec35c35c6519b7fd74d19