Attributed metadata history

Release 0.77.3

This release is a bug fix release and addresses the CVEs published in the 0.77.3 release cycle. Detailed change log below (AI generated). Artifact changes Added Azure.Monitor.Upload, which uploads server-side artifact results to an Azure Monitor Log Analytics workspace. Takes a table name, a Data Collection Rule id, and either a client secret or a managed identity. (#4974, 2026-09-04) Server.Utils.BackupDirectory, Server.Utils.BackupGCS and Server.Utils.BackupS3 now emit only ClientId, FlowId and the fields derived from them, rather than all columns. Downstream consumers reading a column that is no longer emitted will need updating. (#4999, 2026-09-04) Windows.Forensics.Prefetch reads VolumeSerialNumber at offset 16 rather than 12. (#5000, 2026-09-09) Windows.Registry.EnableUnsafeClientMailRules reads the target user's NTUser path rather than the collector's OSPath. (#5016, 2026-09-17) Bug fixes The registry accessor parses MULTI_SZ values correctly. (#4972, 2026-08-12) Flow completion now waits for the final FlowStats write. (#4982, 2026-08-25) ArtifactName is read from the cell environment rather than passed as a parameter. (#4990, 2026-08-25) Pool clients report the correct hostname in compressed responses. (#5003, 2026-09-08) Filestore StatFile() reports the uncompressed file size. (#5024, 2026-09-18) The events view in the GUI no longer breaks on artifacts whose name contains a slash, such as Server.Monitor.Health/Prometheus. (#5001, 2026-09-15) A user's notebook view now lists notebooks shared with them, in line with the global notebook view. (#5001, 2026-09-15) enrollments_per_second: -1 disables enrollment instead of being ignored. (#5042, 2026-09-27) Globs with unbalanced alternatives, such as /bin/{ls, now report an error. (#5044, 2026-09-27) Internal Replaced the gRPC connection pool with a direct connection to the frontend. (#5022, 2026-09-18) Closed the gRPC channel from the returned closure. (#5014, 2026-09-14) Moved the client info manager's lock into the record locking system. (#5015, 2026-09-15) Serialised creation of the global eBPF manager. (#5031, 2026-09-20) Refactored the event queues, and split flow storage deletion into its own manager. (#5035, 2026-09-24, #5037, 2026-09-25) Added client event artifacts to the artifact verifier. (#5043, 2026-09-27)

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.