Changelog

Synapse-Cybersixgill Changelog

NEXTVERS - 2026-XX-YY

Automatic Migrations

  • Migrated existing client id, client secret, and tag prefix settings to the new configuration manager. Per-user client ids and secrets were migrated to user-scoped configurations named synapse-cybersixgill:<useriden>. A legacy client id and secret that cannot be migrated, because they are malformed or their configuration already exists, are left in place and reported in the Cortex log; add them with cybersixgill.config.add. An invalid tag prefix is reported in the Cortex log and not migrated.

Features and Enhancements

  • Added support for proxy and SSL verification configurations on a per-vault basis.

  • Added new configuration manager commands:

    • cybersixgill.config.add

    • cybersixgill.config.del

    • cybersixgill.config.list

    • cybersixgill.config.show

    • cybersixgill.config.update

    • cybersixgill.config.migrate

  • Added verification of the client id and secret by requesting an API token to cybersixgill.config.add and cybersixgill.config.update, with a --no-check-apikey option to skip it.

  • Added a --config argument to cybersixgill.iocs, cybersixgill.cve.enrich, cybersixgill.credentials.leaks, cybersixgill.intel.items, and cybersixgill.intel.items.byid to override the default configuration.

  • Added the power-ups.cybersixgill.admin permission, which grants access to all Synapse-Cybersixgill commands and the cybersixgill.privsep module.

  • Replaced the Optic configuration workflow with one for synapse-cybersixgill vaults.

  • Removed the cybersixgill.setup.apikey and cybersixgill.setup.tagprefix commands. Use cybersixgill.config.add / cybersixgill.config.update instead.

Bugfixes

  • Fixed the data migrations failing when a view is deleted while they run. They now warn when they skip a view whose write layer is read-only.

  • Fixed privsep functions exposing Cybersixgill API tokens to callers.

  • Made the cybersixgill.privsep generic request helpers (postApi, postApiPageNum, postApiPageToken and getApi), which sent authenticated requests to any caller-supplied path, private.

v2.0.1 - 2026-10-13

Bugfixes

  • Fixed an issue which caused cybersixgill.cve.enrich to fail with the current Cybersixgill DVE API response format.

  • Fixed an issue which caused cybersixgill.cve.enrich to not set the :_cybersixgill:exploit:score property.

v2.0.0 - 2025-12-10

Automatic Migrations

  • Migrated and removed all inet:web:post and inet:web:acct nodes created by Synapse-Cybersixgill.

  • Migrated storage version tracking to use Storm package inits.

Features and Enhancements

  • Updated ingest logic to create inet:service:message and inet:service:account instead of inet:web:post and inet:web:acct.

v1.0.0 - 2025-05-16

Automatic Migrations

  • Deleted :nist:nvd:modified and :nist:nvd:published properties on risk:vuln nodes created by Synapse-Cybersixgill.

Features and Enhancements

  • Added cybersixgill.intel.items.byid command for querying the Intel Items API by item ID.

  • Updated cybersixgill.iocs and cybersixgill.intel.items to populate the it:exec:query:synuser property.

  • Updated risk:vuln ingest logic to no longer set :nist:nvd:modified or :nist:nvd:published. Please use NIST NVD as the authoritative source for setting these properties on it:sec:cve.

v0.7.0 - 2024-06-17

Features and Enhancements

  • Add Optic Workflow for searching and ingesting Intel Items.

  • Add Optic Workflow for searching and ingesting Credentials Leaks.

Bugfixes

  • Fix an issue where the default tag prefix was used in addition to a custom tag prefix when ingesting Intel Items.

v0.6.0 - 2024-04-01

Features and Enhancements

  • Update risk:vuln node generation to deconflict on the :reporter:name property.

v0.5.1 - 2024-02-20

Features and Enhancements

  • Update deprecated $lib.dict() usage to JSON style syntax.

v0.5.0 - 2023-12-08

Features and Enhancements

  • Always print the full raw API response when --debug is specified.

  • Handle HTTP error code 429 (rate-limiting) and retry after the time specified in the header.

  • Set the partial_content option to false for cybersixgill.intel.items.

  • Set the module option to cti and osint for cybersixgill.intel.items.

  • Update cybersixgill.intel.items to create it:exec:query nodes with -(found)> edges.

Bugfixes

  • Fix an issue that caused the end time for cybersixgill.intel.items to not be parsed properly.

v0.4.0 - 2023-11-20

Features and Enhancements

  • Add cybersixgill.credentials.leaks command for querying the Credentials Leaks API.

  • Add cybersixgill.intel.items command for querying the Intel Items API.

v0.3.1 - 2023-10-11

Bugfixes

  • Fix an issue where the auth token would not be cleared when removing the currently configured API key.

v0.3.0 - 2023-06-16

Features and Enhancements

  • Updated to use new CVSS model and $lib.infosec.cvss.vectToScore()

v0.2.0 - 2023-02-28

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • Add cybersixgill.cve.enrich command for enriching CVEs with additional vulnerability data from the DVE enrichment API.

v0.1.0 - 2023-02-16

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • Initial beta release of the Synapse-Cybersixgill Power-Up