Changelog

Synapse-TeamCymru Changelog

v5.0.1 - 2026-11-05

Bugfixes

  • Fixed an internal build issue.

v5.0.0 - 2026-11-04

Automatic Migrations

  • Migrated storage version tracking to use Storm package inits.

Bugfixes

  • Fixed the data migrations failing when a view is deleted while they run, or when a view’s write layer is read-only. Views with a read-only write layer are now skipped with a warning.

  • Fixed the debug output of the teamcymru.recon commands printing the whole results download response, including the API key in the request headers.

  • Fixed the teamcymru.privsep module making API requests to a caller-modified endpoint and returning cached results without a configured API key.

  • Fixed the conversion of legacy API keys to vaults blocking the remaining migrations when a vault could not be added. A legacy API key whose vault cannot be added, for example because the user already has a vault, is left in place and reported in the Cortex log; use teamcymru.recon.setup.apikey to add it.

  • Fixed the minimum Optic version for the configuration workflow, which is now v2.135.0, since older Optic releases cannot start on Synapse v2.240.0 or later.

v4.3.1 - 2026-10-13

Bugfixes

  • Fixed the first example in the teamcymru.recon.ja3.search help, which used --ja3-fingerprint-md5 and --ja3s-fingerprint-md5 instead of the --ja3 and --ja3s options.

v4.3.0 - 2026-07-29

Features and Enhancements

  • Updated the teamcymru.recon commands to avoid parsing duplicate certificates from within the same job ingest.

  • Updated the teamcymru.scout.details command to break out open directory data.

v4.2.0 - 2026-06-23

Features and Enhancements

  • Updated the --debug switch to print the outbound API request line and a pretty-printed API response on all TeamCymru commands.

Bugfixes

  • Fixed an issue where incomplete IP records could throw an exception when using teamcymru.scout.search.

v4.1.0 - 2025-12-17

Features and Enhancements

  • Added Synapse-TeamCymru user-agent to API requests.

v4.0.1 - 2025-07-10

Bugfixes

  • Fixed an issue where incomplete X509 records could stop the ingest of a Recon job.

v4.0.0 - 2025-05-30

Automatic Migrations

  • Migrated :server:fingerprint:ja3 to :server:ja3s and :client:fingerprint:ja3 to :client:ja3 on inet:tls:handshake nodes created by the Synapse-TeamCymru Power-Up.

Features and Enhancements

  • Updated ingest logic for JA3/JA3S to use modern properties.

v3.3.0 - 2025-05-20

Features and Enhancements

  • Updated teamcymru.recon.jobs.ingest to populate the it:exec:query:synuser property.

v3.2.0 - 2025-03-07

Features and Enhancements

  • Added teamcymru.scout.details to pull information concerning an IP address using the Scout API.

  • Added teamcymru.scout.foundation to pull information about IP addresses that show up in alerts or security incidents.

  • Added teamcymru.scout.usage to list current Scout API usage and limits.

  • Added teamcymru.scout.search to search for IP addresses matching a Scout search query.

v3.1.0 - 2025-02-05

Features and Enhancements

  • Added modelling for OS Fingerprint, Beacon, and Useragent reports.

v3.0.0 - 2025-01-17

Automatic Migrations

  • Migrated all inet:ssl:cert created by Synapse-TeamCymru to inet:tls:servercert nodes. The migrated inet:ssl:cert nodes are removed by this migration if they don’t have any other meta:source -(seen)> edges.

Features and Enhancements

  • Updated Power-Up to make inet:tls:servercert nodes instead of deprecated inet:ssl:cert nodes.

v2.3.0 - 2024-05-20

Features and Enhancements

  • Add modelling for JA3 fields.

  • Add teamcymru.recon.ja3.search command to search on JA3 related fields.

v2.2.0 - 2024-05-15

Features and Enhancements

  • Update $lib.bytes usage with $lib.axon APIs.

  • Update teamcymru.recon.setup.apikey command to accept a baseurl argument.

  • Update to use vaults for storing API keys and base URL configs. Existing global and user API keys will be automatically migrated during the first instantiation of this version.

  • Update configuration workflow to accept baseurl option.

v2.1.1 - 2024-02-20

Features and Enhancements

  • Update deprecated $lib.dict() usage to JSON style syntax.

v2.1.0 - 2023-12-08

Features and Enhancements

  • Automatically retry requests when a rate limit exceeded response is returned by the TeamCymru API.

v2.0.0 - 2023-06-07

Features and Enhancements

  • Add --batch-size parameter to allow aggregating sets of inbound nodes into jobs. By default, jobs will be created out of sets of 100 inbound nodes. The previous behavior of one node per job can be used by specifying --batch size 1.

  • Add category tags to src/dst inet:ipv4 nodes created when ingesting the results of flows jobs.

  • Add teamcymru.recon.x509.enrich and teamcymru.recon.x509.search commands for creating and ingesting x509 queries.

Bugfixes

  • The teamcymru.recon.dnsquery command has been removed due to no longer being a valid query type.

Documentation

  • Add API documentation for the teamcymru Storm module.

v1.4.0 - 2023-02-15

Features and Enhancements

  • Use it:exec:query to link job results instead of inet:search:query.

Bugfixes

  • Verify that the requested size is below the API limit.

  • Improve the error message when a timeout occurs for an HTTP request.

  • Fix examples in User Guide.

v1.3.0 - 2022-05-17

Features and Enhancements

  • Cached API responses are now stored in the JsonStor instead of in nodedata.

v1.2.0 - 2022-04-21

Features and Enhancements

  • Record :tot:txcount and :tot:txbytes on inet:flow nodes created from flows jobs.

v1.1.0 - 2022-02-21

Features and Enhancements

  • Record :ip:proto and :ip:tcp:flags on inet:flow nodes created from flows jobs.

v1.0.2 - 2022-02-15

Bugfixes

  • Use job_id field to generate unique inet:search:query node.

v1.0.1 - 2022-02-15

Bugfixes

  • Use start_time field to populate inet:flow:time for flows jobs.

v1.0.0 - 2021-12-10

Features and Enhancements

  • Initial release of the Synapse-TeamCymru Power-Up

  • Storm command support to create queries for flows, dns_query, pdns, and pdns_other queries.

  • Storm command support to list/ingest/delete existing queries.

  • Storm API support for create/list/ingest/delete queries of arbitrary type.