Changelog

Synapse-TeamCymru Changelog

v4.0.1 - 2025-07-10

Bugfixes

  • Fixed an issue where incomplete X509 records could stop the ingest of a Recon job.

v4.0.0 - 2025-05-30

Automatic Migrations

  • Migrated :server:fingerprint:ja3 to :server:ja3s and :client:fingerprint:ja3 to :client:ja3 on inet:tls:handshake nodes created by the Synapse-TeamCymru Power-Up.

Features and Enhancements

  • Updated ingest logic for JA3/JA3S to use modern properties.

v3.3.0 - 2025-05-20

Features and Enhancements

  • Updated teamcymru.recon.jobs.ingest to populate the it:exec:query:synuser property.

v3.2.0 - 2025-03-07

Features and Enhancements

  • Added teamcymru.scout.details to pull information concerning an IP address using the Scout API.

  • Added teamcymru.scout.foundation to pull information about IP addresses that show up in alerts or security incidents.

  • Added teamcymru.scout.usage to list current Scout API usage and limits.

  • Added teamcymru.scout.search to search for IP addresses matching a Scout search query.

v3.1.0 - 2025-02-05

Features and Enhancements

  • Added modelling for OS Fingerprint, Beacon, and Useragent reports.

v3.0.0 - 2025-01-17

Automatic Migrations

  • Migrated all inet:ssl:cert created by Synapse-TeamCymru to inet:tls:servercert nodes. The migrated inet:ssl:cert nodes are removed by this migration if they don’t have any other meta:source -(seen)> edges.

Features and Enhancements

  • Updated Power-Up to make inet:tls:servercert nodes instead of deprecated inet:ssl:cert nodes.

v2.3.0 - 2024-05-20

Features and Enhancements

  • Add modelling for JA3 fields.

  • Add teamcymru.recon.ja3.search command to search on JA3 related fields.

v2.2.0 - 2024-05-15

Features and Enhancements

  • Update $lib.bytes usage with $lib.axon APIs.

  • Update teamcymru.recon.setup.apikey command to accept a baseurl argument.

  • Update to use vaults for storing API keys and base URL configs. Existing global and user API keys will be automatically migrated during the first instantiation of this version.

  • Update configuration workflow to accept baseurl option.

v2.1.1 - 2024-02-20

Features and Enhancements

  • Update deprecated $lib.dict() usage to JSON style syntax.

v2.1.0 - 2023-12-08

Features and Enhancements

  • Automatically retry requests when a rate limit exceeded response is returned by the TeamCymru API.

v2.0.0 - 2023-06-07

Features and Enhancements

  • Add --batch-size parameter to allow aggregating sets of inbound nodes into jobs. By default, jobs will be created out of sets of 100 inbound nodes. The previous behavior of one node per job can be used by specifying --batch size 1.

  • Add category tags to src/dst inet:ipv4 nodes created when ingesting the results of flows jobs.

  • Add teamcymru.recon.x509.enrich and teamcymru.recon.x509.search commands for creating and ingesting x509 queries.

Bugfixes

  • The teamcymru.recon.dnsquery command has been removed due to no longer being a valid query type.

Documentation

  • Add API documentation for the teamcymru Storm module.

v1.4.0 - 2023-02-15

Features and Enhancements

  • Use it:exec:query to link job results instead of inet:search:query.

Bugfixes

  • Verify that the requested size is below the API limit.

  • Improve the error message when a timeout occurs for an HTTP request.

  • Fix examples in User Guide.

v1.3.0 - 2022-05-17

Features and Enhancements

  • Cached API responses are now stored in the JsonStor instead of in nodedata.

v1.2.0 - 2022-04-21

Features and Enhancements

  • Record :tot:txcount and :tot:txbytes on inet:flow nodes created from flows jobs.

v1.1.0 - 2022-02-21

Features and Enhancements

  • Record :ip:proto and :ip:tcp:flags on inet:flow nodes created from flows jobs.

v1.0.2 - 2022-02-15

Bugfixes

  • Use job_id field to generate unique inet:search:query node.

v1.0.1 - 2022-02-15

Bugfixes

  • Use start_time field to populate inet:flow:time for flows jobs.

v1.0.0 - 2021-12-10

Features and Enhancements

  • Initial release of the Synapse-TeamCymru Power-Up

  • Storm command support to create queries for flows, dns_query, pdns, and pdns_other queries.

  • Storm command support to list/ingest/delete existing queries.

  • Storm API support for create/list/ingest/delete queries of arbitrary type.