Changelog

Synapse-URLScan Changelog

NEXTVERS - 2026-XX-YY

Automatic Migrations

  • Populated :cookies and :response:cookies on inet:http:request nodes previously ingested by Synapse-URLScan and removed the refs edges to inet:http:cookie nodes from their HTTP header nodes that no other data source has seen.

  • Set :type to urlscan.incident on existing meta:rule nodes for URLScan incidents, identified by their guid and :ext:id, replacing any other :type value.

Features and Enhancements

  • Updated urlscan.scan, urlscan.enrich, and urlscan.search to set :cookies and :response:cookies on inet:http:request nodes instead of linking inet:http:cookie nodes to their headers with refs edges.

  • Updated urlscan.search.incidents to set :type to urlscan.incident on meta:rule nodes.

v2.0.0 - 2026-10-13

Automatic Migrations

  • Migrated existing API key and tag prefix settings to the new configuration manager. Per-user API keys were migrated to user-scoped configurations named synapse-urlscan:<useriden>.

  • Migrated storage version tracking to use Storm package inits.

Features and Enhancements

  • Added support for proxy and SSL verification configurations on a per-vault basis.

  • Added new configuration manager commands:

    • urlscan.config.add

    • urlscan.config.del

    • urlscan.config.list

    • urlscan.config.show

    • urlscan.config.update

    • urlscan.config.migrate

  • Added a --config argument to urlscan.search, urlscan.search.hostnames, urlscan.search.certificates, urlscan.search.incidents, urlscan.enrich, urlscan.scan, and urlscan.quota to override the default configuration.

  • Added the power-ups.urlscan.admin permission, which grants access to all Synapse-URLScan commands and the urlscan.privsep module.

  • Added an Optic configuration workflow for synapse-urlscan vaults.

  • Removed the urlscan.setup.apikey and urlscan.setup.tagprefix commands. Use urlscan.config.add / urlscan.config.update instead.

Bugfixes

  • Fixed an issue which caused the downloadFile() function in the urlscan.privsep module to return request headers including the API key.

  • Fixed urlscan.enrich not setting the _urlscan properties on inet:url nodes.

v1.15.1 - 2026-09-08

Bugfixes

  • Fixed an error in urlscan.scan and urlscan.search --detail when a scan result could not be retrieved from URLScan or was missing a timestamp.

v1.15.0 - 2026-04-17

Features and Enhancements

  • Added HTTP retry logic, rate-limit handling, and better handling for server errors. API endpoints are now defined in the package modconf.

v1.14.0 - 2025-08-22

Features and Enhancements

  • Updated urlscan.enrich search query to include page.url in addition to task.url.

v1.13.0 - 2025-05-20

Features and Enhancements

  • Updated urlscan.scan.storm, urlscan.search.certificates.storm, urlscan.search.hostnames.storm, urlscan.search.incidents.storm, and urlscan.search.storm to populate the it:exec:query:synuser property.

v1.12.1 - 2025-01-27

Bugfixes

  • Fixed an issue where the file:bytes node was not populated with the SHA256 hash of the certificate file.

v1.12.0 - 2024-09-16

Features and Enhancements

  • Tag inet:url nodes with URLScan labels and verdict categories in scan results.

  • Add extended model properties to inet:url to represent verdicts from URLScan and its community.

v1.11.0 - 2024-05-15

Features and Enhancements

  • Add a --download-responses option to the urlscan.enrich, urlscan.search, and urlscan.scan commands to download available HTTP response bodies and downloaded files from results.

v1.10.0 - 2024-03-13

Features and Enhancements

  • Update $lib.bytes usage with $lib.axon APIs.

Bugfixes

  • Fix an issue where characters were not correctly escaped when using an inet:url node as input to the urlscan.search.incidents command.

v1.9.1 - 2024-02-20

Features and Enhancements

  • Update deprecated $lib.dict() usage to JSON style syntax.

v1.9.0 - 2024-01-23

Features and Enhancements

  • Add .seen timestamps to inet:url nodes seen during URL redirects.

v1.8.0 - 2023-11-27

Deprecations

  • Caching has been removed from the urlscan.enrich, urlscan.search, urlscan.search.certificates, and urlscan.search.hostnames commands, so the --asof argument has been deprecated and will no longer have any effect.

This release contains an automatic cache cleanup that will run when the package is first upgraded. This will remove existing cached API response data from the jsonstor.

v1.7.0 - 2023-10-11

Features and Enhancements

  • Add urlscan.search.incidents for searching the URLScan Pro incidents datasource.

v1.6.0 - 2023-08-25

Features and Enhancements

  • Add urlscan.search.hostnames and urlscan.search.certificates commands for searching additional urlscan Pro datasources.

  • Update error messages for unsuccessful HTTP requests to include the reason phrase in addition to the response code.

v1.5.1 - 2023-06-14

Bugfixes

  • Remove the use of a deprecated Storm function.

v1.5.0 - 2023-04-05

Features and Enhancements

  • Add --country option to urlscan.scan to allow specifying the country to perform the scan from.

  • Update ingest to populate inet:http:request:response:body when a SHA256 hash of the HTTP response body is available.

  • Update ingest to populate it:exec:url:http:request with the inet:http:request for the URL.

  • Update command help to clarify the use of inet:urlredir nodes for scans where the actual URL returned is not the same as the initial scan URL.

  • Set file:bytes:mime property on downloaded screenshots.

v1.4.0 - 2023-03-22

Features and Enhancements

  • Update Power-Up to build with code signing.

v1.3.0 - 2022-09-28

Features and Enhancements

  • Update urlscan.search and urlscan.scan to create it:exec:query nodes with -(found)> edges.

v1.2.0 - 2022-05-12

Features and Enhancements

  • Cached API responses are now stored in the JsonStor instead of in nodedata.

v1.1.1 - 2022-02-10

Bugfixes

  • Fix various spelling errors in command help output.

v1.1.0 - 2022-01-19

Features and Enhancements

  • Download screenshots when ingesting results with the --detail flag.

  • Add --dom and --screenshot flags to urlscan.enrich and urlscan.search. These can be used to download the DOM trees or screenshots of results instead of the full result as with --detail.

  • Add inet:urlfile nodes for files downloaded by pages.

  • Add Optic node action for urlscan.scan.

  • Add inet:url nodes to allowed forms for the urlscan.enrich node action.

Notes

  • DOM trees are now modeled using the :page:html property on it:exec:url nodes instead of a -(dom)> edge. The following Storm command can be used to migrate existing search results:

    > $lib.import(urlscan).migrateDomEdges()

v1.0.4 - 2021-11-17

Bugfixes

  • Add -(found)> edges to link results back to the inet:search:query node.

v1.0.3 - 2021-11-15

Features and Enhancements

  • Print clear warning when ingesting invalid search results

  • Default search size parameter moved to 10k

Bugfixes

  • Account for pagination of search queries with <10k results

v1.0.2 - 2021-11-12

Bugfixes

  • Fix pagination based ingest of URLScan search queries.

v1.0.1 - 2021-10-13

Bugfixes

  • Fix an issue where results containing an empty request object could raise an error.

v1.0.0 - 2021-08-13

Features and Enhancements

  • Initial release of Synapse-URLScan v1.0.0.