Logpresso Store

1.5.2609.0 2026-09-18 18:12

Mail flow collection moved to Microsoft Graph - Applies to: `Exchange Mail Flow` logger, `m365-exchange-mail-flows` query command M365 Mail Flow log schema changes - Added `dst_ip` and `src_city` - `organization`, `index`, `start_date`, and `end_date` are not provided by the Graph API but are kept for compatibility with existing data Other improvements - `m365-exchange-mail-flows` now splits the query range from oldest to newest, matching the logger - Fixed the time filter not being applied in dashboards **Note: The setup procedure for mail flow collection has changed. See the install guide.**

Microsoft Teams

1.0.2511.1 2026-09-18 17:08

`ms-teams-send-batch` query command updates - Now available in stream queries - Fixed message delivery failure when the ticket priority value is missing - Fixed the previous record's priority, ticket status, and link being carried over into the next message after a delivery failure - Fixed a malformed detail link button when the `url` field is missing - Fixed result records being duplicated as many times as the number of registered workflow URLs

BLUEMAX NGF

1.11.2609.0 2026-09-17 18:19

Feature Improvements - Added NAT rule lookup command (bluemax-ngf-nat-rules) - Added session logout command (bluemax-ngf-logout) - Fixed issue where the profile idle timeout option was not applied

CrowdStrike Falcon

1.1.2609.0 2026-09-16 17:10

New features - New connect profile type - 2 new log schemas - 3 new loggers - Event Streams — detection, incident, audit and remote session events (persistent connection) - Scheduled Report Logs — scheduled report executions - Scheduled Search Logs — scheduled search executions - 8 new query commands - `crowdstrike-falcon-devices` — list devices - `crowdstrike-falcon-ngsiem-query` — run an NG SIEM query - `crowdstrike-falcon-scheduled-reports` / `-searches` — list scheduled report and search executions - `crowdstrike-falcon-scheduled-report` / `-search` — read a result by execution id - `crowdstrike-falcon-last-scheduled-report` / `-search` — read the latest execution by name **Note: If you installed an app file delivered outside the store, remove the existing app and install this version as a new one.**

Sophos XGS

1.0.2609.0 2026-09-15 19:24

CTX

1.2.2609.0 2026-09-13 12:20

Feature Improvements - Added file download feature: ctx-download-file - Requires [File Store](https://logpresso.store/en/apps/filestore) app

YARA Scanner

1.0.2609.0 2026-09-13 12:10

First release - Included YARA Forge 4832 rules - Requires [File Store](https://logpresso.store/en/apps/filestore) app

Experimental

2.3.2609.1 2026-09-11 12:17

Feature Improvements - Stream rule validation: sonar-create-stream-rule-batch, sonar-insert-stream-rule-command-batch, sonar-update-stream-rule-command-batch - Batch rule validation: sonar-create-batch-rule-batch, sonar-update-batch-rule-query-batch

Experimental

2.3.2609.0 2026-09-10 22:47

Feature Improvements - New commands: sonar-create-stream-rule-batch, sonar-create-batch-rule-batch, sonar-update-stream-rule-batch, sonar-update-batch-rule-batch, sonar-update-rule-mitre-batch, sonar-stream-rule-command-templates, sonar-insert-stream-rule-command-batch, sonar-update-stream-rule-command-batch, sonar-delete-stream-rule-command-batch, sonar-update-batch-rule-query-batch - Renamed commands: sonar-clone-dashboard-batch, sonar-clone-dataset-batch, sonar-clone-widget-batch - Support for MITRE ATT&CK fields: sonar-stream-rules, sonar-batch-rules

Google Cloud Pub/Sub

1.3.2609.0 2026-09-10 10:51

Note: Stop the logger before upgrading the app Improvements - Logger bug fixes (failure reporting, automatic reconnection, connect profile change detection) - Query command fixes - `gcp-pubsub-pull` added — reads a subscription without consuming messages - `gcp-pubsub-publish` — publish failures reported, integer field input and empty message handling fixed, `msg_id` added to output - `gcp-pubsub-messages` — connect profile errors reported Compatibility - Requires Logpresso Sonar 4.0.2308.0 or later