# Firewall Analyzer - Readme
## Release Overview
### Build No - 12.9.149 - October 6, 2026
**New Features & Enhancements:**
1. Support ID: `13425606` - Introduced support for Device Discovery and Rule Management of individual Palo Alto firewalls through the Panorama Management Server.
2. Updated the protocol list based on the latest IANA standards.
3. Support ID: 13433335 — Enhanced Username-IP Mapping using Active Directory to fetch user mapping details from Event ID 4624 in addition to Event IDs 672 and 4768.
4. Support ID: 13617477 — Enhanced syslog processing for FortiGate firewall devices.
5. Support ID: 12560722 — Enhanced syslog processing for Check Point firewall devices.
6. Support ID: 13407862 — Added support for virtual firewall handling and rule field parsing for F5 devices.
7. Removed the HttpClient 4 JAR dependency for Firewall REST API access and migrated to the ITOM HTTP Client.
8. Support for ManageEngine Log360 Cloud integration has been introduced, enabling users to forward application access, audit, and debug logs, as well as alarm events through Notification Templates.

**Issues Fixed:**
1. SupportID: #13576649 — SonicWall: Device Rule - Fixed issues in parsing rule names and service objects.
2. SupportID: #13292260 — FortiGate: Added support for wildcard network objects in Rule Management Reports.
3. SupportID: #13307304 — Policy Anomaly Report: Previously, discrepancies occurred in Shadow Anomaly detection for rules configured with the "Any" interface based on rule order. This issue has now been fixed.
4. SupportID: #13154854 — Anomaly Calculation: Previously, rules configured with "ALL" services or protocols were not handled correctly. This issue has now been fixed.
5. SupportID: #13625893 — Rule Grouping: Added grouping suggestions for rules configured with different protocols.
6. SupportID: #13301795 — Huawei: Device Rule - Default Rules are now included along with other access rules.
7. SupportID: #13266666, #13353904, #13580560 — Palo Alto: Previously, Pre Rules and Pre-NAT Rules were missing from the Policy Overview reports. This issue has now been fixed.
8. SupportID: #13291683 — FortiGate Security Audit Report: Previously, incorrect Allowed/Denied rule mapping and logging status were displayed. This issue has now been fixed.
9. SupportID: #13580560 — Palo Alto: Device Rule - Added support for fetching Pushed and Shared configurations for multiple VSYS cases in Panorama-managed devices.
10. SupportID: #13418480 — Check Point: Device Rule - Added object group de-referencing in APIs to fetch all relevant object details for Rule Management reports.
11. SupportID: #13563369 — Risk Report: Previously, the Show by Rules report displayed no data. This issue has now been fixed.
12. SupportID: #13776463 — Risk Report: Previously, the Mark False Positive option did not work for section names containing quotation marks. This issue has now been fixed.
13. Support IDs: 13461528, 13069487, 13246999 — Previously, the Change Management report was not populated for Firepower (FMC) devices. This issue has now been fixed.
14. Support ID: 13167919 — Previously, when FortiGate HA firewalls with the same IP address were added in both OpManager and the Firewall Analyzer module, the Security tab displayed incorrect data by referring to the wrong device. This issue has now been fixed.
15. Support IDs: 13339611, 13373923 — Previously, VPN login log syslog ID 734001 was not processed and stored properly in the log archive. This issue has now been fixed.
16. SupportID: 13912963, 13884745, 13775365: Syslog reporting was intermittently stopped in high syslog-flow environments. This issue has now been fixed.

### Build No - 12.9.136 - September 3, 2026
**Security Fixes:**
1. Previously, a broken access control vulnerability allowed scoped Operators to access information associated with unassigned firewalls through device group access. This issue has now been fixed.
2. Previously, a broken access control vulnerability allowed scoped Operators to view and delete Rule Management > Impact reports associated with unassigned firewalls. This issue has now been fixed.
3. Previously, in Enterprise Edition, a broken access control vulnerability allowed Probe-scoped Operators to access information associated with unassigned Probes through the Central server. This issue has now been fixed.
4. Previously, in Enterprise Edition, a path traversal vulnerability allowed the Probe server to overwrite files on the Central server. This issue has now been fixed.

### Build No - 12.9.135 - August 28, 2026
**Security Fixes:**
1. Fixed a broken access control vulnerability that allowed a scoped user to disable monitoring for unassigned firewalls. (Reported by sealldev)
2. Fixed a broken access control vulnerability that allowed a scoped user to modify the scheduled Change Management report configuration for unassigned firewalls. (Reported by sealldev)
3. Fixed a broken access control vulnerability that allowed a scoped user to configure alert notifications for unassigned firewalls. (Reported by sealldev)
4. Fixed a SQL injection vulnerability in Enterprise Edition that allowed registered Probes to execute unauthorized queries on the Central server. (Reported by zeocrynt)
5. Fixed a privilege escalation vulnerability that allowed an Operator to gain Administrator privileges through Report Profile import. (Reported by zeocrynt)

### Build No - 12.9.133 - August 12, 2026
**New Features & Enhancements:**
1. SupportID: 13054003 — Added support for F5 Firewall custom partition (VDOM) handling based on CLI.
2. SupportID: 12478021 - Introduced enhancements to the Unused Rules report for supported non-Cisco firewall devices to ensure consistency with the Security Rules page.
3. SupportID: 13258967 - Introduced a time-based filtering option in the Policy Fine Tuning report for viewing Used and Unused rules.
4. Introduced support for Rule Expiry reports for WatchGuard and SonicWall firewalls.
5. Introduced SNMP Credentials profile to simplify the device association process.
6. Firewall Analyzer now supports TOPdesk integration to streamline IT service management by automatically converting network alerts into incidents in TOPdesk.

**Issues Fixed:**
1. SupportID: 13175765 - Device rule parsing issues found related to Unused rules, Unassigned objects, Object Details report for Sonicwall firewall SonicOS 7.3.x.
2. SupportID: 9470513 - Config backup should only store the configuration if there are differences.
3. SupportID: 13076894 - Rule expiry slowness issue found in case of device group with more devices.
4. SupportID: 13218270 - NAT/PAT configuration details and Name Resolution Configuration details of Paloalto firewall is supported under Security Audit report now.
5. SupportID: 13239505 - Paloalto device rule parsing issue related to service objects is fixed.
6. SupportID: 13239505 - Fortigate firewall device rule parsing issue related to application objects is fixed now.
7. SupportID: 13334852 - Fortigate firewall device rule parsing issue related to large rule comments is fixed now.
8. SupportID: 13303711 - In "Overview", logging disabled rules data shows incorrect data. This issue is fixed now.
9. SupportID: 13300799 - WAN mandating check is excluded in standards and risk report now.
10. SupportID: 12905648 - Change management configuration change diff shows garbled chars. This issue is fixed now.
11. SupportID: 13381766 - WatchGuard firewall device rule objects groups parsing fails due to large interface lists. Fixed this issue.
12. SupportID: 13357046 - Firepower firewall object name mismatch issue found in policy overview report is fixed now.
13. SupportID: 13526572 - In OPM EE, if multiple probes have same firewall name, they are not synced with central properly. This issue has been fixed.

**Security Fixes:**
1. Previously, an XML injection vulnerability was identified in Rule Management > Compare Policies. This issue has been fixed. (Reported by qquynh)
2. Previously, a remote code execution vulnerability was identified in Diagnose Settings. To address this, the Diagnose Settings feature has been removed. (Reported by qquynh)
3. Previously, a data exposure vulnerability was identified due to firewall IP address updates based on the syslog receiving host. This issue has been fixed. (Reported by qquynh)

### Build No - 12.9.125 - September 03, 2026
**Security Fixes:**
1. Fixed a broken access control vulnerability that allowed a scoped user to disable monitoring for unassigned firewalls. (Reported by sealldev)
2. Fixed a broken access control vulnerability that allowed a scoped user to modify the scheduled Change Management report configuration for unassigned firewalls. (Reported by sealldev)
3. Fixed a broken access control vulnerability that allowed a scoped user to configure alert notifications for unassigned firewalls. (Reported by sealldev)
4. Fixed a SQL injection vulnerability in Enterprise Edition that allowed registered Probes to execute unauthorized queries on the Central server. (Reported by zeocrynt)
5. Fixed a privilege escalation vulnerability that allowed an Operator to gain Administrator privileges through Report Profile import. (Reported by zeocrynt)

### Build No - 12.9.119 - July 22, 2026
**New Features & Enhancements:**
1. Enhanced support for syslog-dependent Rule Management and Compliance reports in high-syslog firewall environments by setting a System property. Firewall Analyzer now provides improved report generation for syslog-dependent reports, including Unused Rules, Rule Suggestion, Policy Fine-Tuning, Objects Usage, and Unused Objects.
2. SupportID: 13069487 — Introduced enhancements for [Cisco FMC](https://www.manageengine.com/products/firewall/help/cisco-fmc-rule-management.html?fwa_readme) using API mode Firepower device rule support.

### Build No 12.9.118 - July 20, 2026
**New Features & Enhancements:**
1. The Ember.js version used for the Custom Reports, Syslog Reports, Proxy Reports, and Country Reports pages has been upgraded to 6.4.
2. The Ember.js version used for the Search and VPN tabs has been upgraded to 6.4.

**Security Fixes:**
1. Previously, path traversal issue identified during export report. This issue has been fixed. (Reported by Tuannq. Refer ZVE-2026-4565)

### Build No 12.9.117 - July 09, 2026
**Security Fixes:**
1. Previously, sensitive information was exposed on the Inventory interface list page. This issue has now been fixed. (Reported by ch4r0n. Refer ZVE-2026-4285)

### Build No 12.9.106 - July 03, 2026
**Issues Fixed:**
1. Previously, firewall names detected from syslog could cause a stored XSS vulnerability. This issue has now been fixed. (Reported by NGOC HIEU)
2. Previously, an SQL injection vulnerability was identified in Rule Management Search Reports. This issue has now been fixed. (Reported by NGOC HIEU)

### Build No 12.9.102 - June 18, 2026
**New Features & Enhancements:**
1. Support ID: 13005925 - Added an option to create an "Event Report" based Anomaly Alert.
2. Support ID: 13074591 - For PaloAlto and Sophos XG firewall devices, handled the following NAT fields from syslog to display the respective values in the RAW Search report: NAT Source IP, NAT Destination IP, NAT Source Port, NAT Destination Port.
3. Introduced [OpenAI](https://www.manageengine.com/products/firewall/help/integrate-openai-with-fwa.html?fwa_readme) as a third-party GenAI integration, allowing users to connect via an API key and leverage AI-powered summarization features.
4. Introduced [Ollama](https://www.manageengine.com/products/firewall/help/integrate-ollama-with-fwa.html?fwa_readme) as a third-party GenAI integration, allowing users to connect locally hosted LLMs using a Base URL and leverage AI-powered summarization features.
5. Introduced [DeepSeek](https://www.manageengine.com/products/firewall/help/integrate-deepseek-with-fwa.html?fwa_readme) as a third-party GenAI integration, allowing users to connect via an API key and leverage AI-powered summarization features.
6. Added support for selecting a default GenAI provider while adding or editing an integration, with priority based fallback to OpenAI, DeepSeek, and Ollama when the configured default provider is reset or removed.
7. Firewall Analyzer now introduces the AI-guided [Zia chatbot](https://www.manageengine.com/products/firewall/help/integrate-ziachatbot-with-fwa.html?fwa_readme) within the product UI to enhance user assistance and support. Users can interact with the chatbot to quickly access feature guidance, understand policy-related configurations, and obtain relevant troubleshooting support directly from the interface, helping simplify administration and improve productivity.
8. Added support for forwarding alarms to Log360 On-Premises using Notification Templates.

**Issues Fixed:**
1. Support ID: 12906520 - There was an issue where Username—IP Mapping was not working for Cisco firewall devices. This issue has now been fixed.
2. Support ID: 12778312, 12755846 - In some environments, Sophos XG sends syslogs from multiple IPs (ISP), which caused multiple devices to be added for a single firewall. Added a custom option to map Device ID vs Firewall IP in Firewall Analyzer to prevent duplicate device addition.
3. Support ID: 12908952 - Fixed syslog parsing issue for VPN disconnection syslogs in Sophos XG firewall devices.
4. Support ID: 13065822, 13116373 - Fixed the issue where CountryCode table population in MSSQL failed during BCP operation, resulting in "Unknown" values for Source Country and Destination Country in reports.
5. Support ID: 11646671 - There was an issue where Associated Rules were not displayed properly for Object Groups in the Juniper SRX Duplicate Objects Report. This issue has now been fixed.
6. Support ID: 11474096 - Fixed FortiGate Device Rule parsing issues.
7. Support ID: 12307333 - Improved REST API-based configuration fetching by gracefully handling API error responses, including "not configured" responses.

### Build No 12.9.100 - June 04, 2026
**New Features & Enhancements:**
1. SupportID: 12292991 - Introduced Security Rating, Baseline Rating, and Regulatory Rating scores in the [Executive Summary Report and Policy Overview](https://www.manageengine.com/products/firewall/help/device-score.html?fwa_readme) pages to provide enhanced visibility into firewall policy health, baseline adherence, and regulatory compliance.
2. SupportID: 12729995, 13218270 - Added support for capturing URL Categories and Profiles configured in PaloAlto Security Rules in the Policy Overview and Policy Anomaly reports.

**Issues Fixed:**
1. SupportID: 12521452 - Incorrect logging status was displayed for parent rules of inline layers in Check Point, where parent rules were shown as logging disabled by default.
2. SupportID: 12816704 - Frequent socket timeout exceptions occurred in Device Rule API mode, causing connection timeout issues during device rule retrieval.
3. SupportID: 12983378 - A parsing issue related to NAT IP Pool data was identified in Juniper SRX devices. This issue has been fixed.
4. SupportID: 13033390 - A PaloAlto configuration parsing issue caused partial parsing and skipped valid rule sections such as pre/post rules during conditional XPath evaluation. This issue has been fixed.

### Build No 12.8.732 - May 8, 2026
**New Features & Enhancements:**
1. Support IDs: 12441121, 12151443, 10077088 - Introduced a [Custom Risk Profile](https://www.manageengine.com/products/firewall/help/custom-risk-profile.html?fwa_readme) feature under Risk Reporting. This allows users to define risk evaluation criteria based on their organization’s policies. Users can also associate either Standard or Custom Risk Profiles with devices for more flexible and accurate risk assessment.
2. The Firewall Analyzer Enterprise Edition now consistently uses the terms “Central” and “Probe” server across the UI and documentation, replacing the earlier “Admin” and “Collector” terminology.

**Issues Fixed:**
1. Support ID: 12708266 - Fixed an issue in SNMP settings where applying credentials to multiple firewalls from the same vendor caused all selected devices to inherit the IP address of the first firewall.
2. Support ID: 10726120 - Devices in the Inventory tab are now sorted by license status by default.

### Build No 12.8.718 - April 09, 2026
**New Features & Enhancements:**
1. SupportID 12292991 — Introduced [Advanced Filter](https://www.manageengine.com/products/firewall/help/advanced-filter.html?fwa_readme) functionality for Security Rules, with Save Filter support, enabling multi-condition searches across firewall rule attributes.
2. SupportID 12610494 — Added new VPN-related sections to the Security Audit report, alongside the Configuration and Security sections.

**Issues Fixed:**
1. SupportID: 12593971 — FortiGate configuration parsing issue related to rules with multi-line comments. This issue has now been fixed.
2. SupportID: 12560722 — Check Point configuration parsing issue while processing “Any” TCP/UDP services. This issue has now been resolved.
3. SupportID: 12478021 — Unused Rules report for Check Point devices did not display rule number or UID based on system property configuration. This issue has now been fixed.
4. SupportID: 12661875 — Firepower configuration parsing issues caused failures in the Policy Anomaly report. This issue has now been resolved.
5. SupportID: 12520165 — Security Audit report generation failed in non-English environments. This issue has now been fixed.
6. SupportID: 12722175 — fwacustomcreatedobjects usage handling was incorrectly applied for Cisco and Firepower devices. This issue has now been fixed.
7. SupportID: 12661875 — Policy Anomaly detection did not consider “Any” interfaces, rule cross-comparisons, and multi-interface rules. This issue has now been resolved.
8. SupportID: 12624159 — FQDN objects in source/destination fields of FortiGate security rules were not considered in reports. This issue has now been fixed.
9. SupportID: 12722430 — “Out Of Memory” issue occurred while deleting the ConfigVersions table. This issue has now been resolved.
10. SupportID: 11643323 — Security/IPS profiles configured in rules were not considered for Policy Anomaly detection. This issue has now been fixed.
11. SupportID: 12753839 — Risk Report was not generated in FOS-configured setups. This issue has now been resolved.
12. SupportID: 12753839 — Policy Overview page experienced slowness while loading the device-rule dropdown list. This issue has now been fixed.
13. SupportID: 12753839 — Custom Reports page was unresponsive in certain MSSQL setups. This issue has now been resolved.
14. SupportID: 12753839 — Duplicate rules were added in Scheduled Rule attachments for device groups. This issue has now been fixed.

### Build No 12.8.711 - September 01, 2026
**Security Fixes:**
1. Previously, a broken access control vulnerability allowed a scoped user to disable monitoring for unassigned firewalls. This issue has now been fixed. (Reported by sealldev)
2. Previously, a broken access control vulnerability allowed a scoped user to modify the scheduled Change Management report configuration for unassigned firewalls. This issue has now been fixed. (Reported by sealldev)
3. Previously, a broken access control vulnerability allowed a scoped user to configure alert notifications for unassigned firewalls. This issue has now been fixed. (Reported by sealldev)
4. Previously, a SQL injection vulnerability allowed registered Probes to execute unauthorized queries on the Central server. This issue has now been fixed. (Reported by zeocrynt)
5. In Enterprise Edition, previously, a privilege escalation vulnerability allowed an Operator to gain Administrator privileges through Report Profile import. This issue has now been fixed. (Reported by zeocrynt)

### Build No 12.8.710 - August 14, 2026
**Security Fixes:**
1. Previously, an XML injection vulnerability was identified in Rule Management > Compare Policies. This issue has now been fixed. (Reported by qquynh)
2. Previously, a remote code execution vulnerability was identified in Diagnose Settings. To address this, the Diagnose Settings feature has been removed. (Reported by qquynh)
3. Previously, a data exposure vulnerability was identified due to firewall IP address updates based on the syslog receiving host. This issue has now been fixed. (Reported by qquynh)

### Build No 12.8.709 - July 21, 2026
**Security Fixes:**
1. Previously, firewall names detected from syslog could cause a stored XSS vulnerability. This issue has now been fixed. (Reported by NGOC HIEU. Refer ZVE-2026-4258).
2. Previously, an SQL injection vulnerability was identified in Rule Management Search Reports. This issue has now been fixed. (Reported by NGOC HIEU. Refer CVE-2026-14913).
3. Previously, sensitive information was exposed on the Inventory interface list page. This issue has now been fixed. (Reported by ch4r0n. Refer ZVE-2026-4285).

**Issues Fixed:**
1. User addition on the Central Server was failing from version 12.8.662 onwards. This issue has now been fixed.

### Build No 12.8.707 - April 03, 2026
**New Features & Enhancements:**
1. General: Support for [ManageEngine Log360](https://www.manageengine.com/products/firewall/help/integrate-log360.html?fwa_readme) integration has been introduced for Firewall Analyzer. Users can now forward application audit and access logs to Log360.

### Build No 12.8.704 - March 20, 2026
**New Features & Enhancements:**
1. Support ID: 12909872 — Added support for Peplink SDX Pro devices for syslog reporting.
2. Support ID: 12319598 — Introduced support for a new syslog format for Checkpoint Embedded GAIA OS (SMB 2580 R82-based appliances).
3. Support ID: 12431557 — Enhanced Cloud Service drilldown reports by adding Source IP and Destination IP columns.
4. Rule Risk Report support has been added for Netfilter firewalls.

**Issues Fixed:**
1. Support ID: 12635401, 12528299 — Parsing issues in VPN syslogs for Check Point firewalls have been fixed.
2. Support ID: 12573493 — Report widget names were not displayed in translated languages when navigating via Aggregated Search → Saved Report → View Report. This issue has been resolved.
3. Support ID: 12733626 — Importing Protocol List XML under System → Protocol Group failed due to XML file size restrictions. This issue has been fixed.
4. Support ID: 12647135 — Exporting all rows failed when data was spread across multiple tables for a selected time period. This issue has been resolved.
5. Support ID: 12359105 — An issue with interface discovery using SNMP credentials for SonicWall firewalls has been fixed.
6. Support ID: 12237489 — Real-time change management reports/notifications failed due to "Cluster name" being logged instead of "Gateway name". This issue has been resolved.
7. Support ID: 12188254 — Parsing issues in VPN syslogs for SonicWall firewalls have been fixed.
8. Support ID: 12573493 — Empty reports were generated when navigating via Aggregated/RAW Search → Saved Report → View Report due to XML restrictions when report names contained Japanese characters. This issue has been resolved.
9. Support ID: 12761221 — Fixed a FortiGate configuration parsing issue related to rules with multi-line comments.
10. Support ID: 12722175 — Firepower firewall inbound and outbound rules were not displayed correctly. This issue has been fixed.
11. Support ID: 12594720 — Incorrect data in the unused rules report for Palo Alto firewalls has been fixed.
12. Support ID: 12594720 — Schedule data is now correctly displayed with Start and End Time instead of "Days of the Week".
13. Support ID: 12568243 — New fields such as IPS-enabled data and schedule expiration data are now correctly parsed for FortiGate and SRX firewall rule data.
14. SonicWall administration session-ended logs are now properly tracked in syslog reporting for change management user verification.
15. An exception occurring during standards report generation in MSSQL setups has been resolved.

### Build No 12.8.691 - February 27, 2026
**New Features & Enhancements:**
1. Introduced the [High Availability (HA) monitoring](https://www.manageengine.com/products/firewall/help/high-availability-monitoring.html?fwa_readme) option under Settings → Discovery. This enhancement allows customers to configure HA settings and map HA pairs as a single logical device for simplified management and reporting.
2. Support ID: 12432939 — Added support for SSH key-based authentication in device rule configuration for CLI mode.
3. Support ID: 12113918 — Enabled mapping of Cisco FMC with FTD devices to generate Change Management and Rule Change History reports based on the "Deploy Policy" logs received from FMC devices.

**Issues Fixed:**
1. Support ID: 11618075 — Fixed an issue where the Deny URL Report was not populated for proxy devices due to a syslog parsing problem.
2. Support ID: 11403917 — Fixed an issue where the login failure reason present in "Failed VPN event" syslogs from Palo Alto Firewalls was not parsed. The value is now parsed and displayed in the Description field.
3. Support ID: 11406009 — Fixed an issue where VPN reports displayed negative values in the Session Duration column.

### Build No 12.8.670 - July 06, 2026
**Issues Fixed:**
1. Previously, firewall names detected from syslog could cause a stored XSS vulnerability. This issue has now been fixed. (Reported by NGOC HIEU. Refer ZVE-2026-4258).
2. Previously, an SQL injection vulnerability was identified in Rule Management Search Reports. This issue has now been fixed. (Reported by NGOC HIEU. Refer ZVE-2026-4253).

### Build No 12.8.669 - June 22, 2026
**Security Fixes:**
1. General: Previously, Operator users were able to delete shared dashboards due to an access control validation issue. This issue has now been fixed. (Reported by Sus.)
2. General: Previously, an unauthenticated TCP relay vulnerability was identified in SparkGateway (ZVE-2026-3290, Reported by Sus). This issue has now been rectified.
3. OpManager: Previously, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified in certain Load Balancer APIs. This issue has now been fixed. (ZVE-2026-3318, Reported by Sus.)
4. OpManager: Previously, an authenticated stored SQL injection vulnerability was identified in the Custom View feature. This issue has now been fixed. (Reported by Sus.)

**Issues Fixed:**
1. General: Previously, from build 12.8.524 onward, users were redirected to a blank page after session timeout due to an internal error. This issue has now been fixed.
2. General: Due to security reasons, certain special characters have been restricted in dashboard names during dashboard creation and update.
3. General: Support IDs: 12513701, 11569302, 12269459 — Introduced a superuser privilege pre-check for remote PostgreSQL in PPM for builds below 12.8.511.

### Build No 12.8.668 - June 13, 2026
**Security Fixes:**
1. Previously, there was a Server-Side Template Injection (SSTI) vulnerability in Configlet processing that could potentially lead to remote code execution (RCE). This issue has now been fixed.

### Build No 12.8.665 - January 09, 2026
**New Features & Enhancements:**
1. Firewall Analyzer has been optimized to fetch configurations from multiple devices in parallel via API or CLI and to improve the performance of "Risk Report" generation from the Web UI.
2. SupportID: 11339464 – Firewall Analyzer now supports extended-style configuration files for MGuard firewalls in both the Rule Management and Compliance Reports, in addition to plain-style configuration files.
3. Push notifications have been enabled in the mobile application for Firewall Analyzer.
4. The mobile application now includes options for Business Hours filtering and Exclude Weekends for configuration.
5. SupportID: 11226174 – Rule-Expiry scheduled reports now support Excel and CSV export formats in addition to PDF.
6. SupportID: 11226174 – A new option to view rules expiring within ‘N’ days has been added to the Rule-Expiry reports section.
7. SupportID: 11226174 – Complete details of expired rule configurations are now included in the email notification content.
8. SupportID: 11519591 – Policy fine-tuning reports can now be generated for multiple rules simultaneously, with on-demand export options available in CSV, XLS, and PDF formats.

**Issues Fixed:**
1. SupportID: 11412252 – Change management notifications were not sent for API-based VDOM devices. This issue has now been fixed.
2. SupportID: 11471109 – The Rule Reorder report displayed the “To” position as zero for Check Point firewalls. This issue has now been fixed.
3. SupportID: 11416892 – The Cisco ASA Unused ACE report displayed incorrect data. This issue has now been fixed.
4. SupportID: 11355127 – Palo Alto default deny rules were not handled in device rule parsing. This issue has now been fixed.
5. SupportID: 12128235 – The Rule Administration access provision option for the Administrator role was not visible on the scope page. This issue has now been fixed.
6. SupportID: 11594202 – The Security Audit report downloaded from the Device Rule page appeared empty when the device was added manually and the device rule was created via file. This issue has now been fixed.
7. SupportID: 11249670 – The Deny Report and Attack Reports were not populated for F5 firewall devices due to a syslog parsing error. This issue has now been fixed.
8. SupportID: 12104317 – Saved reports for RAW Search and Aggregated Search could not be viewed. This issue has now been fixed.
9. SupportID: 12146753 – Resolved an issue where configuration backup scheduling caused out-of-memory (OOM) errors and product restarts when handling large configuration files.
10. SupportID: 12220467 – Rule expiry notifications failed to function correctly after modifying the end date in the schedule object. This issue has been fixed now.
11. SupportID: 12308018 – Addressed FWA login issues that occurred due to idle database connections left open by the rule expiry report.
12. SupportID: 6989163 – The Rule Suggestion Report now displays “No Data” when there are no rules available to show.

### Build No 12.8.639 - July 07, 2026
**Security Fixes:**
1. Previously, firewall names detected from syslog could cause a stored XSS vulnerability. This issue has now been fixed. (Reported by NGOC HIEU. Refer ZVE-2026-4258)
2. Previously, an SQL injection vulnerability was identified in Rule Management Search Reports. This issue has now been fixed. (Reported by NGOC HIEU. Refer ZVE-2026-4253)
3. Previously, sensitive information was exposed on the Inventory interface list page. This issue has now been fixed. (Reported by ch4r0n. Refer ZVE-2026-4285)

### Build No 12.8.638 - June 10, 2026
**Issues Fixed:**
1. Support ID: 12104317 — An empty report was displayed when accessing Aggregated/RAW Search → Saved Report → View Report if the report name contained Japanese character and dot[.] symbol, due to an XML security restriction. This issue has now been resolved.
2. Support ID: 12573456 — A “Deselect All” option has been added under Search → RAW Search → Save Action, allowing users to generate reports using only the selected columns.
3. Support ID: 12581026 — The grid search option on the RAW Search → Search Result page, which was previously removed due to internal changes, has now been restored.

### Build No 12.8.631 - November 10, 2025
**Issues Fixed:**
1. SupportID: 12128235 – Rule Administration access provision option for Administrator role is not shown in the scope page. This issue has been resolved now.

### Build No 12.8.626 - September 24, 2025
**New Features & Enhancements:**
1. SupportID: 11160679 – Syslog-based traffic reports are now supported for H3C Firewalls.
2. SupportID: 11126963 – Syslog-dependent Rule Management Reports (Rule Fine-Tune, Rule Suggestion, Objects Usage, and Unused Objects) have been optimized for better performance and scalability, especially during high-flow cases over long periods.
3. The ‘NAT Rules’ report has been extended to support the following devices: Huawei, Juniper SRX, MikroTik, Vyatta, Hillstone Firewall, Forcepoint, Cisco Meraki, WatchGuard, Sophos XG, and Sophos UTM.

**Issues Fixed:**
1. SupportID: 11183654 – Live Traffic reports were not populated properly for Check Point firewalls when SNMP settings were configured. This issue has been resolved now.
2. SupportID: 11519591 – NAT rule population did not work for Check Point firewalls when the skipCPPackageTargets property was enabled. This issue has been fixed now.
3. SupportID: 11519591 – Drill-down functionality for user-access objects on Check Point devices was not working. This issue has been fixed now.
4. SupportID: 11645757 – A syslog parsing issue related to Protocol occurred for Cisco Firepower firewalls. This issue has been resolved now.
5. SupportID: 11406009 – Negative duration values were shown in VPN Reports. This issue has been fixed now.
6. Support ID: 11339464 – The Rule information from MGuard firewalls is now parsed and displayed in the Top Used Rules section.

### Build No 12.8.611 - August 25, 2025
**New Features & Enhancements:**
1. Support ID: 11236550 – Security Audit Reports can now be customized based on customer requirements.
2. Support ID: 11412252 – Added support for displaying the Application column in Security Audit Reports for Fortigate, Palo Alto, Firepower, and Barracuda firewalls.
3. Introduced a new VPN tab along with VPN Overview reports that include high-level VPN widgets.

**Issues Fixed:**
1. Support ID: 11289046 – Resolved a syslog parsing issue in Mikrotik firewalls.
2. Support ID: 11335639 – Alarm profiles now support the Log ID field in FortiGate firewall logs.
3. Support ID: 11410910 – Fixed issues in RAW Search reports where incorrect columns were displayed under Custom Report, and the Edit option was not working properly.
4. Support ID: 11412252 – Fixed multiple Fortigate VDOM-related issues:
   - Notification option missing in the Change Management page.
   - Devices not listed in the Security Audit Schedule page.
   - API-based rule action failures during scheduled configuration fetch.
5. Support ID: 10109602 – Cisco ASA: Fixed an issue with unused rule population during rule fetch.
6. Support ID: 11126963 – Check Point: Resolved missing service object port values and addressed missing associated rule values for VPN objects.
7. Support ID: 11086396 – Resolved device rule parsing issues in Fortigate Firewalls.
8. Support ID: 10914891 – Palo Alto: Improved VSYS configuration fetch logic to fix incomplete rule listings.
9. The offset option was not working in MSSQL-based setups in Policy Overview Page. This issue has been fixed now.
10. Support ID: 10720632 – Bandwidth Alert notification was not received despite notifications being enabled, and the alert did not appear in the Alarms tab. This issue has been resolved.

### Build No 12.8.609 - August 12, 2025
**New Features & Enhancements:**
1. General: The Ember.js version has been upgraded to 5.12 for the Support and View Logs pages.

### Build No 12.8.596 - July 24, 2025
**New Features & Enhancements:**
1. SupportID: 10955305 – Introduced Rule Management and Compliance support via CLI for ZyXEL firewalls.
2. Introduced a ‘Timeout’ option for API-based configuration fetching across all devices in the Device-Rule settings.

**Issues Fixed:**
1. SupportID: 11035916 – There was an issue where rules allowing a specific IP and service, alongside an "Any-Any" deny (similar to an explicit deny rule), were incorrectly flagged as a Correlation anomaly. This has now been resolved.
2. SupportID: 10913604 – The issue with discrepancies in the "Network Services" section of the Security Audit Report for Palo Alto devices has now been fixed.
3. SupportID: 10913604 – Rectified incorrect logging status display in the Policy Overview page for Palo Alto devices, especially in Panorama-managed environments.
4. SupportID: 10872413 – There was an issue with Anomaly Report generation failures caused by multiple rules being grouped under the same Grouping Anomaly. This has now been resolved.
5. SupportID: 10945603 – Policy Optimization report exports now include object details for Source, Destination, and Service entries.
6. SupportID: 11126963 – Resolved a missing configuration parsing scenario that led to inaccuracies in the Rule Reorder report for Check Point devices.
7. SupportID: 10522039 – Fixed a parsing issue affecting Policy Overview report generation for Barracuda devices due to NAT Rules.
8. SupportID: 10522039 – Enabled Unused Rules report support for Barracuda devices.
9. SupportID: 11023106 – Resolved a parsing issue that caused inaccuracies in the Rule Reorder report for Palo Alto devices.
10. SupportID: 11196118 – Extended Unused Rules report support for Mikrotik devices.

### Build No 12.8.594 - July 14, 2025
**Issues Fixed:**
1. General: Previously, upgrade failures occurred in the DB-migrated environment due to a database-related file of the Firewall Analyzer module. This issue has now been resolved.

### Build No 12.8.590 - March 13, 2026
**Issues Fixed:**
1. Support ID: 12104317 — An empty report was displayed when accessing Aggregated/RAW Search → Saved Report → View Report if the report name contained Japanese character and dot[.] symbol, due to an XML security restriction. This issue has now been resolved.
2. Support ID: 12573456 — A “Deselect All” option has been added under Search → RAW Search → Save Action, allowing users to generate reports using only the selected columns.
3. Support ID: 12581026 — The grid search option on the RAW Search → Search Result page, which was previously removed due to internal changes, has now been restored.

### Build No 12.8.584 - July 21, 2025
**Issues Fixed:**
1. General: Previously, upgrade failures occurred in the DB-migrated environment due to a database-related file of the Firewall Analyzer module. This issue has now been resolved.

### Build No 12.8.582 - June 30, 2025
**New Features and Enhancements:**
1. SupportID: 11126963 - NAT Rules support is now available for CheckPoint firewalls under Rule Management "Overview" reports.
2. Firewall Analyzer now integrates with Splunk using the UDP protocol, allowing audit and access logs to be forwarded.
3. Firewall Analyzer now integrates with any SIEM tool using the UDP protocol, allowing audit and access logs to be forwarded.
4. Firewall Analyzer integrates with PagerDuty to streamline alert management by automatically creating PagerDuty alerts/events from network alerts.

**Issues Fixed:**
1. SupportID: 11157413 - A parsing issue occurred in Check Point device rules. This issue has been resolved.
2. SupportID: 11126963 - A parsing issue occurred in Check Point device rules that affects Rule Suggestion and Policy Fine tuning reports. This issue has been resolved.

### Build No 12.8.568 - May 30, 2025
**New Features and Enhancements:**
1. Support ID: 10497337 – Added support for bulk Device-Rule configuration using the Credential Profile option.
2. Support ID: 11019707 – Introduced virtual device addition option in the Manual Device Add feature.
3. Support ID: 10407268 – New device support: mGuard Firewall version 8.2.2.
4. Support ID: 10955008 – New device support: A10 Proxy – Device Model: TH1040S, OS/Version: 5.2.1-P6, Build 74.
5. Support ID: 10796795 – Introduced policy-based rule group support for Sophos XG firewalls.
6. Support ID: 10340135 – Credential Profile-based device rule addition now supported in API mode.
7. Support ID: 11126963 – Added support for nested group details on the Object Overview page.
8. Support ID: 11126963 – Added inline rule number support for Check Point firewalls.
9. Support ID: 11126963 – Rule names replaced with rule numbers for Check Point firewalls using custom parameter-based handling.
10. Support ID: 11126963 – Upcoming scheduled changes are now displayed on the Device Rule List page.
11. Support ID: 11126963 – Added support for all object types in Check Point firewalls on the Object Overview page.
12. Support ID: 11126963 – Added VPN column support to the Policy Overview page for Check Point firewalls.
13. Support ID: 11019707, 11012115 – Changes made to skip pager command execution based on custom options.
14. Support ID: 10845235 – Security Audit Report can now be generated in a custom language.
15. Support ID: 10955305 – L2TP VPN Report now supported for Zyxel (ZyWALL) firewall.
16. Support ID: 10955305 – URL Report now supported for Zyxel (ZyWALL) firewall.
17. Support ID: 10906449 – Support added for a new type of SSLVPN syslog for Huawei firewalls.
18. Availability Alert Edit Option – Edit option added for Availability Alert in both Firewall Analyzer Standalone and Enterprise Probe installations.
19. Collector Availability Alert Edit Option – Edit option added for Collector Availability Alert in Firewall Analyzer Enterprise Central installations.

**Issues Fixed:**
1. Support ID: 10723523 – Device rule actions were failing due to trailing spaces in Cisco Meraki network names. This issue has been fixed.
2. Support ID: 10978763 – A parsing issue occurred in SonicWall device rules. This issue has been resolved.
3. Support ID: 10109602 – CLI-based device rule failures were observed for F5 devices. This issue has been fixed.
4. Support ID: 10885982 – Manual rule comparison report generation was failing. This issue has been resolved.
5. Support ID: 10819761 – Credential validation failures were occurring on the Rule Administration page. This issue has been resolved.
6. Support ID: 10906449 – Parsing issues were encountered in Huawei device rules. This issue has been resolved.
7. Support ID: 10998446 – Check Point device rule REST API access was failing when the rule count exceeded 500 in access layers. This issue has been fixed.
8. Support ID: 10913604 – Duplicate rule names with case-sensitive variations were resulting in extra rules being listed on the Policy Overview page. This issue has been fixed.
9. Support ID: 11126963 – An object count mismatch was observed in Check Point devices. This issue has been fixed.
10. Support ID: 10913604 – Discrepancies were observed in Used Services and Unused Interfaces data in the Security Audit Report for FortiGate devices. This issue has been resolved.
11. Support ID: 10979422 – Rule fetching based on the config file was not working for Cisco VDOM cases. This issue has been resolved.
12. Support ID: 10990804 – FortiGate config parsing was failing when rule comments spanned multiple lines. This issue has been fixed.
13. Support ID: 10522039 – Minor parsing issues were found in Barracuda configs. These issues have been resolved.
14. Support ID: 10747482 – Missing interfaces for FortiGate VDOMs were not showing on the Rule Administration page. This issue has been fixed.
15. Support ID: 10814806 – Data issues were affecting Checkpoint Policy Optimization report generation. This issue has been resolved.
16. Support ID: 10661869 – The database query used to fetch bidirectional rules in MSSQL was malfunctioning. This issue has been resolved.
17. Support ID: 10358852, 10121664 – Cisco config fetch was failing during scheduled runs. This issue has been fixed.
18. Support ID: 10341458 – Huawei config parsing failed when processing interface details. This issue has been fixed.
19. Support ID: 10642955 – Rule descriptions were not displayed correctly in the Unused Rules Report for Palo Alto devices. This issue has been resolved.
20. Support ID: 10340135 – On-demand Security Audit Report generation for Cisco Routers was failing. This issue has been resolved.
21. Support ID: 10908128, 10973259 – Cisco Firepower firewalls were sending two different syslog formats, causing processing delays. This issue has been resolved.
22. Support ID: 10911895 – Logout syslog ID "199017" for Cisco Firewall was not handled. This issue has been resolved.
23. Support ID: 10982072 – A syslog parsing issue occurred in Checkpoint Firewall. This issue has been resolved.
24. Support ID: 6079521 – The on-demand Config Analysis Report option was incorrectly present on the Device Rule List page. It has now been removed, as it is included in the Security Audit Report. This issue has been resolved.