User created Security Incidents auto clear after 24 hours.

phPerfMonitor module crashes when both STM and perf monitoring are defined.

FortiGuard IOC download may fail because of inability to update malware update history.

Incident Resolution Recommendation Engine is learning from its own actions, instead of only learning from user actions.

During Upgrade and Content Update, GUI shows many Collector status as 'inwaiting'.

Discovering a Windows machine both via FortiSIEM Agent and Fortinet EMS/FGT integration results in duplicate CMDB entries.

Content update fails if there are dashboard widgets in the content update package.

phMonitor may time out if DR configuration takes more than 1 hour.

GitLab discovery failure: Need to use host name as IP does not work during SSL handshake.

Agent Manager has high memory usage when reading large files for Generic AWS S3 integration.

NullPointerException in the POST SAML response after modifying the idle timeout for Azure user.

Name field from External Authentication shouldn't allow 'space' when the protocol is SAML.

SAML Organization field for SAML Role configuration doesn't accept space and umlaut characters.

Linux Agent is auditing its own processes and system calls - this may result in a very high number of useless events.

Collector may stop writing event to buffer after 2 hours if Collectors are unable to offload.

Incorrect /etc/hosts configuration during Worker addition may result in larger than normal DNS traffic.

The factoryreset procedure on hardware appliances may cause all directories under /opt installed from the FSM rpm to be owned by root.

Handle AlienVault new native STIX/TAXII 2.1 API.

Use ZSTD for ClickHouse compression.