What's new

Product version

1.7

Release date

08/31/2026

Overview

The TRON.ASOC v1.7 release expands the platform's integration capabilities with CI/CD and external processes. It adds a human-readable API for managing the Project → Layer → Check hierarchy and a custom parser builder for connecting scanning tools that the system doesn't support. The release also adds file lifecycle management in S3 object storage and expands the API for policies, webhooks, dashboards, and administrative settings.

Summary

• Manage file storage in S3
• Report parser builder
• Trigger scans through webhooks from version control systems (VCS)
• Human-readable API
• CVSS and Exploitability metrics in quality gates
• JSON parser for Aqua
• Expanded Jira field mapping

What's new

New capability	Description
Manage file storage in S3	Added automatic file deletion based on time to live (TTL) and manual deletion. What changed for users: You can set a retention period (TTL) for generated reports and scan results in object storage by using a variable in the docker-compose.yml file. After the specified period expires, the files are deleted automatically. Manual file deletion when you delete the related check, layer, or project still works.
Report parser builder	Added support for system parsers for reports from security tools supported by TRON.ASOC. You can also create custom report parsers with the JSONata query and data transformation language. What changed for users: You can now use system parsers to process reports from supported security tools or create a custom parser to process reports from tools that the system doesn't support.
Trigger scans through webhooks from version control systems (VCS)	You can now automatically trigger security checks for push and merge/pull request events from GitLab, GitHub, Bitbucket, and Gitea. What changed for users: You can configure checks to run automatically for push and merge/pull request events without starting scans manually or on a schedule.
Human-readable API	The API now includes human-readable URLs that let you address layers and checks by project and layer names, for example, /project/{project}/layers/{layer_name}/checks/{check_name}. What changed for users: You can now address layers and security checks in the API by name instead of only by numeric ID. This simplifies CI/CD integration and automation scripts.
CVSS and Exploitability metrics in quality gates	Added CVSS (range) and Exploitability (equal/not equal) metrics for precise quality gate configuration. What changed for users: When you configure a quality gate, you can now define conditions based on the CVSS score (value range) and the Exploitability attribute (whether the issue is exploitable).
JSON parser for Aqua	Added support for the JSON format in Aqua reports. What changed for users: Aqua reports now upload in JSON format. Support for the legacy HTML format has ended.
Expanded Jira field mapping	Added the Layer type, Layer, Assignee, and Last detection date fields to the Jira integration. What changed for users: When you create Jira issues, TRON.ASOC now includes additional security issue details, such as Layer type, Layer, Assignee, and Last detection date. This provides more context directly in the issue without requiring you to open TRON.ASOC.

Improvements

• The internal file storage architecture now uses the SeaweedFS S3-compatible storage instead of MinIO
• Redesigned the scanning source management interface. The update improves the table, filters, integration creation form, and source display.
• Simplified custom scanning source creation. Removed the CLI tool custom source type, added the ability to create a custom scanning source while creating a security check, and added the option to leave the source empty when needed.
• You can now set project and group Tags when you create or edit projects and groups. The Manage tags option no longer appears in the role settings interface.

REST API changes

New endpoints

• GET /admin-settings: Retrieves the platform's administrative settings
• PUT /admin-settings: Partially updates the platform's administrative settings
• GET /assistant/runtime: Retrieves the assistant's current state
• GET /assistant/session-token: Retrieves the current user's session token for working with the assistant
• GET /assistant/whoami: Retrieves the current user by the ASOC session ID (X-ASOC-Session header)
• DELETE /custom-policy: Deletes multiple custom policies
• GET /custom-policy/events: Retrieves the list of event codes available for custom policies
• GET /custom-policy/filters: Retrieves aggregated values for filters in the custom policy list
• PUT /custom-policy/orders: Changes the order of multiple custom policies in one request
• POST /custom-policy/validate: Validates the syntax of a custom policy and its event codes
• PUT /custom-policy/{id}: Updates an existing custom policy
• PATCH /custom-policy/{id}/enabled: Enables or disables a custom policy
• GET /dashboard-settings: Retrieves the list of dashboard settings, with pagination and filtering by project code
• GET /dashboard-settings/{project_code}: Retrieves dashboard settings by project code
• PUT /dashboard-settings/{project_code}: Saves dashboard settings for a project
• DELETE /dashboard-settings/{project_code}: Deletes dashboard settings
• POST /parser: Creates a parser
• GET /parser/{id}: Retrieves a parser by ID
• PUT /parser/{id}: Updates a parser
• POST /parser/{id}/test: Tests report parsing without saving the result
• GET /parsers: Retrieves the list of parsers, with pagination, name search, and system/user filtering
• DELETE /parsers: Deletes parsers
• GET /project/{project_code}/layers/{layer_name}: Retrieves a layer by project code and layer name
• POST /project/{project_code}/layers/{layer_name}: Creates or retrieves a layer by project code and layer name
• PUT /project/{project_code}/layers/{layer_name}: Updates a layer by project code and layer name
• GET /project/{project_code}/layers/{layer_name}/gates: Retrieves the layer's quality gates by project code and layer name
• POST /project/{project_code}/layers/{layer_name}/run: Runs a layer by project code and layer name
• GET /project/{project_code}/layers/{layer_name}/checks/{check_name}: Retrieves a security check by project code, layer name, and check name
• POST /project/{project_code}/layers/{layer_name}/checks/{check_name}: Creates or retrieves a security check by check name
• PUT /project/{project_code}/layers/{layer_name}/checks/{check_name}: Updates a security check by check name
• GET /project/{project_code}/layers/{layer_name}/checks/{check_name}/gates: Retrieves the security check's quality gates by check name
• POST /project/{project_code}/layers/{layer_name}/checks/{check_name}/run: Runs a security check by check name
• POST /project/{project_code}/layers/{layer_name}/checks/{check_name}/external: Imports scan results (JSON) into a security check by check name
• POST /project/{project_code}/layers/{layer_name}/checks/{check_name}/upload-result: Uploads a result file (multipart) to a security check by check name
• POST /project/{project_code}/layers/{layer_name}/check-groups/{group_name}/run: Runs a group of security checks by project code, layer name, and group name
• GET /project/{project_code}/webhook-triggers: Retrieves the list of project webhook triggers, with pagination
• POST /project/{project_code}/webhook-triggers: Creates a webhook trigger for a project
• GET /webhook-triggers/{id}: Retrieves a webhook trigger by ID
• PUT /webhook-triggers/{id}: Updates a webhook trigger
• DELETE /webhook-triggers/{id}: Deletes a webhook trigger
• POST /webhooks/vcs/{webhook_id}: Receives an incoming webhook from a source control system (VCS) and runs the security checks associated with the trigger
• GET /events-list: Retrieves the catalog of all system events
• GET /issues/trackers: Retrieves a unique list of issue trackers where issues have been created for the specified vulnerabilities
• POST /master-source/{id}/test: Tests master source authentication
• DELETE /sources-list-with-masters: Deletes sources and master sources from the combined list, with an option to delete child sources
• PUT /tracker/{id}/task/{task_key}: Forces an issue update in the issue tracker by its key
• GET /trackers/labels: Retrieves the list of issue tracker labels, with search, pagination, and sorting
• POST /user/{id}/permissions/projects: Retrieves a user's permissions for the projects available to them. This endpoint replaces the corresponding GET endpoint (see Removed endpoints).

Changed endpoints

Changed endpoint	Summary of changes
POST /check	Changed the result schema in the 200 response. The SecurityCheck parameter has been replaced with SecurityCheckWithResult, which contains the check result.
GET /custom-policy	- Added the filter[event_code] parameter, which filters by event code or the service value trigger type: cron, scheduled_once - Clarified the descriptions of filter[project_code], which now supports multiple comma-separated codes, and sort, which now includes new sorting fields
POST /custom-policy	This endpoint now only creates a new custom policy. Use the separate PUT /custom-policy/{id} endpoint to update an existing policy.
GET /custom-policy/presets/actions	Changed the result schema in the 200 response from array<CustomPolicyPreset> to array<CustomPolicyPresetGroup>, which returns grouped presets.
- GET /issues - GET /issues/count	Added the filter[layer_type_id] parameter to filter by Layer type IDs, separated by commas.
GET /issues/filter	Added the filter[layer_id] parameter to filter by layer IDs, with automatic expansion to nested layers, and the filter[layer_type_id] parameter.
- GET /security-rules - GET /security-rules/filter	Added the filter[layer_id] and filter[layer_type_id] parameters.
- GET /sources - GET /sources-list-with-masters - GET /sources/filter	Added the filter[include_auto_created] parameter to include automatically created service sources in the results.
GET /stats/tool-name-depreciated	Changed the result schema in the 200 response from ToolVulnerabilityStatResponse to ToolVulnerabilityDetailResponse, which returns more detailed statistics.
GET /stats/tool-name-list-deprecated	Standardized the error format in the 400/401/403/500 responses. The common HTTPError schema now replaces the legacy Error schema.
GET /trackers	- Added pagination: the limit parameter defaults to 50, and the page parameter defaults to 1 - The 200 response now returns a TrackerListResponse wrapper instead of a simple array<Tracker> - Clarified the descriptions of the order, search, and sort parameters

Removed endpoints

• POST /check-group
• GET /check-group/{group_id}
• PUT /checks-group/{group_id}
• GET /user/{id}/permissions/projects (replaced with POST /user/{id}/permissions/projects)

Upgrade instructions

• Online Documentation
• Install with Docker Compose
• Install with Helm Chart

Feedback and support

• Support email: support@tronasoc.ru
• Partner technical support policy for TRON.ASOC software users

Conclusion

The TRON.ASOC v1.7 release strengthens the system in several areas: a human-readable API for managing checks from external systems, flexible integration with unsupported scanning tools through the parser builder, and more reliable and predictable data storage. This update lays the foundation for expanding the platform's integration scenarios.