Cribl

No entries match these filters. Clear filters

1. changelog Nov 2, 2026 · issue 129

   Cribl adds Telemetry Decisions Bench public benchmark and cribl-decision-2 open-weight model family for IT and security telemetry decisions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   • Cribl adds Telemetry Decisions Bench, a public benchmark and leaderboard covering 4,806 production-like IT, security, and telemetry decision tasks across 10 task families, reporting accuracy, negative log-likelihood (NLL), expected calibration error (ECE), latency per decision, and cost for API models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Cribl adds cribl-decision-2, a family of open-weight decision models available for download from Hugging Face, with sizes at 0.8B (20 ms per decision) and 4B (78 ms per decision), trained specifically for telemetry classification and routing decisions.

   2 details in Everything

2. changelog Oct 29, 2026 · issue 125
   • New integration Microsoft 365 Copilot Interaction Export API integration
3. changelog Oct 22, 2026 · issue 116

   Cribl Search gains optional OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. v1.8 field mapping in the Lakehouse Engine via dataset rules, with modes to add or replace fields and support for custom Datatypes.

   • New compliance frameworkAdds OCSF v1.8 field mapping to Cribl Search's Lakehouse Engine, configurable via a dataset rule (GDI Step 3), so analysts can query security data using consistent OCSF field names instead of vendor-specific ones like src_ip, source_ip, or srcaddr.
   • Supports two mapping modes: add mapped OCSF fields alongside original source fields, or replace source fields with OCSF names — configurable per dataset rule.
   • Allows creation and cloning of custom Datatypes in Cribl Search to extend or override built-in OCSF Schema Mappings for any desired schema.

   3 details in Everything

4. changelog Oct 22, 2026 · issue 117

   Cribl Lake Azure Storage Locations gain Outpost support for in-network management calls and Private Endpoint support for private Search reads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Bind an Azure Storage Location to an Outpost Group so all Azure management calls run from inside your vNet — required for regulated environments where public control-plane access to storage is blocked.
   📍In Cribl.Cloud, go to Lake › Storage Locations › [your Azure Storage Location] › Edit. Under Outpost, select your deployed Outpost Group and supply the storage account's Azure Resource ID, then save. Cribl validates the path end-to-end and rolls back automatically on misconfiguration.
   Enable Private Endpoint support on an Azure Storage Location so Cribl Search query traffic never leaves the Microsoft backbone — satisfying 'no public internet on the read path' audit requirements.
   📍In Cribl.Cloud, go to Lake › Storage Locations › [your Azure Storage Location] › Edit. Under Private Endpoint, enable the option and save. Then, in the Azure portal, locate the pending private endpoint connection request on your storage account and approve it. No bytes flow until approval.
   • Adds Cribl Outpost support for Azure Storage Locations, routing all Azure management calls (container creation, lifecycle and retention policies, validation) through an Outpost you deploy inside your Azure vNet rather than from the Cribl control plane.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Azure Private Endpoint support for Cribl Search, enabling query traffic to your Azure Blob Storage to travel over the Microsoft backbone instead of the public internet, with a connection you approve and can revoke at any time.
   • Both Outpost and Private Endpoint capabilities are opt-in per storage location, with no migration required for existing Azure Storage Locations.
   • Adds Cribl Outpost support for Azure Storage Locations, routing all Azure management calls (container creation, lifecycle and retention policies, validation) through an Outpost you deploy inside your Azure vNet rather than from the Cribl control plane.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Azure Private Endpoint support for Cribl Search, enabling query traffic to your Azure Blob Storage to travel over the Microsoft backbone instead of the public internet, with a connection you approve and can revoke at any time.

   1 more in Everything

5. Introducing the Gigamon Network Observability App: Network-derived metadata built on Cribl’s AI Platform for Telemetry (2026-10-01) Oct 1, 2026 · release notes

   Cribl releases Gigamon Network Observability App for marketplace integration

   └──▷ HOW TO FIND IT
   Install a new integration from the Cribl Marketplace to immediately gain visibility into network metadata.
   📍In Cribl Stream, go to Marketplace and install Gigamon Network Observability App
6. changelog Sep 29, 2026 · issue 089

   Cribl launches StreamAI (AI gateway with model routing) and Cribl Detect (full SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. with 8,000+ detection rules) at CriblCon 26.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Get started with Cribl Detect on Cribl.Cloud to immediately access SIEM detection, posture management, and 8,000+ detection rules without migrating existing telemetry pipelines.
   📍In Cribl.Cloud, log in to your organization, navigate to the Cribl Detect tile, and select Get Started to activate detection on your existing telemetry streams.
   • Adds Cribl Detect, a complete SIEM built on the Cribl platform with detection, coverage and posture management, investigation, response, and threat intelligence — available now for Cribl.Cloud customers at up to 50% less cost than incumbent SIEMsSIEMsSecurity Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point., priced on infrastructure rather than per-GB ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds StreamAI, an enterprise AI gateway with a built-in model router that routes each prompt to the right model based on SecIT Bench benchmarks, with free inference for customers using automatic routing.
   • StreamAI enforces spending budgets and cutoffs, redacts sensitive data in both prompts and responses, and records every model call as audit-ready telemetry.
   • Cribl Detect includes Detection Posture Management, continuously showing coverage gaps, broken rules, and missing telemetry required to detect specific attacks.
   • Cribl Detect ships with a catalog of more than 8,000 detection rules covering a broad range of threats, with correlation across signals to surface multi-stage attacks.

   +5 more show less

   • Cribl Detect generates detection signals directly in the data pipeline, enabling real-time threat identification while telemetry is still in motion.
   • Adds an agentic development environment that lets teams build apps, workflows, and agents using natural language, running on the same agentic runtime that powers Cribl Detect with compute, scheduling, logging, and permissions included.
   • Opens the platform to agents via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. and SDKs, adding 70 new integrations this year.
   • Adds AI auto-parsing of telemetry so incoming data is structured and usable the moment it arrives.
   • Grows the Cribl App Framework to 150+ apps from Cribl, partners, and customers, available in the Cribl Marketplace.
   • Adds Cribl Detect, a complete SIEM built on the Cribl platform with detection, coverage and posture management, investigation, response, and threat intelligence — available now for Cribl.Cloud customers at up to 50% less cost than incumbent SIEMsSIEMsSecurity Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point., priced on infrastructure rather than per-GB ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds StreamAI, an enterprise AI gateway with a built-in model router that routes each prompt to the right model based on SecIT Bench benchmarks, with free inference for customers using automatic routing.
   • StreamAI enforces spending budgets and cutoffs, redacts sensitive data in both prompts and responses, and records every model call as audit-ready telemetry.
   • Cribl Detect includes Detection Posture Management, continuously showing coverage gaps, broken rules, and missing telemetry required to detect specific attacks.
   • Cribl Detect ships with a catalog of more than 8,000 detection rules covering a broad range of threats, with correlation across signals to surface multi-stage attacks.

   +4 more show less

   • Cribl Detect generates detection signals directly in the data pipeline, enabling real-time threat identification while telemetry is still in motion.
   • Adds an agentic development environment that lets teams build apps, workflows, and agents using natural language, running on the same agentic runtime that powers Cribl Detect with compute, scheduling, logging, and permissions included.
   • Opens the platform to agents via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. and SDKs, adding 70 new integrations this year.
   • Adds AI auto-parsing of telemetry so incoming data is structured and usable the moment it arrives.

   1 more in Everything

7. changelog Sep 29, 2026 · issue 014

   Cribl launches StreamAI (AI gateway with model routing) and Cribl Detect (full SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. with 8,000+ detection rules) at CriblCon 26.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Get started with Cribl Detect on Cribl.Cloud to immediately access SIEM detection, posture management, and 8,000+ detection rules without migrating existing telemetry pipelines.
   📍In Cribl.Cloud, log in to your organization, navigate to the Cribl Detect tile, and select Get Started to activate detection on your existing telemetry streams.
   • Adds Cribl Detect, a complete SIEM built on the Cribl platform with detection, coverage and posture management, investigation, response, and threat intelligence — available now for Cribl.Cloud customers at up to 50% less cost than incumbent SIEMsSIEMsSecurity Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point., priced on infrastructure rather than per-GB ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds StreamAI, an enterprise AI gateway with a built-in model router that routes each prompt to the right model based on SecIT Bench benchmarks, with free inference for customers using automatic routing.
   • StreamAI enforces spending budgets and cutoffs, redacts sensitive data in both prompts and responses, and records every model call as audit-ready telemetry.
   • Cribl Detect includes Detection Posture Management, continuously showing coverage gaps, broken rules, and missing telemetry required to detect specific attacks.
   • Cribl Detect ships with a catalog of more than 8,000 detection rules covering a broad range of threats, with correlation across signals to surface multi-stage attacks.

   +5 more show less

   • Cribl Detect generates detection signals directly in the data pipeline, enabling real-time threat identification while telemetry is still in motion.
   • Adds an agentic development environment that lets teams build apps, workflows, and agents using natural language, running on the same agentic runtime that powers Cribl Detect with compute, scheduling, logging, and permissions included.
   • Opens the platform to agents via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. and SDKs, adding 70 new integrations this year.
   • Adds AI auto-parsing of telemetry so incoming data is structured and usable the moment it arrives.
   • Grows the Cribl App Framework to 150+ apps from Cribl, partners, and customers, available in the Cribl Marketplace.
   • Adds Cribl Detect, a complete SIEM built on the Cribl platform with detection, coverage and posture management, investigation, response, and threat intelligence — available now for Cribl.Cloud customers at up to 50% less cost than incumbent SIEMsSIEMsSecurity Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point., priced on infrastructure rather than per-GB ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds StreamAI, an enterprise AI gateway with a built-in model router that routes each prompt to the right model based on SecIT Bench benchmarks, with free inference for customers using automatic routing.
   • StreamAI enforces spending budgets and cutoffs, redacts sensitive data in both prompts and responses, and records every model call as audit-ready telemetry.
   • Cribl Detect includes Detection Posture Management, continuously showing coverage gaps, broken rules, and missing telemetry required to detect specific attacks.
   • Cribl Detect ships with a catalog of more than 8,000 detection rules covering a broad range of threats, with correlation across signals to surface multi-stage attacks.

   +4 more show less

   • Cribl Detect generates detection signals directly in the data pipeline, enabling real-time threat identification while telemetry is still in motion.
   • Adds an agentic development environment that lets teams build apps, workflows, and agents using natural language, running on the same agentic runtime that powers Cribl Detect with compute, scheduling, logging, and permissions included.
   • Opens the platform to agents via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. and SDKs, adding 70 new integrations this year.
   • Adds AI auto-parsing of telemetry so incoming data is structured and usable the moment it arrives.

   1 more in Everything

8. A new way to SIEM, a smarter way to AI, one platform to power it all (2026-09-29) Sep 29, 2026 · release notes

   Cribl introduces StreamAI model router and Cribl Detect SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., plus 70 new integrations and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. agent support

   └──▷ HOW TO FIND IT
   Use StreamAI to automatically route AI inference to cost-effective models while enforcing budgets and redacting sensitive data.
   📍In the Cribl platform, enable StreamAI and configure automatic routing to benchmarked models; utilize built-in budget enforcement and data redaction settings.
   Deploy the new Cribl Detect SIEM to get complete detection capabilities without migrating existing telemetry infrastructure.
   📍Access Cribl Detect from the Cribl.Cloud console to enable AI SOC intelligence and detection posture management on your existing telemetry.
   • Introduces StreamAI, an enterprise AI gateway with a built-in model router that sends prompts to the right model based on job, context, and economics.
   • Introduces Cribl Detect, a new SIEM capability running on the Cribl platform that provides complete SIEM functionality at up to 50% less cost.
   • Introduces Cribl Detect features: AI SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. intelligence, detection posture management, and auto-parsing of telemetry.

   3 details in Everything

9. A new way to SIEM starts with a new foundation (2026-09-29) Sep 29, 2026 · release notes

   Cribl launches Detect, an integrated SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. with detection rules, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. coverage mapping, AI investigation, and response capabilities

   • Launches Cribl Detect as a new SIEM solution extending the Cribl AI Platform for Telemetry
   • Enables high-fidelity detections by generating signals directly in the data pipeline for real-time threat identification
   • Correlates individual detection signals into broader chains of activity to identify slow-burn or multi-stage attacks
   • Provides a catalog of over 8,000 detection rules covering broad threat use cases
   • Includes a Detection Lab interface for building, validating, and tuning rules via AI assistance

   +9 more show less

   • Maps coverage against MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. framework and visualizes rule health by tactic or threat group
   • Identifies configuration or schema drift that can silently break detections
   • Delivers prioritized recommendations to focus detection engineering on gaps based on the organization's threat model
   • Provides AI-guided investigation to explore related evidence without requiring deep query language expertise
   • Unifies results from multiple systems in a single view across events, fields, tables, timelines, and charts
   • Supports collaborative notebooks for shareable, auditable investigation workflows combining searches, findings, and notes
   • Performs AI-driven triage to separate genuine threats from noise and aggregates related signals into streamlined alerts
   • Integrates existing SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. investments into the response workflow with flexible notifications to Slack, PagerDuty, or other channels
   • Combines external threat intelligence on APT activity, vulnerabilities, and adversary behavior with internal context on users, endpoints, and assets

   14 details in Everything

10. docs update Sep 25, 2026 · issue 085

    Cribl Search adds metrics ingestion (Preview) via Prometheus Remote WritePrometheus Remote WriteA protocol for streaming time-series metrics from a Prometheus instance to a remote storage backend, letting cyber tools offload long-term metric retention and query load to a dedicated system. and OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor., plus Monitors and Metrics Explorer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Route all incoming Prometheus metrics into Cribl Search for storage and exploration — confirm arrival before building monitors.
    📍Steps: 1. In Cribl Search, add a Lakehouse Engine. 2. Add a Prometheus Remote Write Source and point your Prometheus client at it. 3. Under Metric Dataset Rules, verify the default catch-all rule targets your primary metrics Dataset. 4. Start sending metrics, then open Explore Metrics to confirm they arrive.
    Alert your team when a key metric crosses a threshold — without writing a query — using the new Monitors (Preview) feature.
    📍Steps: 1. In Cribl Search, navigate to Monitors (Preview). 2. Create a new Monitor, select the metric and Dataset. 3. Set a threshold condition (e.g. value exceeds limit or behaves anomalously). 4. Save — Cribl Search will alert when the condition is met.
    • Adds metrics ingestion (Preview) into Cribl Search lakehouse engines via Prometheus Remote Write and OpenTelemetry (OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools.) sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Metric Dataset Rules to route incoming metrics into a metrics Dataset, with a default catch-all rule targeting the primary metrics Dataset.
    • Adds Explore Metrics (Preview) — a query-free interface to filter and visualize metrics stored in the lakehouse.
    • Adds Monitors (Preview) — alerting on metrics when a value crosses a threshold or behaves anomalously.

    4 details in Everything

11. Cribl Stream and Databricks: A faster path to analytics-ready telemetry (2026-09-24) Sep 24, 2026 · release notes

    Adds Databricks Zerobus Destination in Cribl Stream for direct Delta Table ingestion.

    └──▷ HOW TO FIND IT
    Route telemetry from Cribl Stream directly to a Databricks Delta Table without intermediate storage.
    📍In Cribl Stream UI: Go to Data >> Destinations >> Add Destination. Select Databricks Zerobus and configure Workspace URL, Workspace ID, Zerobus endpoint, Table name, and Service Principal credentials.
    • Adds the Databricks Zerobus destination to Cribl Stream for direct telemetry delivery into Unity Catalog Delta TablesDelta TablesAn open-source storage format maintained by the Linux Foundation that layers ACID transactions and versioned history onto Parquet files, letting tools query, update, and time-travel through large datasets reliably. via gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication.
    • Enables configuration of Workspace URL, Workspace ID, Zerobus endpoint, and target catalog.schema.table in the Stream UI

    2 details in Everything

12. changelog Sep 17, 2026 · issue 077

    Cribl adds backend functions for Apps, an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for external AI clients, and muting rules for Cribl Insights alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Suppress noisy alert notifications during a maintenance window by creating a Muting Rule in Cribl Insights.
    📍In Cribl Insights, navigate to Muting Rules and create a new rule specifying the matching alert criteria and the time window during which outbound notifications should be suppressed.
    • Introduces backend functions for Cribl Apps — server-side logic declared in an App that Cribl deploys and runs alongside it, enabling scheduled work and other operations that should not run in the browser.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an embedded MCP server in Cribl.Cloud that lets external MCP clients (such as Cursor, Claude Code, or Codex) connect to your Cribl environment and interact with Sources, Destinations, Pipelines, metrics, and Search Notebooks through natural language; an admin enables it and a Bearer tokenBearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. is copied from Settings > Global > Information.
    • Adds Muting Rules to Cribl Insights, allowing teams to suppress outbound notifications for matching alerts during a configured time window.
    • Introduces the Cribl Guard Privacy 3.0 model family for background sensitive-data detection, adding per-entity detection thresholds and a new Pro model alongside the existing Fast and Base models.
    • Cribl Apps now supports a KV store accessible to App code and backend functions for persistent key-value storage within an App.

    +1 more show less

    • Cribl Apps enforces a declared allowed-hosts list at the project root for outbound access, with SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. protections applied; administrators can authorize additional hosts after install.
    • Introduces backend functions for Cribl Apps — server-side logic declared in an App that Cribl deploys and runs alongside it, enabling scheduled work and other operations that should not run in the browser.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an embedded MCP server in Cribl.Cloud that lets external MCP clients (such as Cursor, Claude Code, or Codex) connect to your Cribl environment and interact with Sources, Destinations, Pipelines, metrics, and Search Notebooks through natural language; an admin enables it and a Bearer tokenBearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. is copied from Settings > Global > Information.
    • Adds Muting Rules to Cribl Insights, allowing teams to suppress outbound notifications for matching alerts during a configured time window.
    • Cribl Apps now supports a KV store accessible to App code and backend functions for persistent key-value storage within an App.
    • Cribl Apps enforces a declared allowed-hosts list at the project root for outbound access, with SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. protections applied; administrators can authorize additional hosts after install.

    1 more in Everything

13. Backend functions arrive in Cribl Apps (2026-09-16) Sep 16, 2026 · release notes

    Cribl 4.20 adds backend functions to apps, enabling HTTP endpoints and scheduled jobs for background workflows.

    • Adds support for backend functions in Cribl Apps, allowing apps to expose HTTP endpoints and run jobs on a schedule
    • Moves Cribl Apps from preview to general availability

    2 details in Everything

14. Cribl Guard Privacy Models 3.0: Less noise, more signal (2026-09-16) Sep 16, 2026 · release notes

    Cribl Guard Privacy Models 3.0 introduces per-entity thresholds and a new Pro model tier.

    • Adds per-entity thresholds to allow tailored precision/recall trade-offs for each sensitive data entity type.
    • Introduces the Pro model tier in Cribl Guard Privacy 3.0 for deeper detection with highest precision and F1 score.

    2 details in Everything

15. 4.20.0 Sep 16, 2026 · release notes

    Cribl Stream 4.20.0 adds Parquet schema validation, static egress IPs, new Akamai/Trend Micro sources, and more

    • Parquet schema validation is now available via C.Schema('<schema-id>', { kind: 'parquet' }).validate(<event>).
    • Add support for Azure VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. Flow Logs, Microsoft Copilot, and Claude Enterprise Analytics as new Sources.
    • Databricks Zerobus Destination enables direct writes to Unity Catalog Delta tables via Databricks Zerobus Ingest.
    • Traversal Destination allows sending OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. log events over gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. or HTTP.
    • Static egress IPs are now configurable per region on Workspace > Connections > Static Egress IP.

    +4 more show less

    • New CRIBL_DISABLE_FEATURES=remote_capture environment variable disables remote capture in on-prem and hybrid deployments.
    • Cribl AI Recommendations are now available for AWS Cloud Connections to rank log sources and config values.
    • Auto-Parse is enabled via toggle in a Route or Source's Pre-Processing settings to detect event formats.
    • Akamai, Aqua Security, BeyondTrust, ExtraHop, F5 BIG-IP, Gigamon, HashiCorp HCP Vault, Mimecast, Ping Identity, SailPoint, Trellix, and Trend Micro Vision One sources are added.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !C.env returns only allowlisted environment variables (those starting with CRIBL_ or built-ins); custom variables must be renamed to start with CRIBL_ and processes restarted.
    • !Login and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management./SLOSLOA Service Level Objective is a target threshold for a system's reliability or performance, such as 99.9% uptime or sub-200ms latency, giving cyber tools a measurable contract to enforce or report against. callback rate limits moved from cribl.yml to the /system/api-limits endpoint and stored in api-limits.yml.
16. docs update Aug 26, 2026 · issue 057

    Cribl LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Observability adds Cohere and CrewAI as supported instrumentation targets via OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor..

    • Supports instrumenting Cohere with OpenTelemetry to send telemetry to Cribl Stream and Cribl Search.
    • Supports instrumenting CrewAI with OpenTelemetry to send telemetry to Cribl Stream and Cribl Search.

    2 details in Everything

17. docs update Aug 19, 2026 · issue 050

    Cribl LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Observability adds LlamaIndex support via OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. instrumentation

    • Supports instrumenting LlamaIndex applications with OpenTelemetry to send telemetry to Cribl Stream and Cribl Search.

    1 detail in Everything

18. Introducing Cribl Marketplace: A central place to discover and deploy apps (2026-08-19) Aug 19, 2026 · issue 050

    Cribl Marketplace launches in Cribl.Cloud, enabling in-product discovery and one-click installation of apps from Cribl, partners, and community developers.

    ⤢
    • Introduces Cribl Marketplace, a central in-product hub within Cribl.Cloud (available to cloud and hybrid leaders) for browsing, discovering, and installing prebuilt apps without manually importing GitHub URLs or configuring endpoints.
    • Supports filtering the app catalog by solution type, publisher, product, tags, support model, certification status, and recency to help practitioners find relevant apps quickly.
    • Surfaces per-app detail pages showing overview, permissions, external API access, files, support information, and version history before installation, giving administrators visibility into what an app requires.
    • Roadmap includes automated readiness checks, security scanning, review workflows, publisher verification, and certification signals to establish trust signals across the ecosystem.
    • Provides a standardized publishing process for developers and partners to contribute and distribute apps to Cribl customers through the Marketplace.

    +1 more show less

    • Plans a dedicated public Marketplace URL outside Cribl.Cloud so non-customers can browse and explore available apps without an existing Cribl account.

    6 details in Everything

19. 4.19.1 Aug 19, 2026 · release notes

    Cribl Stream 4.19.1 adds global secrets, raw HTTP CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript., Cribl Marketplace apps, and Terraform support for apps.

    • Centralize credentials across Stream and Edge in on-prem deployments with global secrets retrieved from HashiCorp Vault or the built-in secret store.
    • Enable browser-based OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools./HTTP clients to send telemetry directly by configuring CORS (origins, methods, headers) on the Raw HTTP Source.
    • Install Cribl-supported Apps directly from the in-product Cribl Marketplace catalog without importing package files.

    3 details in Everything

20. Introducing AWS Cloud Connections: Automated AWS log discovery for Cribl Stream (2026-08-18) Aug 18, 2026 · issue 050

    Cribl introduces AWS Cloud Connections for automated log discovery and onboarding across multi-region, multi-account AWS environments.

    • New AWS Cloud Connections feature automatically enumerates log destinations (S3, CloudWatch, Firehose, and Firehose destinations) across AWS accounts and regions without manual hunting or custom scripts.
    • Generates CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. templates to provision a read-only AWS STSAWS STSAWS Security Token Service, an Amazon Web service that issues short-lived credentials for IAM roles, letting tools authenticate to AWS APIs without storing long-term secrets. role granting Cloud Connections access to discover logging configurations via AWS APIs.
    • Produces CloudFormation configuration files deployable as a CloudFormation stack to onboard discovered log sources directly into Cribl Stream.
    • Discovery results include enough context to identify whether a log source is already onboarded to Cribl, surfacing gaps in existing collection coverage.
    • Supports onboarding both existing Cribl organizations and entirely new AWS environments or individual accounts.

    5 details in Everything

21. docs update Aug 15, 2026 · issue 046

    Cribl LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Observability adds Pydantic AI instrumentation via OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor., routed to Cribl Stream and Cribl Search.

22. Cribl Privacy 2.1: More telemetry scanned per unit of compute (2026-08-14) Aug 14, 2026 · issue 046

    Cribl Privacy 2.1 delivers 64%–163% throughput gains and 13%–24% lower memory for AI-based telemetry privacy detection in Cribl Guard.

    ⤢
    • Cribl Privacy 2.1 model family increases detection throughput by 64%–163% and reduces average memory use by 13%–24% versus Privacy 2.0, with F1 accuracy held steady or improved and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. utilization unchanged.
    • New model pruning and distillation pipeline shrinks feed-forward layers by 75% or more, then trains a smaller student model against the original frozen teacher to recover near-equivalent detection quality at higher throughput.
    • Introduces a three-tier model lineup — Fast (maximum throughput), Base (balanced), and Pro (maximum detection accuracy, coming soon) — letting operators choose an operating point on the accuracy/throughput/resource curve per pipeline.
    • Training data enriched with feedback from production Guard customers, improving detection on commonly used log types and telemetry patterns encountered in real deployments.
    • Previews cribl-privacy-3.0-pro, a forthcoming larger, high-accuracy model for lower-volume, accuracy-sensitive workloads, alongside additional personalization controls for tuning detections per environment.

    5 details in Everything

23. Cribl Apps: Do the fun part of development (2026-08-14) Aug 14, 2026 · issue 045

    Cribl introduces an Apps platform letting users build and run custom data experiences on top of existing Cribl infrastructure.

    • Adds an Apps button in the upper-right corner of every Cribl screen, providing access to pre-built tools and a platform for building custom apps via an AI-driven conversational interface.
    • Provides pre-built apps that add new views, processes, workflows, and capabilities built around existing Cribl data — without requiring users to stand up hosting, identity, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., or data access layers from scratch.
    • Enables users to build custom apps on the Cribl Apps platform, iterating through an AI-driven conversational flow while Cribl handles the underlying infrastructure, authentication, RBAC, and data governance.

    3 details in Everything

24. docs update Aug 12, 2026 · issue 043

    Cribl adds Grok to its LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. observability integrations via OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor.

25. docs update Aug 4, 2026 · issue 035

    Cribl Guard adds a locally-run NER model on Worker Nodes to surface sensitive data without requiring custom rules.

    ⤢ ⤢ ⤢
    • Adds a Cribl-managed Named Entity Recognition (NER) model that runs locally on Worker Nodes to detect sensitive data not covered by existing rules, via Cribl Background Detection.

    1 detail in Everything

26. docs update Aug 1, 2026 · issue 032

    Cribl adds OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code. and Semantic Kernel as supported LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. observability integrations via OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor..

    • Supports instrumenting OpenRouter with OpenTelemetry to send LLM telemetry to Cribl Stream and Cribl Search.
    • Supports instrumenting Semantic Kernel with OpenTelemetry to send LLM telemetry to Cribl Stream and Cribl Search.

    2 details in Everything

27. What is your AI actually doing? Introducing the Cribl App for AI Observability (2026-07-31) Jul 31, 2026 · issue 036

    Cribl launches the App for AI Observability: unified search, cost tracking, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. detection, and trace investigation across all AI models and providers.

    ⤢ ⤢ ⤢
    • New Cribl App for AI Observability delivers a single pane to search, investigate, and report on AI telemetry across models, tools, and environments, built on Cribl's AI Platform for Telemetry.
    • Usage and Cost Dashboard surfaces spending trends, token consumption, top users and models, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. efficiency anti-patterns, and an activity heatmap.
    • Org View provides a hierarchical roll-up of spend, tokens, and requests across an organization.
    • Goals and Monitors continuously evaluate live AI telemetry against user-defined targets, such as month-to-date token spend vs. budget.
    • Usage Efficiency tooling exposes LLM efficiency issues to improve token efficiency and model effectiveness.

    +5 more show less

    • Security and Compliance Dashboard tracks sensitive data exposure rates, findings by type and user, tool-call audit, and content risk indicators.
    • Sensitive Data Traces pinpoint exactly where sensitive data (PII, credentials, API keys) appears within a trace or session, with analysis by category, user, model, and tool over time.
    • Sessions and Traces view provides end-to-end trace visibility with filterable session lists, span timelines, and full prompt, response, and tool-call payloads.
    • AI Insights offers a conversational AI agent for querying usage, cost, and security data across the organization in plain language.
    • AI-generated briefs automatically surface what needs attention so teams are alerted to problems without manual hunting.

    10 details in Everything

28. What is your AI actually doing? Introducing the Cribl app for AI Observability (2026-07-31) Jul 31, 2026 · issue 032

    Cribl launches AI Observability app — unified search, cost tracking, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. detection, and trace investigation across all AI models and providers.

    └──▷ HOW TO FIND IT
    Surface PII or credential leakage in AI sessions by reviewing Sensitive Data Traces — useful during a security review or incident triage.
    📍In Cribl.Cloud, open the AI Observability app › Security and Compliance Dashboard › Sensitive Data Traces, then filter by subcategory (PII, credentials, API keys) and by user or model to locate the exact trace or session where sensitive data appeared.
    Track AI spend against budget targets to catch token overruns before they become a finance problem.
    📍In Cribl.Cloud, open the AI Observability app › Goals and Monitors, create a new monitor targeting month-to-date token spend, and set the budget threshold for your team or model.
    Investigate a model quality regression by jumping from a dashboard anomaly directly into the full prompt and response payloads for that session.
    📍In Cribl.Cloud, open the AI Observability app › Sessions and Traces, filter the session list by model and time range, select the suspect session, and inspect the span timeline alongside full prompt, response, and tool-call payloads.
    • New Cribl app for AI Observability provides a single platform to search, investigate, and report on AI telemetry across models, tools, and environments.
    • Usage and Cost Dashboard surfaces spending trends, token consumption, top users and models, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. efficiency anti-patterns, and an activity heatmap.
    • Org View delivers a hierarchical roll-up of spend, tokens, and requests across the organization.
    • Goals and Monitors continuously evaluate live AI telemetry against user-defined targets such as month-to-date token spend vs. budget.
    • Security and Compliance Dashboard tracks sensitive data exposure rates, findings by type and user, tool-call audit trails, and content risk indicators.

    +5 more show less

    • Sensitive Data Traces pinpoint exactly where PII, credentials, and API keys appear within a trace or session.
    • Sessions and Traces view provides end-to-end trace visibility with filterable session lists, span timelines, and full prompt, response, and tool-call payloads.
    • AI Insights offers a conversational AI agent for querying usage, cost, and security data across the org in plain language.
    • AI-generated briefs automatically surface anomalies and areas needing attention without requiring manual investigation.
    • Built on Cribl's AI Platform for Telemetry Lakehouse engine, enabling data collection, transformation, storage, and flexible analysis via search or dashboards.

    10 details in Everything

29. What is your AI actually doing? Introducing the Cribl app for AI Observability (2026-07-31) Jul 31, 2026 · issue 006

    Cribl launches AI Observability app — unified search, cost tracking, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. detection, and trace investigation across all AI models and providers.

    └──▷ HOW TO FIND IT
    Surface PII or credential leakage in AI sessions by reviewing Sensitive Data Traces — useful during a security review or incident triage.
    📍In Cribl.Cloud, open the AI Observability app › Security and Compliance Dashboard › Sensitive Data Traces, then filter by subcategory (PII, credentials, API keys) and by user or model to locate the exact trace or session where sensitive data appeared.
    Track AI spend against budget targets to catch token overruns before they become a finance problem.
    📍In Cribl.Cloud, open the AI Observability app › Goals and Monitors, create a new monitor targeting month-to-date token spend, and set the budget threshold for your team or model.
    Investigate a model quality regression by jumping from a dashboard anomaly directly into the full prompt and response payloads for that session.
    📍In Cribl.Cloud, open the AI Observability app › Sessions and Traces, filter the session list by model and time range, select the suspect session, and inspect the span timeline alongside full prompt, response, and tool-call payloads.
    • New Cribl app for AI Observability provides a single platform to search, investigate, and report on AI telemetry across models, tools, and environments.
    • Usage and Cost Dashboard surfaces spending trends, token consumption, top users and models, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. efficiency anti-patterns, and an activity heatmap.
    • Org View delivers a hierarchical roll-up of spend, tokens, and requests across the organization.
    • Goals and Monitors continuously evaluate live AI telemetry against user-defined targets such as month-to-date token spend vs. budget.
    • Security and Compliance Dashboard tracks sensitive data exposure rates, findings by type and user, tool-call audit trails, and content risk indicators.

    +5 more show less

    • Sensitive Data Traces pinpoint exactly where PII, credentials, and API keys appear within a trace or session.
    • Sessions and Traces view provides end-to-end trace visibility with filterable session lists, span timelines, and full prompt, response, and tool-call payloads.
    • AI Insights offers a conversational AI agent for querying usage, cost, and security data across the org in plain language.
    • AI-generated briefs automatically surface anomalies and areas needing attention without requiring manual investigation.
    • Built on Cribl's AI Platform for Telemetry Lakehouse engine, enabling data collection, transformation, storage, and flexible analysis via search or dashboards.

    10 details in Everything

30. docs update Jul 29, 2026 · issue 029

    Cribl LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Observability now supports Ollama via OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. instrumentation.

31. Why full-text search matters for modern log analytics (2026-07-28) Jul 28, 2026 · issue 029

    Cribl Search 4.19 makes full-text inverted-index search on _raw the default for Lakehouse engines, with backfill for existing engines.

    └──▷ TRY IT
    During incident response, search a dataset for a raw token (e.g., an error code or hostname fragment) across the full event message without specifying a field.
    copy

    $ dataset="flowlogs" 123456 | ...

    Use the where … has form to explicitly invoke the full-text index when the token search follows a pipeline operator.
    copy

    $ dataset="flowlogs" | where _raw has 123456 | ...

    • Enables full-text search (FTS) via an inverted index on _raw as the default experience in Cribl Search's Lakehouse Engine, allowing token-based searches without targeting a specific field.
    • Delivers 150×–350× query acceleration on token-based 'needle in the haystack' searches (tested on 1 billion row datasets) by skipping irrelevant storage blocks.
    • Supports FTS activation via the simple string predicate in the leftmost implied cribl operator, or via the where operator with the has string operator.

    3 details in Everything

32. docs update Jul 25, 2026 · issue 025

    Cribl LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Observability adds Mistral AI support via OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. instrumentation

    • Supports instrumenting Mistral AI with OpenTelemetry to send telemetry to Cribl Stream and Cribl Search.

    1 detail in Everything

33. docs update Jul 25, 2026 · docs issue 004

    Cribl LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Observability adds Mistral AI support via OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. instrumentation

    • Supports instrumenting Mistral AI with OpenTelemetry to send telemetry to Cribl Stream and Cribl Search.

    1 detail in Everything

34. Architecting for the speed of "vibe coding": Introducing Apps (2026-07-23) Jul 23, 2026 · issue 023

    Cribl introduces Apps: a sandboxed iframe-based framework letting customers build custom UIs and workflows directly on the Cribl platform.

    • Introduces Apps, a new sandboxed application framework that lets customers build and run custom UIs and workflows on the Cribl platform without requiring internal platform privileges.
    • Provides built-in managed backend primitives — including state persistence and secure API proxies — so custom apps need no separate backend infrastructure.
    • Enforces a strict trust boundary: Apps interact with the Cribl platform only through existing public APIs, never with internal auth tokens or API keys.
    • Runs customer-written app code in a zero-privilege sandboxed iframe, isolating failures from the core platform's latency, security, and availability.
    • Enables local development and packaging of Apps using standard web technologies, eliminating the need to learn proprietary platform DSLs.

    5 details in Everything

35. docs update Jul 22, 2026 · issue 022

    Cribl AI gains an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for external agent access and Guard recommendations for actionable detection guidance.

    └──▷ HOW TO FIND IT
    Connect Cursor or Claude Code to your Cribl environment so an AI agent can query Pipelines and Search Notebooks through natural language.
    📍In Settings › Global › AI Settings, enable MCP Server, then select Copy bearer token and provide it to your MCP client (e.g., Cursor or Claude Code) as a bearer token to connect.
    Route all Cribl AI features through your own model provider instead of Cribl-managed models.
    📍In Settings › Global › AI Settings, under AI Model Providers, select Use Custom AI Provider and complete the configuration wizard.
    • New MCP server lets external AI clients (Cursor, Claude Code, Codex) connect to Cribl environments and interact with Sources, Destinations, Pipelines, and Search Notebooks via natural language.
    • Guard recommendations surface a suggested action (create a rule, mark mitigated, or ignore) for each detection so practitioners can act on findings without leaving the UI.
    • MCP Integrations setting allows Cribl to call tools from an approved list of external agents via MCP.
    • Web Search option enables a Cribl agent to search the web for information during Search investigations.
    • Bring Your Own Model (BYOM) support lets operators route Cribl AI through their own cloud-hosted or self-hosted AI provider instead of Cribl-managed models.

    +1 more show less

    • AI feature entry points remain visible and surface a actionable error message when a configured custom provider is unreachable, rather than failing silently.

    6 details in Everything

36. docs update Jul 22, 2026 · docs issue 004

    Cribl AI gains an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for external agent access and Guard recommendations for actionable detection guidance.

    └──▷ HOW TO FIND IT
    Connect Cursor or Claude Code to your Cribl environment so an AI agent can query Pipelines and Search Notebooks through natural language.
    📍In Settings › Global › AI Settings, enable MCP Server, then select Copy bearer token and provide it to your MCP client (e.g., Cursor or Claude Code) as a bearer token to connect.
    Route all Cribl AI features through your own model provider instead of Cribl-managed models.
    📍In Settings › Global › AI Settings, under AI Model Providers, select Use Custom AI Provider and complete the configuration wizard.
    • New MCP server lets external AI clients (Cursor, Claude Code, Codex) connect to Cribl environments and interact with Sources, Destinations, Pipelines, and Search Notebooks via natural language.
    • Guard recommendations surface a suggested action (create a rule, mark mitigated, or ignore) for each detection so practitioners can act on findings without leaving the UI.
    • MCP Integrations setting allows Cribl to call tools from an approved list of external agents via MCP.
    • Web Search option enables a Cribl agent to search the web for information during Search investigations.
    • Bring Your Own Model (BYOM) support lets operators route Cribl AI through their own cloud-hosted or self-hosted AI provider instead of Cribl-managed models.

    +1 more show less

    • AI feature entry points remain visible and surface a actionable error message when a configured custom provider is unreachable, rather than failing silently.

    6 details in Everything

37. What’s New! We heard you like AI. (2026-07-22) Jul 22, 2026 · issue 023

    Cribl 4.19 adds an app framework, embedded MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, multi-region Workspaces, and new Snowflake/BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data./Bedrock destinations.

    └──▷ HOW TO FIND IT
    Reduce top-of-hour CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. spikes when many scheduled searches fire simultaneously by enabling Schedule Jitter on a recurring search.
    📍In the Cribl Search UI, open a scheduled search, locate the Schedule settings, and enable Schedule Jitter with a configurable window (e.g., 15 minutes) to introduce a random delay within that window before execution.
    Stream security or operational data directly into a Snowflake table without Kafka or S3 staging, using the new native Destination.
    📍In Cribl Stream, go to Routing › QuickConnect (or a Pipeline's Output), add a new Destination, select Snowflake, and configure the Snowflake Destination per target table with your account credentials.
    Collect Amazon Bedrock model invocation and CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. audit logs into Cribl Stream for centralized analysis.
    📍In Cribl Stream, add a new Source, select the Amazon Bedrock tile, configure S3/SQS ingestion using the cribl-aws-bedrock-io Pack, and enable dedicated inputs for invocation logs and CloudTrail data.
    • New app framework lets teams build and install custom UIs, dashboards, and workflow shortcuts directly inside Cribl using Cribl APIs and AI-assisted tools like Cursor, importable via files, URLs, or Git repos.
    • Cribl-managed MCP server is now embedded in the Cribl Leader as a first-class platform feature, enabling MCP-compatible AI tools and agents to connect using existing auth and access controls — no separate Docker deployment required.
    • Cribl Insights now supports monitoring, metrics, and alerting for non-main Workspaces (dev, test, and production environments), not just the main Workspace.
    • Multi-region Workspace provisioning allows Workspaces to be created in any supported region independently of the Organization region, supporting data residency, sovereignty, and compliance requirements.
    • Centralized credentials support lets teams define credentials once in HashiCorp Vault or Cribl's built-in secret store and reuse them across Stream and Edge, reducing credential sprawl.

    +6 more show less

    • Expanded public API adds Edge-focused endpoints for programmatic management of Edge Nodes, configuration pushes, and lifecycle operations suitable for CI/CD and infra-as-code pipelines.
    • Schedule Jitter for Search introduces a configurable random delay on scheduled searches to spread execution across the hour and reduce burst load.
    • Native Amazon Bedrock Source tile in Stream ingests Bedrock model invocation logs and CloudTrail audit logs via an S3/SQS pattern using the cribl-aws-bedrock-io Pack.
    • Native Snowflake Destination enables direct streaming into Snowflake's streaming service without Kafka or S3 intermediaries, configurable per table.
    • Native Google BigQuery Destination streams data directly from Cribl Stream into BigQuery tables, supporting project, dataset, table, location, ingestion mode, and authentication configuration — no GCS hop required.
    • Native IBM Cloud Object Storage Destination sends data directly to IBM COS with a purpose-built integration rather than generic S3 compatibility.

    11 details in Everything

38. Cribl MCP Server: Interact with Cribl using the AI tools you already use (2026-07-22) Jul 22, 2026 · issue 022

    Cribl 4.19 embeds an MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. natively in the Leader, letting AI clients like Claude Code, Cursor, and OpenAI Codex CLI query configs, metrics, and Search Notebooks directly.

    └──▷ HOW TO FIND IT
    Enable the embedded MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server and connect an AI client to your Cribl Leader for the first time.
    📍In the Cribl UI, go to Settings › AI Settings and enable MCP Server. Copy the generated bearer token, then add the Cribl MCP endpoint and token to your client configuration (e.g., Claude Code, Cursor, or OpenAI Codex CLI). Restart the client and confirm the Cribl tools appear and the server shows as connected.
    • Adds a native, embedded MCP Server in the Cribl Leader — no separate container or service required to connect MCP-compatible AI clients.
    • Supports MCP-compatible clients including Claude Code, Cursor, and the OpenAI Codex CLI via remote HTTP, with no additional proxy to install.
    • Enables AI clients to retrieve Sources, Destinations, Worker Groups, Pipelines, metrics, and alerts directly from the Cribl environment.
    • Allows AI clients to connect to Cribl Search to generate and refine queries, retrieve results, and create or update Search Notebooks.
    • Supports building AI-powered runbooks and security playbooks as Notebooks that combine queries, Markdown summaries, findings, and next steps.

    +3 more show less

    • Enables custom agent workflows that can query Cribl, enrich results from other systems, notify teams, and trigger approved actions — combinable with the Cribl SDK.
    • Enforces existing Cribl RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. and bearer-token authentication for every MCP tool call, with no separate MCP permission model to configure.
    • Supports Cribl.Cloud, on-premises, and hybrid deployments.

    8 details in Everything

39. 4.19.0 Jul 22, 2026 · release notes

    Cribl Stream 4.19.0 adds AWS Cloud Connections, Amazon Bedrock Source, BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. and Snowflake Destinations, Gemini AI provider, and cribl pipe CLI enhancements

    • AWS Cloud Connections in Cribl.Cloud allows automatic discovery and bulk-onboarding of cloud data sources as Cribl Sources.
    • New Amazon Bedrock Source collects model invocation and audit logs from Amazon Bedrock.
    • New Sysdig Cloud NSS Source receives security data from Sysdig via HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools..
    • New Upwind Source receives security events from Upwind’s cloud platform via HEC.
    • New Amazon Managed Service for Prometheus (AMSP) Destination provides a dedicated tile for remote-writing metrics to AMP.

    +23 more show less

    • New Google BigQuery Destination enables writing events directly into BigQuery tables using Google’s Storage Write API.
    • New IBM Cloud Object Storage Destination allows routing data to IBM Cloud Object Storage buckets using HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it.-based authentication.
    • New Snowflake Streaming Destination enables writing events directly to Snowflake tables using the Snowflake REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
    • Gemini added as a custom AI provider option, with ability to reset BYOM tier assignments.
    • The cribl pipe CLI command now supports --breaker (-e) and --fields (-f) options for end-to-end Pack testing without a live Source.
    • Parser Function Type can now be set to Auto to detect event format and extract top-level fields from _raw.
    • Worker process config update concurrency and Worker process reload timeout (seconds) are new settings on the Worker Processes tab.
    • New Restart unresponsive Worker Processes setting (enabled by default) automatically restarts Workers that stop sending heartbeats.
    • Cribl Guard runs an automatic preliminary scan every 24 hours; Recommendations section in Findings view proposes actions and shows regex patterns.
    • Worker Node and Stream Worker information now opens in a full dedicated page instead of a side drawer.
    • Outpost Group settings expose an API Server Settings section, including host, port, and TLS settings.
    • QuickConnect includes an Enabled only filter to hide disabled Sources.
    • Data Preview toolbar shows inline fields and bytes statistics after Simple Preview; select Pipeline diagnostics for full stats.
    • New metric breaker.ts_extract_failures reports timestamp extraction failures per Source.
    • Git commits now record the actual user as the Git author instead of a generic admin user.
    • Worker Group or Fleet variables can be referenced in Packs using C.systemVars in JavaScript-enabled fields.
    • New secure, read-only external API provides programmatic access to FinOps Center billing and usage data.
    • FinOps Center has a new Global Date Range picker for all billing graphs.
    • Organization role(s) now appear under the user's name in the account menu.
    • Cribl AI is embedded by default; enable MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server integration in AI Settings and use a bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else..
    • New Private LinkPrivate LinkAn AWS networking feature that exposes a service over a private endpoint inside a VPC, so traffic never traverses the public internet, giving cyber tools a way to integrate with cloud services without opening public routes. configuration available for AWS and Azure in Cribl.Cloud portal.
    • Cribl.Cloud Release Channels allow assigning Workspaces to Regular or Slow release channels.
    • Global Secrets in Cribl.Cloud support retrieval from HashiCorp Vault or built-in secret store.

    28 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. Sources bound to IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses (e.g. ::) now receive IPv6 traffic only; previously received dual-stack traffic on Linux/macOS.
    • !Selected Cribl API endpoints for Pipelines, Routes, profiler, and job logs now return correct HTTP status codes (e.g., 400 instead of 500 for invalid schema).
    • !Single-item GET requests in on-prem deployments return HTTP 404 for unknown IDs, previously returned 200 OK with empty items.
    • !Disable Node Persistence setting is deprecated; use Worker Group/Fleet-level Time to keep disconnected Nodes setting instead.
    • !CentOS 7 is End of Support and End of Life for all on-premises deployments; no further updates or patches provided.
    • !AppScope Source has reached End of Support (EOS) and will be removed in a future release.
    • !Smart mode for Source persistent queue is deprecated and will automatically migrate to Always On mode in January 2027.
    • !Cribl as Code TypeScript and Go SDKs are discontinued; migration to Python SDK, Terraform Provider, or direct Cribl API access recommended.
    • !Custom Bootstrap Package URLs must use HTTP or HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.; file:// URLs are no longer supported for download_url parameter.
40. 4.18.2 Jun 24, 2026 · release notes

    Cribl Stream 4.18.2 adds Google Cloud Observability destination, Apps RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., cribl diag connect, SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. proxies for Outpost Nodes

    • Adds Google Cloud Observability Destination for sending OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. metrics, logs, and traces to Google Cloud.
    • Adds RBAC control for Apps (Preview) to restrict user and team access per App.
    • Adds cribl diag connect CLI command to test Leader connectivity from managed Stream Workers and Edge Nodes.
    • Enables SOCKS proxy support for Outpost Node communication with the Leader.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Single-item GET requests in the Cribl.Cloud API now return HTTP 404 Not Found for unknown IDs instead of HTTP 200 OK with an empty items array.
    • !The CRIBL_OUTPOST_LISTENER_URL environment variable is deprecated due to Outpost listener service startup fixes.
41. 4.18.0 May 20, 2026 · release notes

    Cribl Stream 4.18.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integrations, new sources/destinations, S3-backed persistent queues, and Guard AI models

    • MCP Integrations for Cribl AI enables external Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers via endpoint URLs with auth headers and API keys
    • Cribl Copilot Chatbot Toggle in AI Settings dashboard allows admins to enable or disable the chatbot widget independently of other AI features
    • New Azure Event Hubs AMQP Source ingests events via Event Hubs’ native AMQP protocol
    • New Okta Source enables collection of Okta system logs using the Okta Management API
    • New OpenAI Compliance Logs Source (Platform Source) collects compliance and observability logs for ChatGPT Enterprise deployments

    +24 more show less

    • New Anthropic Compliance API (Claude Compliance API) Source collects compliance data from Anthropic’s Enterprise Compliance API
    • New ServiceNow Table API Source ingests records from ServiceNow’s Table API
    • S3-Backed Shared Persistent Queue Storage allows Worker Groups to use AWS S3 or S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage as a centralized backing store for PQs (on-prem/hybrid only)
    • Cribl Guard Detection Analysis and Model Selection introduces agentic Guard analysis with new privacy models selectable in the Detection model drop-down on the Guard page
    • New Apps (Preview) feature allows building and running custom packaged UI experiences that call Cribl and third-party APIs
    • REST Collector Interactive Debug Mode captures full HTTP request/response details for authentication, discovery, and collection phases
    • New Buffer size limit (bytes) setting for Source and Destination persistent queues replaces the deprecated event-based limit
    • New orphanedJobTTL parameter in UI or job-limits.yml configures Job Reaper removal time for orphaned Collection jobs (default: 7d)
    • Number of connection listener processes setting in Outpost Group configuration defines connection processes for Outpost Nodes
    • Max log files per type in UI or -l argument for ./cribl diag create CLI specifies max rotated log files in diagnostic bundles
    • OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. Destination now supports dynamic metadata for gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. protocol and OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Client Credentials for HTTP protocol
    • Wiz Defend Destination adds new Wiz Source Type options: AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Logs, AWS Resolver Query Logs, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Audit Logs
    • ClickHouse Destination now supports up to 25 MB Body Size Limit for write batches (increased from 10 MB)
    • Google Cloud Pub/Sub Destination maps event’s attributes field to native Pub/Sub message attributes on publish
    • Prometheus Remote WritePrometheus Remote WriteA protocol for streaming time-series metrics from a Prometheus instance to a remote storage backend, letting cyber tools offload long-term metric retention and query load to a dedicated system. integrations use the v2 parser by default for on-prem deployments
    • File Monitor Event breakers now persist state across restarts for custom header-based and stateful breakers
    • Journal Files Sources have new Suppress errors when search path does not exist option
    • Prometheus Scraper Source supports HTTP-based service discovery and new Use field per metric setting
    • Datadog Agent Source now supports ZSTD-compressed logs (aligns with Datadog Agent 7.67.0+)
    • OpenTelemetry Source (HTTP) supports configuration of multiple authentication tokens
    • Wiz API Source adds content types for Detections, Application Endpoints, Cloud Resources V2, and configurable event breakers
    • Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. Source supports state tracking using Graph delta queries
    • Expanded Pack Variables allow use within simple arrays and across Collectors, Sources, and Destinations
    • Pack Notifications feature allows configuring and managing Notifications for Sources and Destinations directly within the Pack context

    29 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !API responses for /system/settings, /system/settings/auth, and /lib/database-connections no longer include plaintext bindCredentials or client_secret; values are omitted or masked.
    • !The Disable Node persistence setting is deprecated and will be removed in 4.19.0.
    • !The Buffer size limit (events) setting for persistent queues is deprecated in favor of the byte-based limit; fully removed in an upcoming release.
    • !The Tee Function is deprecated in Cribl Stream and Cribl Edge; disabled by default for new installations and will require Support enablement in a future release.
42. 4.17.1 Apr 22, 2026 · release notes

    Cribl Stream 4.17.1 adds IP allowlisting for API credentials, M365 GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy./DoD/China support, gzip compression for Cortex XSIAM Destinations, and Databricks custom workspace

    • Adds IP Allowlist option in Cribl.Cloud UI to restrict API access for API Credentials to specific IPv4 CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges
    • Expands Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. Source to support Microsoft 365 GCC High, DoD, and China cloud deployments via a new endpoint selector dropdown
    • Adds gzip compression setting to the Cortex XSIAM Destination tile to reduce egress costs
    • Adds configurable workspace host in Databricks Destination for government and secure cloud environments

    4 details in Everything

43. 4.17.0 Mar 11, 2026 · release notes

    Cribl Stream 4.17 adds Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. Source, OpenAI Source, Cribl Search Destination, custom AI providers, and Pack cross-routing.

    • Adds Microsoft Graph Source to replace the legacy Message Trace Source for M365 data ingestion
    • Adds OpenAI Source to ingest model invocation and audit logs for governance
    • Adds Cribl Search Destination which targets the local_search endpoint in Cribl.Cloud
    • Adds Custom AI Provider support (BYOM) via AI Settings at Workspace/Global level
    • Makes Cribl MCP Server generally available on-prem and cloud for AI assistant integration

    +1 more show less

    • Allows routing from global Sources to Packs containing Destinations and vice versa

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Pack IDs must be entirely lowercase; the system now validates uniqueness based on lowercase strings.
    • !The legacy Microsoft Message Trace Source is deprecated; users must migrate to the new Microsoft Graph Source before May 2026.
44. 4.16.0 Jan 28, 2026 · release notes

    Cribl Stream 4.16 adds VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. Flow Logs Event Breaker, Wiz Defend Destination, Outpost Groups, and Configurable TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. Log Levels

    • Adds Azure Virtual Network (VNet) Flow logs Event Breaker type for parsing Microsoft's recommended successor to NSG Flow logs
    • Adds Wiz Defend Destination using an HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools.-compatible HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. endpoint for direct log and metric delivery
    • Adds Outpost Groups with configurable disconnected retention time, filtering tags, and target product version settings
    • Adds TTL (time-to-livetime-to-liveTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit.) setting support in on-prem deployments to temporarily change log levels for up to 24 hours
    • Adds Directory batch size setting to Amazon S3, Amazon Security Lake, Azure Blob Storage, Azure Data Explorer, Exabeam, Filesystem/NFS, Google Cloud Storage, and MinIO Destinations

    +5 more show less

    • Adds Enable Source IP Spoofing setting to Netflow Destination to preserve original Source IP from __srcIpPort
    • Adds Salt file hash toggle to File Monitor to differentiate files with identical hashes
    • Adds Use legacy collection for LastLog option in System State Source (Linux) Advanced Settings
    • Adds HTTP Connection Timeout setting to Prometheus Scraper Collector
    • New Monitoring charts for Sources, Destinations, Data Fields, Packs, Pipelines, Projects, Routes, Subscriptions, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. Load, Free Memory, and Bytes In/Out now support configurable local time range pickers

    10 details in Everything

45. 4.15.1 Dec 17, 2025 · release notes

    Cribl Stream 4.15.1 adds Azure Gov support for Blob Storage Sources/Destinations and per-process throttling in Cribl HTTP Destination.

    • Adds Azure Government cloud environment support for Azure Blob Storage Sources and Destinations when using Client secret or Certificate authentication methods.
    • Enables configuration of a Throttling rate per Worker Process in the Cribl HTTP Destination to limit output volume.

    2 details in Everything

46. 4.15.0 Nov 19, 2025 · release notes

    Cribl Stream 4.15 adds Fabric Real-Time Intelligence and Databricks Destinations, Cloudflare Source, and temporary log level TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. on Cribl.Cloud

    • Adds Fabric Real-Time Intelligence Destination for sending telemetry to Microsoft Fabric Eventstreams.
    • Adds Databricks Destination for sending data to Databricks Unity Catalog volumes.
    • Adds Cloudflare Source via HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools. endpoints to receive Cloudflare Logpush data.
    • Adds Cloudflare R2 Destination for S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. object storage delivery.
    • Adds configurable TTL setting on Cribl.Cloud to temporarily change log levels for up to 24 hours.

    +8 more show less

    • Extends Cribl Outpost to route control plane communication from Stream Workers.
    • Adds Enable Source IP Spoofing setting to Syslog Destination (UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. only) to preserve original Source IP.
    • Adds Force close on shutdown setting to Filesystem, S3, Azure Blob, GCS, and Minio Destinations.
    • Adds Minimum age duration and Apply filename allowlist internal to archive files settings to File Monitor Source.
    • Adds ZSTD compression support for Kafka, Confluent Cloud, and Amazon MSK Sources and Destinations.
    • Adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. labeling support to Google Cloud Chronicle API Destination.
    • Adds Directory batch size setting to S3, Azure Blob, GCS, and Minio Destinations on Cribl.Cloud.
    • Adds Zscaler Cloud NSS Source integration with expanded metrics.

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Azure Monitor Log Destination is deprecated; use Microsoft Sentinel Destination instead.
    • !The previous Age duration limit setting in File Monitor Source is renamed to Maximum age duration.
    • !Schema type selection in the UI for Confluent Cloud and Kafka Sources/Destinations is removed as schema detection is now automatic.
47. 4.14.1 Oct 23, 2025 · release notes

    Cribl Stream 4.14.1 adds Google Cloud Chronicle API Destination, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for multiple orgs, and gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. encrypted private keys.

    • Adds Google Cloud Chronicle API Destination with v1alpha ImportLogs ingestion method for per-event labeling and improved scaling
    • Enables SSO authentication for multiple Organizations sharing the same email domain in Cribl.Cloud
    • Introduces IAM Admin Permission at the Organization level to manage SSO and members without data engineering access
    • Adds Passphrase setting in TLS configuration for gRPC encrypted private keys in Model Driven Telemetry and OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. Sources
    • Adds Key Prefix column to Amazon S3 Destination configuration tables for auditing

    +4 more show less

    • Adds Validate and correct log name option to Google Cloud Logging Destination to sanitize illegal characters
    • Adds Get auth token from header setting to REST Collector Login methods to support JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. in Authorization header
    • Makes Cribl Guard available in on-prem and hybrid deployments of Cribl Stream
    • Adds credit spend projection charts per-product and product-specific tabs in FinOps Center

    9 details in Everything

48. 4.14.0 Sep 17, 2025 · release notes

    Cribl Stream 4.14 adds Cribl Guard scanning, Terraform provider, Wiz Webhook Source, and more.

    • CRIBL_GIT_REMOTE_URL environment variable allows setting a Git remote URL from the UI without restarting the Leader.
    • Adds Wiz folder in Source catalog with Wiz Webhook Source for collecting Wiz Defend alert data.
    • C.Mask expression supports SHA3-256 and SHA3-512 hashing algorithms for data masking.
    • Adds ability to drop dimensions directly from the Data Preview pane in the UI.

    4 details in Everything

49. 4.13.1 Aug 13, 2025 · release notes

    Cribl Stream 4.13.1 adds structured metadata support for Grafana/Loki, Avro/JSON schema types for Confluent, dynamic HTTP headers for Loki, and more packs.

    • Adds Schema type setting to Confluent Cloud Source/Destinations to select Avro or JSON serialization
    • Adds Enable structured metadata toggle to Grafana/Loki Source/Destination to expose the internal __structuredMetadata field as string key-value pairs
    • Adds dynamic HTTP header support in Loki Destination by inspecting each event for a __headers object and batching identical values
    • Adds Monitor subscription for new messages toggle to Google Cloud Pub/Sub Source for monitoring via subscription ID only
    • Adds REST Collector Packs for CrowdStrike, Okta, and Microsoft O365

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !If you use S3 Object Lock, the Amazon S3 Destination will fail when configured to send data to an S3 bucket with default Object Lock enabled due to AWS SDK upgrade; do not upgrade until the patch release.
50. 4.13.0 Jul 16, 2025 · release notes

    New SentinelOne AI SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Destination, Drop Dimensions function for metrics, and Stored Credentials for Oracle improve Cribl Stream's integration and processing capabilities.

    • Adds SentinelOne AI SIEM destination for direct ingestion into SentinelOne's cloud-native SIEM via a HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools.-compatible endpoint.
    • Introduces the new Drop Dimensions function to remove dimensions from outgoing metrics data, reducing high cardinality and storage costs.
    • Adds Stored Credentials authentication method for Oracle Database connections to allow referencing separate secrets for username/password and connection string.

    3 details in Everything

51. 4.12.2 Jun 18, 2025 · release notes

    Cribl Stream 4.12.2 adds S3 object tagging and supports Azure China cloud in Blob Storage destination.

    • Adds Tag after processing toggle to Amazon S3 Source for configuring custom static or dynamic S3 object tags
    • Adds Azure Cloud setting to Azure Blob Storage Destination to support cloud services in China

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Users with Read Only role must now use Admin role to fetch Leader token; stream_reader becomes stream_admin and edge_reader becomes edge_admin.
52. 4.12.0 May 21, 2025 · release notes

    Cribl Stream 4.12 adds disk-based lookups, Copilot editor, foldkeys function, workspace data transfer, and improved billing/metrics visibility

    • Adds Disk-Based Lookups as an alternative to in-memory lookups for optimizing memory usage across Worker Processes
    • Introduces the Copilot Editor with interactive plain-language prompting to generate Regex or JavaScript Expressions for Pipelines
    • Adds the foldkeys Function to transform flat field names with common separators into nested objects
    • Expands Cribl.Cloud billing portal with labeled tabs for credit/usage stats, detailed product consumption tables, and an invoice export tab
    • Introduces Configurable Metrics Levels (Minimal, Basic, Detailed) in Worker Group settings and expands available metrics types

    +6 more show less

    • Enables Data Transfer Across Workspaces or Environments using Cribl TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. or HTTP Source/Destination pairs for non-shared Leader workers
    • Enhances Packs to support Sources, Destinations, and Event Breakers with exportable end-to-end solutions and Pack-level metrics
    • Improves Import Packs from Git feature with write-back capability for round-trip Git integration
    • Updates Helm chart to configure Kubernetes Service Account for Leader deployment IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role binding
    • Adds encoding parameter to Cribl HTTP Source JSON configuration (e.g., "encoding": "utf8") for character encoding support
    • Adds Enable enhanced TLS handshake for proxy protocol toggle in Syslog Source to preserve source IP/port via PROXY headers

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Persistent queueing (PQ) is no longer available in the free tier of Cribl Stream and requires Standard or Enterprise license plans.
53. 4.11.1 Apr 23, 2025 · release notes

    Cribl Stream 4.11.1 adds Cortex XSIAM Destination with format parsing and batching

    • Adds the Cortex XSIAM Destination to bridge security alert and audit log data into Palo Alto Networks’ Cortex XSIAM platform
    • Increases the RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. timeout limit to improve reliability when downloading upgrade packages from the CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. (cdn.cribl.io)
    • Enables ownership transfer for Packs published in the Cribl Packs Repository

    3 details in Everything

54. 4.11.0 Mar 26, 2025 · release notes

    Cribl Stream 4.11 introduces Metrics Pipeline Builder, new Aggregate Metrics Function, and Kinesis ListShards validation.

    • Adds a new Metrics Pipeline Builder in the UI to automate dropping or aggregating metrics from Data Preview.
    • Adds a new Aggregate Metrics Function supporting StatsD, Prometheus, and OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. for pre-aggregation.
    • Adds Indexed Fields support with JavaScript expressions in the Google Cloud Logging Destination.
    • Adds a new Log last schema mismatch advanced setting in the ClickHouse Destination for troubleshooting.
    • Adds a Max requests per socket setting to the Windows Event Forwarder Source.

    +2 more show less

    • Adds an optional endpoint suffix parameter to Azure Blob Storage destinations for regional targeting.
    • Adds granular compression control for S2S v4 in Splunk TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. Source, Splunk Load Balanced Destination, and Splunk Single Instance Destination.

    7 details in Everything

55. 4.10.1 Feb 26, 2025 · release notes

    Cribl Stream 4.10.1 adds sensitiveFields API filter, v2 Prometheus parser, and Datadog counter conversion.

    • Adds sensitiveFields configuration property to filter sensitive information in /inputs and /outputs API responses
    • Adds prometheusParser: v2 config option to the Prometheus Remote WritePrometheus Remote WriteA protocol for streaming time-series metrics from a Prometheus instance to a remote storage backend, letting cyber tools offload long-term metric retention and query load to a dedicated system. Source for ~2.5x throughput improvement
    • Adds Datadog Destination option to send counter metrics as count

    3 details in Everything

56. 4.10.0 Jan 29, 2025 · release notes

    Cribl Stream 4.10 adds Zscaler NSS source, IPFIXIPFIXAn IETF standard protocol for exporting network flow records from routers and probes to a collector, giving cyber tools a vendor-neutral stream of structured traffic metadata without full packet capture. parsing, PIV auth, new CLI diag commands, and socket management settings.

    • Adds Zscaler Cloud NSS Source for receiving log data from Zscaler’s Nanolog Streaming Service
    • Adds support for IPFIX messages in the renamed NetFlow & IPFIX source, including template records and options templates
    • Adds Personal Identity Verification (PIV) authentication using smart cards for on-prem deployments
    • Adds decrypt function in the CLI to decrypt configuration secrets such as encryption keys and passwords
    • Adds diag subcommands (perf, cpuprofile, heapsnapshot) to generate CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. profiles or heap snapshots from the CLI

    +9 more show less

    • Adds persistent queue usage notification triggers for Sources when disk usage exceeds a threshold
    • Adds new socket management settings for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.-based Sources: Socket idle timeout, Socket max lifespan, and Forced socket termination timeout
    • Adds Partitioning scheme drop-down option for DDSS in the S3 Collector
    • Adds Blob access tier selection for the Azure Blob Storage Destination
    • Adds Compression levels support for the Amazon S3 Destination
    • Adds additional realms (us2, eu1, eu2, au0, jp0) to the SignalFx Destination
    • Adds Max active connections setting under Advanced Settings in the Syslog Source UI
    • Adds Delete files setting on the File Monitor Source for Manual Discovery mode
    • Adds mapping of Teams to multiple IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups in Cribl.Cloud

    14 details in Everything

57. 4.9.1 Nov 6, 2024 · release notes

    Cribl Stream 4.9.1 adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. Trap Serialize Function, custom region endpoints for Sources/Destinations, and Cloud admin Git message customization

    • Adds SNMP Trap Serialize Function to serialize events into SNMP traps for sending via SNMP Trap Destinations.
    • Enables custom region endpoints for AWS, Google Cloud, and New Relic Sources and Destinations to support new cloud regions without release updates.
    • Allows Cribl.Cloud administrators to customize the default Git commit message when deploying changes, matching on-prem capabilities.

    3 details in Everything

58. 4.9 Oct 16, 2024 · release notes

    Cribl Stream 4.9 adds ClickHouse/Dynatrace OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. destinations, Security Lake source, cross-region worker groups, dead-lettering, and API workspace creds.

    • Adds support for the ClickHouse destination to write data directly into ClickHouse clusters
    • Adds support for the Dynatrace HTTP (logs only) and Dynatrace OpenTelemetry Protocol (OTLP) destinations
    • Adds the Amazon Security Lake Source which supports receiving Amazon Simple Queue Service (SQS) data from Amazon Security Lake event subscriptions
    • Allows creating Cribl-managed Worker Groups in different AWS regions within Cribl.Cloud, independent of the Organization Leader's region
    • Adds new KV StoreKV StoreA key-value store is a database that maps arbitrary keys to values with no fixed schema, offering fast lookups that cyber tools use for caching, state sharing, or configuration at scale. limit settings on the Leader Node to control API process resource usage

    +5 more show less

    • Enables creation of API credentials for individual Workspaces in Cribl.Cloud to manage access programmatically
    • Introduces a dead-lettering feature for Filesystem-based Destinations to store failed files and configure retry limits
    • Adds Always On and Backpressure persistent queue modes for Destinations to control disk write behavior during backpressure
    • Adds a Disk space protection setting for Filesystem-based Destinations to block or drop events when free disk space is low
    • Allows disabling the Script Collector across the entire deployment via the Cribl command-line interface

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for CentOS 7 on the Cribl Stream Leader and Worker Nodes is deprecated
59. 4.8.2 Sep 11, 2024 · release notes

    Cribl Stream 4.8.2 adds NetFlow v9 source/destination, CrowdStrike Falcon Next-Gen SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. destination, and various source/destination enhancements.

    • Adds NetFlow v9 Source for collecting NetFlow records over UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.
    • Adds NetFlow Destination to route unmodified NetFlow v5/v9 data
    • Enables period and underscore separators in OTLP Metrics Function prefixes
    • Adds dynamic Site name setting via JavaScript in the Exabeam Destination
    • Extends Retry Connection Timeout and Retry Connection Reset options to Office 365 Message Trace, Office 365 Services, Wiz, and REST Collector sources

    +7 more show less

    • Enables secrets store support in the Splunk HEC Source for authentication tokens
    • Adds Azure service principal authentication for Azure Blob Source, Collector, and Destination
    • Adds Authentication URL and audience customization in the Wiz Source
    • Enables random partition assignment for Kafka, Confluent Cloud, Amazon MSK, and Azure Event Hubs Sources
    • Adds character encoding configuration (UTF-16LE, Latin-1) for Splunk Search Source and multiple Collectors
    • Enables IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles authentication for Google Cloud Pub/Sub Source and Google Cloud Storage Collector Source
    • Adds Dammam region (me-central2) support to the Exabeam Destination

    12 details in Everything

60. 4.8 Aug 14, 2024 · release notes

    Cribl Stream 4.8 adds Azure worker groups, ServiceNow OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. destination, HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. auth for REST Collectors, and non-root Docker support.

    • Adds Azure as a provider option when creating new Cloud Worker Groups in Cribl.Cloud.
    • Adds the ServiceNow Cloud Observability Destination supporting OpenTelemetry ProtocolOpenTelemetry ProtocolOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. (OTLP) via HTTP or gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication..
    • Adds HMAC (Hash-based Message Authentication Code) Functions to the Knowledge Library for authenticating REST Collectors.
    • Adds CRIBL_VOLUME_DIR environment variable requirement for running Cribl Stream as a non-root user in Docker.
    • Adds Mapping ID setting to Teams in Cribl.Cloud for mapping Identity Provider groups.

    +6 more show less

    • Adds automatic memory snapshot capture setting in Group’s General Settings for hybrid/on-prem deployments.
    • Adds log rotation for cribl_stderr.log limiting files to 5 MB each with a maximum of five rotated copies.
    • Adds Scale Reads setting to the Redis function to specify read node selection (primary, replica, or both).
    • Adds Enable load balancing setting to TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. and TCP JSON Sources.
    • Adds Retry Connection Timeout and Retry Connection Reset settings for Splunk Search Collector/Source and Office 365 Activity Source.
    • Adds Scope setting to the renamed Microsoft Sentinel Destination.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Azure Sentinel Destination has been renamed to Microsoft Sentinel.
61. 4.7.2 Jul 17, 2024 · release notes

    Cribl Stream 4.7.2 adds OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. Traces Function, HTTP source IP allowlist/denylist regex, and new retry/config settings for sources/destinations.

    • OTLP Traces Function now available to normalize and batch OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. trace events (supports OTLP 0.10.0 and 1.3.1)
    • HTTP-based Sources support IP allowlist regex and IP denylist regex options
    • Retries section added to Kafka, Confluent Cloud, Amazon MSK, and Azure Event Hubs Sources and Destinations
    • Datadog Destination uses api/v1/distribution_points endpoint for distribution metrics
    • DNS resolution period setting added to Syslog (UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.), SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale., and Metrics (UDP) Destinations

    +4 more show less

    • Filesystem Destination gains Compression level and Writing high watermark (KB) settings
    • REST Collector adds Retry-After header name setting
    • Cribl.Cloud Admins can edit and delete Members and Teams via UI
    • Audit logs now capture filter expressions for traceability

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Scripts are disabled by default in new deployments; admins must explicitly enable them
62. 4.7 Jun 5, 2024 · release notes

    Cribl Stream 4.7 adds Universal Subscription, AuthZ Teams, Google SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. UDM/OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. API v2 support, and SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. routing control.

    • Introduces Universal Subscription enabling on-prem Leader to Cribl.Cloud connection for centralized credit billing and consumption-based usage monitoring.
    • Adds AuthZ Teams allowing Organization- and product-level permissions assignment in customer-managed deployments, replacing Local Users and Roles.
    • Enables sending structured data satisfying the Unified Data Model (UDM) schema to Google Security Operations via Cribl Pipelines and Functions.
    • Adds support for Google Security Operations API version 2 in the SecOps Destination alongside existing version 1.
    • Introduces OTLP Logs Function supporting batching based on Resource Attributes to reduce data volume over the wire.

    +7 more show less

    • Updates OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. Source and Destination to support protocol specification version 1.3.1.
    • Adds new setting in cribl.yml to disable SNI routing for specific Groups or Fleets, superseding previous instance.yml workarounds.
    • Allows REST Collector to write custom JavaScript via the new Format discover result option for parallel collection jobs.
    • Enables Oracle database connections within Database Connections for direct data retrieval.
    • Adds Syslog Source automatic framing type inference (transparent vs. octet-count).
    • Enables Splunk Load Balancer Destination to use multiple authentication tokens for indexer discovery in high-availability environments.
    • Adds new shutdown.lost_events internal metric for Worker shutdown telemetry visibility.

    12 details in Everything

63. 4.6.1 May 15, 2024 · release notes

    Cribl Stream 4.6.1 adds Wiz source, health check endpoint for HTTP sources, and token-level metrics for Splunk HECSplunk HECAn HTTP endpoint built into Splunk that accepts JSON-formatted log and event data pushed directly from applications or agents over HTTPS, letting cyber tools ship telemetry to Splunk without requiring a forwarder agent on the sending host.

    • Adds Wiz Source for collecting Audit Logs, Configuration Findings, Issues, and Vulnerabilities data from the Wiz cloud security platform.
    • Adds http(s)://<host>:<port>/cribl_health endpoint to HTTP-based Sources for ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. health monitoring.
    • Adds Capture response headers setting to REST Collector to include API response headers in the __collectible.resHeaders object.
    • Adds Emit per-token request metrics option to Splunk HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools. Source to expose token-level performance data previously limited to metrics.log.

    4 details in Everything

64. 4.6 Apr 17, 2024 · release notes

    Cribl Stream 4.6 introduces Cribl Lake storage, Copilot AI assistant, Workspaces multi-tenancy, NetFlow V5 source, and S3/REST checkpointing.

    • Introduces Cribl Lake, a new long-term data storage product with a dedicated Collector Source for replaying data and a Cribl Lake Destination for writing.
    • Introduces Cribl Copilot, an AI assistant accessible via the teal AI icon at the bottom right of any page in Cribl.Cloud.
    • Enables opt-in to the new Cribl.Cloud User Interface with multi-tenant Workspaces (up to 5 isolated instances with dedicated VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules.) and Teams for access control.
    • Adds a new NetFlow Source to collect, route, and control IP traffic via Netflow V5 (UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.).
    • Adds TCP Load Balancing for the Syslog Source in Distributed mode to prevent TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. pinning across Worker Processes.

    +18 more show less

    • Enables state tracking by time or arbitrary value for REST Collectors to resume interrupted jobs with no data gaps.
    • Enables S3 Source Checkpointing to resume processing files from the last checkpoint after worker restarts or network issues.
    • Adds the new system_email preconfigured email notification target for Cribl.Cloud Enterprise customers.
    • Allows remote storage of Config Bundles in an AWS S3 bucket via the config bundle distribution settings.
    • Enables direct copying of Packs between Worker Groups or Fleets via the Pack management UI.
    • Adds a new Advanced format option to the Webhook Destination for integrating with unsupported APIs.
    • Automatically converts Kafka Source record headers from raw bytes to strings during ingestion.
    • Supports region-specific AWS STSAWS STSAWS Security Token Service, an Amazon Web service that issues short-lived credentials for IAM roles, letting tools authenticate to AWS APIs without storing long-term secrets. endpoints using the CRIBL_AWS_STS_REGION environment variable on Worker Nodes.
    • Appends -CLONE to the ID when cloning a Source or Destination.
    • Adds a new Staging file limit setting to the Amazon S3 Destination to control backpressure application.
    • Adds a new Number of concurrent streams setting to the Google Pub/Sub Source.
    • Adds a new Header line setting to the Filesystem Destination to prepend text to output files.
    • Adds authToken variable support in REST Collector Collect and Discover steps for dynamic authentication.
    • Enables Google service account authentication with scopes and impersonation in the REST Collector.
    • Adds Reuse Redis connections Worker Group setting to manage TCP connections to Redis servers.
    • Adds a new optional argument cribl_user_group to the Leader's bootstrap script for Worker self-provisioning.
    • Enables tagging Worker Groups by keywords via the Worker Group creation or editing interface.
    • Replaces Enable automatic upgrades with Upgrade Workers automatically toggle in the Global Upgrade Settings UI.

    23 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Leader Node auth token is now restricted to a-z, A-Z, 0-9, and _; tokens containing other special characters must be updated before upgrading to 4.5.1 or newer.
65. 4.5.1 Mar 20, 2024 · release notes

    Cribl Stream 4.5.1 adds UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. functions, Google Pub/Sub cross-account support, and S3 Glacier Instant Retrieval

    • Google Pub/Sub Source can now subscribe to topics in a project on a different service account.
    • Amazon S3 Destination supports the new Glacier Instant Retrieval storage class, with existing classes renamed to match AWS naming (Glacier Flexible Retrieval, Glacier Deep Archive).

    2 details in Everything

66. 4.5 Feb 14, 2024 · release notes

    Cribl Stream 4.5 adds Model Driven Telemetry source, OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. Metrics function, email notifications, and FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. mode GA.

    • Adds Model Driven Telemetry Source to receive network device metrics via gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication./protobuf
    • Adds OTLP Metrics Function to transform dimensional metrics to the OTLP data model
    • Adds Email notification target type for alerting and search notifications
    • Moves FIPS Mode to GA with a new CLI command for generating NodeJS configuration
    • Enables all HTTP Destinations to honor Retry-After headers via Retry Settings

    +3 more show less

    • Database Collector now supports state tracking for ad hoc, full, and scheduled jobs
    • Amazon Kinesis Data Streams Destination can send single events per record uncompressed
    • Exabeam Destination now sends the Exabeam Site ID metadata

    8 details in Everything

67. 4.4.4 Jan 17, 2024 · release notes

    Cribl Stream 4.4.4 adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. mode (beta), load-balanced webhook destinations, and exponential backoff retry for HTTP-based sinks.

    • Adds FIPS Mode (Beta) for Customer Managed deployments to enforce FIPS compliant cryptography and password requirements
    • Adds load balancing support in the Webhook Destination with configurable weights and IP exclusion options
    • Adds exponential backoff retry configuration for HTTP-based Destinations including Google Chronicle, Azure Data Explorer, Dataset, and Elasticsearch

    3 details in Everything

68. 4.4.2 Dec 6, 2023 · release notes

    Cribl Stream 4.4.2 adds Elastic Cloud and Exabeam Destinations with auto Parquet schema generation

    • Adds Elastic Cloud tile as a new Destination to send data directly to Elastic Cloud
    • Adds Exabeam tile as a new Destination for the Exabeam security operations platform
    • Enables automatic Parquet schema generation in Parquet-enabled Destinations (Filesystem, S3, Google Cloud, Azure Blob, MinIO)

    3 details in Everything

69. 4.4 Nov 8, 2023 · release notes

    Cribl Stream 4.4 adds ADX destination, PQ disk guardrails, and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. encoding expressions

    • Adds Azure Data Explorer (ADX) as a native Destination for sending security and observability data directly to Azure.
    • Adds System Metrics Source support for configuring Process Metrics reports filtered by specific running processes.
    • Adds C.Decode.inflate and C.Encode.deflate expressions for handling data types like intercepted SAML logs.
    • Enables Elasticsearch Destination to update Datasets via the index Write action for replacing events in legacy indexes.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upgrading Groups to Cribl Stream 4.4+ sets undefined PQ Max queue size values in Source/Destination configs to a new 5 GB default.
    • !The highest accepted value for PQ Max queue size is now constrained by the Group Settings > General Settings > Limits > Storage > Max PQ size per Worker Process field, with the corresponding limits.yml key being maxPQSize.
70. 4.3.1 Oct 11, 2023 · release notes

    Cribl Stream 4.3.1 adds Parquet ingestion to Azure/Google collectors, SNMPv3 for SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. sources, and SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure./Slack notification targets.

    • Adds Parquet format support for data ingestion and replay in the Azure Blob Storage Collector and Google Cloud Storage Collector
    • Adds Amazon SNS as a Notification target
    • Adds Slack as a Notification target
    • Adds SNMPv3 user authentication and data privacy support to the SNMP Source
    • Enables multiple users via SNMPv3 for the SNMP Trap Source, allowing receipt of traps from devices with different credentials

    5 details in Everything

71. 4.3 Sep 13, 2023 · release notes

    Cribl Stream 4.3 adds global banners, Parquet ingestion, GCS Service Account auth, and Chain Function performance gains.

    • Adds ability to define a global banner visible across all Cribl Suite products via UI notifications
    • Enables automatic in-app license expiration warnings starting 30 days before expiry without manual config
    • Supports creating Cribl.Cloud Organizations in the AWS Europe (Frankfurt) Region
    • Adds on-hover tooltips for Permission options and a numeric Members indicator/link in the Data Projects tab UI
    • Enables S3 and Filesystem Collectors to ingest and replay data stored in Parquet format

    +4 more show less

    • Adds GCP Service Accounts and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles authorization support for the Google Cloud Storage Destination
    • Enhances metadata and logging capabilities in the Exec Source
    • Diagnostice bundles now indicate whether they were generated from a Worker or Leader node
    • Promotes Chain Function cycle detection to configuration time for improved performance

    9 details in Everything

72. 4.2.2 Aug 21, 2023 · release notes

    Cribl Stream 4.2.2 adds diag heapsnapshot CLI command, DNS short name resolution options, and Grafana Cloud Loki/Prometheus URL config.

    • Adds diag heapsnapshot command to enable capturing memory snapshots from on-prem deployments
    • Enables DNS Lookup Function to resolve short names using /etc/resolv.conf, search/domain fallbacks, or DNS.lookup() via new options
    • Allows Grafana Cloud Destination configuration with separate Loki URL and Prometheus URL fields

    3 details in Everything

73. 4.2 Jul 19, 2023 · release notes

    Cribl Stream 4.2 adds Stream Projects (isolated workspaces), Azure Sentinel Destination, database rising columns, and fine-grained RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..

    • Adds Stream Projects for isolated, per-tenant workspaces with scoped access and pipelines.
    • Adds Azure Sentinel Destination to onboard security data in one step, supporting all custom tables and four native tables.
    • Adds rising column support in Database Collectors for state tracking and incremental collection.
    • Adds OAuth Certificate authentication option to the Office 365 Message Trace Source.
    • Adds Listening Ports, Logged-In Users, and Services collectors to the System State Source.

    +7 more show less

    • Enables writing summaries and histograms to a Prometheus Destination and receiving them from a Prometheus Source.
    • Restricts Amazon CloudWatch Logs Destination batches to 24 hours per request.
    • Adds a new option to reject unauthorized certificates that cannot be verified against a valid CA for Sources and Collectors.
    • Adds delimiter configuration in the Serialize Function for key=value pair separation.
    • Adds optional Activity log sample rate setting in the Code Function to reduce error flood volume.
    • Adds export of Worker Nodes list on the List View tab and a new Workers button for health status.
    • Enables compression by default on all HTTP-based Destinations to minimize egress charges.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The project_user Role and ProjectSourceSubscribe Policy are retired; Stream Projects/Subscriptions now rely entirely on granular Members and Permissions access control.
    • !Projects created in versions older than v.4.2 must be re-created, and Subscriptions carrying over during upgrade must be deleted and re-created.
74. 4.1.3 Jun 14, 2023 · release notes

    Cribl Stream 4.1.3 adds native Amazon Security Lake destination, mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. for Webhooks, and API process profiling.

    • Adds a new Amazon Security Lake Destination generally available for routing logs to AWS security lake infrastructure
    • Webhook Destination now supports mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. (mTLS) configuration for authenticated outbound webhooks
    • API process profiling is now available in Settings > Global Settings > System > Service Processes > Processes and Worker Settings > System > Worker Processes
    • On Cribl.Cloud Enterprise plans, multiple Cribl-managed Worker Groups are now generally available for scaled processing
    • Datadog Destination’s Datadog site field now supports four additional locations beyond US and Europe

    5 details in Everything

75. 4.1.2 May 17, 2023 · release notes

    Cribl Stream 4.1.2 adds env var support for Google Cloud Storage and HTTP Source timeouts, plus Script Collector JS expressions.

    • Adds Socket timeout threshold to Amazon Data Firehose, Elasticsearch API, HTTP/S, and Splunk HECSplunk HECAn HTTP endpoint built into Splunk that accepts JSON-formatted log and event data pushed directly from applications or agents over HTTPS, letting cyber tools ship telemetry to Splunk without requiring a forwarder agent on the sending host. Sources to close inactive connections.
    • Enables CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. configuration in the Splunk HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools. Source via two new fields.
    • Adds Environment option in Exec Source to support GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. workflows.
    • Allows Script Collector to set environment variables via JavaScript expressions.
    • Makes Cribl Internal Source’s CriblMetrics option available on all worker types (managed, on-prem, hybrid).

    +2 more show less

    • Enables load balancing by default for newly created Destinations (Splunk HEC, Elasticsearch, Syslog, etc.).
    • Allows Google Cloud Storage Destination to use environment variables.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The ci and co internal dimensions are deprecated in Cribl Stream 4.1.2 and must be replaced with input and output respectively.
76. 4.1.1 Apr 19, 2023 · release notes

    Cribl Stream 4.1.1 introduces beta Stream Projects, native MSK support, and new Function capabilities.

    • Adds Stream Projects (Beta) to create isolated spaces for teams and users.
    • Adds native Amazon Managed Streaming for Kafka (MSK) Source and Destination with IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role authentication.
    • Enables toggling individual Masking Rules on/off in the Mask Function for iterative debugging.
    • Adds SHA512 hash algorithm support to the Mask Function.
    • Adds mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. support to the Redis Function.

    +1 more show less

    • Adds cribl_route to Post-Processing > System fields in Destinations, with !cribl_route negation available for Serialize Functions.

    6 details in Everything

77. 4.1 Mar 21, 2023 · release notes

    Cribl Stream 4.1 adds Persistent Queue tuning, OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. support, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., and more.

    • Persistent Queues now default to Always on mode for greater reliability
    • New Strict ordering toggle in Destinations to control event prioritization during queue drain
    • New Drain rate limit setting to cap events per second when draining Persistent Queues
    • New Worker Processes connection limits and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. load thresholds in Group Settings to prevent Worker overload
    • New Raw UDP Source for ingesting unstructured UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. traffic

    +15 more show less

    • New Amazon S3 Destination under Data Lakes to stage data for Cribl Search
    • Splunk HECSplunk HECAn HTTP endpoint built into Splunk that accepts JSON-formatted log and event data pushed directly from applications or agents over HTTPS, letting cyber tools ship telemetry to Splunk without requiring a forwarder agent on the sending host. Source now supports S2S v4 protocol over HTTP and validates Allowed indexes via wildcard in the index field
    • Azure Event Hubs Source and Destination now authenticate against Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. via OAuth
    • Database Collector now supports PostgreSQL databases
    • Windows Event Forwarder (WEF) Source now supports KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. authentication
    • Open Telemetry Source now accepts events in the OTLP protocol over HTTP or gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. transports
    • Open Telemetry Destination now sends OTLP-compliant events via HTTP or gRPC and supports Deflate and Gzip compression codecs
    • Webhook Destination Batch expression field enables sending data in wrapper objects for API interaction
    • Enterprise Cribl.Cloud now supports creating multiple Worker Groups with configurable ingest rate estimates and disablement capabilities
    • Cribl.Cloud Organizations Owners/Admins can obtain Role-based access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. directly from the portal
    • Cribl.Cloud Organization Owner Role can be shared and transferred among multiple users
    • SAML integration for third-party identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. (IDPs) with on-prem Cribl Stream/Edge logins
    • New TLS private-key certs created in v4.1+ are now encrypted within Cribl config files
    • Eval Function allows toggling individual Add Field expressions on or off during debugging
    • Lookup Expressions support retrieving all columns from lookup files' matched rows via C.Lookup()

    20 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Leader upgrades to v.4.1.x require Workers to also upgrade to v.4.1.x, for feature compatibility.
    • !TLS certificate private keys within Cribl configuration files are now encrypted; existing unencrypted keys must be backed up before upgrading as new keys are not backward-compatible.
    • !Source-side Persistent Queues now default to Always on mode; automation assuming the previous Smart mode default will need updates.
78. 4.0.4 Feb 22, 2023 · release notes

    Cribl Stream 4.0.4 adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. to Webhook destinations and static ingress IPs for Cribl.Cloud.

    • Webhook Destination now supports OAuth 2.0 authentication

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Packs developed for Cribl Stream v4.0.x and above do not work in v3.5.x.
79. 4.0.3 Jan 18, 2023 · release notes

    Cribl Stream 4.0.3 adds dynamic webhook headers, HTTP keep-alive timeouts, OTELOTELAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. gzip, and several source/destination improvements.

    • Webhook Destination now supports adding dynamic headers to outgoing requests
    • HTTP Sources gain a configurable Keep alive timeout parameter for connection persistence
    • OTEL Source now accepts inbound data compressed with gzip
    • Splunk TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. Source includes a Use Universal Forwarder time zone option for Event Breakers

    4 details in Everything

80. 4.0.1 Dec 7, 2022 · release notes

    Cribl Stream 4.0.1 adds Google Cloud Logging destination, Bearer tokenBearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. auth for Splunk, raw format in Sumo Logic, and Kafka retry/DNS settings

    • Adds Google Cloud Logging as a new native Destination to write log data directly to Google Cloud.
    • Enables Bearer tokensBearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. for authentication in both the Splunk Search Collector and Splunk Source.
    • Adds raw format option in the Sumo Logic Destination’s Data format drop-down.
    • Adds configurable Kafka retries setting for Kafka, Confluent Cloud, and Azure Event Hubs Sources and Destinations.
    • Adds DNS name configuration for the Log API endpoint in the Azure Monitor Logs Destination.

    5 details in Everything

81. 4.0 Nov 9, 2022 · release notes

    Cribl Stream 4.0 adds Cribl Search, Cloud SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., Persistent Queues, Database Collector, and consolidated UI.

    • Introduces Cribl Search, a new federated searching product for data at rest, on the edge, or in motion, available exclusively on Cribl.Cloud via a new Search tile in the Cloud portal.
    • Enables federated authentication (OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. or SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.) for Cloud SSO, allowing user and group management through external identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    • Adds Persistent Queues for Enterprise plans to buffer and retain data on Cribl-managed and hybrid Workers with 1 GB disk space per Worker Process.
    • Introduces a new Database Collector to pull events from MySQL and SQL Server DBMSs, configurable via multiple Database Connections in Knowledge libraries.
    • Enhances the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. Collector to support custom HTTP verbs/methods and custom/overridden Authorization headers.

    +9 more show less

    • Adds AppScope Configs in Knowledge libraries as templates for filtering data ingested from AppScope.
    • Adds support for v4 of the S2S (Splunk to Splunk) binary protocol on Splunk Single Instance and Splunk Load Balanced Destinations.
    • Enhances the Google Chronicle Destination to allow definition of multiple custom Log types with a selectable default.
    • Extends the Redis Function to support Redis Cluster instances.
    • Adds a criblencrypt command to the Cribl App for Splunk.
    • Introduces new Pipeline Profile options to analyze and optimize individual Functions’ impacts on data volume, events count, and processing time.
    • Allows Idle-session expiration time to be extended up to 60 minutes (previously limited to 10).
    • Adds an option in the on-prem UI diagnostic bundle generator to enable or disable Include metrics.
    • Consolidates primary navigation into a top text link bar, moving most Limits settings (including Metrics and Jobs) from Global Settings to Group Settings in distributed deployments.

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Cribl Stream Source and Destination are no longer supported; use Cribl HTTP or Cribl TCP instead.
    • !The Prometheus Publisher Function is deprecated; use the Prometheus Destination instead.
    • !The Reverse DNS Function is deprecated; use the DNS Lookup Function instead.