https://cybertoolchain.io/tools/cribl New releases and features in Cribl, tracked by The Cyber Toolchain. en Mon, 02 Nov 2026 00:00:00 GMT https://cribl.io/blog/announcing-telemetry-decision-bench-and-cribl-decision-2 https://cribl.io/blog/announcing-telemetry-decision-bench-and-cribl-decision-2 Mon, 02 Nov 2026 00:00:00 GMT Cribl adds Telemetry Decisions Bench public benchmark and cribl-decision-2 open-weight model family for IT and security telemetry decisions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Cribl adds Telemetry Decisions Bench, a public benchmark and leaderboard covering 4,806 production-like IT, security, and telemetry decision tasks across 10 task families, reporting accuracy, negative log-likelihood (NLL), expected calibration error (ECE), latency per decision, and cost for API models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Cribl adds cribl-decision-2, a family of open-weight decision models available for download from Hugging Face, with sizes at 0.8B (20 ms per decision) and 4B (78 ms per decision), trained specifically for telemetry classification and routing decisions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/taming-the-ai-data-deluge-governing-telemetry-with-cribl-and-microsoft https://cribl.io/blog/taming-the-ai-data-deluge-governing-telemetry-with-cribl-and-microsoft Thu, 29 Oct 2026 00:00:00 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/cribl-search-adds-ocsf-mapping-for-more-consistent-searches https://cribl.io/blog/cribl-search-adds-ocsf-mapping-for-more-consistent-searches Thu, 22 Oct 2026 07:50:32 GMT Cribl Search's Lakehouse Engine adds optional OCSF v1.8 schema mapping, letting analysts query security data with consistent field names across sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds OCSF v1.8 field mapping to Cribl Search's Lakehouse Engine, configurable via a dataset rule (GDI Step 3), so analysts can query security data using consistent OCSF field names instead of vendor-specific ones like `src_ip`, `source_ip`, or `srcaddr`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports two mapping modes: add mapped OCSF fields alongside original source fields, or replace source fields with OCSF names — configurable per dataset rule. • Allows creation and cloning of custom Datatypes in Cribl Search to extend or override built-in OCSF Schema Mappings for any desired schema. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/your-azure-storage-your-network-outpost-and-private-endpoint-support-for-cribl-lake https://cribl.io/blog/your-azure-storage-your-network-outpost-and-private-endpoint-support-for-cribl-lake Thu, 22 Oct 2026 00:00:00 GMT Cribl Lake Azure Storage Locations gain Outpost support for in-network management calls and Private Endpoint support for private Search reads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Cribl Outpost support for Azure Storage Locations, routing all Azure management calls (container creation, lifecycle and retention policies, validation) through an Outpost you deploy inside your Azure vNet rather than from the Cribl control plane.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Azure Private Endpoint support for Cribl Search, enabling query traffic to your Azure Blob Storage to travel over the Microsoft backbone instead of the public internet, with a connection you approve and can revoke at any time. • Both Outpost and Private Endpoint capabilities are opt-in per storage location, with no migration required for existing Azure Storage Locations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/a-new-way-to-siem-a-smarter-way-to-ai-one-platform-to-power-it-all https://cribl.io/blog/a-new-way-to-siem-a-smarter-way-to-ai-one-platform-to-power-it-all Tue, 29 Sep 2026 14:23:02 GMT Cribl launches StreamAI (AI gateway with model routing) and Cribl Detect (full SIEM with 8,000+ detection rules) at CriblCon 26.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Cribl Detect, a complete SIEM built on the Cribl platform with detection, coverage and posture management, investigation, response, and threat intelligence — available now for Cribl.Cloud customers at up to 50% less cost than incumbent SIEMs, priced on infrastructure rather than per-GB ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds StreamAI, an enterprise AI gateway with a built-in model router that routes each prompt to the right model based on SecIT Bench benchmarks, with free inference for customers using automatic routing. • StreamAI enforces spending budgets and cutoffs, redacts sensitive data in both prompts and responses, and records every model call as audit-ready telemetry. • Cribl Detect includes Detection Posture Management, continuously showing coverage gaps, broken rules, and missing telemetry required to detect specific attacks. • Cribl Detect ships with a catalog of more than 8,000 detection rules covering a broad range of threats, with correlation across signals to surface multi-stage attacks. • Cribl Detect generates detection signals directly in the data pipeline, enabling real-time threat identification while telemetry is still in motion. • Adds an agentic development environment that lets teams build apps, workflows, and agents using natural language, running on the same agentic runtime that powers Cribl Detect with compute, scheduling, logging, and permissions included. • Opens the platform to agents via MCP and SDKs, adding 70 new integrations this year. • Adds AI auto-parsing of telemetry so incoming data is structured and usable the moment it arrives. • Grows the Cribl App Framework to 150+ apps from Cribl, partners, and customers, available in the Cribl Marketplace. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/a-new-way-to-siem-a-smarter-way-to-ai-one-platform-to-power-it-all https://cribl.io/blog/a-new-way-to-siem-a-smarter-way-to-ai-one-platform-to-power-it-all Tue, 29 Sep 2026 14:23:02 GMT Cribl launches StreamAI (AI gateway with model routing) and Cribl Detect (full SIEM with 8,000+ detection rules) at CriblCon 26.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Cribl Detect, a complete SIEM built on the Cribl platform with detection, coverage and posture management, investigation, response, and threat intelligence — available now for Cribl.Cloud customers at up to 50% less cost than incumbent SIEMs, priced on infrastructure rather than per-GB ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds StreamAI, an enterprise AI gateway with a built-in model router that routes each prompt to the right model based on SecIT Bench benchmarks, with free inference for customers using automatic routing. • StreamAI enforces spending budgets and cutoffs, redacts sensitive data in both prompts and responses, and records every model call as audit-ready telemetry. • Cribl Detect includes Detection Posture Management, continuously showing coverage gaps, broken rules, and missing telemetry required to detect specific attacks. • Cribl Detect ships with a catalog of more than 8,000 detection rules covering a broad range of threats, with correlation across signals to surface multi-stage attacks. • Cribl Detect generates detection signals directly in the data pipeline, enabling real-time threat identification while telemetry is still in motion. • Adds an agentic development environment that lets teams build apps, workflows, and agents using natural language, running on the same agentic runtime that powers Cribl Detect with compute, scheduling, logging, and permissions included. • Opens the platform to agents via MCP and SDKs, adding 70 new integrations this year. • Adds AI auto-parsing of telemetry so incoming data is structured and usable the moment it arrives. • Grows the Cribl App Framework to 150+ apps from Cribl, partners, and customers, available in the Cribl Marketplace. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/backend-functions-arrive-in-cribl-apps https://cribl.io/blog/backend-functions-arrive-in-cribl-apps Thu, 17 Sep 2026 07:37:40 GMT Cribl adds backend functions for Apps, an MCP server for external AI clients, and muting rules for Cribl Insights alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces backend functions for Cribl Apps — server-side logic declared in an App that Cribl deploys and runs alongside it, enabling scheduled work and other operations that should not run in the browser.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an embedded MCP server in Cribl.Cloud that lets external MCP clients (such as Cursor, Claude Code, or Codex) connect to your Cribl environment and interact with Sources, Destinations, Pipelines, metrics, and Search Notebooks through natural language; an admin enables it and a Bearer token is copied from `Settings > Global > Information`. • Adds Muting Rules to Cribl Insights, allowing teams to suppress outbound notifications for matching alerts during a configured time window. • Introduces the Cribl Guard Privacy 3.0 model family for background sensitive-data detection, adding per-entity detection thresholds and a new Pro model alongside the existing Fast and Base models. • Cribl Apps now supports a KV store accessible to App code and backend functions for persistent key-value storage within an App. • Cribl Apps enforces a declared allowed-hosts list at the project root for outbound access, with SSRF protections applied; administrators can authorize additional hosts after install. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/introducing-cribl-marketplace-a-central-place-to-discover-and-deploy-apps https://cribl.io/blog/introducing-cribl-marketplace-a-central-place-to-discover-and-deploy-apps Wed, 19 Aug 2026 03:00:00 GMT Cribl Marketplace launches in Cribl.Cloud, enabling in-product discovery and one-click installation of apps from Cribl, partners, and community developers. • Introduces Cribl Marketplace, a central in-product hub within Cribl.Cloud (available to cloud and hybrid leaders) for browsing, discovering, and installing prebuilt apps without manually importing GitHub URLs or configuring endpoints. • Supports filtering the app catalog by solution type, publisher, product, tags, support model, certification status, and recency to help practitioners find relevant apps quickly. • Surfaces per-app detail pages showing overview, permissions, external API access, files, support information, and version history before installation, giving administrators visibility into what an app requires. • Roadmap includes automated readiness checks, security scanning, review workflows, publisher verification, and certification signals to establish trust signals across the ecosystem. • Provides a standardized publishing process for developers and partners to contribute and distribute apps to Cribl customers through the Marketplace. • Plans a dedicated public Marketplace URL outside Cribl.Cloud so non-customers can browse and explore available apps without an existing Cribl account. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/introducing-aws-cloud-connections-automated-aws-log-discovery-for-cribl-stream https://cribl.io/blog/introducing-aws-cloud-connections-automated-aws-log-discovery-for-cribl-stream Tue, 18 Aug 2026 00:00:00 GMT Cribl introduces AWS Cloud Connections for automated log discovery and onboarding across multi-region, multi-account AWS environments. • New AWS Cloud Connections feature automatically enumerates log destinations (S3, CloudWatch, Firehose, and Firehose destinations) across AWS accounts and regions without manual hunting or custom scripts. • Generates CloudFormation templates to provision a read-only AWS STS role granting Cloud Connections access to discover logging configurations via AWS APIs. • Produces CloudFormation configuration files deployable as a CloudFormation stack to onboard discovered log sources directly into Cribl Stream. • Discovery results include enough context to identify whether a log source is already onboarded to Cribl, surfacing gaps in existing collection coverage. • Supports onboarding both existing Cribl organizations and entirely new AWS environments or individual accounts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/cribl-privacy-2-1-more-telemetry-scanned-per-unit-of-compute https://cribl.io/blog/cribl-privacy-2-1-more-telemetry-scanned-per-unit-of-compute Fri, 14 Aug 2026 00:00:00 GMT Cribl Privacy 2.1 delivers 64%–163% throughput gains and 13%–24% lower memory for AI-based telemetry privacy detection in Cribl Guard. • Cribl Privacy 2.1 model family increases detection throughput by 64%–163% and reduces average memory use by 13%–24% versus Privacy 2.0, with F1 accuracy held steady or improved and CPU utilization unchanged. • New model pruning and distillation pipeline shrinks feed-forward layers by 75% or more, then trains a smaller 'student' model against the original frozen 'teacher' to recover near-equivalent detection quality at higher throughput. • Introduces a three-tier model lineup — Fast (maximum throughput), Base (balanced), and Pro (maximum detection accuracy, coming soon) — letting operators choose an operating point on the accuracy/throughput/resource curve per pipeline. • Training data enriched with feedback from production Guard customers, improving detection on commonly used log types and telemetry patterns encountered in real deployments. • Previews `cribl-privacy-3.0-pro`, a forthcoming larger, high-accuracy model for lower-volume, accuracy-sensitive workloads, alongside additional personalization controls for tuning detections per environment. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/cribl-apps-do-the-fun-part-of-development https://cribl.io/blog/cribl-apps-do-the-fun-part-of-development Fri, 14 Aug 2026 00:00:00 GMT Cribl introduces an 'Apps' platform letting users build and run custom data experiences on top of existing Cribl infrastructure. • Adds an 'Apps' button in the upper-right corner of every Cribl screen, providing access to pre-built tools and a platform for building custom apps via an AI-driven conversational interface. • Provides pre-built apps that add new views, processes, workflows, and capabilities built around existing Cribl data — without requiring users to stand up hosting, identity, RBAC, or data access layers from scratch. • Enables users to build custom apps on the Cribl Apps platform, iterating through an AI-driven conversational flow while Cribl handles the underlying infrastructure, authentication, RBAC, and data governance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/what-is-your-ai-actually-doing-introducing-the-cribl-app-for-ai-observability https://cribl.io/blog/what-is-your-ai-actually-doing-introducing-the-cribl-app-for-ai-observability Fri, 31 Jul 2026 14:00:00 GMT Cribl launches the App for AI Observability: unified search, cost tracking, PII detection, and trace investigation across all AI models and providers. • New Cribl App for AI Observability delivers a single pane to search, investigate, and report on AI telemetry across models, tools, and environments, built on Cribl's AI Platform for Telemetry. • Usage and Cost Dashboard surfaces spending trends, token consumption, top users and models, LLM efficiency anti-patterns, and an activity heatmap. • Org View provides a hierarchical roll-up of spend, tokens, and requests across an organization. • Goals and Monitors continuously evaluate live AI telemetry against user-defined targets, such as month-to-date token spend vs. budget. • Usage Efficiency tooling exposes LLM efficiency issues to improve token efficiency and model effectiveness. • Security and Compliance Dashboard tracks sensitive data exposure rates, findings by type and user, tool-call audit, and content risk indicators. • Sensitive Data Traces pinpoint exactly where sensitive data (PII, credentials, API keys) appears within a trace or session, with analysis by category, user, model, and tool over time. • Sessions and Traces view provides end-to-end trace visibility with filterable session lists, span timelines, and full prompt, response, and tool-call payloads. • AI Insights offers a conversational AI agent for querying usage, cost, and security data across the organization in plain language. • AI-generated briefs automatically surface what needs attention so teams are alerted to problems without manual hunting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/what-is-your-ai-actually-doing-introducing-the-cribl-app-for-ai-observability https://cribl.io/blog/what-is-your-ai-actually-doing-introducing-the-cribl-app-for-ai-observability Fri, 31 Jul 2026 14:00:00 GMT Cribl launches AI Observability app — unified search, cost tracking, PII detection, and trace investigation across all AI models and providers. • New Cribl app for AI Observability provides a single platform to search, investigate, and report on AI telemetry across models, tools, and environments. • Usage and Cost Dashboard surfaces spending trends, token consumption, top users and models, LLM efficiency anti-patterns, and an activity heatmap. • Org View delivers a hierarchical roll-up of spend, tokens, and requests across the organization. • Goals and Monitors continuously evaluate live AI telemetry against user-defined targets such as month-to-date token spend vs. budget. • Security and Compliance Dashboard tracks sensitive data exposure rates, findings by type and user, tool-call audit trails, and content risk indicators. • Sensitive Data Traces pinpoint exactly where PII, credentials, and API keys appear within a trace or session. • Sessions and Traces view provides end-to-end trace visibility with filterable session lists, span timelines, and full prompt, response, and tool-call payloads. • AI Insights offers a conversational AI agent for querying usage, cost, and security data across the org in plain language. • AI-generated briefs automatically surface anomalies and areas needing attention without requiring manual investigation. • Built on Cribl's AI Platform for Telemetry Lakehouse engine, enabling data collection, transformation, storage, and flexible analysis via search or dashboards. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/what-is-your-ai-actually-doing-introducing-the-cribl-app-for-ai-observability https://cribl.io/blog/what-is-your-ai-actually-doing-introducing-the-cribl-app-for-ai-observability Fri, 31 Jul 2026 14:00:00 GMT Cribl launches AI Observability app — unified search, cost tracking, PII detection, and trace investigation across all AI models and providers. • New Cribl app for AI Observability provides a single platform to search, investigate, and report on AI telemetry across models, tools, and environments. • Usage and Cost Dashboard surfaces spending trends, token consumption, top users and models, LLM efficiency anti-patterns, and an activity heatmap. • Org View delivers a hierarchical roll-up of spend, tokens, and requests across the organization. • Goals and Monitors continuously evaluate live AI telemetry against user-defined targets such as month-to-date token spend vs. budget. • Security and Compliance Dashboard tracks sensitive data exposure rates, findings by type and user, tool-call audit trails, and content risk indicators. • Sensitive Data Traces pinpoint exactly where PII, credentials, and API keys appear within a trace or session. • Sessions and Traces view provides end-to-end trace visibility with filterable session lists, span timelines, and full prompt, response, and tool-call payloads. • AI Insights offers a conversational AI agent for querying usage, cost, and security data across the org in plain language. • AI-generated briefs automatically surface anomalies and areas needing attention without requiring manual investigation. • Built on Cribl's AI Platform for Telemetry Lakehouse engine, enabling data collection, transformation, storage, and flexible analysis via search or dashboards. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/why-full-text-search-matters-for-modern-log-analytics https://cribl.io/blog/why-full-text-search-matters-for-modern-log-analytics Tue, 28 Jul 2026 00:00:00 GMT Cribl Search 4.19 makes full-text inverted-index search on `_raw` the default for Lakehouse engines, with backfill for existing engines. • Enables full-text search (FTS) via an inverted index on `_raw` as the default experience in Cribl Search's Lakehouse Engine, allowing token-based searches without targeting a specific field. • Delivers 150×–350× query acceleration on token-based 'needle in the haystack' searches (tested on 1 billion row datasets) by skipping irrelevant storage blocks. • Supports FTS activation via the simple string predicate in the leftmost implied cribl operator, or via the `where` operator with the `has` string operator. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/architecting-for-the-speed-of-vibe-coding-introducing-apps https://cribl.io/blog/architecting-for-the-speed-of-vibe-coding-introducing-apps Thu, 23 Jul 2026 00:00:00 GMT Cribl introduces Apps: a sandboxed iframe-based framework letting customers build custom UIs and workflows directly on the Cribl platform. • Introduces Apps, a new sandboxed application framework that lets customers build and run custom UIs and workflows on the Cribl platform without requiring internal platform privileges. • Provides built-in managed backend primitives — including state persistence and secure API proxies — so custom apps need no separate backend infrastructure. • Enforces a strict trust boundary: Apps interact with the Cribl platform only through existing public APIs, never with internal auth tokens or API keys. • Runs customer-written app code in a zero-privilege sandboxed iframe, isolating failures from the core platform's latency, security, and availability. • Enables local development and packaging of Apps using standard web technologies, eliminating the need to learn proprietary platform DSLs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/whats-new-4-19 https://cribl.io/blog/whats-new-4-19 Wed, 22 Jul 2026 09:00:00 GMT Cribl 4.19 adds an app framework, embedded MCP server, multi-region Workspaces, and new Snowflake/BigQuery/Bedrock destinations. • New app framework lets teams build and install custom UIs, dashboards, and workflow shortcuts directly inside Cribl using Cribl APIs and AI-assisted tools like Cursor, importable via files, URLs, or Git repos. • Cribl-managed MCP server is now embedded in the Cribl Leader as a first-class platform feature, enabling MCP-compatible AI tools and agents to connect using existing auth and access controls — no separate Docker deployment required. • Cribl Insights now supports monitoring, metrics, and alerting for non-main Workspaces (dev, test, and production environments), not just the main Workspace. • Multi-region Workspace provisioning allows Workspaces to be created in any supported region independently of the Organization region, supporting data residency, sovereignty, and compliance requirements. • Centralized credentials support lets teams define credentials once in HashiCorp Vault or Cribl's built-in secret store and reuse them across Stream and Edge, reducing credential sprawl. • Expanded public API adds Edge-focused endpoints for programmatic management of Edge Nodes, configuration pushes, and lifecycle operations suitable for CI/CD and infra-as-code pipelines. • Schedule Jitter for Search introduces a configurable random delay on scheduled searches to spread execution across the hour and reduce burst load. • Native Amazon Bedrock Source tile in Stream ingests Bedrock model invocation logs and CloudTrail audit logs via an S3/SQS pattern using the cribl-aws-bedrock-io Pack. • Native Snowflake Destination enables direct streaming into Snowflake's streaming service without Kafka or S3 intermediaries, configurable per table. • Native Google BigQuery Destination streams data directly from Cribl Stream into BigQuery tables, supporting project, dataset, table, location, ingestion mode, and authentication configuration — no GCS hop required. • Native IBM Cloud Object Storage Destination sends data directly to IBM COS with a purpose-built integration rather than generic S3 compatibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://cribl.io/blog/cribl-mcp-server-interact-with-cribl-using-the-ai-tools-you-already-use https://cribl.io/blog/cribl-mcp-server-interact-with-cribl-using-the-ai-tools-you-already-use Wed, 22 Jul 2026 00:30:00 GMT Cribl 4.19 embeds an MCP Server natively in the Leader, letting AI clients like Claude Code, Cursor, and OpenAI Codex CLI query configs, metrics, and Search Notebooks directly. • Adds a native, embedded MCP Server in the Cribl Leader — no separate container or service required to connect MCP-compatible AI clients. • Supports MCP-compatible clients including Claude Code, Cursor, and the OpenAI Codex CLI via remote HTTP, with no additional proxy to install. • Enables AI clients to retrieve Sources, Destinations, Worker Groups, Pipelines, metrics, and alerts directly from the Cribl environment. • Allows AI clients to connect to Cribl Search to generate and refine queries, retrieve results, and create or update Search Notebooks. • Supports building AI-powered runbooks and security playbooks as Notebooks that combine queries, Markdown summaries, findings, and next steps. • Enables custom agent workflows that can query Cribl, enrich results from other systems, notify teams, and trigger approved actions — combinable with the Cribl SDK. • Enforces existing Cribl RBAC and bearer-token authentication for every MCP tool call, with no separate MCP permission model to configure. • Supports Cribl.Cloud, on-premises, and hybrid deployments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4182/ https://docs.cribl.io/stream/release-notes/release-v4182/ Wed, 24 Jun 2026 00:00:00 GMT Cribl Stream 4.18.2 adds Google Cloud Observability destination, Apps RBAC, `cribl diag connect`, SOCKS proxies for Outpost Nodes • Adds `Google Cloud Observability Destination` for sending OpenTelemetry metrics, logs, and traces to Google Cloud. • Adds RBAC control for Apps (Preview) to restrict user and team access per App. • Adds `cribl diag connect` CLI command to test Leader connectivity from managed Stream Workers and Edge Nodes. • Enables SOCKS proxy support for Outpost Node communication with the Leader. Breaking changes: • Single-item GET requests in the Cribl.Cloud API now return `HTTP 404 Not Found` for unknown IDs instead of `HTTP 200 OK` with an empty `items` array. • The `CRIBL_OUTPOST_LISTENER_URL` environment variable is deprecated due to Outpost listener service startup fixes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4180/ https://docs.cribl.io/stream/release-notes/release-v4180/ Wed, 20 May 2026 00:00:00 GMT Cribl Stream 4.18.0 adds MCP integrations, new sources/destinations, S3-backed persistent queues, and Guard AI models • `MCP Integrations` for Cribl AI enables external Model Context Protocol servers via endpoint URLs with auth headers and API keys • `Cribl Copilot Chatbot Toggle` in `AI Settings` dashboard allows admins to enable or disable the chatbot widget independently of other AI features • New `Azure Event Hubs AMQP Source` ingests events via Event Hubs’ native AMQP protocol • New `Okta Source` enables collection of Okta system logs using the Okta Management API • New `OpenAI Compliance Logs Source` (Platform Source) collects compliance and observability logs for ChatGPT Enterprise deployments • New `Anthropic Compliance API (Claude Compliance API) Source` collects compliance data from Anthropic’s Enterprise Compliance API • New `ServiceNow Table API Source` ingests records from ServiceNow’s Table API • `S3-Backed Shared Persistent Queue Storage` allows Worker Groups to use AWS S3 or S3-compatible storage as a centralized backing store for PQs (on-prem/hybrid only) • `Cribl Guard Detection Analysis and Model Selection` introduces agentic Guard analysis with new privacy models selectable in the `Detection model` drop-down on the `Guard` page • New Apps (Preview) feature allows building and running custom packaged UI experiences that call Cribl and third-party APIs • `REST Collector Interactive Debug Mode` captures full HTTP request/response details for authentication, discovery, and collection phases • New Buffer size limit (bytes) setting for Source and Destination persistent queues replaces the deprecated event-based limit • New `orphanedJobTTL` parameter in UI or `job-limits.yml` configures Job Reaper removal time for orphaned Collection jobs (default: 7d) • `Number of connection listener processes` setting in Outpost Group configuration defines connection processes for Outpost Nodes • `Max log files per type` in UI or `-l` argument for `./cribl diag create` CLI specifies max rotated log files in diagnostic bundles • OpenTelemetry Destination now supports dynamic metadata for gRPC protocol and OAuth2 Client Credentials for HTTP protocol • Wiz Defend Destination adds new `Wiz Source Type` options: AWS VPC Flow Logs, AWS Resolver Query Logs, OCI Audit Logs • ClickHouse Destination now supports up to 25 MB `Body Size Limit` for write batches (increased from 10 MB) • Google Cloud Pub/Sub Destination maps event’s `attributes` field to native Pub/Sub message attributes on publish • Prometheus Remote Write integrations use the v2 parser by default for on-prem deployments • File Monitor Event breakers now persist state across restarts for custom header-based and stateful breakers • Journal Files Sources have new `Suppress errors when search path does not exist` option • Prometheus Scraper Source supports HTTP-based service discovery and new `Use field per metric` setting • Datadog Agent Source now supports ZSTD-compressed logs (aligns with Datadog Agent 7.67.0+) • OpenTelemetry Source (HTTP) supports configuration of multiple authentication tokens • Wiz API Source adds content types for Detections, Application Endpoints, Cloud Resources V2, and configurable event breakers • Microsoft Graph Source supports state tracking using Graph delta queries • Expanded Pack Variables allow use within simple arrays and across Collectors, Sources, and Destinations • `Pack Notifications` feature allows configuring and managing Notifications for Sources and Destinations directly within the Pack context Breaking changes: • API responses for `/system/settings`, `/system/settings/auth`, and `/lib/database-connections` no longer include plaintext `bindCredentials` or `client_secret`; values are omitted or masked. • The `Disable Node persistence` setting is deprecated and will be removed in 4.19.0. • The Buffer size limit (events) setting for persistent queues is deprecated in favor of the byte-based limit; fully removed in an upcoming release. • The `Tee Function` is deprecated in Cribl Stream and Cribl Edge; disabled by default for new installations and will require Support enablement in a future release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4171/ https://docs.cribl.io/stream/release-notes/release-v4171/ Wed, 22 Apr 2026 00:00:00 GMT Cribl Stream 4.17.1 adds IP allowlisting for API credentials, M365 GCC High/DoD/China support, gzip compression for Cortex XSIAM Destinations, and Databricks custom workspace • Adds `IP Allowlist` option in Cribl.Cloud UI to restrict API access for API Credentials to specific IPv4 CIDR ranges • Expands Microsoft Graph Source to support Microsoft 365 GCC High, DoD, and China cloud deployments via a new endpoint selector dropdown • Adds `gzip` compression setting to the Cortex XSIAM Destination tile to reduce egress costs • Adds configurable workspace host in Databricks Destination for government and secure cloud environments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4170/ https://docs.cribl.io/stream/release-notes/release-v4170/ Wed, 11 Mar 2026 00:00:00 GMT Cribl Stream 4.17 adds Microsoft Graph Source, OpenAI Source, Cribl Search Destination, custom AI providers, and Pack cross-routing. • Adds `Microsoft Graph Source` to replace the legacy Message Trace Source for M365 data ingestion • Adds `OpenAI Source` to ingest model invocation and audit logs for governance • Adds `Cribl Search Destination` which targets the `local_search` endpoint in Cribl.Cloud • Adds Custom AI Provider support (BYOM) via `AI Settings` at Workspace/Global level • Makes `Cribl MCP Server` generally available on-prem and cloud for AI assistant integration • Allows routing from global Sources to Packs containing Destinations and vice versa Breaking changes: • Pack IDs must be entirely lowercase; the system now validates uniqueness based on lowercase strings. • The legacy Microsoft Message Trace Source is deprecated; users must migrate to the new Microsoft Graph Source before May 2026. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4160/ https://docs.cribl.io/stream/release-notes/release-v4160/ Wed, 28 Jan 2026 00:00:00 GMT Cribl Stream 4.16 adds VNet Flow Logs Event Breaker, Wiz Defend Destination, Outpost Groups, and Configurable TTL Log Levels • Adds `Azure Virtual Network (VNet) Flow logs` Event Breaker type for parsing Microsoft's recommended successor to NSG Flow logs • Adds `Wiz Defend Destination` using an HEC-compatible HTTPS endpoint for direct log and metric delivery • Adds `Outpost Groups` with configurable disconnected retention time, filtering tags, and target product version settings • Adds TTL (time-to-live) setting support in on-prem deployments to temporarily change log levels for up to 24 hours • Adds Directory batch size setting to Amazon S3, Amazon Security Lake, Azure Blob Storage, Azure Data Explorer, Exabeam, Filesystem/NFS, Google Cloud Storage, and MinIO Destinations • Adds `Enable Source IP Spoofing` setting to Netflow Destination to preserve original Source IP from `__srcIpPort` • Adds `Salt file hash` toggle to File Monitor to differentiate files with identical hashes • Adds `Use legacy collection for LastLog` option in System State Source (Linux) Advanced Settings • Adds HTTP Connection Timeout setting to Prometheus Scraper Collector • New Monitoring charts for Sources, Destinations, Data Fields, Packs, Pipelines, Projects, Routes, Subscriptions, CPU Load, Free Memory, and Bytes In/Out now support configurable local time range pickers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4151/ https://docs.cribl.io/stream/release-notes/release-v4151/ Wed, 17 Dec 2025 00:00:00 GMT Cribl Stream 4.15.1 adds Azure Gov support for Blob Storage Sources/Destinations and per-process throttling in Cribl HTTP Destination. • Adds Azure Government cloud environment support for Azure Blob Storage Sources and Destinations when using `Client secret` or `Certificate` authentication methods. • Enables configuration of a `Throttling` rate per Worker Process in the Cribl HTTP Destination to limit output volume. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4150/ https://docs.cribl.io/stream/release-notes/release-v4150/ Wed, 19 Nov 2025 00:00:00 GMT Cribl Stream 4.15 adds Fabric Real-Time Intelligence and Databricks Destinations, Cloudflare Source, and temporary log level TTL on Cribl.Cloud • Adds `Fabric Real-Time Intelligence Destination` for sending telemetry to Microsoft Fabric Eventstreams. • Adds `Databricks Destination` for sending data to Databricks Unity Catalog volumes. • Adds `Cloudflare Source` via HEC endpoints to receive Cloudflare Logpush data. • Adds `Cloudflare R2 Destination` for S3-compatible object storage delivery. • Adds configurable TTL setting on Cribl.Cloud to temporarily change log levels for up to 24 hours. • Extends `Cribl Outpost` to route control plane communication from Stream Workers. • Adds `Enable Source IP Spoofing` setting to Syslog Destination (UDP only) to preserve original Source IP. • Adds `Force close on shutdown` setting to Filesystem, S3, Azure Blob, GCS, and Minio Destinations. • Adds `Minimum age duration` and `Apply filename allowlist internal to archive files` settings to File Monitor Source. • Adds ZSTD compression support for Kafka, Confluent Cloud, and Amazon MSK Sources and Destinations. • Adds RBAC labeling support to Google Cloud Chronicle API Destination. • Adds `Directory batch size` setting to S3, Azure Blob, GCS, and Minio Destinations on Cribl.Cloud. • Adds Zscaler Cloud NSS Source integration with expanded metrics. Breaking changes: • The `Azure Monitor Log Destination` is deprecated; use `Microsoft Sentinel Destination` instead. • The previous `Age duration limit` setting in File Monitor Source is renamed to `Maximum age duration`. • Schema type selection in the UI for Confluent Cloud and Kafka Sources/Destinations is removed as schema detection is now automatic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4141/ https://docs.cribl.io/stream/release-notes/release-v4141/ Thu, 23 Oct 2025 00:00:00 GMT Cribl Stream 4.14.1 adds Google Cloud Chronicle API Destination, SSO for multiple orgs, and gRPC encrypted private keys. • Adds `Google Cloud Chronicle API` Destination with `v1alpha ImportLogs` ingestion method for per-event labeling and improved scaling • Enables `SSO authentication for multiple Organizations` sharing the same email domain in Cribl.Cloud • Introduces `IAM Admin Permission` at the Organization level to manage SSO and members without data engineering access • Adds `Passphrase` setting in TLS configuration for gRPC encrypted private keys in Model Driven Telemetry and OpenTelemetry Sources • Adds `Key Prefix` column to Amazon S3 Destination configuration tables for auditing • Adds `Validate and correct log name` option to Google Cloud Logging Destination to sanitize illegal characters • Adds `Get auth token from header` setting to REST Collector Login methods to support JWT in Authorization header • Makes Cribl Guard available in on-prem and hybrid deployments of Cribl Stream • Adds credit spend projection charts per-product and product-specific tabs in FinOps Center Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4140/ https://docs.cribl.io/stream/release-notes/release-v4140/ Wed, 17 Sep 2025 00:00:00 GMT Cribl Stream 4.14 adds Cribl Guard scanning, Terraform provider, Wiz Webhook Source, and more. • `CRIBL_GIT_REMOTE_URL` environment variable allows setting a Git remote URL from the UI without restarting the Leader. • Adds `Wiz folder` in Source catalog with `Wiz Webhook Source` for collecting Wiz Defend alert data. • `C.Mask` expression supports SHA3-256 and SHA3-512 hashing algorithms for data masking. • Adds ability to drop dimensions directly from the Data Preview pane in the UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4131/ https://docs.cribl.io/stream/release-notes/release-v4131/ Wed, 13 Aug 2025 00:00:00 GMT Cribl Stream 4.13.1 adds structured metadata support for Grafana/Loki, Avro/JSON schema types for Confluent, dynamic HTTP headers for Loki, and more packs. • Adds `Schema type` setting to Confluent Cloud Source/Destinations to select `Avro` or `JSON` serialization • Adds `Enable structured metadata` toggle to Grafana/Loki Source/Destination to expose the internal `__structuredMetadata` field as string key-value pairs • Adds dynamic HTTP header support in Loki Destination by inspecting each event for a `__headers` object and batching identical values • Adds `Monitor subscription for new messages` toggle to Google Cloud Pub/Sub Source for monitoring via subscription ID only • Adds REST Collector Packs for CrowdStrike, Okta, and Microsoft O365 Breaking changes: • If you use S3 Object Lock, the Amazon S3 Destination will fail when configured to send data to an S3 bucket with default Object Lock enabled due to AWS SDK upgrade; do not upgrade until the patch release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4130/ https://docs.cribl.io/stream/release-notes/release-v4130/ Wed, 16 Jul 2025 00:00:00 GMT New SentinelOne AI SIEM Destination, Drop Dimensions function for metrics, and Stored Credentials for Oracle improve Cribl Stream's integration and processing capabilities. • Adds `SentinelOne AI SIEM` destination for direct ingestion into SentinelOne's cloud-native SIEM via a HEC-compatible endpoint. • Introduces the new `Drop Dimensions` function to remove dimensions from outgoing metrics data, reducing high cardinality and storage costs. • Adds `Stored Credentials` authentication method for Oracle Database connections to allow referencing separate secrets for username/password and connection string. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4122/ https://docs.cribl.io/stream/release-notes/release-v4122/ Wed, 18 Jun 2025 00:00:00 GMT Cribl Stream 4.12.2 adds S3 object tagging and supports Azure China cloud in Blob Storage destination. • Adds `Tag after processing` toggle to Amazon S3 Source for configuring custom static or dynamic S3 object tags • Adds `Azure Cloud` setting to Azure Blob Storage Destination to support cloud services in China Breaking changes: • Users with Read Only role must now use Admin role to fetch Leader token; `stream_reader` becomes `stream_admin` and `edge_reader` becomes `edge_admin`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4120/ https://docs.cribl.io/stream/release-notes/release-v4120/ Wed, 21 May 2025 00:00:00 GMT Cribl Stream 4.12 adds disk-based lookups, Copilot editor, foldkeys function, workspace data transfer, and improved billing/metrics visibility • Adds Disk-Based Lookups as an alternative to in-memory lookups for optimizing memory usage across Worker Processes • Introduces the Copilot Editor with interactive plain-language prompting to generate Regex or JavaScript Expressions for Pipelines • Adds the `foldkeys` Function to transform flat field names with common separators into nested objects • Expands Cribl.Cloud billing portal with labeled tabs for credit/usage stats, detailed product consumption tables, and an invoice export tab • Introduces Configurable Metrics Levels (Minimal, Basic, Detailed) in Worker Group settings and expands available metrics types • Enables Data Transfer Across Workspaces or Environments using Cribl TCP or HTTP Source/Destination pairs for non-shared Leader workers • Enhances Packs to support Sources, Destinations, and Event Breakers with exportable end-to-end solutions and Pack-level metrics • Improves Import Packs from Git feature with write-back capability for round-trip Git integration • Updates Helm chart to configure Kubernetes Service Account for Leader deployment IAM role binding • Adds `encoding` parameter to Cribl HTTP Source JSON configuration (e.g., `"encoding": "utf8"`) for character encoding support • Adds `Enable enhanced TLS handshake for proxy protocol` toggle in Syslog Source to preserve source IP/port via PROXY headers Breaking changes: • Persistent queueing (PQ) is no longer available in the free tier of Cribl Stream and requires Standard or Enterprise license plans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4111/ https://docs.cribl.io/stream/release-notes/release-v4111/ Wed, 23 Apr 2025 00:00:00 GMT Cribl Stream 4.11.1 adds Cortex XSIAM Destination with format parsing and batching • Adds the `Cortex XSIAM Destination` to bridge security alert and audit log data into Palo Alto Networks’ Cortex XSIAM platform • Increases the RPC timeout limit to improve reliability when downloading upgrade packages from the CDN (cdn.cribl.io) • Enables ownership transfer for Packs published in the Cribl Packs Repository Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4110/ https://docs.cribl.io/stream/release-notes/release-v4110/ Wed, 26 Mar 2025 00:00:00 GMT Cribl Stream 4.11 introduces Metrics Pipeline Builder, new Aggregate Metrics Function, and Kinesis ListShards validation. • Adds a new `Metrics Pipeline Builder` in the UI to automate dropping or aggregating metrics from Data Preview. • Adds a new `Aggregate Metrics Function` supporting StatsD, Prometheus, and OTLP for pre-aggregation. • Adds `Indexed Fields` support with JavaScript expressions in the Google Cloud Logging Destination. • Adds a new `Log last schema mismatch` advanced setting in the ClickHouse Destination for troubleshooting. • Adds a `Max requests per socket` setting to the Windows Event Forwarder Source. • Adds an optional endpoint suffix parameter to Azure Blob Storage destinations for regional targeting. • Adds granular compression control for S2S v4 in Splunk TCP Source, Splunk Load Balanced Destination, and Splunk Single Instance Destination. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4101/ https://docs.cribl.io/stream/release-notes/release-v4101/ Wed, 26 Feb 2025 00:00:00 GMT Cribl Stream 4.10.1 adds `sensitiveFields` API filter, v2 Prometheus parser, and Datadog counter conversion. • Adds `sensitiveFields` configuration property to filter sensitive information in `/inputs` and `/outputs` API responses • Adds `prometheusParser: v2` config option to the Prometheus Remote Write Source for ~2.5x throughput improvement • Adds Datadog Destination option to send counter metrics as count Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v4100/ https://docs.cribl.io/stream/release-notes/release-v4100/ Wed, 29 Jan 2025 00:00:00 GMT Cribl Stream 4.10 adds Zscaler NSS source, IPFIX parsing, PIV auth, new CLI diag commands, and socket management settings. • Adds `Zscaler Cloud NSS Source` for receiving log data from Zscaler’s Nanolog Streaming Service • Adds support for IPFIX messages in the renamed NetFlow & IPFIX source, including template records and options templates • Adds Personal Identity Verification (PIV) authentication using smart cards for on-prem deployments • Adds `decrypt` function in the CLI to decrypt configuration secrets such as encryption keys and passwords • Adds `diag` subcommands (`perf`, `cpuprofile`, `heapsnapshot`) to generate CPU profiles or heap snapshots from the CLI • Adds persistent queue usage notification triggers for Sources when disk usage exceeds a threshold • Adds new socket management settings for TCP-based Sources: `Socket idle timeout`, `Socket max lifespan`, and `Forced socket termination timeout` • Adds `Partitioning scheme` drop-down option for DDSS in the S3 Collector • Adds `Blob access tier` selection for the Azure Blob Storage Destination • Adds `Compression levels` support for the Amazon S3 Destination • Adds additional realms (`us2`, `eu1`, `eu2`, `au0`, `jp0`) to the SignalFx Destination • Adds `Max active connections` setting under Advanced Settings in the Syslog Source UI • Adds `Delete files` setting on the File Monitor Source for Manual Discovery mode • Adds mapping of Teams to multiple IDP groups in Cribl.Cloud Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v491/ https://docs.cribl.io/stream/release-notes/release-v491/ Wed, 06 Nov 2024 00:00:00 GMT Cribl Stream 4.9.1 adds SNMP Trap Serialize Function, custom region endpoints for Sources/Destinations, and Cloud admin Git message customization • Adds `SNMP Trap Serialize` Function to serialize events into SNMP traps for sending via SNMP Trap Destinations. • Enables custom region endpoints for AWS, Google Cloud, and New Relic Sources and Destinations to support new cloud regions without release updates. • Allows Cribl.Cloud administrators to customize the default Git commit message when deploying changes, matching on-prem capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v49/ https://docs.cribl.io/stream/release-notes/release-v49/ Wed, 16 Oct 2024 00:00:00 GMT Cribl Stream 4.9 adds ClickHouse/Dynatrace OTLP destinations, Security Lake source, cross-region worker groups, dead-lettering, and API workspace creds. • Adds support for the `ClickHouse` destination to write data directly into ClickHouse clusters • Adds support for the `Dynatrace HTTP` (logs only) and `Dynatrace OpenTelemetry Protocol` (OTLP) destinations • Adds the `Amazon Security Lake Source` which supports receiving Amazon Simple Queue Service (SQS) data from Amazon Security Lake event subscriptions • Allows creating Cribl-managed Worker Groups in different AWS regions within Cribl.Cloud, independent of the Organization Leader's region • Adds new `KV Store` limit settings on the Leader Node to control API process resource usage • Enables creation of `API credentials` for individual Workspaces in Cribl.Cloud to manage access programmatically • Introduces a dead-lettering feature for Filesystem-based Destinations to store failed files and configure retry limits • Adds `Always On` and `Backpressure` persistent queue modes for Destinations to control disk write behavior during backpressure • Adds a `Disk space protection` setting for Filesystem-based Destinations to block or drop events when free disk space is low • Allows disabling the Script Collector across the entire deployment via the Cribl command-line interface Breaking changes: • Support for CentOS 7 on the Cribl Stream Leader and Worker Nodes is deprecated Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v482/ https://docs.cribl.io/stream/release-notes/release-v482/ Wed, 11 Sep 2024 00:00:00 GMT Cribl Stream 4.8.2 adds NetFlow v9 source/destination, CrowdStrike Falcon Next-Gen SIEM destination, and various source/destination enhancements. • Adds `NetFlow v9 Source` for collecting NetFlow records over UDP • Adds `NetFlow Destination` to route unmodified NetFlow v5/v9 data • Enables period and underscore separators in `OTLP Metrics Function` prefixes • Adds dynamic `Site name` setting via JavaScript in the Exabeam Destination • Extends `Retry Connection Timeout` and `Retry Connection Reset` options to Office 365 Message Trace, Office 365 Services, Wiz, and REST Collector sources • Enables secrets store support in the `Splunk HEC Source` for authentication tokens • Adds Azure service principal authentication for `Azure Blob Source`, Collector, and Destination • Adds `Authentication URL` and `audience` customization in the Wiz Source • Enables random partition assignment for Kafka, Confluent Cloud, Amazon MSK, and Azure Event Hubs Sources • Adds character encoding configuration (UTF-16LE, Latin-1) for Splunk Search Source and multiple Collectors • Enables IAM roles authentication for Google Cloud Pub/Sub Source and Google Cloud Storage Collector Source • Adds Dammam region (`me-central2`) support to the Exabeam Destination Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v48/ https://docs.cribl.io/stream/release-notes/release-v48/ Wed, 14 Aug 2024 00:00:00 GMT Cribl Stream 4.8 adds Azure worker groups, ServiceNow OTLP destination, HMAC auth for REST Collectors, and non-root Docker support. • Adds `Azure` as a provider option when creating new Cloud Worker Groups in Cribl.Cloud. • Adds the `ServiceNow Cloud Observability Destination` supporting OpenTelemetry Protocol (OTLP) via HTTP or gRPC. • Adds HMAC (Hash-based Message Authentication Code) Functions to the Knowledge Library for authenticating REST Collectors. • Adds `CRIBL_VOLUME_DIR` environment variable requirement for running Cribl Stream as a non-root user in Docker. • Adds `Mapping ID` setting to Teams in Cribl.Cloud for mapping Identity Provider groups. • Adds automatic memory snapshot capture setting in Group’s General Settings for hybrid/on-prem deployments. • Adds log rotation for `cribl_stderr.log` limiting files to 5 MB each with a maximum of five rotated copies. • Adds `Scale Reads` setting to the Redis function to specify read node selection (primary, replica, or both). • Adds `Enable load balancing` setting to TCP and TCP JSON Sources. • Adds `Retry Connection Timeout` and `Retry Connection Reset` settings for Splunk Search Collector/Source and Office 365 Activity Source. • Adds `Scope` setting to the renamed Microsoft Sentinel Destination. Breaking changes: • The `Azure Sentinel Destination` has been renamed to `Microsoft Sentinel`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v472/ https://docs.cribl.io/stream/release-notes/release-v472/ Wed, 17 Jul 2024 00:00:00 GMT Cribl Stream 4.7.2 adds OTLP Traces Function, HTTP source IP allowlist/denylist regex, and new retry/config settings for sources/destinations. • `OTLP Traces Function` now available to normalize and batch OpenTelemetry trace events (supports OTLP 0.10.0 and 1.3.1) • HTTP-based Sources support `IP allowlist regex` and `IP denylist regex` options • `Retries` section added to Kafka, Confluent Cloud, Amazon MSK, and Azure Event Hubs Sources and Destinations • `Datadog Destination` uses `api/v1/distribution_points` endpoint for distribution metrics • DNS resolution period setting added to Syslog (UDP), SNMP, and Metrics (UDP) Destinations • Filesystem Destination gains `Compression level` and Writing high watermark (KB) settings • REST Collector adds `Retry-After header name` setting • Cribl.Cloud Admins can edit and delete Members and Teams via UI • Audit logs now capture filter expressions for traceability Breaking changes: • Scripts are disabled by default in new deployments; admins must explicitly enable them Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v47/ https://docs.cribl.io/stream/release-notes/release-v47/ Wed, 05 Jun 2024 00:00:00 GMT Cribl Stream 4.7 adds Universal Subscription, AuthZ Teams, Google SecOps UDM/OTel API v2 support, and SNI routing control. • Introduces `Universal Subscription` enabling on-prem Leader to Cribl.Cloud connection for centralized credit billing and consumption-based usage monitoring. • Adds `AuthZ Teams` allowing Organization- and product-level permissions assignment in customer-managed deployments, replacing Local Users and Roles. • Enables sending structured data satisfying the Unified Data Model (UDM) schema to Google Security Operations via Cribl Pipelines and Functions. • Adds support for Google Security Operations API version 2 in the SecOps Destination alongside existing version 1. • Introduces `OTLP Logs` Function supporting batching based on Resource Attributes to reduce data volume over the wire. • Updates OpenTelemetry Source and Destination to support protocol specification version 1.3.1. • Adds new setting in `cribl.yml` to disable SNI routing for specific Groups or Fleets, superseding previous `instance.yml` workarounds. • Allows REST Collector to write custom JavaScript via the new `Format discover result` option for parallel collection jobs. • Enables Oracle database connections within Database Connections for direct data retrieval. • Adds Syslog Source automatic framing type inference (transparent vs. octet-count). • Enables Splunk Load Balancer Destination to use multiple authentication tokens for indexer discovery in high-availability environments. • Adds new `shutdown.lost_events` internal metric for Worker shutdown telemetry visibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v461/ https://docs.cribl.io/stream/release-notes/release-v461/ Wed, 15 May 2024 00:00:00 GMT Cribl Stream 4.6.1 adds Wiz source, health check endpoint for HTTP sources, and token-level metrics for Splunk HEC • Adds `Wiz Source` for collecting Audit Logs, Configuration Findings, Issues, and Vulnerabilities data from the Wiz cloud security platform. • Adds `http(s)://<host>:<port>/cribl_health` endpoint to HTTP-based Sources for ALB health monitoring. • Adds `Capture response headers` setting to REST Collector to include API response headers in the `__collectible.resHeaders` object. • Adds `Emit per-token request metrics` option to Splunk HEC Source to expose token-level performance data previously limited to `metrics.log`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v46/ https://docs.cribl.io/stream/release-notes/release-v46/ Wed, 17 Apr 2024 00:00:00 GMT Cribl Stream 4.6 introduces Cribl Lake storage, Copilot AI assistant, Workspaces multi-tenancy, NetFlow V5 source, and S3/REST checkpointing. • Introduces `Cribl Lake`, a new long-term data storage product with a dedicated Collector Source for replaying data and a Cribl Lake Destination for writing. • Introduces `Cribl Copilot`, an AI assistant accessible via the teal AI icon at the bottom right of any page in Cribl.Cloud. • Enables opt-in to the new `Cribl.Cloud User Interface` with multi-tenant `Workspaces` (up to 5 isolated instances with dedicated VPCs) and `Teams` for access control. • Adds a new NetFlow Source to collect, route, and control IP traffic via Netflow V5 (UDP). • Adds `TCP Load Balancing` for the Syslog Source in Distributed mode to prevent TCP pinning across Worker Processes. • Enables `state tracking by time or arbitrary value` for REST Collectors to resume interrupted jobs with no data gaps. • Enables `S3 Source Checkpointing` to resume processing files from the last checkpoint after worker restarts or network issues. • Adds the new `system_email` preconfigured email notification target for Cribl.Cloud Enterprise customers. • Allows remote storage of `Config Bundles` in an AWS S3 bucket via the config bundle distribution settings. • Enables direct copying of Packs between Worker Groups or Fleets via the Pack management UI. • Adds a new `Advanced` format option to the Webhook Destination for integrating with unsupported APIs. • Automatically converts Kafka Source record headers from raw bytes to strings during ingestion. • Supports region-specific AWS STS endpoints using the `CRIBL_AWS_STS_REGION` environment variable on Worker Nodes. • Appends `-CLONE` to the ID when cloning a Source or Destination. • Adds a new `Staging file limit` setting to the Amazon S3 Destination to control backpressure application. • Adds a new `Number of concurrent streams` setting to the Google Pub/Sub Source. • Adds a new `Header line` setting to the Filesystem Destination to prepend text to output files. • Adds `authToken` variable support in REST Collector Collect and Discover steps for dynamic authentication. • Enables Google service account authentication with scopes and impersonation in the REST Collector. • Adds `Reuse Redis connections` Worker Group setting to manage TCP connections to Redis servers. • Adds a new optional argument `cribl_user_group` to the Leader's bootstrap script for Worker self-provisioning. • Enables tagging `Worker Groups` by keywords via the Worker Group creation or editing interface. • Replaces `Enable automatic upgrades` with `Upgrade Workers automatically` toggle in the Global Upgrade Settings UI. Breaking changes: • The Leader Node auth token is now restricted to a-z, A-Z, 0-9, and `_`; tokens containing other special characters must be updated before upgrading to 4.5.1 or newer. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v451/ https://docs.cribl.io/stream/release-notes/release-v451/ Wed, 20 Mar 2024 00:00:00 GMT Cribl Stream 4.5.1 adds UUID functions, Google Pub/Sub cross-account support, and S3 Glacier Instant Retrieval • Google Pub/Sub Source can now subscribe to topics in a project on a different service account. • Amazon S3 Destination supports the new `Glacier Instant Retrieval` storage class, with existing classes renamed to match AWS naming (`Glacier Flexible Retrieval`, `Glacier Deep Archive`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v45/ https://docs.cribl.io/stream/release-notes/release-v45/ Wed, 14 Feb 2024 00:00:00 GMT Cribl Stream 4.5 adds Model Driven Telemetry source, OTLP Metrics function, email notifications, and FIPS mode GA. • Adds `Model Driven Telemetry` Source to receive network device metrics via gRPC/protobuf • Adds `OTLP Metrics` Function to transform dimensional metrics to the OTLP data model • Adds `Email` notification target type for alerting and search notifications • Moves FIPS Mode to GA with a new CLI command for generating NodeJS configuration • Enables all HTTP Destinations to honor `Retry-After` headers via Retry Settings • Database Collector now supports state tracking for ad hoc, full, and scheduled jobs • Amazon Kinesis Data Streams Destination can send single events per record uncompressed • Exabeam Destination now sends the Exabeam Site ID metadata Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v444/ https://docs.cribl.io/stream/release-notes/release-v444/ Wed, 17 Jan 2024 00:00:00 GMT Cribl Stream 4.4.4 adds FIPS mode (beta), load-balanced webhook destinations, and exponential backoff retry for HTTP-based sinks. • Adds FIPS Mode (Beta) for Customer Managed deployments to enforce FIPS compliant cryptography and password requirements • Adds load balancing support in the `Webhook Destination` with configurable weights and IP exclusion options • Adds exponential backoff retry configuration for HTTP-based Destinations including `Google Chronicle`, `Azure Data Explorer`, `Dataset`, and `Elasticsearch` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v442/ https://docs.cribl.io/stream/release-notes/release-v442/ Wed, 06 Dec 2023 00:00:00 GMT Cribl Stream 4.4.2 adds Elastic Cloud and Exabeam Destinations with auto Parquet schema generation • Adds `Elastic Cloud` tile as a new Destination to send data directly to Elastic Cloud • Adds `Exabeam` tile as a new Destination for the Exabeam security operations platform • Enables automatic Parquet schema generation in Parquet-enabled Destinations (Filesystem, S3, Google Cloud, Azure Blob, MinIO) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v44/ https://docs.cribl.io/stream/release-notes/release-v44/ Wed, 08 Nov 2023 00:00:00 GMT Cribl Stream 4.4 adds ADX destination, PQ disk guardrails, and SAML encoding expressions • Adds Azure Data Explorer (ADX) as a native Destination for sending security and observability data directly to Azure. • Adds `System Metrics` Source support for configuring Process Metrics reports filtered by specific running processes. • Adds `C.Decode.inflate` and `C.Encode.deflate` expressions for handling data types like intercepted SAML logs. • Enables Elasticsearch Destination to update Datasets via the `index` Write action for replacing events in legacy indexes. Breaking changes: • Upgrading Groups to Cribl Stream 4.4+ sets undefined PQ `Max queue size` values in Source/Destination configs to a new 5 GB default. • The highest accepted value for PQ `Max queue size` is now constrained by the `Group Settings` > `General Settings` > `Limits` > `Storage` > `Max PQ size per Worker Process` field, with the corresponding `limits.yml` key being `maxPQSize`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v431/ https://docs.cribl.io/stream/release-notes/release-v431/ Wed, 11 Oct 2023 00:00:00 GMT Cribl Stream 4.3.1 adds Parquet ingestion to Azure/Google collectors, SNMPv3 for SNMP sources, and SNS/Slack notification targets. • Adds `Parquet` format support for data ingestion and replay in the Azure Blob Storage Collector and Google Cloud Storage Collector • Adds Amazon SNS as a Notification target • Adds Slack as a Notification target • Adds SNMPv3 user authentication and data privacy support to the SNMP Source • Enables multiple users via SNMPv3 for the SNMP Trap Source, allowing receipt of traps from devices with different credentials Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl https://docs.cribl.io/stream/release-notes/release-v43/ https://docs.cribl.io/stream/release-notes/release-v43/ Wed, 13 Sep 2023 00:00:00 GMT Cribl Stream 4.3 adds global banners, Parquet ingestion, GCS Service Account auth, and Chain Function performance gains. • Adds ability to define a global banner visible across all Cribl Suite products via UI notifications • Enables automatic in-app license expiration warnings starting 30 days before expiry without manual config • Supports creating Cribl.Cloud Organizations in the AWS Europe (Frankfurt) Region • Adds on-hover tooltips for Permission options and a numeric Members indicator/link in the Data Projects tab UI • Enables S3 and Filesystem Collectors to ingest and replay data stored in Parquet format • Adds GCP Service Accounts and IAM roles authorization support for the Google Cloud Storage Destination • Enhances metadata and logging capabilities in the Exec Source • Diagnostice bundles now indicate whether they were generated from a Worker or Leader node • Promotes Chain Function cycle detection to configuration time for improved performance Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl