https://cybertoolchain.io/tools/tenzir New releases and features in Tenzir, tracked by The Cyber Toolchain. en Fri, 30 Oct 2026 00:00:00 GMT https://tenzir.com/changelog/tenzir/v6.20.1/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir/v6.20.1/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Fri, 30 Oct 2026 00:00:00 GMT Tenzir now pushes more SentinelOne filter conditions server-side and writes fewer small files with `to_iceberg`⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Tenzir's `to_iceberg` operator now writes fewer small data files, reducing object-store overhead for Iceberg table sinks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Tenzir now pushes more SentinelOne filter conditions inside disjunctions to the SentinelOne side, reducing data transferred to the node. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.20.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir/v6.20.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Mon, 26 Oct 2026 00:00:00 GMT Tenzir v6.20.0 adds a new heterogeneous-list data model, `ai_decide` typed decisions, secrets in function args, DuckDB/ClickHouse/Hydrolix integrations, and encryption functi⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `ai_decide` operator with typed decisions and a new `Decisions` endpoint, plus Cloudflare Workers AI and OpenAI backends.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `type_kind` function to inspect a value's type, Luhn check digit and CRC-32 checksum functions, OCSF functions, and functions for record conversion to key-value entries and record values as a list. • Adds encryption functions and Parquet encryption with a shared AES key. • Adds secrets as function arguments, secret keys for `hmac` with secrets censored on assignment, and secret seeds for Crypto-PAn anonymization. • Adds named in-memory DuckDB databases with the ability to read from and write to DuckDB databases. • Adds Windows Event Forwarding support without requiring a Windows collector. • Adds SentinelOne Data Lake API keys, summaries computed in SentinelOne, and filter and time-window pushdown for SentinelOne via the console API. • Adds support for reading events from ClickHouse catch-all tables. • Adds Suricata schema types for NTP, LDAP, LLMNR, DNP3, drop, and frame events. • Adds PRI-prefixed text and Cisco syslog header parsing. Breaking changes: • `append` is now the default mode for `to_clickhouse`, changing prior insert behavior on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://docs.tenzir.com/changelog https://docs.tenzir.com/changelog Fri, 23 Oct 2026 11:17:46 GMT Tenzir: Adds machine credentials for organizations in the Tenzir Platform (v1.41.0), enabling non-interactive, programmatic authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports slow node startups in Tenzir Helm Charts (v0.2.0). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir-helm-charts/v0.2.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir-helm-charts/v0.2.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Thu, 22 Oct 2026 00:00:00 GMT Tenzir Helm Charts v0.2.0 adds an optional startup probe for nodes with large partition catalogs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an optional startup probe to give nodes with large partition catalogs time to initialize before Kubernetes liveness checks begin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Kubernetes version labels now reflect the configured image tag. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/platform/v1.41.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/platform/v1.41.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Thu, 22 Oct 2026 00:00:00 GMT Tenzir Platform v1.41.0 adds machine credentials for organizations: federated OIDC workload identity and service tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds organization service tokens to cover automation use cases such as the Terraform provider, with immediate invalidation on revocation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds federated credentials for workload identity, letting workloads such as GitHub Actions authenticate using their own OIDC tokens instead of a stored secret. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir-skills/v4.0.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir-skills/v4.0.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Thu, 22 Oct 2026 00:00:00 GMT Tenzir Skills v4.0.0 adds Codex and Claude Code plugin support and rebuilds the OCSF skill on structured YAML schema data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Codex plugin support, enabling Tenzir Skills to run inside the Codex environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Claude Code plugin support, enabling Tenzir Skills to run inside Claude Code. • Adds OCSF release notes surfacing inside the OCSF skill. • Rebuilds the OCSF skill on structured YAML schema data sourced from the official OCSF compiler, replacing the previous schema representation. Breaking changes: • The package management skill has been removed from the public collection. • The developer skills have been removed from the public collection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.20.0-rc.4/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir/v6.20.0-rc.4/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Wed, 21 Oct 2026 00:00:00 GMT Tenzir v6.20.0-rc.4 ships a new heterogeneous-list data model, `ai_decide` typed decisions, encryption functions, and a wave of new source/sink integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `ai_decide` operator with typed decisions and a dedicated `Decisions` endpoints configuration, plus `Default ai_prompt input without earlier AI results` behavior change.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `type_kind` function for inspecting value types in pipelines. • Adds encryption functions and support for secrets as function arguments, including `Secret keys for hmac` and Parquet encryption with a shared AES key. • Adds `Luhn check digits` and `CRC-32 checksums` functions. • Adds `OCSF functions` for Open Cybersecurity Schema Framework support. • Adds `from_clickhouse` with `Map columns` support and catch-all table reads, plus summaries computed in ClickHouse. • Adds support for reading from and writing to DuckDB databases, including named in-memory DuckDB databases. • Adds Windows Event Forwarding without requiring a Windows collector. • Adds filter, projection, and limit pushdown for MySQL and SQL Server, and for Microsoft Defender and Log Analytics. • Adds filter and time-window pushdown for SentinelOne, plus SentinelOne Data Lake API keys and summaries computed in SentinelOne. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir-test/v2.3.1/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir-test/v2.3.1/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Wed, 21 Oct 2026 00:00:00 GMT Tenzir Test v2.3.1 adds automatic package loading for Python tests, matching existing TQL test behavior.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Python tests now automatically load their enclosing package and configured package directories, matching the behavior already available in TQL tests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Python executors now capture package settings at construction time, so explicit environment mappings reliably select packages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.20.0-rc.3/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir/v6.20.0-rc.3/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Thu, 15 Oct 2026 00:00:00 GMT Tenzir v6.20.0-rc.3 ships a new data model, typed AI decisions, encryption/secret functions, and a wave of new source/sink integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `ai_decide` operator with typed decisions and dedicated `Decisions` endpoints, so pipelines can branch on structured AI-evaluated results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds secrets as function arguments and `Secret keys for hmac`, enabling secret-backed HMAC signing inside pipeline expressions. • Adds `Luhn check digits`, `CRC-32 checksums`, `OCSF functions`, and `Encryption functions` as new built-in functions for pipeline expressions. • Improves ClickHouse integration with `from_clickhouse` `Map columns` support via `map columns in from_clickhouse`, reading from ClickHouse `catch-all tables`, and `Append as default mode for to_clickhouse`. • Adds `Windows Event Forwarding` ingestion without requiring a Windows collector and `Write metrics to Google Cloud Monitoring` as a new metrics sink. • Adds `Named in-memory DuckDB databases` with read/write support via the DuckDB operators. • Improves the SentinelOne integration with `SentinelOne Data Lake API keys` authentication, `Filter and time-window pushdown` for SentinelOne queries, and `SentinelOne queries through the console API` as an alternative query path. • Adds `Summaries computed in DuckDB`, `ClickHouse`, `MySQL`, `SQL Server`, `SentinelOne`, and through source renames/projections, expanding pushdown aggregation to six backends. • Adds `Parallel load balancing` across pipeline branches. • Adds `Filter, projection, and limit pushdown` for MySQL and SQL Server data sources. Breaking changes: • `Append` is now the default mode for `to_clickhouse`, which changes the write behaviour for existing pipelines that previously relied on a different default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://docs.tenzir.com/changelog https://docs.tenzir.com/changelog Tue, 13 Oct 2026 08:06:42 GMT Tenzir v6.20.0-rc.2 introduces a new data model for faster pipelines; Platform v1.40.2 adds Explorer support for it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces a new data model in Tenzir Node v6.20.0-rc.2 designed for faster pipeline execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds scrolling and error details to the Explorer in Tenzir Platform v1.40.1. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.20.0-rc.2/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir/v6.20.0-rc.2/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Mon, 12 Oct 2026 00:00:00 GMT Tenzir v6.20.0-rc.2 ships a new data model with heterogeneous lists, typed AI decisions via `ai_decide`, secrets in function arguments, and encryption functions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `ai_decide` operator with typed decisions, pairing with new Cloudflare Workers AI and OpenAI Decisions endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds secrets as function arguments, including `secret keys` for `hmac` and `secret seeds` for Crypto-PAn. • Adds new pipeline functions: encryption functions, `Luhn` check digit and `CRC-32` checksum functions, and functions to convert records to key-value entries and record values to a list. • Adds `Windows Event Forwarding` support without requiring a Windows collector, and read and write support for named in-memory `DuckDB` databases. • Adds filter, projection, and limit pushdown for `MySQL` and `SQL Server` sources; filter and time-window pushdown and queries through the console API for `SentinelOne`; and case-insensitive prefix/suffix filters and regular expression filters in `ClickHouse` and `DuckDB`. • Adds best-effort platform pipeline telemetry. • Adds new Suricata schema types for NTP, LDAP, LLMNR, DNP3, drop, and frame events. • Introduces a new data model that allows lists to hold values of different types and makes pipelines faster. • Adds narrower input reads for aggregations to reduce data scanned, bounded memory for limited sorting, and the ability for filters to move through assignments and drop and fold constants, improving pipeline efficiency. • Adds diagnostics for Kafka offset test failures. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.20.0-rc.1/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir/v6.20.0-rc.1/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Fri, 09 Oct 2026 00:00:00 GMT Tenzir v6.20.0-rc.1 ships a new data model, typed AI decisions, encryption functions, and DuckDB read/write support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds typed decisions with `ai_decide`, enabling structured, type-safe outputs from AI decision steps in pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds named in-memory DuckDB databases with read and write support via the new DuckDB integration. • Adds `hmac` secret keys and Crypto-PAn secret seeds as function arguments, expanding secrets into cryptographic functions. • Adds encryption functions to the pipeline expression language. • Adds Luhn check digit and CRC-32 checksum functions. • Adds filter, projection, and limit pushdown for MySQL and SQL Server connectors. • Adds filter and time-window pushdown for SentinelOne. • Adds SentinelOne queries through the console API. • Adds Windows Event Forwarding support without requiring a Windows collector. • Adds record conversion to key-value entries and record values as a list in the data model. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/platform/v1.40.2/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/platform/v1.40.2/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Fri, 09 Oct 2026 00:00:00 GMT Tenzir Platform v1.40.2 updates the Explorer to group events by schema name with accurate per-name counts under the new data model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Explorer now groups events by schema name and displays accurate per-name counts, even when field sets differ across events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://docs.tenzir.com/changelog https://docs.tenzir.com/changelog Sun, 04 Oct 2026 07:49:34 GMT Tenzir v6.19.0 adds ClickHouse catch-all columns and Avro encoding; Tenzir Test gains structured CI reports and selective warning suppression.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds catch-all column support and Avro encoding to the ClickHouse integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir-test/v2.3.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir-test/v2.3.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Sat, 03 Oct 2026 00:00:00 GMT Tenzir Test v2.3.0 adds versioned JSON test reports and tagged log records for CI-friendly failure surfacing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exports final test outcomes, failure diagnostics, and plain diffs as versioned JSON reports for CI integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds tagged log records so CI pipelines can surface failures from sandboxed builds without parsing terminal output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir-test/v2.2.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir-test/v2.2.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Fri, 02 Oct 2026 00:00:00 GMT Tenzir Test v2.2.0 adds runtime warning suppression so irrelevant warnings can be silenced without hiding errors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds runtime warning suppression for Tenzir tests, allowing irrelevant warnings to be silenced while keeping errors and compilation diagnostics visible.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • The deprecated `--multi` option has been removed; any test configurations or scripts using it will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.19.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir/v6.19.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Tue, 29 Sep 2026 00:00:00 GMT Tenzir v6.19.0 adds ClickHouse catch-all JSON columns, `print_avro` Avro binary encoding, and HTTP/archive package sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `print_avro` function to encode events as Avro binary, suitable for message sinks such as Kafka.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • The `to_clickhouse` operator now stores fields with no matching column in a native JSON catch-all column, preserving all event data in existing tables. • Supports HTTP URLs and local archives as package sources. • Adds default packet lengths in `write_pcap`. • Makes Parquet reads faster and bounded in memory. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://docs.tenzir.com/changelog https://docs.tenzir.com/changelog Fri, 25 Sep 2026 07:51:37 GMT Tenzir v6.18.0/v1.40.0 adds Azure managed identity for Key Vault and parallel processing across transforms and sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables parallel processing across transforms and sources in the Tenzir Node. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/platform/v1.40.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/platform/v1.40.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Wed, 23 Sep 2026 00:00:00 GMT Tenzir Platform v1.40.0 adds Azure managed identity auth for Key Vault secret stores and JSON output to the workspace creation CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a JSON output flag to the workspace creation CLI command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports Azure managed identity authentication for Key Vault secret stores, eliminating the need for long-lived client secrets in workspace configuration. • Enables force stopping of Explorer pipelines. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.18.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir/v6.18.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Tue, 22 Sep 2026 00:00:00 GMT Tenzir v6.18.0 adds parallel pipeline execution, a recursive `search` function, and restores SentinelOne Data Lake operators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `search` function for recursive value matching across pipeline data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds experimental warning suppression via `quiet`. • Enables parallel execution for asynchronous transforms, increasing throughput for DNS, context, and Python workloads. • Enables parallel competing-consumer sources, increasing throughput for AMQP and Google Cloud Pub/Sub workloads. • Provides position-independent static Linux binaries. Breaking changes: • The legacy non-neo executor has been removed; pipelines relying on the legacy executor must migrate to the neo executor. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://docs.tenzir.com/changelog https://docs.tenzir.com/changelog Tue, 15 Sep 2026 13:01:28 GMT Tenzir adds parallel data movement, deeper pushdown, on-demand schema loading, and automatic Sigma matching for OCSF⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds parallel data movement and deeper operator pushdown in Tenzir Node v6.17.0 to accelerate pipeline throughput.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds on-demand schema loading in Tenzir Platform v1.39.2, enabling schemas to be fetched as needed rather than preloaded. • Adds automatic Sigma rule matching for OCSF-formatted events in Tenzir Node v6.16.0, extending detection coverage to OCSF schemas without manual mapping. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.17.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir/v6.17.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Fri, 11 Sep 2026 00:00:00 GMT Tenzir v6.17.0 adds parallel Kafka and HTTP sink execution, KQL query sources for Defender and Azure Log Analytics, and deeper pushdown for ClickHouse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Parallelizes Kafka operators to increase pipeline throughput across partitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Microsoft Defender advanced hunting as a KQL query source for pipelines. • Adds Azure Log Analytics as a KQL query source for pipelines. • Supports parallel requests for HTTP-based sinks to accelerate data movement. • Expands `from_clickhouse` with Time, IP, and function pushdown to reduce data transfer at the source. • Pushes projections through nested pipelines to reduce intermediate data volume. • Broadens pipeline pushdown through transforms for wider coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/platform/v1.39.2/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/platform/v1.39.2/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Thu, 10 Sep 2026 00:00:00 GMT Tenzir Platform v1.39.2 adds on-demand schema loading in the Explorer, fetching field definitions only when a schema is first expanded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Explorer now loads stored schema names and event counts on demand, fetching field definitions only when a schema is first expanded and caching them until a manual refresh.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Explorer opens the Results tab by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://docs.tenzir.com/changelog https://docs.tenzir.com/changelog Tue, 08 Sep 2026 07:44:40 GMT Tenzir v6.15.0 adds Splunk HEC acknowledgement support to the Tenzir Node. • Adds Splunk HEC acknowledgement support to the Tenzir Node, enabling confirmed event delivery over the HTTP Event Collector protocol. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.16.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir/v6.16.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Tue, 08 Sep 2026 00:00:00 GMT Tenzir v6.16.0 adds automatic Sigma-to-OCSF matching, Microsoft 365 collection, Kafka Avro with Schema Registry, and more. • Adds `from_clickhouse` operator that pushes filters, limits, and field selection into SQL for efficient ClickHouse queries. • Adds automatic matching of stock Sigma rules against OCSF (Open Cybersecurity Schema Framework) events without manual mapping. • Adds query parameters support for web identity token endpoints, expanding identity federation options. • Adds Entra workload identity federation support for Azure Blob Storage. • Adds a Microsoft 365 audit activity collector to ingest M365 events into the pipeline. • Adds Kafka Avro decoding with Schema Registry integration. • Adds a blob conversion function for binary data handling. • Adds limit and field selection pushdown toward sources to reduce data transferred from upstream. • Includes source locations in node startup diagnostics for easier troubleshooting. • Improves catalog lookups with a faster match-all path. • Improves Sigma rule diagnostics to point directly at the offending rule. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.15.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed https://tenzir.com/changelog/tenzir/v6.15.0/?utm_source=tenzir&utm_medium=feed&utm_content=changelog-feed Wed, 02 Sep 2026 00:00:00 GMT Tenzir v6.15.0 adds Splunk HEC acknowledgements, Avro decoding, and full parallelism options for `to_google_secops` • Adds `read_avro` operator and `parse_avro` function to decode raw Avro data. • Adds support for the Splunk HEC acknowledgement protocol, preserving delivery guarantees across node restarts. • Extends `parallel` to accept all parallelism options, enabling finer-grained control over concurrent execution. • Adds independent Google SecOps output instances via parallelized `to_google_secops`. • Delivers up to 9x faster event branching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/platform/v1.39.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-platform-v1-39-0 https://tenzir.com/changelog/platform/v1.39.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-platform-v1-39-0 Fri, 28 Aug 2026 00:00:00 GMT Tenzir Platform v1.39.0 adds Explorer display options, custom timestamp field selection, schema browsing, and field-level value frequency previews. • Adds display options for the Explorer Stream view, giving users new ways to control how streaming data is rendered. • Adds custom timestamp field selection for Explorer time ranges, letting users choose which field drives time-based filtering. • Adds node schema browsing in the Explorer so users can inspect stored schemas without leaving the interface. • Adds field actions and cached value insights in the Explorer, enabling frequency previews and contextual actions directly on fields. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://docs.tenzir.com/changelog https://docs.tenzir.com/changelog Mon, 24 Aug 2026 14:30:49 GMT Tenzir v6.13.0 brings parallel pipeline execution across the node, and v6.12.0 adds RELP transport for Syslog ingestion. • Supports parallel pipeline execution across the node, enabling concurrent pipeline runs in Tenzir Node v6.13.0. • Adds Syslog ingestion over RELP (Reliable Event Logging Protocol) in Tenzir Node v6.12.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir-ship/v2.2.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-ship-v2-2-0 https://tenzir.com/changelog/tenzir-ship/v2.2.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-ship-v2-2-0 Mon, 24 Aug 2026 00:00:00 GMT Tenzir Ship v2.2.0 adds forward-looking metadata policies to enforce author and PR rules on unreleased changelog entries. • Changelog projects can now require authors and reject pull request metadata in unreleased entries, with validation applied to unreleased entries by default and an explicit full-history audit mode also available. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir-test/v2.1.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-test-v2-1-0 https://tenzir.com/changelog/tenzir-test/v2.1.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-test-v2-1-0 Sun, 23 Aug 2026 00:00:00 GMT Tenzir Test v2.1.0 adds format-aware sorting that keeps multiline record blocks intact during test output comparison. • Applies pre-compare transforms consistently across the shell, Python fixture, and diff runners before baseline comparison. • Keeps multiline record blocks intact when sorting test output, stabilizing nondeterministic event ordering. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.13.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-13-0 https://tenzir.com/changelog/tenzir/v6.13.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-13-0 Sat, 22 Aug 2026 00:00:00 GMT Tenzir v6.13.0 adds native OTLP ingestion, node-wide pipeline parallelism, and parallel file-reading operators. • Adds native OpenTelemetry Protocol (OTLP) ingestion, enabling direct ingest of traces, metrics, and logs from OTLP sources. • Introduces node-wide parallelism so pipeline execution scales across the full node, covering file ingestion and periodic aggregation. • Parallelizes file-reading operators, allowing multiple files to be read concurrently within a pipeline. • Reworks the `parallel` operator for improved behaviour and reliability. • Adds parallel `summarize` with periodic emission, enabling concurrent aggregation alongside time-based output. • Delivers faster `summarize` performance on interleaved group keys. • Adopts flat names for built-in operators and functions. • Runs sequential pipelines without fused channels. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir-test/v2.0.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-test-v2-0-0 https://tenzir.com/changelog/tenzir-test/v2.0.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-test-v2-0-0 Wed, 19 Aug 2026 00:00:00 GMT Tenzir Test v2.0.0 adds deterministic diagnostic baselines and node output capture for easier integration test diagnosis. • Records diagnostics before pipeline output in test baselines, making baseline ordering deterministic. Breaking changes: • Test baselines that contain both diagnostics and pipeline output channels must be updated, as diagnostics are now recorded before pipeline output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.12.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-12-0 https://tenzir.com/changelog/tenzir/v6.12.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-12-0 Tue, 18 Aug 2026 00:00:00 GMT Tenzir v6.12.0 adds reliable Syslog ingestion over RELP with TLS/mTLS and PCAPNG capture support. • Supports receiving Syslog over RELP (Reliable Event Logging Protocol), including TLS and mutual TLS, with bounded acknowledgements and backpressure. • Adds PCAPNG capture support for network traffic ingestion. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://docs.tenzir.com/changelog https://docs.tenzir.com/changelog Mon, 17 Aug 2026 09:39:11 GMT Tenzir v6.11.0 adds Sigma 2.1 and YARA-X detection; v6.10.0 brings native time-series analytics for beacon detection. • Adds Sigma 2.1 detection support in Tenzir Node v6.11.0. • Adds YARA-X detection support in Tenzir Node v6.11.0. • Introduces native time-series analytics for beacon detection in Tenzir Node v6.10.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.11.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-11-0 https://tenzir.com/changelog/tenzir/v6.11.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-11-0 Fri, 14 Aug 2026 00:00:00 GMT Tenzir v6.11.0 adds Sigma v2.1 support, YARA-X detection findings, a `merge` operator, parallel pipeline execution, and new windowing and math functions. • Adds a `merge` operator for combining pipeline streams. • Adds named path and rules arguments for the `sigma` operator, enabling more precise rule targeting. • Full Sigma v2.1 detection support, including Sigma global filter rules and Sigma processing metrics. • Sigma matches now produce OCSF Detection Findings output. • YARA-X detection findings support, surfacing YARA-X scan results as structured findings. • Adds parallel pipeline execution for concurrent processing. • Adds processing-time, count, and trailing window types for streaming analytics. • Adds exponential, logarithmic, and power math functions. • Adds geographic distance calculations. • Adds dynamic string replacement capability. • Adds final aggregate annotations for events in streaming pipelines. • Incremental summaries for event streams. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.10.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-10-0 https://tenzir.com/changelog/tenzir/v6.10.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-10-0 Mon, 10 Aug 2026 00:00:00 GMT Tenzir v6.10.0 adds native beacon-detection analytics with cadence and periodicity functions, plus ClickHouse JSON improvements. • Adds cadence analysis functions `deltas`, `mad`, and `skewness` to TQL for research-grade beacon and anomaly detection. • Adds periodicity detection functions `autocorrelation`, `periodogram`, and `dominant_period` to TQL for identifying periodic C2 beacon patterns. • Adds non-top-level JSON column support and automatic JSON column detection to `to_clickhouse`, including detection after `ocsf::cast`. • Enables automatic NetFlow format detection for simplified ingestion pipelines. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.10.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-10-0 https://tenzir.com/changelog/tenzir/v6.10.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-10-0 Mon, 10 Aug 2026 00:00:00 GMT Tenzir v6.10.0 adds native beacon-detection analytics with cadence and periodicity functions, plus ClickHouse JSON improvements. • Adds cadence analysis functions `deltas`, `mad`, and `skewness` to TQL for research-grade beacon and anomaly detection. • Adds periodicity detection functions `autocorrelation`, `periodogram`, and `dominant_period` to TQL for identifying periodic C2 beacon patterns. • Adds non-top-level JSON column support and automatic JSON column detection to `to_clickhouse`, including detection after `ocsf::cast`. • Enables automatic NetFlow format detection for simplified ingestion pipelines. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/platform/v1.38.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-platform-v1-38-0 https://tenzir.com/changelog/platform/v1.38.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-platform-v1-38-0 Fri, 07 Aug 2026 00:00:00 GMT Tenzir Platform v1.38.0 adds pipeline search by ID and gates telemetry behind explicit user consent. • Pipeline list search box now matches on pipeline ID, letting you paste an ID to jump directly to a pipeline. • Telemetry collection is now opt-in, gated behind explicit user consent via the Account page. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/platform/v1.38.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-platform-v1-38-0 https://tenzir.com/changelog/platform/v1.38.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-platform-v1-38-0 Fri, 07 Aug 2026 00:00:00 GMT Tenzir Platform v1.38.0 adds pipeline search by ID and gates telemetry behind explicit user consent. • Pipeline list search box now matches on pipeline ID, letting you paste an ID to jump directly to a pipeline. • Telemetry collection is now opt-in, gated behind explicit user consent via the Account page. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.9.0-rc.2/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-9-0-rc-2 https://tenzir.com/changelog/tenzir/v6.9.0-rc.2/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-9-0-rc-2 Thu, 06 Aug 2026 00:00:00 GMT Tenzir v6.9.0-rc.2 adds `to_iceberg` for native Apache Iceberg table output, automatic NetFlow/IPFIX decoding, and OCSF 1.9.0 support. • New `to_iceberg` operator writes events directly into Apache Iceberg tables via a REST catalog, automatically creating and evolving table schemas as heterogeneous streams arrive. • Adds optional batch validation for events read from persisted stores. • Adds automatic NetFlow and IPFIX decoding. • Adds OCSF 1.9.0 support. • Faster, lower-memory catalog loading at node startup for very large catalogs. • Faster variant encoding and lower resource usage for null-filling in `ocsf::cast`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.9.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-9-0 https://tenzir.com/changelog/tenzir/v6.9.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-v6-9-0 Thu, 06 Aug 2026 00:00:00 GMT Tenzir v6.9.0 adds native Apache Iceberg output via `to_iceberg`, automatic NetFlow/IPFIX decoding, and OCSF 1.9.0 support. • New `to_iceberg` operator writes events directly into Apache Iceberg tables through a REST catalog, automatically creating and evolving schemas as heterogeneous streams arrive. • Adds automatic NetFlow and IPFIX decoding. • Supports OCSF 1.9.0. • Adds the ability to assign fields using dynamic keys. • Optionally validate batches read from persisted stores. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir-ship/v2.0.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-ship-v2-0-0 https://tenzir.com/changelog/tenzir-ship/v2.0.0/?utm_source=changelog-feed&utm_medium=feed&utm_campaign=changelog-tenzir-ship-v2-0-0 Wed, 05 Aug 2026 00:00:00 GMT Tenzir Ship v2.0.0 keeps pre-1.0 projects on major version zero when unreleased entries include breaking changes. • Automatically selects the next minor release instead of bumping to 1.0.0 when unreleased entries include breaking changes in pre-1.0 projects. • Projects can still explicitly request 1.0.0 to declare their first stable release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir-ship/v1.12.0/ https://tenzir.com/changelog/tenzir-ship/v1.12.0/ Tue, 04 Aug 2026 00:00:00 GMT Tenzir Ship v1.12.0 adds pre-publish confirmation and the ability to tag a release without creating a GitHub release. • Adds option to publish a release tag without creating a GitHub release, for cases where another repository owns the release or downstream builds must validate the tag first. • Confirms every commit, tag, and push before making any changes during release publishing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.9.0-rc.1/ https://tenzir.com/changelog/tenzir/v6.9.0-rc.1/ Fri, 31 Jul 2026 00:00:00 GMT Tenzir v6.9.0-rc.1 adds native Apache Iceberg table output via REST catalog with auto-evolving schemas. • New `to_iceberg` operator writes events directly into Apache Iceberg tables through a REST catalog, automatically creating and evolving table schemas as heterogeneous streams arrive. • Optionally validate batches read from persisted stores for data integrity checks. • Faster, lower-memory catalog loading at node startup for large catalogs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://docs.tenzir.com/changelog https://docs.tenzir.com/changelog Thu, 23 Jul 2026 16:01:10 GMT • Adds a Splunk search input operator, enabling Tenzir nodes to pull data directly from Splunk searches. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.8.0/ https://tenzir.com/changelog/tenzir/v6.8.0/ Tue, 21 Jul 2026 00:00:00 GMT Tenzir v6.8.0 adds a Splunk search input operator and improves ClickHouse throughput with JSON column support. • New `from_splunk` operator lets nodes run bounded searches against a Splunk Search Head and emit results as events. • Upgraded `to_clickhouse` operator re-batches events before insert for higher throughput. • Adds support in `to_clickhouse` for writing directly into JSON columns. • Nodes now quarantine corrupt or truncated partitions instead of crashing repeatedly, improving resilience. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.7.0/ https://tenzir.com/changelog/tenzir/v6.7.0/ Wed, 15 Jul 2026 00:00:00 GMT Tenzir v6.7.0 adds fork_merge for fanning out subpipelines and a force-stop action for pipelines. • New `fork_merge` operator fans out subpipelines over the same input and merges their outputs into a single stream. • Adds a force-stop action for pipelines in the Tenzir Platform. • Improved Tenzir Platform performance. • Restores unstructured (raw-log) ingestion support for Google SecOps. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/platform/v1.37.0/ https://tenzir.com/changelog/platform/v1.37.0/ Wed, 15 Jul 2026 00:00:00 GMT Tenzir Platform v1.37.0 adds custom Git-backed package libraries, force-stop for pipelines, and a workspace key minting command. • Adds custom library sources: organizations can add public or private Git repositories alongside the built-in Tenzir Library to maintain their own package libraries. • Adds a Force stop action for pipelines that are slow to drain, enabling operators to hard-terminate stalled pipelines. • Adds an admin command to mint workspace keys. Breaking changes: • The Random Example feature has been removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/tenzir/v6.6.0/ https://tenzir.com/changelog/tenzir/v6.6.0/ Fri, 10 Jul 2026 00:00:00 GMT Tenzir v6.6.0 expands ClickHouse integration with LowCardinality/DateTime64 support and adds a reference date for partial parse_time formats. • Adds reference date support for partial `parse_time` format strings, enabling relative time parsing without a full timestamp. • Supports additional ClickHouse column types in `to_clickhouse`, including LowCardinality and DateTime64. • Enables `to_clickhouse` to tolerate ClickHouse columns that have default values, avoiding pipeline failures on schema mismatches. • Adds warnings in `to_clickhouse` instead of silently dropping events when column mapping issues occur. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir https://tenzir.com/changelog/platform/v1.35.0/ https://tenzir.com/changelog/platform/v1.35.0/ Thu, 09 Jul 2026 00:00:00 GMT Tenzir Platform v1.35.0 adds optional MFA support and improves pipeline Diagnostics tab performance. • Adds optional multi-factor authentication (MFA) support for the public Tenzir Platform. • Improves performance of the pipeline Diagnostics pane. • Enables graceful shutdown for Docker Compose nodes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tenzir