Product Updates

Platform• Cribl-managed MCP Server: Connect your AI tools to your Cribl environment straight from the Leader.• New release channel option: Switch to a "Slow" cadence if you need upgrades to line up with change windows.• Private Links: Self-service private connectivity from AWS and Azure to Cribl.Cloud, no public internet required.• Credential centralization: Manage shared Vault or Cribl secret store credentials from one place.• Cribl App for AI Observability: One view of AI and LLM costs, usage, and sensitive data. Stream• Improved Cribl Guard mitigation workflow: Guard now generates mitigation recommendations automatically. Edge• Endpoints for the Cribl API: Manage Edge config and lifecycle programmatically. Search• Metrics Store (Preview): AI-native metrics store built into Search's lakehouse engine.• Schedule Jitter: Stagger scheduled searches so you're not slamming the top of every hour. Integrations• A batch of new integrations: AWS Cloud Connections, Amazon Bedrock API Source, Claude Compliance API expansion, Snowflake Destination, and Google BigQuery Destination. These are just the highlights. Check out the full release notes for Stream, Edge, Search, Lake, and Insights.Cribl.Cloud customers: once your Organization is updated, just click Deploy.On-prem customers can download the update now.

New known issue page(s) added: LAKE-2091 | Zscaler Direct Access events are not parsed into fields and land in _raw

New known issue page(s) added: CRIBL-42792 | AWS Cloud Connections Onboard Data step only supports selecting resources from a single region at a time CRIBL-43445 | AWS Cloud Connections discovery scan may not complete for large AWS accounts CRIBL-43526 | S3 Sources created via AWS Cloud Connections may not have assume-role configured

New known issue page(s) added: CRIBL-42792 | AWS Cloud Connections Onboard Data step only supports selecting resources from a single region at a time CRIBL-43445 | AWS Cloud Connections discovery scan may not complete for large AWS accounts CRIBL-43526 | S3 Sources created via AWS Cloud Connections may not have assume-role configured

New known issue page(s) added: SEARCH-14548 | Filtering on datatype, source, and sourceFormat returns fewer results than expected

Known issue page(s) updated: CRIBL-22360 | After restarting the File Monitor Source, Event Breakers aren't processing CSV files correctly when the File Monitor Source is configured to collect CSV logs CRIBL-40408 | Outpost Listener service does not start when TLS is configured with a passphrase CRIBL-41815 | Persistent queue buffer changed from `64KB` to `1MB` after upgrade CRIBL-42946 | Interrupted Windows Edge Node upgrades can cause the Node to lose connection to the Leader LAKE-632 | Lakehouses listing page doesn't refresh automatically SEARCH-12205, SEARCH-12534 | Searches on certain Splunk journal files return incomplete column values SEARCH-13091 | V2 searches on BYOS Azure Lake Datasets are limited to one hour SEARCH-9046 | API Dataset Providers: Endpoint name changes don't propagate to Datasets

New known issue page(s) added: CRIBL-42946 | Interrupted Windows Edge Node upgrades can cause the Node to lose connection to the Leader

New known issue page(s) added: NUG-914 | Minimum freshness incorrectly reports as 0ms

Stream - Send security telemetry from Cribl Stream to the Artemis AI-Native SIEM, and fan out Artemis cases back into your SOC workflow tools. View Pack

Stream - Collector Pack to process data from the Island Browser API View Pack

Stream - This Pack enables filtering, reduction, parsing and routing for McAfee® Web Gateway logs. View Pack

Stream - Stream pack to normalize Microsoft Defender for Endpoint logs from Azure Event Hubs, unroll batched records, fix timestamps, and reduce noise for SIEM and analytics destinations. View Pack

Stream - Cribl AWS CloudTrail Data Collection View Pack

Stream, Edge - Drop, Extract, Suppress based on certain ASA codes in lookup tables View Pack

Stream, Edge - Drop, Extract, Suppress based on certain FTD codes in lookup tables View Pack

New known issue page(s) added: CRIBL-42722 | Worker Groups and Fleets in Cribl.Cloud don't protect `system.*` metrics by default

New known issue page(s) added: PLAT-12586 | Scripts can be enabled after Leader returns to primary following high-availability (HA) failover

New known issue page(s) added: CRIBL-42245 | After a persistent queue drains, Workers can peg at 100% CPU

New known issue page(s) added: SEARCH-12205, SEARCH-12534 | Searches on certain Splunk journal files return incomplete column values

Goats, 4.18.2 is out across the suite. Here are the highlights.Stream• Google Cloud Observability Destination: Send OpenTelemetry metrics, logs, and traces to GCO.Platform• App Platform (Preview) RBAC: Admins can now control which users and teams have access to each App.Search• Comment-Only Queries Blocked: Search now validates queries before execution and surfaces a clear message instead of running and returning an error.Lake• Netskope Direct Access Source: Land Transaction Events directly into Lake without managing AWS infrastructure.These are just the highlights. Check out the full release notes for Stream, Edge, Search, Lake, and Insights.Cribl.Cloud customers: once your Organization is updated, just click Deploy.On-prem customers can download the update now.

New known issue page(s) added: CRIBL-41815 | Persistent queue buffer changed from `64KB` to `1MB` after upgrade Known issue page(s) updated: AI-3994 | Some AI features ignore model tiers and fall back to default models CRIBL-38175 | Windows `@-style` domain service accounts are not working CRIBL-40423 | Unattended Cribl Edge upgrade on Windows can cause the host to reboot CRIBL-40928 | Teleport and Worker Group size changes fail for Azure Cribl.Cloud Worker Groups with uppercase names CRIBL-41025 | Wiz API Source does not re-ingest Issues when their status changes CRIBL-41026 | Wiz API Source does not re-ingest Configuration Findings when they are updated CRIBL-41299 | Syslog LB pending flush timer resets octet-counting state, causing parser failure and connection loss CRIBL-41322 | Running Source persistent queue in `Smart` mode alters `__inputId` values CRIBL-41494 | Destination Post-Processing Skipped When a Pack Source Uses Worker Group Routes CRIBL-41528 | Upgrading Cribl Edge Nodes on Windows fails with files being reported in use LAKE-2235 | Deleting a lakehouse engine Dataset fails PLAT-9643 | In Cribl.Cloud, Sources and Destinations with legacy hard-coded `/opt/cribl` paths can fail SEARCH-10016 | Variables in Dashboard inputs may throw a syntax error SEARCH-12739 | Variables are not substituted in Email Notification subject lines SEARCH-13238 | V2 searches with hive-style path templates return 0 results

Search - Analyze Zscaler Logs View Pack

Stream - Collect, parse, and route Vectra AI Stream and Detect telemetry to Elasticsearch, Splunk, and Cribl Lake with no forwarders or add-ons required. View Pack

Stream, Edge - Drop, Extract, Suppress based on certain FTD codes in lookup tables View Pack

Stream - This Pack collects AlphaSOC OCSF Detection Findings from the AlphaSOC API and routes them to Worker Group routes for delivery to your destinations. View Pack