This release brings Apps to GA, puts AI throughout Cribl Search, adds tighter security controls across the control plane, and lets you search archived Splunk data without rehydrating it.
Platform and Apps
- App Backend Functions: Run searches, detect threats, and respond to events without the app staying open.
- AI Infrastructure Observability App: Track GPU usage and spend across environments, find idle capacity, and catch hardware issues early.
- Observability Apps Bundle: Ready-to-use monitoring for Kubernetes, uptime, databases, infrastructure, NetFlow, and real-user experience.
Stream
- Cribl Guard Privacy 3.0 model series: Better background detection, with Nano for speed, Balanced for the middle ground, and a new Pro option when accuracy matters most.
- Auto-parsing globally and in Routing: Auto-parse Sources globally, on selected Routes, or in the Parser function, with guardrails against duplicate processing.
- Auth Token Management for Node Connections: Rotate, audit, and revoke provisioning tokens to tighten control-plane security.
Edge
- Fleet Inheritance Visibility: See whether Sources, Destinations, and Pipelines are inherited or local before you change them. Fewer accidental overrides in nested Fleets.
- Scaling to 500K Nodes: Run larger distributed Edge fleets in Cribl.Cloud without every node staying connected to the Leader.
Search
- AI across the Search experience: A persistent AI assistant that follows you from question to query to analysis, Notebooks, and dashboards.
- CrowdStrike NG-SIEM Dataset Provider: Investigate security data where it lives, without another silo or a SIEM replacement project.
- Federated Search for Splunk DDSS and SmartStore: Search archived Splunk data in your own object storage without rehydrating it.
- Metrics (Preview): RBAC now covers metrics datasets, plus OpenTelemetry metric ingestion and Grafana dashboard imports.
Insights
- RBAC for Cribl Insights: Give teams the right level of access without making every Insights user an admin.
Integrations
- New AI and enterprise Sources: Microsoft Copilot, Anthropic (non-compliance), and Azure VNet Flow Logs.
These are just the highlights. Check the full release notes for the details.
Cribl.Cloud customers: once your Organization is updated, just click Deploy.
On-prem customers can download the update now.