This release is heavy on Azure, with some AI help for Pipelines and more OCSF support for security data.
Platform
- API rate limiting: Protects your deployment from overload and tells integrations when to retry.
- Cribl MCP for Pack Pipelines: Update Pipelines inside Packs with AI help.
- Marketplace updates: Share Apps publicly, find Cribl-certified Apps, and control each App’s API access.
Stream
- Pipeline Builder (formerly Copilot Editor): Build Pipelines with natural language, now with OCSF 1.9 support.
Edge
- Azure metadata: Tag events with subscription, resource group, VM name, and region.
- Windows message file resolution: Get readable Windows event fields at collection.
Search
- OCSF mapping for Lakehouse Engine: Consistent field names across sources.
- Preview v2 datatype parsing: Test parsing against sample, dataset, or live data before you commit.
- Datadog Metrics Source: Bring Datadog v1 metrics into Cribl with a dedicated Source.
Lake
- Outpost for Azure Storage: Use Azure BYOS without opening inbound access.
- Private Endpoints for Azure Storage: Search Lake data in Azure without public internet exposure or IP allowlists.
These are just the highlights. Check the full release notes for the details.
Cribl.Cloud customers: once your Organization is updated, just click Deploy.
On-prem customers can download the update now.