Product Updates

New known issue page(s) added: LAKE-2235 | Deleting a lakehouse engine Dataset fails

New known issue page(s) added: CRIBL-40928 | Teleport and Worker Group size changes fail for Azure Cribl.Cloud Worker Groups with uppercase names

New known issue page(s) added: SEARCH-13091 | V2 searches on BYOS Azure Lake Datasets are limited to one hour

Known issue page(s) updated: CRIBL-41528 | Upgrading Cribl Edge Nodes on Windows fails with files being reported in use

New known issue page(s) added: AI-4044 | Dataset Intelligence is not supported for federated API Dataset Providers

New known issue page(s) added: CRIBL-38175 | Windows `@-style` domain service accounts are not working Known issue page(s) updated: CRIBL-40423 | Unattended Cribl Edge upgrade on Windows can cause the host to reboot CRIBL-41528 | Upgrading Cribl Edge Nodes on Windows fails with files being reported in use

New known issue page(s) added: CRIBL-41494 | Destination Post-Processing Skipped When a Pack Source Uses Worker Group Routes

New known issue page(s) added: CRIBL-40408 | Outpost Listener service does not start when TLS is configured with a passphrase

New known issue page(s) added: CRIBL-41025 | Wiz API Source does not re-ingest Issues when their status changes CRIBL-41026 | Wiz API Source does not re-ingest Configuration Findings when they are updated

Known issue page(s) updated: CRIBL-41528 | Upgrading Cribl Edge Nodes on Windows fails with files being reported in use

Known issue page(s) updated: CRIBL-41528 | Upgrading Cribl Edge Nodes on Windows fails with files being reported in use

New known issue page(s) added: CRIBL-41528 | Upgrading Cribl Edge Nodes on Windows results in an upgrade loop

Search - Analyze Zscaler Logs View Pack

New known issue page(s) added: PLAT-9643 | In Cribl.Cloud, Sources and Destinations with legacy hard-coded `/opt/cribl` paths can fail

New known issue page(s) added: SEARCH-11328 | Saved Search Manage as JSON output is not compatible with the API

New known issue page(s) added: AI-3994 | Some AI features ignore model tiers and fall back to default models

Known issue page(s) updated: CRIBL-41322 | Running Source persistent queue in `Smart` mode alters `__inputId` values

New known issue page(s) added: CRIBL-41322 | Running Source persistent queue in `Smart` mode alters `__inputId` values

Search - Dashboards, saved searches, macros, and datatype for Vectra AI Detect and Vectra Stream data in Cribl Lake. View Pack

New known issue page(s) added: CRIBL-41299 | Syslog LB pending flush timer resets octet-counting state, causing parser failure and connection loss

New release. AI flexibility, a new app platform, and some killer upgradesPlatform• New App Platform (Preview): Build custom apps, focused UIs, and dashboards that match how your teams actually work. Early look, come kick the tires.• Additional BYOM Providers (LiteLLM and OpenAI Retail): More model options without giving up control over your data or infrastructure.Stream• Cribl Guard Model Choice and Agentic Recommendations: Choose the AI model that best fits your data, and get one-click recommendations you can review and act on.• Shared Storage for Persistent Queues: Write backlogged data to NFS or S3 instead of local disk. Better protection during outages, cleaner scaling.Edge• Mac Unified Log Source: macOS logs now flow into the same pipelines as your Windows and Linux data. One less gap in fleet visibility.Search• Notebook Templates: Reusable investigation templates so teams move faster and stop reinventing the same workflows.Lake• Cribl Lake BYOS in Azure: Query data in-place from Azure Blob Storage. No moving it, no duplicating it.Integrations• OpenAI Compliance Source: Pull OpenAI compliance API data into Stream so security teams can monitor usage and audit activity in one place.• ServiceNow Table API Source: Bring incident, change, and CMDB data from ServiceNow into Cribl for correlation and automation.These are just the highlights. Check out the full release notes for Stream, Edge, Search, and Lake.Cribl.Cloud customers: once your Organization is updated, just click Deploy.On-prem customers can download the update now.

Known issue page(s) updated: SEARCH-11922 | S3 Parquet Searches Don't Show Bytes Scanned

New known issue page(s) added: CRIBL-39937 | Cribl Edge on Windows installed in custom directory reverts to default location on upgrade MON-814 | Custom monitors and Data Insights need a namespace filter Known issue page(s) updated: CRIBL-13125 | Pipelines with Clone and other Functions can show inconsistent total processing times CRIBL-13404 | Kubernetes Logs Source doesn't collect logs from exited or short-lived containers CRIBL-13999 | Diag bundles might fail to download from teleported Worker/Edge Nodes CRIBL-14239 | Default commit message missing for non-admin users CRIBL-14627 | Recently added Worker Nodes fail to appear on the Monitoring page CRIBL-15239 | Cannot clear Messages drawer while in GitOps Push mode CRIBL-18973 | Migrated Local Users appear in the Members UI with No Access CRIBL-28742 | Bind error when changing Source address from `0.0.0.0` to `::` on TCP Sources CRIBL-38843 | Pack export in merge mode redacts email notification recipients CRIBL-40418 | Objects named `core` can be excluded from commits CRIBL-40423 | Unattended Cribl Edge upgrade on Windows can cause the host to reboot CRIBL-8600 | GitOps + License expiration = Catch-22 LAKE-1165 | Storage Locations in Cribl.Cloud Government display non-U.S. Regions LAKE-1196 | Lake Dataset IDs must be unique across all Storage Locations LAKE-1368 | Dataset size for Cribl Lake Datasets is not visible in the UI LAKE-2001 | Reserved Dataset ID prefixes for Search lakehouse engines block updates to existing Lake Datasets MON-481 | Insights time range options don't reflect available data SEARCH-12211 | rawMetrics.totalMetrics.eventsIn Can Be Inaccurate for Searches During Concurrent Ingestion SEARCH-12663 | Lakehouse metrics reshape `_metric`/`_value`; searches may fail after upgrade

Stream - Real-time analytics for AI conversations. Tracks costs across 16+ models, grades response quality (A-D), detects sentiment and intent, and provides optimization recommendations - all in-stream. View Pack

This one is all about control, precision, and making things just work better.Platform• IP Allowlist for API Credentials: Lock API keys to trusted networks.• Terraform Config Exporter: Turn live configs into Terraform. No more rebuilding by hand. Capture it once, reuse it everywhere.Stream• Cribl Guard Detection Improvements: Better signal, less noise. More accurate sensitive data detection without the alert fatigue.Search• Field Transformation on Ingest (Lakehouse Engine): Shape your data on the way in so you’re not wrangling it later.• Clear Datasets: Reset datasets without deleting them. Cleaner workflows, faster iteration.• New 2XS and 3XS Tiers: Smaller entry points for federated and lakehouse engines. Test, validate, and scale without overcommitting.These are just the highlights. Check out the full release notes for Stream, Edge, Search, and Lake.Cribl.Cloud customers are already upgraded—just click Deploy.On-prem customers can download the update now.