v.4.14.0 Release

Cribl Edge 4.14.0 includes significant performance improvements, new capabilities, and important bug fixes.

New Features​

​

This release provides the following improvements:

Cribl Outpost (Preview)

​

Cribl Outpost (a Preview feature) is a new solution for managing deployments in restricted environments with multiple data centers or complicated networking setups. Instead of opening firewall rules or configuring third-party proxies, you can now establish Cribl Outposts to handle the control plane traffic between multiple Edge Nodes and the Cribl.Cloud or on-prem Leader.

Cribl Edge on macOS (Preview)

​

Cribl Edge is now available on macOS. You can now install and run Cribl Edge on supported macOS environments, monitoring and collecting log files.

Cribl Terraform Provider (Preview)

​

The Cribl Terraform provider is now available in Preview from the Terraform Registry. Use the criblio provider to manage Cribl as part of your infrastructure-as-code workflows and make large deployments repeatable and reliable.

New Cribl.Cloud Regions

​

We are excited to now support creating Cribl.Cloud Organizations in Switzerland and Singapore AWS Regions (eu-central-2, ap-southeast-1).

Experience Improvements

​

• We’ve increased the granularity of the Route audit logs to provide a more precise audit trail. Instead of logging a generic update event with an ambiguous id default, we now log an event for every updated, deleted, and reordered Route.

• You can now improve the efficiency of Fleet reconnections to the Leader after restarts. Set the Minimum reconnect interval, Maximum reconnect interval, and Random reconnect interval settings per Fleet to stagger reconnections so as not to overwhelm the Leader.

• The C.Mask expression now supports hashing with the SHA3-256 and SHA3-512 algorithms. This expands the available cryptographic methods for data masking.

• We changed the log level for HTTP 4xx errors from error to warn to better distinguish between user errors and application errors. This adjustment helps reduce log noise and ensures that error logs are reserved for critical system failures, while still providing a clear warning for client-side issues.

• We added the ability to drop dimensions directly from the Data Preview pane in the UI. This enhancement allows you to easily remove specific metric dimensions that contribute to high cardinality through the UI.

• We added a new environment variable, CRIBL_GIT_REMOTE_URL, that enables you to set a Git remote URL from the UI without removing the existing local repository and restarting the Leader.

• Cribl is enabling the use of AWS SDK v3 for self-managed customers and hybrid Workers after additional testing.

• We have improved the reliability and performance of Cribl-to-Cribl connections over HTTP/TCP, especially under high-load or failure conditions. To prevent your systems from being overwhelmed during a failure, we’ve added a small, randomized delay to retries. This ensures that not all of your Nodes try to reconnect at the exact same moment, which keeps the system running smoothly and avoids overwhelming destination servers. We’ve also enabled intelligent retry behavior by default for CriblHTTPOut Destinations, helping your Edge Nodes automatically manage their traffic to avoid overloading your Stream Worker Nodes and providing better backpressure protection.

• We enhanced the JSON Array Event Breaker to give you more control over your data. You can now retain and copy top-level fields from the original parent JSON object to each of the new, extracted events. This is particularly useful for logs from services like AWS CloudTrail, EKS CloudWatch, or Google Cloud Audit Logs, where a single log entry contains an array of event records.

• We improved the observability of Sources, Destinations, and persistent queues (PQs) to help you more accurately monitor the health of Worker Processes and manage backpressure. Now when you view any configured integration, you can select the Status tab to assess the health status of PQs. This view aggregates data across all Worker Processes to show how many Worker Processes are in a healthy or unhealthy state, making it easier to pinpoint issues.

Sources and Destinations

​

• The default value for Read mode in the Windows Event Logs Source is now From last entry instead of Entire Log. This will prevent mass ingestion of data when deploying Edge Nodes with large historical logs.

• We’ve expanded I/O Observability monitoring to additional integrations, bringing our existing health and performance metrics—request failures, latency, and endpoint health—to new Sources including Azure EventHub, Elastic, and Azure Blob, as well as Destinations including CrowdStrike NextGen SIEM, Azure Sentinel, Webhook, and Exabeam. These metrics are aggregated every minute. You can access these metrics through the Internal Cribl Source and view performance charts directly on each Source and Destination’s configuration page for greater visibility into your data pipeline integrations.

• The CrowdStrike Falcon Next-Gen SIEM Destination now defaults the Request Format from Raw to JSON when you are configuring a new Destination. This change simplifies the setup process and aligns with the most common configuration.

• In Cribl.Cloud deployments, the default parser for Grafana and Prometheus Remote Write Sources has been updated to version 3.5.3, which supports structured metadata across all existing and new configurations.

• The Google Cloud Pub/Sub Destination now includes the Flush period (sec) setting for specifying the maximum time to allow between requests.

• Support for sending entity data to the Google Security Operations (SecOps) Destination is now available. Entities like user and asset are needed for enriching logs and providing additional context. This feature addresses a major roadblock for customers needing to send entity data directly to their SIEM.

• Native support for OAuth authentication is now available for the Kafka and Confluent Cloud Source and Destination. This feature allows administrators to securely connect to Kafka systems that use OAuth for client authentication, providing a modern way to ingest and send data.

• You can now include System State, System Metrics, Windows Metrics, and Windows Event Logs Sources in Packs. As a result, System State, System Metrics, and Windows Metrics Sources now allow configuring more than one instance of Source per Fleet.

• Source and Destination statuses when Minimal metrics are collected have been improved for clarity.

Corrections

​

This release contains the following bug fixes:

Operational Fixes

​

Source and Destination Fixes

​

Other Functional Fixes

​