Cribl Edge 4.20.3 (Coming Soon) ​

The following draft provides early access to release notes for the upcoming Cribl Suite product release. Features or functionality presented are not considered binding commitments and are subject to change at the discretion of Cribl at any time for any reason without notice. This information should not be relied upon in making purchasing decisions.

Important Changes

This release includes the following important changes:

• Leader license persists across managed Node restarts
• Cribl AI model tier renaming
• Cribl Terraform provider is no longer in preview

Review the full list of important changes for additional critical updates.

New Features ​

This release provides the following improvements:

Fast Release Channel in Cribl.Cloud ​

In Cribl.Cloud, Enterprise customers can now assign each Workspace to the Fast release channel. Cribl publishes new features and services to the Fast release channel approximately weekly, so you can preview them and provide feedback before they become available on the Regular release channel.

Billing Reader Permission for API Credentials ​

Enterprise customers can now assign the Billing Reader Permission on an Organization to API Credentials in Cribl.Cloud. This lets you automate billing and usage reporting without granting broad administrative access to your Organization, Workspaces, or products.

Copilot Is Now Billy ​

The AI assistant formerly known as Cribl Copilot is now Billy. All user-facing text, including titles, tooltips, placeholders, and accessibility labels, now refer to Billy. Billy has the same capabilities as Copilot. Only the name has changed.

MCP Server Connection Details ​

The Cribl MCP server setup experience now surfaces connection details directly in the UI, including the server URL, authentication requirements, and code snippets for connecting your MCP client. You no longer need to switch between the product UI and documentation to complete the setup.

Pack-Scoped Support for Leader MCP Pipeline Tools ​

Leader MCP Pipeline tools now support a packId parameter, allowing Pipelines defined inside Packs to be retrieved and modified through MCP. Previously, Pack-internal Pipelines appeared as opaque placeholders that could not be read or updated.

Apps ​

The Cribl Marketplace now shows which Apps are Cribl Certified, and installed Apps get tighter control over who can open them and what they can call.

• Certified Apps. Find Apps that meet Cribl standards for business-critical use with a new Certified filter in the Cribl Marketplace. Publishers request certification once per App, and it carries to each newer version that Cribl approves for listing.
• App permission models. A newly installed App uses strict policy permissions and can call only the Cribl API endpoints declared in its policies.yml, including when an administrator uses the App. An App that is already installed keeps user-based permissions, where access follows each member’s product permissions and policies.yml can add actions, and you can switch that App to strict policy permissions.
• Private by default. Newly installed Apps are private. Members and teams can open a new App only after an administrator uses Share to assign them the App user access level. Upgrading an App keeps its existing Share assignments.
• Ownership transfer. An App owner can transfer a published App to a new owner.

Experience Improvements ​

• We improved keyboard accessibility in popular areas of Cribl Stream, Edge, and Search. On targeted routes, keyboard users can now navigate, complete forms, and submit changes more reliably, with improved focus order, focus indicators, screen-reader markup, and color contrast.
• Resources that support global secrets now use separate Folder and Secret selection menus instead of a single list of <secretFolderId>/<globalSecretId> references. Also, if the secret folder doesn’t contain the global secret that you want to use, you can now create the secret within the resource configuration workflow instead of navigating to Global Settings.
• Cribl now applies endpoint-specific rate limits to prevent excessive traffic from interfering with normal operations. When a request exceeds the endpoint’s rate limit, the API returns the HTTP status code 429 Too Many Requests and a Retry-After header that specifies how many seconds to wait before retrying.
• The provisioning token list now refreshes automatically after you update or delete a token.
• You can now sort the Workers and Edge Node lists by provisioning token.
• On an App’s Key-Value Stores tab, you can now edit, clone, or delete individual key-value pairs from the Actions menu. Use this to keep an App’s seeded configuration and secrets up to date, and to duplicate an unencrypted pair instead of recreating it.
• Auto-Parse now detects each event’s format and extracts its top-level fields with higher throughput in the Parser Function, on Routes, and on Sources. While it’s ideal for mixed or unknown formats, a specific parser Type remains more resource-efficient for known, stable data.

Sources and Destinations ​

• Edge Nodes running on Azure can collect Azure host metadata, including subscription ID, resource group, VM name, region, and more. Enable the azure event metadata source under Fleet Settings > General Settings > Limits > Metadata. Collected values appear under __metadata.azure.
• The OpenTelemetry Destination now supports OAuth2 client credentials when Protocol is gRPC.
• The OpenTelemetry Source now supports CORS, so browser-based clients can send OTLP/HTTP without a reverse proxy.
• Saving a File Monitor Source configuration in a Single-instance deployment or when teleported to a Node no longer waits for the first file discovery to finish, reducing delays.

Important Changes ​

Leader License Persists Across Managed Node Restarts ​

On-prem and hybrid Worker Nodes and Edge Nodes now save a copy of the license they receive from the Leader. If a node loses its Leader connection and restarts while the saved license remains valid, it loads the saved license instead of switching to the Free license. For details, see Licensing on Managed Node Startup.

Cribl AI Model Tier Renaming ​

The model tiers for Cribl Managed Models and custom AI providers (Bring Your Own Model, or BYOM) are now named Fast, Balanced, and Deep. These names replace Small, Frontier, and Reasoning, respectively. This is a display update only, with no changes to model behavior or performance.

Cribl Terraform Provider No Longer in Preview Status ​

The Cribl Terraform provider is no longer in Preview status and is now generally available. Use the provider to manage Cribl resources as infrastructure as code across Organizations and Workspaces.

Notice: Cribl as Code TypeScript and Go SDK Discontinuation ​

Cribl has stopped active development of the Cribl as Code Go and TypeScript SDKs, which were previously in preview. To give existing users a clear path forward, we have moved the SDKs from the criblio GitHub organization to the Cribl Community GitHub Organization, where they will remain as open-source community resources. This allows customers and community members to continue using the SDKs and build on them, while Cribl steps back from active feature development and long-term support.

The SDKs will continue to be available through their new home in the Cribl Community GitHub Organization, where users can keep using them, fork them, and extend them based on their own needs. Customers who want to stay on a supported integration should consider migrating to either the Python SDK, Terraform Provider, or direct Cribl API access.

Deprecation Notice: Smart Mode for Source Persistent Queue ​

To improve data integrity, Smart mode is now deprecated for Source persistent queue for hybrid and on-prem deployments. In January 2027, configurations for all deployments will automatically migrate to Always On mode, which uses a persistent queue buffer for all events.

Consider updating existing configurations to Always On mode prior to the automatic migration date. Before changing the configuration:

• Monitor your persistent queue usage so that you can allocate enough disk space.
• When making changes to your persistent queue, remember to first drain queues before disabling them to avoid orphaned data.
• Verify that data routing and filtering behaves as expected in a test environment before rolling out the new configuration to production.

Deprecation Notice: Disable Node Persistence ​

The Disable Node persistence setting is deprecated and will be removed in a future release. Node information is persisted by default. Use the Fleet-level Time to keep disconnected Nodes setting to control how long Nodes are tracked.

Notice: Future Removal of AppScope Source ​

The AppScope Source will be removed from Cribl Edge in a future release.

Corrections ​

Security Fixes ​

Operational Fixes ​

Source and Destination Fixes ​

Other Functional Fixes ​

SDK Changelogs ​

The Cribl SDKs help you integrate with Cribl and reduce the need for repetitive tasks. We maintain changelogs for each version of the Cribl SDKs in their GitHub repositories:

• Go SDK changelogs: control plane and management plane
• Python SDK changelogs: control plane and management plane
• TypeScript SDK changelogs: control plane and management plane