Cribl Stream 4.20.0 (Coming Soon) ​

Cribl Stream 4.20.0 includes significant performance improvements, new capabilities, and important bug fixes.

The following draft provides early access to release notes for the upcoming Cribl Suite product release. Features or functionality presented are not considered binding commitments and are subject to change at the discretion of Cribl at any time for any reason without notice. This information should not be relied upon in making purchasing decisions.

Important Changes

This release introduces breaking changes and deprecations that require action if you use the affected features:

• Lookup file paths restricted to default locations
• Event byte limit enforces a size boundary
• Deprecation Notice: Smart Mode for Source persistent queue
• Notice: Cribl as Code TypeScript and Go SDK Discontinuation
• Review the full list of important changes for additional critical updates.

New Features ​

This release provides the following improvements:

Apps General Availability ​

Apps are now generally available and no longer in Preview.

Apps let you build and run custom applications in Cribl. An App is a packaged user-interface experience that can call Cribl and third-party APIs, enabling tailored workflows and front-end experiences beyond the built-in product surfaces.

This release adds:

• Backend functions: An App can expose HTTP endpoints and run work on a schedule, so it can automate tasks instead of doing everything in the browser.
• External API Access: Administrators can authorize which third-party hosts each App may call, including Organization-specific domains that were not packaged with the App.
• Permissions review: Before you install an App, you can see the in-product permissions and external API access it declares.
• App sharing: Administrators choose which members and teams can open each App.
• App limits: Administrators can control how much compute and related capacity each App can use.
• Scaffolding and upgrades: App builders get a clearer path from Create App through packaging, versioning, and upgrading an installed App.

Authentication Token Management ​

The new authentication token mechanism lets you create multiple tokens to provision Stream Workers, Edge Nodes, and Outposts. You can rotate and revoke tokens to control which Nodes can connect to the Leader.

On upgrade to 4.20.0, existing deployments automatically receive one legacy type token set to the value of the existing auth token.

No immediate action is required to migrate to the new token mechanism.

Cribl recommends rotating the legacy token to a new provisioning token at your earliest convenience. You can’t revoke the legacy token in a Cribl.Cloud deployment.

Retrieve Global Secrets from Azure Key Vault ​

You can now create secret stores for global secrets that are backed by Azure Key Vault. Cribl authenticates to Microsoft Entra ID as a service principal and retrieves current secret values from the vault. Define credentials once in Azure Key Vault and reuse them across Cribl Stream and Edge.

Parquet Schema Validation in Expressions ​

You can now validate events against a Parquet schema from any JavaScript expression, using C.Schema('<schema-id>', { kind: 'parquet' }).validate(<event>). A companion explain() method reports which field failed and why. The existing C.Schema().validate() method previously supported only JSON schemas.

Validating in an expression moves that check upstream. You can use a Route filter or an Output Router to send conforming events to your Parquet Destination and everything else to a separate Destination. Non-conforming data stays available for inspection while you refine your schema, instead of being silently discarded.

Auto-Parse on Routes and Sources ​

Automatic parsing, introduced in 4.19 as the Parser Function’s Auto type, is now available on Routes and Sources as well. Toggle on Auto-parse in a Route or in a Source’s Pre-Processing settings. Cribl detects each event’s format and extracts its top-level fields before your Pipeline runs. A new Auto Parsing page lists your configured Sources in one place. You can turn auto-parsing on or off per Source and capture a sample to confirm you get the fields you expect.

MCP Server Role-Based Access Control (RBAC) ​

The Cribl MCP server now supports role-based access control, enabling non-admin users to connect to the MCP server and use tools scoped to their product-level permissions. Previously, MCP server access was restricted to admin users only.

Cribl AI in Cribl.Cloud Government (BYOM) ​

Cribl.Cloud Government now supports Cribl AI via a Bring Your Own Model (BYOM) setup. Activating your custom AI provider routes supported features, including Copilot chat, Stream editing, and Search assistance, through your managed provider using simplified controls while maintaining FedRAMP compliance boundaries.

Self-Service Static Egress IPs ​

You can now configure static IPs for data leaving your Cribl Leader, Worker Groups, and Collection jobs. Static egress gives you a stable set of outbound IP addresses that you can add to firewall and ACL allowlists. Static egress is enabled on a per-region basis and incurs both an hourly infrastructure charge and a per-GB data processing fee.

Disable Remote Capture in On-Prem and Hybrid Deployments ​

In on-prem and hybrid deployments, you can now prevent a Leader from pulling event samples from a Worker by setting CRIBL_DISABLE_FEATURES=remote_capture on the Worker. The Worker refuses every Live Capture request, including captures that the Leader initiates, which keeps events on the host. Because the Worker reads the setting from its own environment, no Leader-side change can re-enable capture.

Cribl Guard Background Detection in Cribl.Cloud Government ​

Cribl Guard background detection is now available in Cribl.Cloud Government. Background detection runs locally using an in-house named-entity-recognition (NER) model and does not require configuring an external AI provider or BYOM setup. This enables automatic scanning of data streams for sensitive entities while maintaining FedRAMP compliance boundaries.

New Sources and Destinations ​

Akamai HEC Source: A new Akamai HEC Source is purpose-built for Akamai DataStream 2, which streams log data to the Splunk HEC raw endpoint path.

Aqua Security Source: A new Aqua Security Source enables you to receive Aqua Security data over Splunk HEC.

BeyondTrust Source: A new BeyondTrust Source enables you to receive BeyondTrust data over Splunk HEC.

ExtraHop RevealX 360 Source: A new ExtraHop RevealX 360 Source enables you to receive ExtraHop RevealX 360 data over Splunk HEC.

F5 BIG-IP Source: A new F5 BIG-IP Source enables you to receive F5 BIG-IP data over Splunk HEC.

HashiCorp HCP Vault Dedicated Source: A new HashiCorp HCP Vault Dedicated Source enables you to receive HashiCorp HCP Vault Dedicated data over Splunk HEC.

Mimecast HEC Source: A new Mimecast HEC Source enables you to receive Mimecast data over Splunk HEC.

Ping Identity PingOne Source: A new Ping Identity PingOne Source enables you to receive PingOne data over Splunk HEC.

SailPoint Source: A new SailPoint Source enables you to receive SailPoint data over Splunk HEC.

Trellix Source: A new Trellix Source enables you to receive Trellix data over Splunk HEC.

Trend Micro Vision One Source: A new Trend Micro Vision One Source enables you to collect XDR and detection data over Splunk HEC.

Vectra AI Source: A new Vectra AI Source enables you to receive Vectra AI data over Splunk HEC.

Azure VNet Flow Logs Source: A new Azure VNet Flow Logs Source enables you to ingest Azure Virtual Network flow logs.

Microsoft Copilot Source: A new Microsoft Copilot Source enables you to collect Microsoft 365 Copilot interaction data, including user prompts and AI responses, through the Interaction Export API.

Claude Enterprise Analytics Source: A new Claude Enterprise Analytics Source enables you to collect Organization API usage and cost data from the Anthropic Usage and Cost Analytics API.

Databricks Zerobus Destination: A new Databricks Zerobus Destination enables you to write events directly into Unity Catalog Delta tables through Databricks Zerobus Ingest, without landing files in object storage first.

Experience Improvements ​

• Bytes Out for Routes now estimates event size after Pipeline processing, instead of reusing the incoming event size. Because the metric responds when Functions modify, enrich, or reduce events, the Routes page and the Monitoring Routes charts show each Route’s real effect on data volume. Use it to confirm and quantify your data reduction, without sending internal metrics to a downstream system to measure it.
• When you select a Node on the Workers page, the details drawer now lists the Worker Processes running on that Node.
• Sample files are easier to scan and manage in both the Knowledge library and the Sample Data tab in Data Preview. Size and Events columns now appear in the Knowledge library table, so you can see how large a sample is and how many events it contains before you use it. The separate Import Data, Edge Data, and Capture Data options are consolidated into one Add Sample File menu, and all row-level actions, including Simple Preview and Full Preview, are now grouped under the row’s Actions menu.
• The Pipelines monitoring view now includes Errors, Total Errors, and Average Errors (EPS) alongside the existing throughput columns. These metrics show each Pipeline’s processing-error rate and count over your selected time range.
• Settings > Global > Upgrade > Validate CDN server certificates now includes a tooltip that explains when to disable certificate validation.
• TLS settings sections across Sources, Destinations, and system configuration have been reorganized to support typical logical flows when configuring TLS.
• To protect Leader stability, Cribl.Cloud now limits how many Worker Groups you can create at once. When the Leader is under memory or CPU pressure, or too many Worker Group creations are already in progress, the request returns HTTP 429 with a Retry-After value, and the Worker Group is not created.

Sources and Destinations ​

• The new Enable discovery Throttling setting lets you throttle CPU usage for File Monitor discovery to a configurable target percentage. This can help you reduce CPU spikes on large directory trees, at the cost of higher discovery latency.
• The Cribl Search Destination can now send logs and native metrics over the same connection.
• The Kafka Destination now supports SASL OAuth.
• The Exabeam Destination now supports Exabeam V2 dynamic metadata.
• The Windows Event Forwarder Source now supports Negotiate authentication, so you can collect events from Windows hosts whose WinRM policy requires message-level encryption.
• The OpenTelemetry Source now supports OAuth2 client credentials as an authentication method, in addition to auth tokens and basic auth.
• The OpenTelemetry Source now accepts OTLP over HTTP with JSON-encoded protobuf, alongside binary protobuf.
• The Amazon S3 Data Lake Destination now lets you select an AWS Region, so you can send data to region-specific S3 endpoints instead of the global endpoint.
• The Wiz Defend Destination adds support for AWS VPC Flow Logs.
• Database Connections now let you store the password or token as a secret, separate from the rest of the connection parameters.
• The Elasticsearch API Source, Splunk TCP Source, Amazon Firehose Source, HTTP Source, Raw HTTP Source, Wiz Webhook Source, Cribl Lake HTTP Source, SNMP Trap Source, and Exabeam Destination now let you select or create a stored secret for auth tokens.
• SQL Server Database Connections using the Config authentication method now support an optional credentials secret for the database username and password.

Important Changes ​

Lookup File Paths Restricted to Default Locations ​

Cribl now loads lookup files only from the default lookup file paths, such as $CRIBL_HOME/data/lookups/. Relative paths that point outside those locations, including ../, no longer resolve. Files in the Knowledge Library are unaffected.

What you need to do:

If you store lookup files outside $CRIBL_HOME, add that location to Allowed lookup file paths in Limits.

Event Byte Limit Enforces a Size Boundary ​

The Event byte limit on an Event Breaker Rule is now an enforced size boundary. When an event reaches the limit before the break pattern matches, Cribl splits the data into events of up to that size. Previously, Cribl kept leftover bytes and rescanned them as more data arrived. This behavior could drive up CPU and memory use and send significantly more data to your Destinations than the Source received.

What you need to do:

Review Event Breaker Event byte limit values if you rely on leftover-byte rescanning. After this change, oversized input is split into events of up to the configured size instead of accumulating and being re-emitted.

Notice: Cribl as Code TypeScript and Go SDK Discontinuation ​

Cribl is stopping active development of the Cribl as Code Go and TypeScript SDKs, which were previously in preview. To give existing users a clear path forward, we are moving the SDKs from the criblio GitHub Organization to the Cribl Community GitHub Organization. We are also open sourcing them as community resources. Customers and community members can continue using and building on the SDKs while Cribl steps back from active development and long-term support.

The SDKs will continue to be available through their new home in the Cribl Community GitHub Organization. You can continue using, forking, and extending them based on your needs. To use a supported integration, consider migrating to the Python SDK, Terraform Provider, or direct Cribl API access. During the transition period, Cribl support will be limited to critical issues, such as security vulnerabilities or P0 blockers. On October 1, 2026, the SDK repositories will be archived and marked read-only.

Deprecation Notice: Smart Mode for Source Persistent Queue ​

To improve data integrity, Smart mode is now deprecated for Source persistent queue for hybrid and on-prem deployments. In January 2027, configurations for all deployments will automatically migrate to Always On mode, which uses a persistent queue buffer for all events.

Consider updating existing configurations to Always On mode prior to the automatic migration date. Before changing the configuration:

• Monitor your persistent queue usage so that you can allocate enough disk space.
• When making changes to your persistent queue, remember to first drain queues before disabling them to avoid orphaned data.
• Verify that data routing and filtering behaves as expected in a test environment before rolling out the new configuration to production.

Deprecation Notice: Disable Node Persistence ​

The Disable Node persistence setting is deprecated and will be removed in a future release. Node information is persisted by default. Use the Worker Group/Fleet-level Time to keep disconnected Nodes setting to control how long Nodes are tracked.

Notice: Future Removal of AppScope Source ​

The AppScope Source will be removed from Cribl Stream in a future release.

Corrections ​

Security Fixes ​

Operational Fixes ​

Source and Destination Fixes ​

Other Functional Fixes ​

SDK Changelogs ​

The Cribl SDKs help you integrate with Cribl and reduce the need for repetitive tasks. We maintain changelogs for each version of the Cribl Python SDKs in their GitHub repositories:

• Control plane
• Management plane