Cribl Stream 4.21.0 (Coming Soon) ​

The following draft provides early access to release notes for the upcoming Cribl Suite product release. Features or functionality presented are not considered binding commitments and are subject to change at the discretion of Cribl at any time for any reason without notice. This information should not be relied upon in making purchasing decisions.

Important Changes

This release introduces deprecation notices that require action if you use the affected features:

• Deprecation Notice: Smart Mode for Source Persistent Queue

Review the full list of important changes for additional critical updates.

New Features ​

This release provides the following improvements:

Introducing Stream AI ​

Cribl StreamAI is a new AI gateway in Cribl.Cloud that gives you centralized visibility into your organization’s AI usage. Connect Billy and other Cribl AI features, or your own OpenAI- and Anthropic-compatible clients such as Claude Desktop and Codex, to StreamAI with an API key. StreamAI intelligently routes each request to the best model for the task, optimizing for performance and cost efficiency. The StreamAI dashboard shows detailed usage by API key, and you can optionally send request telemetry to the AI Observability app or any OpenTelemetry tool.

Unified Billy Experience ​

The Billy sidebar chat experience is now expanding across Cribl products, replacing the standalone Billy widget with a consistent, context-aware assistant. Billy now understands where you are in the product, allowing you to perform product-specific actions, troubleshoot issues, consult documentation, and inspect deployment data while respecting your existing RBAC permissions. Conversations save automatically so you can pick up past sessions from your history at any time.

Privacy 3.1 Detection Models for Cribl Guard ​

Cribl Guard detection models are now upgraded to the Privacy 3.1 family, designed to align sensitive data detection more closely with real telemetry and your expectations so you get more useful findings. Because Cribl manages and publishes the model catalog directly, the Privacy 3.1 family appears automatically in the Detection model drop-down with no manual upgrade or configuration changes required.

Custom Detection Models for Cribl Guard ​

You can now request custom-trained detection models in Cribl Guard tailored to your organization’s sensitive data. If standard models miss proprietary sensitive values or flag safe data as false positives, Cribl can train a dedicated model using samples of your own logs. If you have background detection enabled on at least one pipeline, look for the notification on the Guard home page to contact your Cribl account representative and get started.

GitOps Read Only Mode ​

GitOps read-only mode now lets you troubleshoot production without taking your Leader out of read-only mode. With the permissions you already have, you can test a Destination, capture and save live data, compare the input and output of a Pipeline in Data Preview, and temporarily raise logging levels.

Limit the Disk Space that Collector Discover Results Use ​

You can now limit the size of each Collector job’s Discover results with the Max discover results (% of Worker disk) setting. This prevents a job from using too much disk space on the Node that runs Discover. The default setting, 0.2, limits each job to 20% of the $CRIBL_STATE_DIR/jobs volume. If a job’s Discover results exceed the limit, the job fails.

Use Global Secrets from HashiCorp Vault Without Inbound Access ​

In Cribl.Cloud, you can now configure HashiCorp Vault secret stores to connect using an on-prem Outpost Node so that the Leader does not open a connection to the HashiCorp Vault URL. Vault does not have to accept the inbound connection from the Leader, and its firewall or IP allowlist does not have to allow the Leader. The Outpost Node contacts HashiCorp Vault and returns the global secret values on its existing connection to the Leader.

Data Sharing Controls for Cribl AI Training ​

Cribl now introduces a data-sharing option in AI Settings, giving admins control over whether their organization’s data is used to train Cribl AI models.

For paid organizations, sharing is optional and you will be opted-out of sharing by default. Admins can enable or disable this setting at any time. Data collection will not begin before December 2026, even for organizations that opt in now.

For Free tier organizations, data sharing shall begin starting December 2026. Organizations that prefer to exclude their data from model training can upgrade to a paid tier to access custom data controls.

This setting does not affect Cribl.Cloud Government, where AI data sharing is permanently disabled and cannot be altered.

Retrieve Global Secrets from CyberArk ​

You can now create secret stores for global secrets that are backed by CyberArk Central Credential Provider (CCP). Cribl authenticates with an AppID and retrieves the current secret value for an account in a Safe. Define credentials once in CyberArk and reuse them across Cribl Stream and Edge.

Endpoint Lists ​

You can now create an Endpoint List of receiver hosts and load weights in a Worker Group, Fleet, or Pack, and share it across Cribl HTTP and Cribl TCP Destinations in that same scope.

Schema Monitoring (Preview) ​

Schema Monitoring samples events before they reach a Destination and checks them against a schema you choose. Use it to catch schema drift in live data without validating every event on the way out.

Auto Deploy for Lookup Files ​

Auto deploy is a new lookup file setting that sends a lookup file to the Workers in a Worker Group without a commit and deploy. The Leader also sends each later update to the file, so Workers stay current with reference data that changes often, such as a lookup file that an external system refreshes on a schedule. Your enrichment stays accurate without deploying your Worker Group every time the lookup data changes. Auto deploy is available only for new lookup files.

New Sources and Destinations ​

Check Point SASE Source: A new Check Point SASE Source enables you to receive Check Point SASE events over syslog.

Cisco ASA Source: A new Cisco ASA Source enables you to receive Cisco ASA syslog.

Cisco IOS Source: A new Cisco IOS Source enables you to receive Cisco IOS syslog.

Cisco Meraki Source: A new Cisco Meraki Source enables you to receive Cisco Meraki syslog.

Cisco Secure Firewall Source: A new Cisco Secure Firewall Source enables you to receive Cisco Secure Firewall syslog.

LiteLLM Source: A new LiteLLM Source enables you to receive LiteLLM generic API logger events over HTTP on the Cribl bulk API path.

Netskope Source: A new Netskope Source enables you to collect Netskope alerts and events with a Netskope API v2 token.

Salesforce Source: A new Salesforce Source enables you to collect Salesforce login, audit, and event log data with OAuth.

SentinelOne Search Source: A new SentinelOne Search Source enables you to collect SentinelOne alerts with an API token.

SonicWall Source: A new SonicWall Source enables you to receive SonicWall firewall syslog.

VMware ESXi/vCenter Source: A new VMware ESXi/vCenter Source enables you to receive syslog from VMware ESXi and vCenter.

Zoom Webhooks Source: A new Zoom Webhooks Source enables you to receive Zoom webhook events.

Akamai Object Storage Destination: A new Akamai Object Storage Destination enables you to send events to Akamai Object Storage.

Backblaze B2 Destination: A new Backblaze B2 Destination enables you to send events to Backblaze B2.

DigitalOcean Spaces Destination: A new DigitalOcean Spaces Destination enables you to send events to DigitalOcean Spaces.

DreamObjects Destination: A new DreamObjects Destination enables you to send events to DreamObjects.

Exoscale SOS Destination: A new Exoscale SOS Destination enables you to send events to Exoscale SOS.

Fastly Object Storage Destination: A new Fastly Object Storage Destination enables you to send events to Fastly Object Storage.

Filebase Destination: A new Filebase Destination enables you to send events to Filebase.

FortiSIEM Destination: A new FortiSIEM Destination enables you to send newline-delimited JSON to FortiSIEM.

Impossible Cloud Destination: A new Impossible Cloud Destination enables you to send events to Impossible Cloud.

IONOS S3 Object Storage Destination: A new IONOS S3 Object Storage Destination enables you to send events to IONOS S3 Object Storage.

Oracle Cloud Object Storage Destination: A new Oracle Cloud Object Storage Destination enables you to send events to Oracle Cloud Object Storage.

OVHcloud Object Storage Destination: A new OVHcloud Object Storage Destination enables you to send events to OVHcloud Object Storage.

Scaleway Object Storage Destination: A new Scaleway Object Storage Destination enables you to send events to Scaleway Object Storage.

Seagate Lyve Cloud Destination: A new Seagate Lyve Cloud Destination enables you to send events to Seagate Lyve Cloud.

Securonix Destination: A new Securonix Destination enables you to send newline-delimited JSON to a Securonix HTTP Event Receiver URL.

Serverless Elastic Destination: A new Serverless Elastic Destination enables you to send events to an Elastic Serverless project.

Tencent Cloud COS Destination: A new Tencent Cloud COS Destination enables you to send events to Tencent Cloud COS.

Wasabi Destination: A new Wasabi Destination enables you to send events to Wasabi.

Experience Improvements ​

• When a request is authenticated with an API Credential, the corresponding access.log event now records the API Credential name and the creator’s email address, if they are available.
• You can now add a certificate by uploading a PKCS#12 bundle (.pfx or .p12) as an alternative to PEM format. The exception is FIPS mode, which supports only PEM format.
• Cribl.Cloud now lets administrators edit existing SAML and OIDC single sign-on (SSO) configurations in place, without deleting and recreating the connection. Administrators can test configuration changes as part of the edit workflow.
• Sample file import and copy are now available in both the Knowledge library and the Sample Data tab in Data Preview. You can add a sample where you manage the library, and copy a sample to another Worker Group, Fleet, or Pack while you test a Route or Pipeline.
• In a Project, Select sample in a Function’s Advanced Editor now includes samples captured in that Project.
• You can now delete disconnected Stream Workers, Edge Nodes, and Outposts from their respective lists.
• The new total.dropped_events_system internal metric counts events dropped because they could not be delivered, such as when a persistent queue is full, or a Destination stays blocked or rejects events. total.dropped_events still counts every dropped event, including drops from Pipeline Functions and disabled Destinations. Compare the two metrics to tell whether events were dropped by your Pipelines or lost to delivery problems.
• Show System Fields, a new toggle in the Data Preview Advanced Settings menu, hides the system fields Cribl adds so you can see the event you are building. JSON schema checks can now skip internal fields and system fields, so a schema that rejects extra fields can pass on your data. In both cases, the fields stay on the event.
• The Cribl Marketplace is now at marketplace.cribl.io, where you can find and install Packs and Apps. Pages on the Packs Dispensary at packs.cribl.io redirect to the same pages, and Packs and Apps you already installed from either address can still be upgraded.
• Pack Publish to Git now includes an option to remove unwanted “changeme” values when pushing to an external repository. By unselecting Replace masked values with “changeme”, you can preserve non-sensitive values and variables that were previously overwritten.
• On Preview Mappings, Select Fields now limits the preview to the fields you select, so you can check those fields without the rest of the event in the way.
• The SNMP Trap Serialize Function can now use a stored secret, including a global secret, for the SNMPv3 authentication key and privacy key.
• The JSON Unroll Function is faster. A narrow event is about 40% faster, and data that is not JSON and passes through can be up to about 60 times faster.
• In the Capture Data and Live Data modals, Where to capture now includes Before the event breaker (raw data) on Syslog, TCP (Raw), TCP JSON, Cribl TCP, Splunk TCP, UDP (Raw), NetFlow & IPFIX, SNMP Trap, HTTP/S (Bulk API), Raw HTTP/S, Cribl HTTP, Splunk HEC, Elasticsearch API, Windows Event Forwarder, and other Syslog and HEC Sources. It shows the data a Source received before the Event Breaker runs, so you can troubleshoot events that arrive merged, split in the wrong place, or garbled.
• In an Event Breaker rule preview, selecting a sample now loads the original log lines. The preview no longer shows the sample as formatted JSON.
• Disable bursts is a new setting on Destinations and Collectors. It makes a throttling rate a hard limit that applies immediately, instead of an average over one hour that traffic can exceed.
• The PQ Size column on a Source or Destination status table now sorts by queue size. A queue measured in MB sorts above a queue measured in KB.

Sources and Destinations ​

• The Azure Blob Storage Destination can now write up to 10 literal index tags on each uploaded blob.
• The Amazon S3 Destination can now write up to 10 static object tags on each uploaded object.
• You can now configure an auth token on Cribl HTTP and Cribl TCP Sources and Destinations in every deployment, including on-prem.
• On a JSON Array Event Breaker rule, you can now set the maximum decoded length of a string value.
• The File Monitor Source now offers a Recursive Watch option to help discover files in large trees without causing excessive CPU usage. The watcher tracks the designated directory, reducing the need for walking the full tree. Additional Re-scan interval and Max watched directories settings help finetune the recursive watcher behavior.
• The Azure Blob Storage Source can now extract .zip blobs.
• The Database Collector now supports Snowflake.

Important Changes ​

Deprecation Notice: Smart Mode for Source Persistent Queue ​

To improve data integrity, Smart mode is now deprecated for Source persistent queue for hybrid and on-prem deployments. In January 2027, configurations for all deployments will automatically migrate to Always on mode, which uses a persistent queue buffer for all events.

Consider updating existing configurations to Always on mode prior to the automatic migration date. Before changing the configuration:

• Monitor your persistent queue needs to correctly size your persistent queue disk space needs and then allocate sufficient disk space.
• When making changes to your persistent queue, remember to first drain queues before disabling them to avoid orphaned data.
• Verify that data routing and filtering behaves as expected in a test environment before rolling out the new configuration to production.

Deprecation Notice: Disable Node Persistence ​

The Disable Node persistence setting is deprecated and will be removed in a future release. Node information is persisted by default. Use the Worker Group/Fleet-level Time to keep disconnected Nodes setting to control how long Nodes are tracked.

Notice: Future Removal of AppScope Source ​

The AppScope Source will be removed from Cribl Stream/Edge in a future release.

Notice: Future Removal of CBC and RSA TLS Cipher Suites ​

In an upcoming release, Cribl.Cloud will remove support for CBC and RSA-based TLS cipher suites. The change strengthens the security and confidentiality of customer environments.

Cribl is removing these suites for two reasons:

• CBC ciphers are susceptible to well-documented side-channel and padding oracle attacks.
• RSA key exchange does not provide forward secrecy. If a server’s private key were compromised, previously recorded sessions could be decrypted later.

This change applies to the TLS endpoints your Workspaces expose and connect to for data movement. That includes connections your systems make into Cribl Stream, and outbound connections Stream makes to your Destinations. Customers most likely to be affected have:

• Legacy or embedded data senders that push data into Stream Sources. Examples include older syslog forwarders, appliances, IoT devices, OT devices, and custom agents.
• Third-party or on-prem systems whose TLS libraries have not been updated in several years. Those systems can negotiate only CBC or RSA-keyed cipher suites.
• Custom integrations built on outdated TLS stacks that connect to Stream HTTP, TCP-TLS, or Kafka Sources. The same applies when Stream pushes data to those systems as a Destination. Outdated stacks include older OpenSSL, legacy Java runtimes, and end-of-life operating systems.

Corrections ​

Security Fixes ​

Operational Fixes ​

Source and Destination Fixes ​

Other Functional Fixes ​

SDK Changelogs ​

The Cribl SDKs help you integrate with Cribl and reduce the need for repetitive tasks. We maintain changelogs for each version of the Cribl SDKs in their GitHub repositories:

• Go SDK changelogs: control plane and management plane
• Python SDK changelogs: control plane and management plane
• Typescript SDK changelogs: control plane and management plane