Cribl Stream 4.20.0 ​

Cribl Stream 4.20.0 includes significant performance improvements, new capabilities, and important bug fixes.

Important Changes

This release introduces breaking changes and deprecations that require action if you use the affected features:

• Event byte limit enforces a size boundary
• C.env returns only allowlisted environment variables
• New location for Login and SSO/SLO callback rate limits
• AI Settings audit events use a new type value
• Deprecation Notice: Smart Mode for Source persistent queue
• Notice: Cribl as Code TypeScript and Go SDK Discontinuation
• Review the full list of important changes for additional critical updates.

New Features ​

This release provides the following improvements:

Apps General Availability ​

Apps are now generally available and no longer in Preview.

Apps let you build and run custom applications in Cribl. An App is a packaged user-interface experience that can call Cribl and third-party APIs, enabling tailored workflows and front-end experiences beyond the built-in product surfaces.

This release adds:

• Backend functions: An App can expose HTTP endpoints and run work on a schedule, so it can automate tasks instead of doing everything in the browser.
• External API Access: Administrators can authorize which third-party hosts each App may call, including Organization-specific domains that were not packaged with the App.
• Permissions review: Before you install an App, you can see the in-product permissions and external API access it declares.
• App limits: Administrators can control how much compute and related capacity each App can use.
• Scaffolding and upgrades: App builders get a clearer path from Create App through packaging, versioning, and upgrading an installed App.

Authentication Token Management ​

The new authentication token mechanism lets you create multiple tokens to provision Stream Workers, Edge Nodes, and Outposts. You can rotate and revoke tokens to control which Nodes can connect to the Leader.

On upgrade to 4.20.0, existing deployments automatically receive one legacy type token set to the value of the existing auth token.

No immediate action is required to migrate to the new token mechanism.

Cribl recommends rotating the legacy token to a new provisioning token at your earliest convenience. You can’t revoke the legacy token in a Cribl.Cloud deployment.

Retrieve Global Secrets from Azure Key Vault ​

You can now create secret stores for global secrets that are backed by Azure Key Vault. Cribl authenticates to Microsoft Entra ID as a service principal and retrieves current secret values from the vault. Define credentials once in Azure Key Vault and reuse them across Cribl Stream and Edge.

Parquet Schema Validation in Expressions ​

You can now validate events against a Parquet schema (a Knowledge Object) from any JavaScript expression, using C.Schema('<schema-id>', { kind: 'parquet' }).validate(<event>). A companion explain() method reports which field failed and why. This extends the existing C.Schema().validate() method, which previously supported only JSON schemas.

For routing, run the check once in a Source pre-processing Pipeline with an Eval Function filter, then use a Route filter or an Output Router to label conforming events for routing to your Parquet Destination and everything else to a separate Destination. Failed events stay available for inspection while you refine the schema, instead of being dropped at write time.

Schema validation is ideal for non-latency-sensitive troubleshooting, such as configuring new Sources and Parquet schema Knowledge Objects in a development environment for iterative review before finalizing schemas, Pipelines, and Routes.

Auto-Parse on Routes and Sources ​

Automatic parsing, introduced in 4.19 as the Parser Function’s Auto type, is now available on Routes and Sources as well. Toggle on Auto-parse in a Route, or in a Source’s Pre-Processing settings, and Cribl detects each event’s format and extracts its top-level fields before your Pipeline runs. This is available for raw or unstructured data Sources (such as TCP, UDP, Syslog, HTTP Raw, Splunk, files, object stores, and message queues). A new Auto-Parsing page (a Preview feature) lists your configured Sources in one place, so you can turn auto-parsing on or off per Source and capture a sample to verify successful parsing and view the detected datatype.

MCP Server Role-Based Access Control (RBAC) ​

The Cribl MCP server now supports role-based access control, enabling non-admin users to connect to the MCP server and use tools scoped to their product-level permissions. Previously, MCP server access was restricted to admin users only.

Cribl AI in Cribl.Cloud Government (BYOM) ​

Cribl.Cloud Government now supports Cribl AI via a Bring Your Own Model (BYOM) setup. Activating your custom AI provider routes supported features, including Copilot chat, Stream editing, and Search assistance, through your managed provider using simplified controls while maintaining FedRAMP compliance boundaries.

Cribl AI Recommendations in AWS Cloud Connections ​

On Cribl.Cloud, AWS Cloud Connections can now use Cribl AI to recommend a ranked list of AWS log sources to onboard. Cribl AI can also recommend values for Source configuration and a Destination from those available in the Worker Group. Cribl onboards only the recommended AWS log sources that you add, and the connection steps work as usual if Cribl AI is unavailable.

New Gemini Models in BYOM ​

The Google Gemini custom AI provider now supports the Gemini 3.6 Flash and Gemini 3.5 Flash-Lite models. Based on evaluation results, the suggested tier defaults for Gemini have changed: the Small tier now defaults to gemini-3.5-flash-lite, the Frontier tier now defaults to gemini-3.6-flash, and the Reasoning tier remains gemini-3.1-pro-preview. To restore these suggested defaults for every tier, select Reset to Defaults in AI Settings.

Self-Service Static Egress IPs ​

You can now enable static egress IPs in Cribl.Cloud when a Destination or firewall will accept Cribl traffic only from a known source address. Enable static egress per region on Workspace > Connections > Static Egress IP. Outbound traffic from the Leader, Worker Groups, and Collection jobs then uses a stable set of IPs that you can add to allowlists.

Disable Remote Capture in On-Prem and Hybrid Deployments ​

In on-prem and hybrid deployments, you can now prevent a Leader from pulling event samples from a Worker by setting CRIBL_DISABLE_FEATURES=remote_capture on the Worker. The Worker refuses every Live Capture request, including captures that the Leader initiates, which keeps events on the host. Because the Worker reads the setting from its own environment, no Leader-side change can re-enable capture.

Cribl Guard Background Detection in Cribl.Cloud Government ​

Cribl Guard background detection is now available in Cribl.Cloud Government. Background detection runs locally using an in-house named-entity-recognition (NER) model and does not require configuring an external AI provider or BYOM setup. This enables automatic scanning of data streams for sensitive entities while maintaining FedRAMP compliance boundaries.

New Sources and Destinations ​

Akamai HEC Source: A new Akamai HEC Source is purpose-built for Akamai DataStream 2, which streams log data to the Splunk HEC raw endpoint path.

Aqua Security Source: A new Aqua Security Source enables you to receive Aqua Security data over Splunk HEC.

BeyondTrust Source: A new BeyondTrust Source enables you to receive BeyondTrust data over Splunk HEC.

ExtraHop RevealX 360 Source: A new ExtraHop RevealX 360 Source enables you to receive ExtraHop RevealX 360 data over Splunk HEC.

F5 BIG-IP Source: A new F5 BIG-IP Source enables you to receive F5 BIG-IP data over Splunk HEC.

Gigamon Source: A new Gigamon Source enables you to receive Gigamon Application Metadata Exporter (AMX) data over Splunk HEC.

HashiCorp HCP Vault Dedicated Source: A new HashiCorp HCP Vault Dedicated Source enables you to receive HashiCorp HCP Vault Dedicated data over Splunk HEC.

Mimecast HEC Source: A new Mimecast HEC Source enables you to receive Mimecast data over Splunk HEC.

Ping Identity PingOne Source: A new Ping Identity PingOne Source enables you to receive PingOne data over Splunk HEC.

SailPoint Source: A new SailPoint Source enables you to receive SailPoint data over Splunk HEC.

Trellix Source: A new Trellix Source enables you to receive Trellix data over Splunk HEC.

Trend Micro Vision One Source: A new Trend Micro Vision One Source enables you to collect XDR and detection data over Splunk HEC.

Vectra AI Source: A new Vectra AI Source enables you to receive Vectra AI data over Splunk HEC.

Azure VNet Flow Logs Source: A new Azure VNet Flow Logs Source enables you to ingest Azure Virtual Network flow logs.

Microsoft Copilot Source: A new Microsoft Copilot Source enables you to collect Microsoft 365 Copilot interaction data, including user prompts and AI responses, through the Interaction Export API.

Claude Enterprise Analytics Source: A new Claude Enterprise Analytics Source enables you to collect Organization API usage and cost data from the Anthropic Usage and Cost Analytics API.

Databricks Zerobus Destination: A new Databricks Zerobus Destination enables you to write events directly into Unity Catalog Delta tables through Databricks Zerobus Ingest, without landing files in object storage first.

Traversal Destination: A new Traversal Destination enables you to send OTLP log events to a Traversal Processor over gRPC or HTTP.

Experience Improvements ​

• Bytes Out for Routes now estimates event size after Pipeline processing, instead of reusing the incoming event size. Because the metric responds when Functions modify, enrich, or reduce events, the Routes page and the Monitoring Routes charts show each Route’s real effect on data volume. Use it to confirm and quantify your data reduction, without sending internal metrics to a downstream system to measure it.
• When you select a Node on the Workers page, the details drawer now lists the Worker Processes running on that Node.
• Sample files are easier to scan and manage in both the Knowledge library and the Sample Data tab in Data Preview. Size and Events columns now appear in the Knowledge library table, so you can see how large a sample is and how many events it contains before you use it. In Data Preview, Import Data and Edge Data are grouped under an Import menu, with Capture Data as a separate control. All row-level actions, including Simple Preview and Full Preview, are now grouped under the row’s Actions menu.
• The Pipelines monitoring view now includes Errors, Total Errors, and Average Errors (EPS) alongside the existing throughput columns. These metrics show each Pipeline’s processing-error rate and count over your selected time range.
• Settings > Global > Upgrade > Validate CDN server certificates now includes a tooltip that explains when to disable certificate validation.
• TLS settings sections across Sources, Destinations, and system configuration have been reorganized to support typical logical flows when configuring TLS.
• To protect Leader stability, Cribl.Cloud now limits how many Worker Groups and Fleets can start a Config Helper at the same time. When the Leader is under memory or CPU pressure, or too many of these operations are already in progress, the request returns HTTP 429 with a Retry-After value. Wait for that interval and retry. This is most likely during bulk automation, such as a Terraform or API apply that creates or first configures many Worker Groups or Fleets at once.
• The Lookups list page in the Knowledge Library now includes a Last Modified column. Hover over the relative time in this column to see the full timestamp. The value reflects when the lookup file content last changed, not edits to tags or description.

Sources and Destinations ​

• The new Enable discovery Throttling setting lets you throttle CPU usage for File Monitor discovery to a configurable target percentage. This can help you reduce CPU spikes on large directory trees, at the cost of higher discovery latency.
• The File Monitor Source now offers an Enable Load Balancing option to help handle ingesting more file data EPS than a single Worker Process can handle.
• The Cribl Search Destination can now send logs and native metrics over the same connection.
• The Kafka Destination now supports SASL OAuth.
• The Exabeam Destination now supports Exabeam V2 dynamic metadata.
• The Windows Event Forwarder Source now supports Negotiate authentication, so you can collect events from Windows hosts whose WinRM policy requires message-level encryption.
• The OpenTelemetry Source now supports OAuth2 client credentials as an authentication method, in addition to auth tokens and basic auth.
• The OpenTelemetry Source now accepts OTLP over HTTP with JSON-encoded protobuf, alongside binary protobuf.
• The Amazon S3 Data Lake Destination now lets you select an AWS Region, so you can send data to region-specific S3 endpoints instead of the global endpoint.
• The Wiz Defend Destination adds support for AWS VPC Flow Logs.
• Database Connections now let you store the password or token as a secret, separate from the rest of the connection parameters.
• The Elasticsearch API Source, Splunk TCP Source, Amazon Firehose Source, HTTP Source, Raw HTTP Source, Wiz Webhook Source, Cribl Lake HTTP Source, SNMP Trap Source, and Exabeam Destination now let you select or create a stored secret for auth tokens.
• SQL Server Database Connections using the Config authentication method now support an optional credentials secret for the database username and password.

Important Changes ​

Event Byte Limit Enforces a Size Boundary ​

The Event byte limit on an Event Breaker Rule is now an enforced size boundary. When an event reaches the limit before the break pattern matches, Cribl splits the data into events of up to that size. Previously, Cribl kept leftover bytes and rescanned them as more data arrived. This behavior could drive up CPU and memory use and send significantly more data to your Destinations than the Source received.

What you need to do:

Review Event Breaker Event byte limit values if you rely on leftover-byte rescanning. After this change, oversized input is split into events of up to the configured size instead of accumulating and being re-emitted.

C.env Returns Only Allowlisted Environment Variables ​

As a security hardening measure, C.env now returns an allowlist-filtered snapshot of the process environment instead of the full set of environment variables. Only variables that start with CRIBL_ (except for a few excluded names) and a small set of built-in variables are accessible. Cribl omits all others. See C.env for the complete availability rules.

What you need to do:

If your configurations reference custom (non-CRIBL_) environment variables through C.env in Source fields, Pipeline Code functions, Preview, or other JavaScript-enabled expressions, those references now evaluate to undefined. To restore access to non-sensitive values:

1. Rename each custom variable so its name starts with CRIBL_ (for example, SITE_CODE becomes CRIBL_SITE_CODE).
2. Update every expression that referenced the old name.
3. Restart the Cribl process on each Worker Node so it picks up the renamed environment.

Do not expose credentials or other secrets through C.env. Store them as secrets and retrieve them with C.Secret().

New Location for Login and SSO/SLO Callback Rate Limits ​

The Login rate limit and SSO/SLO callback rate limit settings moved to Settings > Global > General Settings > Limits > API for the Leader and to Worker Group Settings > Limits > API for Worker Groups. Cribl stores the values in api-limits.yml. Existing rate limits defined in cribl.yml continue to work and do not need to be migrated. To set the limits using the Cribl API, use the PATCH /system/api-limits endpoint.

AI Settings Audit Events Use a New Type Value ​

Cribl now records every change made on the AI Settings page in the audit log. This includes custom AI provider changes, AI mode and consent changes, AI feature toggles, and MCP server changes. See Audit AI Settings Changes.

Five of these audit events shipped in earlier releases with the type value AISetting: ai-mode-lock, mcp-server-add, mcp-server-delete, mcp-server-enable, and mcp-server-disable. They now use ai-settings instead.

What you need to do:

Update any search, dashboard, or Notification that filters audit.log or the cribl_internal_logs Dataset on type=='AISetting' to use type=='ai-settings' instead. Filters that keep the old value return no results rather than reporting an error.

Notice: Cribl as Code TypeScript and Go SDK Discontinuation ​

Cribl is stopping active development of the Cribl as Code Go and TypeScript SDKs, which were previously in preview. To give existing users a clear path forward, we are moving the SDKs from the criblio GitHub Organization to the Cribl Community GitHub Organization. We are also open sourcing them as community resources. Customers and community members can continue using and building on the SDKs while Cribl steps back from active development and long-term support.

The SDKs will continue to be available through their new home in the Cribl Community GitHub Organization. You can continue using, forking, and extending them based on your needs. To use a supported integration, consider migrating to the Python SDK, Terraform Provider, or direct Cribl API access. During the transition period, Cribl support will be limited to critical issues, such as security vulnerabilities or P0 blockers. On October 1, 2026, the SDK repositories will be archived and marked read-only.

Deprecation Notice: Smart Mode for Source Persistent Queue ​

To improve data integrity, Smart mode is now deprecated for Source persistent queue for hybrid and on-prem deployments. In January 2027, configurations for all deployments will automatically migrate to Always On mode, which uses a persistent queue buffer for all events.

Consider updating existing configurations to Always On mode prior to the automatic migration date. Before changing the configuration:

• Monitor your persistent queue usage so that you can allocate enough disk space.
• When making changes to your persistent queue, remember to first drain queues before disabling them to avoid orphaned data.
• Verify that data routing and filtering behaves as expected in a test environment before rolling out the new configuration to production.

Deprecation Notice: Disable Node Persistence ​

The Disable Node persistence setting is deprecated and will be removed in a future release. Node information is persisted by default. Use the Worker Group/Fleet-level Time to keep disconnected Nodes setting to control how long Nodes are tracked.

Notice: Future Removal of AppScope Source ​

The AppScope Source will be removed from Cribl Stream in a future release.

Corrections ​

Operational Fixes ​

Source and Destination Fixes ​

Other Functional Fixes ​

SDK Changelogs ​

The Cribl SDKs help you integrate with Cribl and reduce the need for repetitive tasks. We maintain changelogs for each version of the Cribl Python SDKs in their GitHub repositories:

• Control plane
• Management plane