> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/changelog/july-2026/readme.md). # July 9, 2026 - v1.101.0 ### Sources & Destinations **Windows Events:** * A redesigned **Windows Events** source is available with additional channel options (MSSQL, PowerShell, Sysmon, DNS Server, and Forwarded Events) and SID enrichment and custom channels promoted out of advanced settings. The previous version is now labeled "legacy." * New **Windows Event Forwarding** source for collecting events forwarded to a central collector. * New **Windows Remote Collection** source for collecting events from remote Windows hosts. * The new Windows sources include a streaming/polling toggle to control how events are collected. **REST API Source:** * The source now uses a tabbed layout and a timezone-aware date/time picker for time-bound collection. **Azure:** * Azure Blob source adds encoding support. * Azure Event Hub source adds a prefetch option and Azure Active Directory authentication support. **Additional Sources:** * AWS CloudWatch source can now collect metrics in addition to logs via a telemetry-type selector. * New AWS Neuron source for monitoring AWS Trainium and Inferentia accelerators. * Syslog source adds a "none" protocol option. * UDP source exposes an option to disable added attributes. * AIX is now open for public beta. **Destinations:** * New Amazon CloudWatch destination supporting both logs and metrics. * Google SecOps (Chronicle) exporter exposes the `collect_agent_metrics` option. ### Processors **XML Processing Suite:** A new set of processors makes working with XML payloads far easier: * **Parse Simplified XML** and **Get XML** for extracting structured data from XML. * **Remove XML** for stripping XML content. * **Convert XML Attributes To Elements**, **Insert XML Elements**, and **Convert XML Text To Elements** for reshaping XML structure. **Rebuilt Processors:** New versions of several processors ship with expanded capabilities: * **Coalesce** now supports multiple source locations with first-wins resolution. * **Concat** now supports both field and literal sources. * **Deduplicate Logs** offers improved log deduplication. * **Rewrite Timestamp** is now a single processor for all timestamp rewriting. **Parse Timestamp** now supports named-group regular expressions, timezone and locale pickers, and whole-body parsing. **Resource Detection** adds new environment and Kubernetes API detector options. **Other Processor Improvements:** * New **Drain** processor (beta) for log clustering, with storage extension support. * New **Slice to Map** processor for converting slices into maps. * Count connector settings are now exposed in the UI. ### Microsoft Sentinel * Sources can now map directly to ASIM with a consolidated Data Collection Rule (DCR). * Added ASIM preset fixes, save-time coverage validation, an inline mapping editor, an event-mappings list UI, and support for Kubernetes and OpenShift platforms. ### Authentication & Identity Management * SSO is now available for Bindplane Google Edition (BGE). * OIDC claims format is now customizable, and OIDC now uses `sub` and `upn` to match the Auth0 implementation. * Improved handling of organization admin project roles and access, plus a more resilient Auth0 post-login redirect flow. ### Platform & Operations * **Database:** PostgreSQL 18 is supported, along with AWS RDS IAM authentication for the Postgres datastore. * **High availability & security:** The OpAMP extension listener no longer skips TLS verification, and agent-connection row locking was hardened to prevent deadlocks. * **OpAMP & agent metrics:** A new OpAMP connection extension ships agent metrics (including per-exporter and pipeline-health metrics) for cost and health evaluation. ### CLI & API Keys * New `bindplane secret rename` CLI command. * New Splunk-to-Bindplane migration CLI command. ### Blueprints * New blueprint for FIX (Financial Information eXchange) data. * New "Parse Windows Event XML" blueprint. * Updated Windows-to-SecOps blueprint with new labels. ### Deprecations The previous versions of the **Coalesce**, **Concat**, **Deduplicate Logs**, and **Rewrite Timestamp** processors are deprecated in favor of the rebuilt versions described above. Existing configurations continue to work, but new pipelines should use the current versions. ### Bug Fixes * The Move Field processor no longer silently deletes a field when the destination write can't complete. Previously, moving a field into a blank Attributes or Resource destination, or into a log with a string body, would remove the source field without writing it anywhere; the source is now removed only after the destination has been written successfully. * The Marshal, Parse CSV, Parse JSON, and Parse XML processors now support nested fields via bracket notation. * Corrected metric handling in the Parse XML and Parse CSV processors. * Timezone validation now accepts legacy IANA aliases (for example, `US/Hawaii`). * The Splunk source no longer overrides `host.name`. * Resource-name validation is now consolidated in the backend for consistent enforcement. * Keyboard shortcuts no longer trigger while the add-source and add-destination drawers are open. * Improved column spacing for larger routers and corrected stacked-router spacing and sidebar ordering in the ELK layout. * Fixed sorting of the agents table by version. * Fixed search suggestions on the configurations table. * Corrected Viewer-role behavior in the pipeline editor. * Improved handling of mixed-metric OpAMP messages and the new "raw bytes" throughput metric. * Fleet `dateModified` metadata is now updated correctly. * Hardened organization-admin role and project-access enforcement. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bindplane.com/changelog/july-2026/readme.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.