July 9, 2026 - v1.101.0

Self-hosted

Sources & Destinations

Windows Events:

• A redesigned Windows Events source is available with additional channel options (MSSQL, PowerShell, Sysmon, DNS Server, and Forwarded Events) and SID enrichment and custom channels promoted out of advanced settings. The previous version is now labeled "legacy."
• New Windows Event Forwarding source for collecting events forwarded to a central collector.
• New Windows Remote Collection source for collecting events from remote Windows hosts.
• The new Windows sources include a streaming/polling toggle to control how events are collected.

REST API Source:

• The source now uses a tabbed layout and a timezone-aware date/time picker for time-bound collection.

Azure:

• Azure Blob source adds encoding support.
• Azure Event Hub source adds a prefetch option and Azure Active Directory authentication support.

Additional Sources:

• AWS CloudWatch source can now collect metrics in addition to logs via a telemetry-type selector.
• New AWS Neuron source for monitoring AWS Trainium and Inferentia accelerators.
• Syslog source adds a "none" protocol option.
• UDP source exposes an option to disable added attributes.
• AIX is now open for public beta.

Destinations:

• New Amazon CloudWatch destination supporting both logs and metrics.
• Google SecOps (Chronicle) exporter exposes the collect_agent_metrics option.

Processors

XML Processing Suite: A new set of processors makes working with XML payloads far easier:

• Parse Simplified XML and Get XML for extracting structured data from XML.
• Remove XML for stripping XML content.
• Convert XML Attributes To Elements, Insert XML Elements, and Convert XML Text To Elements for reshaping XML structure.

Rebuilt Processors: New versions of several processors ship with expanded capabilities:

• Coalesce now supports multiple source locations with first-wins resolution.
• Concat now supports both field and literal sources.
• Deduplicate Logs offers improved log deduplication.
• Rewrite Timestamp is now a single processor for all timestamp rewriting.

Parse Timestamp now supports named-group regular expressions, timezone and locale pickers, and whole-body parsing.

Resource Detection adds new environment and Kubernetes API detector options.

Other Processor Improvements:

• New Drain processor (beta) for log clustering, with storage extension support.
• New Slice to Map processor for converting slices into maps.
• Count connector settings are now exposed in the UI.

Microsoft Sentinel

• Sources can now map directly to ASIM with a consolidated Data Collection Rule (DCR).
• Added ASIM preset fixes, save-time coverage validation, an inline mapping editor, an event-mappings list UI, and support for Kubernetes and OpenShift platforms.

Authentication & Identity Management

• SSO is now available for Bindplane Google Edition (BGE).
• OIDC claims format is now customizable, and OIDC now uses sub and upn to match the Auth0 implementation.
• Improved handling of organization admin project roles and access, plus a more resilient Auth0 post-login redirect flow.

Platform & Operations

• Database: PostgreSQL 18 is supported, along with AWS RDS IAM authentication for the Postgres datastore.
• High availability & security: The OpAMP extension listener no longer skips TLS verification, and agent-connection row locking was hardened to prevent deadlocks.
• OpAMP & agent metrics: A new OpAMP connection extension ships agent metrics (including per-exporter and pipeline-health metrics) for cost and health evaluation.

CLI & API Keys

• New bindplane secret rename CLI command.
• New Splunk-to-Bindplane migration CLI command.

Blueprints

• New blueprint for FIX (Financial Information eXchange) data.
• New "Parse Windows Event XML" blueprint.
• Updated Windows-to-SecOps blueprint with new labels.

Deprecations

The previous versions of the Coalesce, Concat, Deduplicate Logs, and Rewrite Timestamp processors are deprecated in favor of the rebuilt versions described above. Existing configurations continue to work, but new pipelines should use the current versions.

Bug Fixes

• The Move Field processor no longer silently deletes a field when the destination write can't complete. Previously, moving a field into a blank Attributes or Resource destination, or into a log with a string body, would remove the source field without writing it anywhere; the source is now removed only after the destination has been written successfully.
• The Marshal, Parse CSV, Parse JSON, and Parse XML processors now support nested fields via bracket notation.
• Corrected metric handling in the Parse XML and Parse CSV processors.
• Timezone validation now accepts legacy IANA aliases (for example, US/Hawaii).
• The Splunk source no longer overrides host.name.
• Resource-name validation is now consolidated in the backend for consistent enforcement.
• Keyboard shortcuts no longer trigger while the add-source and add-destination drawers are open.
• Improved column spacing for larger routers and corrected stacked-router spacing and sidebar ordering in the ELK layout.
• Fixed sorting of the agents table by version.
• Fixed search suggestions on the configurations table.
• Corrected Viewer-role behavior in the pipeline editor.
• Improved handling of mixed-metric OpAMP messages and the new "raw bytes" throughput metric.
• Fleet dateModified metadata is now updated correctly.
• Hardened organization-admin role and project-access enforcement.