Tenzir

You can now export final test outcomes, failure diagnostics, and plain diffs as versioned JSON reports. Tagged log records let your CI surface failures from sandboxed builds without parsing terminal output.

An agent can take an unintended action with valid credentials. Connect its recorded actions, approvals, and results with identity, endpoint, and service logs so the SOC can investigate who allowed it and what actually happened.

You can now silence runtime warnings that are irrelevant to your Tenzir tests while keeping errors and compilation diagnostics visible. This release also updates the example project for Tenzir v6 and removes the deprecated --multi option.

Run stock Sigma rules directly on OCSF events Move data faster with parallel sinks and Kafka operators Read only what the pipeline needs Collect Microsoft security data with per-tenant identity Work with Avro data end to end

Provider dashboards show usage, but connecting it to a team and a runaway agent takes more context. Request telemetry lets a pipeline attribute spend and flag changes by workload. In our illustrative model, stopping runaway agents within one day instead o

This release fixes a data-loss regression in v6.19.0 when using custom disk-usage checks such as tenzir-df-percent. Upgrade affected nodes to prevent further data loss; this fix cannot restore data already deleted.

The to_clickhouse operator now keeps fields that have no matching column in a native JSON catch-all column, so events fit into existing tables without losing data. The new print_avro function encodes events as Avro binary for message sinks such as Kafka.

Point-to-point feeds spread the cost of security data across SIEM licenses, duplicate collectors, parser upkeep, and every migration. We priced a representative mid-size SOC: a pipeline layer cuts what the rest of the stack costs per year nearly in half,

Azure Key Vault secret stores can now authenticate with a managed identity, which removes the need to keep a long-lived client secret in the workspace configuration. This release also adds a new flag for JSON output to the workspace creation CLI.

Configured pipeline parallelism now accelerates asynchronous transforms and supported competing-consumer sources, increasing throughput for DNS, context, Python, AMQP, and Google Cloud Pub/Sub workloads. This release also restores the SentinelOne Data Lak