Open Collector 2026.01 Release Notes - 6 January 2026
January 2026 Release Details
The 2026.01 release of Open Collector requires Knowledge Base version 7.1.733.0 (or above).
Software Component | Version Number | New Version? |
|---|---|---|
Open Collector | 5.6.20 | |
LRCTL Script | 6.0.1 | |
LRCTL Container | 6.6.3 | Yes |
LRJQ | 5.1.4 | |
Metrics | 6.0.8 | |
OC Pipeline | 5.1.7 | |
OC-Admin | 6.0.15 | |
OC-DB | 6.0.2 | |
AWS S3 Beat | 6.2.2 | |
Azure Event Hubs Beat | 6.0.10 | |
Carbon Black Cloud Beat | 6.0.8 | |
Cisco AMP Beat | 6.1.6 | |
Darktrace Beat | 6.0.0 | |
Duo Authentication Security Beat | 6.0.5 | |
Exabeam Case Beat | 6.0.0 | |
Generic Beat | 6.2.0 | |
Gmail Message Tracking Beat | 6.0.5 | |
GSuite Beat | 6.0.5 | |
Kafka Beat | 6.0.7 | |
Microsoft Graph API Beat | 6.0.9 | |
Mimecast SIEM Beat | 6.0.0 | |
O365 Beat | 6.0.0 | |
Okta Beat | 6.0.5 | |
Prisma Cloud Beat | 6.0.2 | |
Proofpoint Beat | 6.0.3 | |
PubSub Beat | 6.0.3 | |
Qualys FIM Beat | 6.0.5 | |
Salesforce Audit Beat | 6.0.0 | Yes |
Salesforce Beat | 6.0.2 | |
SentinelOne Beat | 6.0.1 | |
Sophos Central Beat | 7.0.0 | |
Symantec WSS Beat | 6.0.3 | |
Webhook Beat | 6.1.7 |
New Features/Beats
Feature or Beat | Description | Relevant Documentation Updates |
|---|---|---|
Salesforce Audit Beat | A new beat has been added for the Salesforce Audit Beat, replacing the API collection previously done through the System Monitor Agent for the Salesforce Audit log source. | |
LRCTL Service API Enhancements | The LRCTL service, when configured with a Platform Manager IP address and API key, will now synchronize currently-running beats with the Admin API to allow population in the Web Console. If you have not yet setup the LRCTL service, instructions for how to do so can be found in the Configure Open Collector Connection to the Web UI topic. Once this has been configured, the Admin API will allow for beat population in the Web Console. | |
New JSON Policy Builder | The JSON Policy Builder has received a huge update that will streamline the creation and editing of JSON policies for use with Open Collectors and System Monitor Agents. |
Notice of Eventual Open Collector Metrics Deprecation
As the preferred method of configuring the Open Collector and Beats continues to transition to the Web UI, Open Collector Metrics has reached its End of Engineering life as of 1 October 2025. Customers can continue to use Metrics going forward with limited support available.