Open Collector 2026.04 Release Notes - 1 April 2026
April 2026 Release Details
The 2026.04 release of Open Collector requires Knowledge Base version 7.1.739.0 (or above).
Software Component | Version Number | New Version? |
|---|---|---|
Open Collector | 5.6.20 | |
LRCTL Script | 6.0.1 | |
LRCTL Container | 6.6.4 | Yes |
LRJQ | 5.1.4 | |
Metrics | 6.0.8 | |
OC Pipeline | 5.1.7 | |
OC-Admin | 6.0.15 | |
OC-DB | 6.0.2 | |
AWS S3 Beat | 6.2.2 | |
Azure Event Hubs Beat | 6.0.10 | |
Carbon Black Cloud Beat | 6.0.8 | |
Cisco AMP Beat | 6.1.6 | |
Darktrace Beat | 6.0.0 | |
Duo Authentication Security Beat | 6.0.5 | |
Exabeam Case Beat | 6.0.0 | |
Generic Beat | 6.2.0 | |
Gmail Message Tracking Beat | 6.0.6 | Yes |
GSuite Beat | 6.0.5 | |
Kafka Beat | 6.0.7 | |
Microsoft Graph API Beat | 6.1.0 | Yes |
Mimecast SIEM Beat | 6.0.0 | |
O365 Beat | 6.0.0 | |
Okta Beat | 6.0.5 | |
Prisma Cloud Beat | 6.0.2 | |
Proofpoint Beat | 6.0.3 | |
PubSub Beat | 6.0.3 | |
Qualys FIM Beat | 6.0.5 | |
Salesforce Beat | 6.0.2 | |
SentinelOne Beat | 6.0.1 | |
Sophos Central Beat | 7.0.0 | |
Symantec WSS Beat | 6.0.3 | |
Tenable Beat | 6.0.0 | Yes |
Webhook Beat | 6.1.7 |
New Features/Beats
Feature or Beat | Description | Relevant Documentation Updates |
|---|---|---|
Tenable Beat | A new beat has been added: the Tenable Beat, allowing users to leverage Tenable Vulnerability Management to collect logs using the Open Collector infrastructure. | |
Microsoft Graph API Beat | The Microsoft Graph API Beat has received an update enabling GCC customers to specify their status during configuration, allowing log collection in these environments. | |
Secure JSON Listener | The LogRhythm JSON Listener can now accept logs securely from third-party shippers like Cribl and Databahn using SSL encryption. This feature is enabled through new System Monitor Advanced Properties, where you can specify the path to your SSL certificate and private key on both Windows and Linux System Monitors. To streamline troubleshooting, detailed connection and SSL-related errors are now recorded in the scsm.log file, ensuring a smooth and secure integration for your cloud log sources. |
Security-Related Issues
Resolved security-related issues are available for customers to review on the Community.
Notice of JQ Pipeline Deprecation
Exabeam released JSON Parsing for Open Collector and Beats along with LogRhythm SIEM version 7.13. This feature was intended to replace the JQ pipeline within Open Collector, and as a result support and maintenance for the JQ pipeline, including dependencies such as the “ocpipeline” and “metrics beat,” are coming to an end in the October 2026 release.
To ensure that your Beats remain fully supported and maintained, it is recommended that any customers still using the JQ pipeline for their beats move to the JSON Parsing method and remove all metric and OC JQ images from the system.