Open Collector 2026.05 Release Notes - 23 April 2026
May 2026 Release Details
The 2026.05 release of Open Collector requires Knowledge Base version 7.1.741.0 (or above).
Software Component | Version Number | New Version? |
|---|---|---|
Open Collector | 5.6.20 | |
LRCTL Script | 6.0.1 | |
LRCTL Container | 6.6.5 | Yes |
LRJQ | 5.1.4 | |
Metrics | 6.0.8 | |
OC Pipeline | 5.1.7 | |
OC-Admin | 6.0.15 | |
OC-DB | 6.0.2 | |
AWS S3 Beat | 6.2.2 | |
Azure Event Hubs Beat | 6.0.10 | |
Carbon Black Cloud Beat | 6.0.8 | |
Cisco AMP Beat | 6.1.6 | |
Darktrace Beat | 6.0.0 | |
Duo Authentication Security Beat | 6.0.5 | |
Exabeam Case Beat | 6.0.0 | |
Generic Beat | 6.2.0 | |
Gmail Message Tracking Beat | 6.0.6 | |
GSuite Beat | 6.0.5 | |
Kafka Beat | 6.0.8 | Yes |
Microsoft Graph API Beat | 6.1.1 | Yes |
Mimecast SIEM Beat | 6.0.0 | |
O365 Beat | 6.0.0 | |
Okta Beat | 6.0.5 | |
Prisma Cloud Beat | 6.0.2 | |
Proofpoint Beat | 6.0.3 | |
PubSub Beat | 6.0.3 | |
Qualys FIM Beat | 6.0.5 | |
Salesforce Beat | 6.0.2 | |
SentinelOne Beat | 6.0.1 | |
Sophos Central Beat | 7.0.0 | |
Symantec WSS Beat | 6.0.3 | |
Tenable Beat | 6.0.0 | |
Webhook Beat | 6.1.7 |
Enhancements/Improvements
Feature or Beat | Description | Relevant Documentation Updates |
|---|---|---|
Microsoft Graph API Beat | Due to the deprecation of the endpoint used to collect Microsoft Office 365 Message Tracking logs using the System Monitor Agent, this functionality has been moved to the Microsoft Graph API Beat. Using this beat, you can now collect O365 Message Tracking logs that were previously collected using the System Monitor Agent. Due to Open Collector being released separately from System Monitor, to correctly replace the functionality of the System Monitor Agent in collecting O365 Message Tracking logs, users must download this Json policy file and place it in the following location: C:\Program Files\LogRhythm\LogRhythm System Monitor\policies (If the file does not download automatically, and instead the .json file opens in your browser, right-click within the window and then click Save as… This will save the file to your machine as a .json file.) |
Resolved Issues
Bug ID | Description |
|---|---|
ENG-94813 | An issue that was causing the Kafka Beat to stop collecting logs and display an error message in certain situations has been resolved. |
ENG-93479 | An issue that was preventing the Metrics container from starting in certain situations has been resolved. |
Notice of JQ Pipeline Deprecation
Exabeam released JSON Parsing for Open Collector and Beats along with LogRhythm SIEM version 7.13. This feature was intended to replace the JQ pipeline within Open Collector, and as a result support and maintenance for the JQ pipeline, including dependencies such as the “ocpipeline” and “metrics beat,” are coming to an end in the October 2026 release.
To ensure that your Beats remain fully supported and maintained, it is recommended that any customers still using the JQ pipeline for their beats move to the JSON Parsing method and remove all metric and OC JQ images from the system.