June 2026 Release Details
The 2026.06 release of Open Collector requires Knowledge Base version 7.1.743.0 (or above).
|
Software Component |
Version Number |
New Version? |
|---|---|---|
|
Open Collector |
5.6.20 |
|
|
LRCTL Script |
6.0.1 |
|
|
LRCTL Container |
6.6.6 |
Yes |
|
LRJQ |
5.1.4 |
|
|
Metrics |
6.0.8 |
|
|
OC Pipeline |
5.1.7 |
|
|
OC-Admin |
6.0.15 |
|
|
OC-DB |
6.0.2 |
|
|
AWS S3 Beat |
6.2.4 |
Yes |
|
Azure Event Hubs Beat |
6.0.10 |
|
|
Carbon Black Cloud Beat |
6.0.8 |
|
|
Cisco AMP Beat |
6.1.6 |
|
|
Darktrace Beat |
6.0.0 |
|
|
Duo Authentication Security Beat |
6.0.5 |
|
|
Exabeam Case Beat |
6.0.0 |
|
|
Generic Beat |
6.2.1 |
Yes |
|
Gmail Message Tracking Beat |
6.0.6 |
|
|
GSuite Beat |
6.0.5 |
|
|
Kafka Beat |
6.0.8 |
|
|
Microsoft Graph API Beat |
6.1.1 |
|
|
Mimecast SIEM Beat |
6.0.0 |
|
|
O365 Beat |
6.0.0 |
|
|
Okta Beat |
6.0.5 |
|
|
Prisma Cloud Beat |
6.0.2 |
|
|
Proofpoint Beat |
6.0.3 |
|
|
PubSub Beat |
6.0.3 |
|
|
Qualys FIM Beat |
6.0.5 |
|
|
Salesforce Beat |
6.0.2 |
|
|
SentinelOne Beat |
6.0.1 |
|
|
Sophos Central Beat |
7.0.0 |
|
|
Symantec WSS Beat |
6.0.3 |
|
|
Tenable Beat |
6.0.0 |
|
|
Webhook Beat |
6.1.7 |
|
Enhancements/Improvements
|
Feature or Beat |
Description |
Relevant Documentation Updates |
|---|---|---|
|
Long-Running LRCTL |
A new step was added to the configuration of LRCTL that allows for customers to enable or disable FIPS mode for all beats. |
Resolved Issues
|
Bug ID |
Description |
|---|---|
|
ENG-63510 |
An issue in which beat configuration via Web Console could sometimes result in an incorrect Agent IP address being written to the beat’s configuration file has been resolved. |
|
ENG-78865 |
An issue in which configuring the Generic Beat using Oauth and application/json resulted in “invalid string” error messages has been resolved. |
|
ENG-81493 |
An issue in which logs collected via the AWS S3 Beat would be in an unreadable/unusable format in certain situations has been resolved. |
|
ENG-95644 |
Resolved an issue in which the Generic Beat would periodically make API calls with a blank request body, resulting in a “user not authorized” error. |
Notice of JQ Pipeline Deprecation
Exabeam released JSON Parsing for Open Collector and Beats along with LogRhythm SIEM version 7.13. This feature was intended to replace the JQ pipeline within Open Collector, and as a result support and maintenance for the JQ pipeline, including dependencies such as the “ocpipeline” and “metrics beat,” are coming to an end in the October 2026 release.
To ensure that your Beats remain fully supported and maintained, it is recommended that any customers still using the JQ pipeline for their beats move to the JSON Parsing method and remove all metric and OC JQ images from the system.