July 2026 Release Details
The 2026.07 release of Open Collector requires Knowledge Base version 7.1.746.0 (or above).
|
Software Component |
Version Number |
New Version? |
|---|---|---|
|
Open Collector |
5.6.20 |
|
|
LRCTL Script |
6.0.1 |
|
|
LRCTL Container |
6.7.6 |
Yes |
|
LRJQ |
5.1.4 |
|
|
Metrics |
6.0.8 |
|
|
OC Pipeline |
5.1.7 |
|
|
OC-Admin |
6.0.15 |
|
|
OC-DB |
6.0.2 |
|
|
AWS S3 Beat |
6.2.4 |
|
|
Azure Event Hubs Beat |
6.0.10 |
|
|
Box Beat |
6.0.0 |
Yes |
|
Carbon Black Cloud Beat |
6.0.8 |
|
|
Cisco AMP Beat |
6.1.6 |
|
|
Darktrace Beat |
6.0.0 |
|
|
Duo Authentication Security Beat |
6.0.5 |
|
|
Exabeam Case Beat |
6.0.0 |
|
|
Generic Beat |
6.2.1 |
|
|
Gmail Message Tracking Beat |
6.0.6 |
|
|
GSuite Beat |
6.0.5 |
|
|
Kafka Beat |
6.0.8 |
|
|
Microsoft Graph API Beat |
6.1.1 |
|
|
Mimecast SIEM Beat |
6.1.0 |
Yes |
|
O365 Beat |
6.0.0 |
|
|
Okta Beat |
6.0.5 |
|
|
Prisma Cloud Beat |
6.0.2 |
|
|
Proofpoint Beat |
6.0.3 |
|
|
PubSub Beat |
6.0.3 |
|
|
Qualys FIM Beat |
6.0.5 |
|
|
Salesforce Beat |
6.0.2 |
|
|
SentinelOne Beat |
6.0.1 |
|
|
Sophos Central Beat |
7.0.0 |
|
|
Symantec WSS Beat |
6.0.3 |
|
|
Tenable Beat |
6.0.0 |
|
|
Webhook Beat |
6.1.7 |
|
New Features/Beats
|
Feature or Beat |
Description |
Relevant Documentation Updates |
|---|---|---|
|
Box Beat |
Previously, logs from the Box platform were collected using a System Monitor API collector. Starting with the 2026.07 release of Open Collector and the 7.25.0 release of LogRhythm SIEM, this functionality has been moved to an Open Collector Beat. |
Enhancements/Improvements
|
Feature or Beat |
Description |
Relevant Documentation Updates |
|---|---|---|
|
Mimecast SIEM Beat |
The Mimecast SIEM Beat has been upgraded so that collection of the following logs is now possible:
|
Resolved Issues
|
Bug ID |
Description |
|---|---|
|
ENG-80795 |
Resolved an issue in which the Gmail Message Tracking Beat was making full table API calls in certain situations when only partition calls were needed in order to alleviate some unnecessary stress being added to the Open Collector. If you were experiencing this issue, refer to the High Big Query Costs or PartitionTime Errors section of the Troubleshoot the GMT Beat documentation. |
Notice of JQ Pipeline Deprecation
Exabeam released JSON Parsing for Open Collector and Beats along with LogRhythm SIEM version 7.13. This feature was intended to replace the JQ pipeline within Open Collector, and as a result support and maintenance for the JQ pipeline, including dependencies such as the “ocpipeline” and “metrics beat,” are coming to an end in the October 2026 release.
To ensure that your Beats remain fully supported and maintained, it is recommended that any customers still using the JQ pipeline for their beats move to the JSON Parsing method and remove all metric and OC JQ images from the system.