Release notes

Version 81 (2026-05-26)

Fallback flows

You can now configure fallback flows to process data that wasn’t processed by any other flow.

High-availability AxoRouter clusters

Instructions for creating high-availability AxoRouter clusters using keepalived have been added to AxoRouter high availability.

Source and destination improvements

Store metrics

Store metrics are more detailed and include the total size of a store across AxoRouters.

AxoConsole updates

  • Sensitive values like passwords, secrets, and tokens of destinations aren’t visible on the UI, users can only replace them. Sensitive values aren’t displayed on the Activity Logs page.
  • Automatically detected sources can be registered in AxoConsole in bulk.
  • Code snippets in processing steps are automatically syntax-highlighted.
  • Performance improvements in UI autocomplete with very many available values.

Other changes

  • The Axolet and AxoRouter for Linux provisioning scripts can download the installation images directly from AxoConsole.
  • Axoflow agent disk queue metrics were referred to as memory queue metrics in their description. This has been fixed.
  • AxoRouter 0.81 is based on AxoSyslog 4.25.0.

Upgrade notes

SaaS deployments are updated automatically. If you’re running an on-premises AxoConsole deployment, contact our support team for the detailed upgrade instructions.

Version 0.78 (2026-03-31)

Data rehydration

You can now resend selected data from AxoStores to other destinations. For details, see Rehydrate data.

RBAC configuration

You can now configure role-based access control for AxoConsole on the Settings > Roles page.

Source and destination improvements

  • In syslog connector rules, the Enable dynamic window option enables the dynamic sizing of memory queues by sharing the configured Log window size between active incoming connections dynamically, instead of allocating the same window size to each possible connection. Only available for TCP and TLS.
  • For HTTP-based destinations you can configure Response actions to specify what AxoRouter does with the log message, based on the response code received from the destination. For an example, see the Elastic destination.

Log tapping

  • The Tap agent logs option has been renamed to Tap service logs. If available, you can tap into the systemd logs of the related service. You can also filter the logs for specific services. For details, see Log tapping.
  • You can now tap into the service logs on Axoflow agent for Linux hosts. For details, see Tap service logs.

Store metrics

AxoConsole shows basic metrics of stores on the Routers > Stores page, with more details on the pages of the specific stores.

Other changes

  • The design of the Topology and Dashboard pages has been updated.
  • The global search field (CTRL + K / ⌘ + K) introduced in 0.75 can now find resources (for example, hosts) by name in addition to page navigation.
  • Service restarts are no longer indicated as service reloads on the metrics and health page.
  • The log collector agent is installed as part of Axoflow agent for Linux by default.
  • AxoRouter 0.78 is based on AxoSyslog 4.24.0.

Version 0.75 (2026-02-24)

AxoStore improvements

  • You can now configure how to store metadata and the raw message in AxoStore using the Include Metadata and Include Raw Body options. For details, see Create Store.
  • You can now export the search results into a CSV file.

Source updates

Automatic classification now also supports:

Microsoft Sentinel normalization now supports normalizing:

  • CrowdStrike Falcon events to the CommonSecurityLog table
  • Windows events to the SecurityEvent table
  • Palo Alto Networks firewall logs to the CommonSecurityLog table

AxoConsole updates

  • Data forwarding and collection rules are shown on the related Axoflow agent pages.
  • Collector rules and flows are shown on the related AxoRouter pages.
  • The Set fields processing step now handles boolean fields.
  • You can use the Filter bar on the Alerts page to search and filter for specific alerts.
  • A new global search field is introduced in the page header to navigate to pages of AxoConsole. It’s also available with the CTRL + K / ⌘ + K shortcuts.
  • The dynamic Splunk destinations no longer have the Default Source option. If classification or another processing step doesn’t set the source field, AxoRouter automatically sets it to the name of the AxoRouter connector that received the message.

Performance improvements

  • The amount of memory AxoRouter uses to store queued messages has been significantly reduced, by up to 50%.
  • AxoRouter 0.75 is based on AxoSyslog 4.23.0.
  • Many performance and stability improvements in AxoRouter.

Other changes

  • The axorouter-ctl logs command can display the logs of the store container if AxoStore is in use on the AxoRouter host.
  • The axorouter-ctl wipe -a command can delete abandoned disk buffer files without creating a backup copy.

Version 0.73 (2026-01-27)

Cortex XSIAM destination

Axoflow now supports sending data into Palo Alto Network’s Cortex Extended Security Intelligence and Analytics Management (XSIAM) platform for advanced threat detection and response.

AxoStore improvements

Source and connector improvements

Microsoft Sentinel and Azure Monitor destinations

  • The Microsoft Sentinel and Azure Monitor destinations have a default batch size limit to respect the built-in request size limits of Microsoft Sentinel.
  • The Stream name is no longer a required parameter for Azure Monitor and Sentinel destinations.

Performance improvements

  • Performance improvements for the Google SecOps destination.

  • HTTP-based destinations now support content compressions to reduce bandwidth usage.

  • Performance improvements in disk queue management.

  • Performance improvements in source thread parallelization to leverage available CPU cores more effectively with a single source connection.

  • The defaults of batching related destination parameters have been reviewed.

  • New alerts are introduced to warn about sub-optimal performance parameters across the system.

Other changes

  • Agent logs now contain the output of the systemd units used to launch the containers.
  • The platform=linux or platform=windows label is added by default to AxoRouter and Axoflow agent instances to help setting up platform-specific rules.
  • The host page of Axoflow agent for Windows now contains improved analytics data.

Version 0.70 (2025-12-17)

Edge collection

  • A preview of Axoflow agent is now available for Linux edge hosts as well. For Linux edge hosts, you can configure Journald Collectors.
  • Node metrics is now available for edge hosts as well.

Disk buffer configuration

You can set the size of disk buffers, or if needed, disable disk buffers on AxoRouter hosts in the configuration of each destination. For example, see the Google Pub/Sub destination.

Splunk source

  • When receiving data from Splunk Heavy Forwarders now we recommend using NUL-terminated messages.

  • The behavior of classification when receiving logs from Splunk HF using the Axoflow Forwarder Add-on has changed:

    • If classification is disabled, the original source, sourcetype, index, timestamp and host metadata are preserved.
    • If classification is enabled, then a successful classification overrides the sourcetype and the index, while the timestamp and host are overwritten if the original message contains these data.

Other

  • Almost 60% performance improvement in AxoRouter.
  • AxoSyslog has been updated to 4.21.0
    • Introducing autoscaling worker partitions to support special batching scenarios (e.g. Google SecOps).
    • Improved disk queue scalability to eliminate bottlenecks under high load.
  • Fixed an error that occurred when a destination (Dynatrace) applied normalization by default and the related flow also contained a Normalization processing step.

Version 0.69 (2025-12-03)

Storage solutions

You can now use Stores on AxoRouters to collect logs locally, with pre-configured retention time. In addition to local Stores, you can also use External Stores. For details, see Storage.

Processing steps

  • The new Normalize processing step normalizes data according to the specified standard: Dynatrace, Elastic Common Schema (ECS), or Open Cybersecurity Schema Framework (OCSF).
  • Added the Keep fields option to the Reduce processing step.

AxoRouter

  • If the primary IP address of AxoRouter is not accessible from your edge hosts, you can set a Network address override (IP address or an FQDN) that’s edge hosts can connect to.
  • You can enable eBPF load balancing for UDP syslog connectors from AxoConsole.
  • Updated AxoSyslog version to 4.20.1.
  • Performance optimization in flow output metrics, saving one message size calculation for every message.

Analytics

You can now use Most frequent and Least frequent options in addition to Alphabetical bucketing on Sankey and Sunburst diagrams.

Classification and Normalization

  • Extended specific OCSF normalization rules for F5 BigIP.
  • Detect misparsed CEF and LEEF logs.
  • Classification added for NGINX.

Other

  • Axolet builds for Windows Edge hosts are now signed.
  • When sending data to Dynatrace, you can now add extra fields to the message using the meta.destination.dynatrace.extra_fields field.

Version 0.66 (2025-10-30)

Edge Collection and Forwarding

  • Collection Rules and Forwarding Rules for Windows edge hosts now available on the Sources page.

    • Collection Rules create Connectors on a set of edge hosts based on a label selector.
    • Forwarding Rules create Flows from edge hosts to the OTLP connector of AxoRouter based on a label selector.

    Windows edge hosts support data collection from Windows Event Logs, Event Tracing for Windows, and files. Event Tracing for Windows supports predefined profiles (DNS full trace and DNS query) for ease of use, and a custom profile with fine tuning options.

Menu structure and page headers

The headers and main controls have been aligned across pages. Also, the structure of the AxoConsole menu has been changed, and menu items have been reordered and grouped into sections:

  • The first section focuses on your data: Dashboard, Analytics, Flows

  • The Infrastructure section gives access to the following pages:

    • Topology page provides a graphical overview about the infrastructure

    • Sources page (new):

      • Where the Inventory tab lists Edges and Appliances by default
      • The new Collection and Forwarding rules configuration tabs allow setting up log forwarding from Edge hosts

    • Routers page (new):

      • With the Inventory of Routers, and
      • The Connector Rules tab allows setting up connectors.

    • Destinations (new) lists all destinations available which were previously only accessible from the Topology page

    • Provisioning page:

      • Provides platform specific commands to provision Edges and Routers
      • Lists hosts by registration state

  • The System section lists active Alerts in the system and the history of user Activities.

AxoConsole performance

  • Improved dashboard response time by using pre-recorded metrics
  • Improved analytics response times by parallelizing queries
  • Better error reporting about invalid requests on the UI

Miscellaneous

  • You can now create a new destination in place when creating flows

  • Google SecOps destination improvements:

  • Processing workers are now configurable for the Windows Event connector for AxoRouters

  • Syslog source: log-fetch-limit and log-iw-size are now available as configuration options

  • Fix syslog processing workers option (UDP)

  • Round robin worker partitions or custom extra partitions key

  • Revamped service reload and restart functions

  • Kubernetes classification support (enable OTLP classification by default)

  • Windows multiline logs (Splunk UF) classification

  • Do not set indexed fields by default for the Splunk destination

Version 0.65.1 (2025-10-06)

Destinations

  • Support for Sumo Logic and Dynatrace destinations
  • The namespace option of Google SecOps destination became optional

Classification and normalization

  • New log format for Cisco ACS
  • ECS normalization for Zscaler
  • Normalization for Fortinet devices
  • ECS normalization for Dell SonicWall
  • Cisco/Meraki timestamp fixes

Other improvements and changes

  • Upgrade infrastructure dependencies (Pomerium, NGINX ingress)
  • Upgrade to AxoSyslog 4.18.1
  • Improve OTLP source default settings
  • Various UI fixes and improvements for AQL search
  • Improve WEC connector performance
  • Support for Cognito custom groups
  • Various fixes for the Windows deployment script