# Release notes ## Version 81 (2026-05-26) ### Fallback flows You can now configure [fallback flows](../docs/axoflow/0.81/data-management/flow-overview/index.md#fallback-flow) to process data that wasn’t processed by any other flow. ### High-availability AxoRouter clusters Instructions for creating high-availability AxoRouter clusters using `keepalived` have been added to [AxoRouter high availability](../docs/axoflow/0.81/deployment-scenarios/axorouter-high-availability/index.md). ### Source and destination improvements * You can now specify **Message Format** and normalization for the following destinations: [Amazon S3](../docs/axoflow/0.81/destinations/amazon/s3/index.md), [Elastic Cloud and Elasticsearch](../docs/axoflow/0.81/destinations/elastic/elastic-cloud/index.md), [OpenObserve](../docs/axoflow/0.81/destinations/openobserve/index.md), [Cortex XSIAM](../docs/axoflow/0.81/destinations/palo-alto-networks/xsiam/index.md), [Sumo Logic](../docs/axoflow/0.81/destinations/sumo-logic/index.md). * You can now rate-limit the [Syslog destination](../docs/axoflow/0.81/destinations/generic/syslog/index.md) using the **Throttle** option. * The Axoflow agent [Windows Event Log collection rule](../docs/axoflow/0.81/data-sources/collection-rules/windows-event-log/index.md) now supports collecting data from custom EVTX files. * The measurement unit of the **Maximum object size** and **Chunk size** fields of the S3 destinations was incorrect and has been fixed. If you’re using the S3 destinations, check that your configuration is correct. ### Store metrics [Store metrics](../docs/axoflow/0.81/storage/store-metrics/index.md) are more detailed and include the total size of a store across AxoRouters. ### AxoConsole updates * Sensitive values like passwords, secrets, and tokens of destinations aren’t visible on the UI, users can only replace them. Sensitive values aren’t displayed on the **Activity Logs** page. * Automatically detected sources can be registered in AxoConsole in bulk. * Code snippets in processing steps are automatically syntax-highlighted. * Performance improvements in UI autocomplete with very many available values. ### Other changes * The Axolet and AxoRouter for Linux provisioning scripts can download the installation images [directly from AxoConsole](../docs/axoflow/0.81/provisioning/axorouter/linux/advanced-options/index.md#external-images). * Axoflow agent disk queue metrics were referred to as memory queue metrics in their description. This has been fixed. * AxoRouter 0.81 is based on [AxoSyslog 4.25.0](). ### Upgrade notes SaaS deployments are updated automatically. If you’re running an on-premises AxoConsole deployment, [contact our support team]() for the detailed upgrade instructions. ## Version 0.78 (2026-03-31) ### Data rehydration You can now resend selected data from AxoStores to other destinations. For details, see [Rehydrate data](../docs/axoflow/0.81/data-management/rehydration/index.md). ### RBAC configuration You can now configure role-based access control for AxoConsole on the [**Settings > Roles**](../docs/axoflow/0.81/access-management/index.md) page. ### Source and destination improvements * In [syslog connector rules](../docs/axoflow/0.81/data-sources/syslog/index.md), the **Enable dynamic window** option enables the dynamic sizing of memory queues by sharing the configured **Log window size** between active incoming connections dynamically, instead of allocating the same window size to each possible connection. Only available for TCP and TLS. * For HTTP-based destinations you can configure **Response actions** to specify what AxoRouter does with the log message, based on the response code received from the destination. For an example, see the [Elastic destination](../docs/axoflow/0.81/destinations/elastic/elastic-cloud/index.md#response-actions). ### Log tapping * The **Tap agent logs** option has been renamed to **Tap service logs**. If available, you can tap into the systemd logs of the related service. You can also filter the logs for specific services. For details, see [Log tapping](../docs/axoflow/0.81/onboard-hosts/log-tapping/index.md). * You can now tap into the service logs on Axoflow agent for Linux hosts. For details, see [Tap service logs](../docs/axoflow/0.81/onboard-hosts/log-tapping/index.md#service-tap). ### Store metrics AxoConsole shows basic metrics of stores on the [**Routers > Stores** page](../docs/axoflow/0.81/storage/overview/index.md), with more details on the pages of the specific stores. ### Other changes * The design of the [**Topology**](../docs/axoflow/0.81/onboard-hosts/topology/index.md) and [**Dashboard**](../docs/axoflow/0.81/onboard-hosts/dashboard/index.md) pages has been updated. * The global search field (CTRL + K / ⌘ + K) introduced in 0.75 can now find resources (for example, hosts) by name in addition to page navigation. * Service restarts are no longer indicated as service reloads on the metrics and health page. * The log collector agent is installed as part of Axoflow agent for Linux by default. * AxoRouter 0.78 is based on [AxoSyslog 4.24.0](). ## Version 0.75 (2026-02-24) ### AxoStore improvements * You can now configure how to store metadata and the raw message in AxoStore using the **Include Metadata** and **Include Raw Body** options. For details, see [Create Store](../docs/axoflow/0.81/storage/create-store/index.md). * You can now [export the search results](../docs/axoflow/0.81/storage/search/index.md#export-search-results) into a CSV file. ### Source updates Automatic classification now also supports: * [CrowdStrike Falcon Platform](../docs/axoflow/0.81/data-sources/appliances/crowdstrike/falcon/index.md) * [Tanium Platform](../docs/axoflow/0.81/data-sources/appliances/tanium/platform/index.md) * Our [Splunk app](../docs/axoflow/0.81/data-sources/appliances/splunk/splunk/index.md) is now available on GitHub. Microsoft Sentinel normalization now supports normalizing: * CrowdStrike Falcon events to the `CommonSecurityLog` table * Windows events to the `SecurityEvent` table * Palo Alto Networks firewall logs to the `CommonSecurityLog` table ### AxoConsole updates * Data forwarding and collection rules are shown on the related Axoflow agent pages. * Collector rules and flows are shown on the related AxoRouter pages. * The [Set fields processing step](../docs/axoflow/0.81/data-management/processing/index.md#set-fields) now handles boolean fields. * You can use the Filter bar on the [**Alerts**](../docs/axoflow/0.81/onboard-hosts/alerts/index.md#filter-alerts) page to search and filter for specific alerts. * A new global search field is introduced in the page header to navigate to pages of AxoConsole. It’s also available with the CTRL + K / ⌘ + K shortcuts. * The dynamic Splunk destinations no longer have the **Default Source** option. If classification or another processing step doesn’t set the source field, AxoRouter automatically sets it to the name of the AxoRouter connector that received the message. ### Performance improvements * The amount of memory AxoRouter uses to store queued messages has been significantly reduced, by up to 50%. * AxoRouter 0.75 is based on [AxoSyslog 4.23.0](). * Many performance and stability improvements in AxoRouter. ### Other changes * The [`axorouter-ctl logs`](../docs/axoflow/0.81/reference/man-page/axorouter-ctl/index.md#show-logs) command can display the logs of the `store` container if AxoStore is in use on the AxoRouter host. * The [`axorouter-ctl wipe -a`](../docs/axoflow/0.81/reference/man-page/axorouter-ctl/index.md#wipe-disk-buffer) command can delete abandoned disk buffer files without creating a backup copy. ## Version 0.73 (2026-01-27) ### Cortex XSIAM destination Axoflow now supports sending data into [Palo Alto Network’s Cortex Extended Security Intelligence and Analytics Management (XSIAM)](../docs/axoflow/0.81/destinations/palo-alto-networks/xsiam/index.md) platform for advanced threat detection and response. ### AxoStore improvements * You can select the performance profile to use when creating AxoStores. * AxoStore-related configuration changes are available on the [**Activity logs** page](../docs/axoflow/0.81/activity-log/index.md). * You can now [delete all data from AxoStores](../docs/axoflow/0.81/storage/delete-store/index.md) from AxoConsole. ### Source and connector improvements * When receiving UDP data with the syslog connector you can now enable eBPF loadbalancing to split the traffic from high-volume sources to multiple workers. * For [OTLP source connectors](../docs/axoflow/0.81/data-sources/opentelemetry/index.md), you can now configure the window parameters of flow-control (**Initial window size** and **Log fetch limit**). * Automatic classification now also supports: * [Fortinet FortiProxy](../docs/axoflow/0.81/data-sources/appliances/fortinet/fortiproxy/index.md) * [Broadcom (VMware) ESX](../docs/axoflow/0.81/data-sources/appliances/broadcom/esx/index.md) * [Broadcom (VMware) vCenter](../docs/axoflow/0.81/data-sources/appliances/broadcom/vcenter/index.md) * [Omnissa (VMware) Horizon](../docs/axoflow/0.81/data-sources/appliances/omnissa/horizon/index.md). * The [WEC Connector](../docs/axoflow/0.81/data-sources/wec/index.md) can work with multiple independent certificate authorities at the same time. ### Microsoft Sentinel and Azure Monitor destinations * The Microsoft Sentinel and Azure Monitor destinations have a default batch size limit to respect the built-in request size limits of Microsoft Sentinel. * The **Stream** name is no longer a required parameter for Azure Monitor and Sentinel destinations. ### Performance improvements * Performance improvements for the Google SecOps destination. * HTTP-based destinations now support content compressions to reduce bandwidth usage. * Performance improvements in disk queue management. * Performance improvements in source thread parallelization to leverage available CPU cores more effectively with a single source connection. * The defaults of batching related destination parameters have been reviewed. * New alerts are introduced to warn about sub-optimal performance parameters across the system. ### Other changes * [Agent logs](../docs/axoflow/0.81/onboard-hosts/log-tapping/index.md) now contain the output of the systemd units used to launch the containers. * The `platform=linux` or `platform=windows` label is added by default to AxoRouter and Axoflow agent instances to help setting up platform-specific rules. * The host page of Axoflow agent for Windows now contains improved analytics data. ## Version 0.70 (2025-12-17) ### Edge collection * A preview of Axoflow agent is now available for [Linux edge hosts](../docs/axoflow/0.81/provisioning/linux-agent/index.md) as well. For Linux edge hosts, you can configure [Journald Collectors](../docs/axoflow/0.81/data-sources/collection-rules/journald/index.md). * Node metrics is now available for edge hosts as well. ### Disk buffer configuration You can set the size of disk buffers, or if needed, disable disk buffers on AxoRouter hosts in the configuration of each destination. For example, see the [Google Pub/Sub](../docs/axoflow/0.81/destinations/google/pubsub/index.md#disk-buffer) destination. ### Splunk source * When receiving data from [Splunk Heavy Forwarders](../docs/axoflow/0.81/data-sources/appliances/splunk/splunk/index.md) now we recommend using NUL-terminated messages. * The behavior of classification when receiving logs from Splunk HF using the Axoflow Forwarder Add-on has changed: * If classification is disabled, the original source, sourcetype, index, timestamp and host metadata are preserved. * If classification is enabled, then a successful classification overrides the sourcetype and the index, while the timestamp and host are overwritten if the original message contains these data. ### Other * Almost 60% performance improvement in AxoRouter. * AxoSyslog has been updated to 4.21.0 * Introducing autoscaling worker partitions to support special batching scenarios (e.g. Google SecOps). * Improved disk queue scalability to eliminate bottlenecks under high load. * Fixed an error that occurred when a destination (Dynatrace) applied normalization by default and the related flow also contained a **Normalization** processing step. ## Version 0.69 (2025-12-03) ### Storage solutions You can now use Stores on AxoRouters to collect logs locally, with pre-configured retention time. In addition to local Stores, you can also use External Stores. For details, see [Storage](../docs/axoflow/0.81/storage/index.md). ### Processing steps * The new [**Normalize** processing step](../docs/axoflow/0.81/data-management/processing/index.md#normalize) normalizes data according to the specified standard: Dynatrace, Elastic Common Schema (**ECS**), or Open Cybersecurity Schema Framework (**OCSF**). * Added the **Keep fields** option to the [Reduce processing step](../docs/axoflow/0.81/data-management/processing/index.md#reduce). ### AxoRouter * If the primary IP address of AxoRouter is not accessible from your edge hosts, you can set a **Network address override** (IP address or an FQDN) that’s edge hosts can connect to. * You can enable eBPF load balancing for [UDP syslog connectors](../docs/axoflow/0.81/data-sources/syslog/index.md#udp-loadbalancing) from AxoConsole. * Updated AxoSyslog version to [4.20.1](). * Performance optimization in flow output metrics, saving one message size calculation for every message. ### Analytics You can now use **Most frequent** and **Least frequent** options in addition to **Alphabetical** bucketing on Sankey and Sunburst diagrams. ### Classification and Normalization * Extended specific OCSF normalization rules for F5 BigIP. * Detect misparsed CEF and LEEF logs. * Classification added for [NGINX](../docs/axoflow/0.81/data-sources/appliances/kubernetes/nginx/index.md). ### Other * Axolet builds for Windows Edge hosts are now signed. * When sending data to [Dynatrace](../docs/axoflow/0.81/destinations/dynatrace/index.md), you can now add extra fields to the message using the `meta.destination.dynatrace.extra_fields` field. ## Version 0.66 (2025-10-30) ### Edge Collection and Forwarding * **Collection Rules** and **Forwarding Rules** for Windows edge hosts now available on the **Sources** page. * [**Collection Rules**](../docs/axoflow/0.81/data-sources/collection-rules/index.md) create Connectors on a set of edge hosts based on a label selector. * [**Forwarding Rules**](../docs/axoflow/0.81/data-sources/data-forwarding/index.md) create **Flows** from edge hosts to the OTLP connector of AxoRouter based on a label selector. Windows edge hosts support data collection from [Windows Event Logs](../docs/axoflow/0.81/data-sources/collection-rules/windows-event-log/index.md), [Event Tracing for Windows](../docs/axoflow/0.81/data-sources/collection-rules/windows-event-tracing/index.md), and [files](../docs/axoflow/0.81/data-sources/collection-rules/file-collector/index.md). Event Tracing for Windows supports predefined profiles (DNS full trace and DNS query) for ease of use, and a custom profile with fine tuning options. ### Menu structure and page headers The headers and main controls have been aligned across pages. Also, the structure of the AxoConsole menu has been changed, and menu items have been reordered and grouped into sections: * The first section focuses on your data: **Dashboard** , **Analytics** , **Flows** * The Infrastructure section gives access to the following pages: * **Topology** page provides a graphical overview about the infrastructure * **Sources** page (new): * Where the Inventory tab lists Edges and Appliances by default * The new Collection and Forwarding rules configuration tabs allow setting up log forwarding from Edge hosts * **Routers** page (new): * With the Inventory of Routers, and * The **Connector Rules** tab allows setting up connectors. * **Destinations** (new) lists all destinations available which were previously only accessible from the **Topology** page * **Provisioning** page: * Provides platform specific commands to provision Edges and Routers * Lists hosts by registration state * The System section lists active **Alerts** in the system and the history of user **Activities**. ### AxoConsole performance * Improved dashboard response time by using pre-recorded metrics * Improved analytics response times by parallelizing queries * Better error reporting about invalid requests on the UI ### Miscellaneous * You can now create a new destination in place when creating flows * Google SecOps destination improvements: * Change sshd log type to `OPENSSH` * Add [labels support for ingestion](../docs/axoflow/0.81/destinations/google/secops/index.md#related-message-fields) * Set default timeout to the value recommended by Google * Processing workers are now configurable for the [Windows Event connector](../docs/axoflow/0.81/data-sources/wec/index.md) for AxoRouters * [Syslog source](../docs/axoflow/0.81/data-sources/syslog/index.md): `log-fetch-limit` and `log-iw-size` are now available as configuration options * Fix syslog processing workers option (UDP) * Round robin worker partitions or custom extra partitions key * Revamped service reload and restart functions * [Kubernetes classification](../docs/axoflow/0.81/data-sources/appliances/kubernetes/index.md) support (enable OTLP classification by default) * Windows multiline logs (Splunk UF) classification * Do not set indexed fields by default for the Splunk destination ## Version 0.65.1 (2025-10-06) ### Destinations * Support for [Sumo Logic](../docs/axoflow/0.81/destinations/sumo-logic/index.md) and [Dynatrace](../docs/axoflow/0.81/destinations/dynatrace/index.md) destinations * The namespace option of Google SecOps destination became optional ### Classification and normalization * New log format for Cisco ACS * ECS normalization for Zscaler * Normalization for Fortinet devices * ECS normalization for Dell SonicWall * Cisco/Meraki timestamp fixes ### Other improvements and changes * Upgrade infrastructure dependencies (Pomerium, NGINX ingress) * Upgrade to AxoSyslog 4.18.1 * Improve OTLP source default settings * Various UI fixes and improvements for AQL search * Improve WEC connector performance * Support for Cognito custom groups * Various fixes for the Windows deployment script