Release notes

Release notes of the Axoflow Platform: new features, improvements, and fixes in each version.

Version 0.90 (2026-10-22)

AI-assisted parsing

AxoConsole now has an AI assistant that can create a FilterX processing step to parse log messages that AxoRouter doesn’t parse by default, for example, the logs of custom applications. Select a message during flow tapping, select AI-assisted Parsing, refine the parser by chatting with the assistant if needed, then add it to the flow as a processing step. The AI assistant isn’t enabled on every tenant by default: if you want to test it, contact our support team. For details, see AI assistant.

New processing steps

  • You can now save a sequence of processing steps as a reusable custom step, and add it to flows, connector rules, and other custom steps like a built-in processing step. When you modify a custom step, the change applies everywhere it’s used. To manage custom steps, open Flows > Custom Steps. You can create custom steps from scratch, save the existing processing steps of a flow or connector rule with Save as Custom Step, and export and import custom steps as JSON files. For details, see Custom steps.
  • The Fix timestamp processing step can correct the timestamp of messages that have a wrong or missing timezone. For example, many devices send their local time without a timezone, so AxoRouter interprets the timestamp in the wrong timezone, and the message appears hours earlier or later than it happened. For details, see Fix timestamp.

New connectors

AxoRouter has new connectors that receive data pushed over HTTP:

Axoflow Cloud Connector sources

You can now configure Axoflow Cloud Connector-based sources from AxoConsole as connector rules: Axoflow Cloud Connector runs on the AxoRouter as the axoflow-cloudconnector service, so you don’t have to deploy and configure a separate container manually.

  • New sources:

  • Azure Event Hubs is now configured as a connector rule as well. Axoflow now supports Graph Activity logs, and uses the same product label (azure-event-hubs) for every log category, with the category in the service label (audit, graphactivity, provisioning, or signin). Earlier, every category had its own product label, for example, azure-event-hubs-audit. If you use these labels in your flows, update them.

Logstore

Logstore is a new store type (now in early access) that keeps your data in hot, warm, and archive tiers. The archive can be on the local disk of the AxoRouter, on an NFS mount, or on Amazon S3 (or another S3-compatible service). You can search every tier from the Search Logs page. Logstore isn’t enabled on every tenant: if you want to test it, contact our support team. For details, see Create Logstore.

Store access roles

Searching stores now requires a dedicated permission:

  • The new log-searcher role can search in every store.
  • The new Store Access Roles section of the Settings > Roles page lets you grant search access to specific stores.
  • The admin role can no longer search in stores, unless it’s also granted the log-searcher role or access to the specific store.

For details, see Store access roles.

New sources

Axoflow now supports the following sources:

Destinations

  • The CrowdStrike destination has been renamed to Falcon Next-Gen SIEM, and its configuration has been simplified: enter the complete ingest URL and the API token. By default, the destination sends the raw message and the ECS-normalized message as well. For details, see CrowdStrike.
  • HTTP-based destinations have new options: Number of retries and Time to reopen. For details, see the More options section of the specific destination.
  • The Normalize processing step now supports the CrowdStrike Parsing Standard (CPS).
  • S3 destinations now list the KMS permissions needed if the bucket uses SSE-KMS (aws:kms) encryption.

Alerts

AxoConsole has new alerts, including:

  • when a source that used to send data regularly stops sending data,
  • when the clock of a host differs from AxoConsole,
  • when a flow sends timestamps with a suspected timezone offset,
  • when the OpenTelemetry collector of an edge host fails to send or receive log records,
  • when an AxoRouter runs a version that AxoConsole no longer supports. AxoConsole doesn’t update the configuration of these hosts until you upgrade them,
  • when a source of an AxoRouter creates a new metric series for nearly every message, for example, because it sends data in a different protocol than its connector expects.

The traffic alerts for a specific source are opt-in: add the traffic_alerts:true label to the source. For details, see Alerts reference.

Analytics redesign

The charts of the Analytics page were redesigned, bringing:

  • a redesigned histogram and legend,
  • a sunburst with a hierarchical legend,
  • a sankey with a draggable column header,
  • drag-to-zoom on the time series,
  • a per-series view from the legend,
  • a way to export the graph as CSV,
  • a Customize Graph side sheet, and
  • a bucket count settable from the URL.

AxoRouter provisioning

  • The advanced installation options of AxoRouter on Linux have new options, for example, Persist directory, AxoRouter user config directory, AxoStore data directory, Non-interactive installation, Skip prerequisites check, Raise socket receive buffer limit, and Legacy (Docker-based) package. You can also set the directories of Logstore.
  • The Enable Cloudconnectors option is now enabled by default.
  • The Avoid proxy option is now called Skip proxy for the AxoRouter services. It controls whether the AxoRouter services use the proxy. The installer and the Axolet service always use the proxy.

Other changes and fixes

  • The Histogram chart of Analytics is now called Time series.
  • To move to the previous or the next time period of the same length, select the arrows next to the time range of the charts.
  • Flow tapping has a new output-wire option that shows the messages exactly as they’re sent to the destination. It requires AxoRouter 0.90.0 or newer.
  • The Topology page now shows detected sources as well, in addition to the registered sources.
  • Performance improvements in the Select Messages flow processing step. The generated AxoRouter configuration now skips the sources of connectors a flow cannot match, so the metrics stats baseline and input taps may not contain the same data as before.
  • TCP and UDP ports 29500–29519 are reserved for the internal listeners of AxoRouter. You can’t use them in connector rules.
  • Log tapping isn’t recorded in the activity log by default. To include it, contact our support team.
  • Editing the details of an existing host wasn’t recorded in the activity log. This has been fixed.
  • The axorouter-ctl command has a new help command, and can show the logs of and open a shell into the logstore container. The wipe command now moves corrupted disk buffer files to the backup directory instead of deleting them. For details, see axorouter-ctl.
  • AxoRouter 0.90 is based on AxoSyslog 4.29.0.

Upgrade notes

  • If your flows select Azure Event Hubs messages using the category-specific product labels (for example, azure-event-hubs-signin), update them to use the service label. For details, see Azure Event Hubs labels.

  • The following environment variables (and their URL parameters) of the AxoRouter installer have been removed. If you use them in your scripts, update them:

    • AXOSTORE_MOUNT: Use AXO_AXOSTORE_DATA_DIR instead. The installer still uses an exported AXOSTORE_MOUNT if you don’t set AXO_AXOSTORE_DATA_DIR.
    • AXO_AXOROUTER_CONFIG_MOUNT_INSIDE (axorouter_config_mount_inside): Use AXO_CONFIG_MOUNT_INSIDE (config_mount_inside) instead. The old name never had an effect.
    • AXO_EXTRA_ARGS (extra_args): Not supported. To pass arguments to the containers, use AXO_PODMAN_ARGS.

  • SaaS deployments are updated automatically. If you’re running an on-premises AxoConsole deployment, see Upgrade for the detailed upgrade instructions.

  • AxoRouter deployments older than 0.75.0 are no longer supported and don’t get any configuration updates. They keep using their last configuration until they’re upgraded. Upgrade your AxoRouters after your AxoConsole is upgraded.

Documentation updates

  • The documentation is available as a PDF file as well. To download the guide of the version you’re reading, select Download guide as PDF on the right side of any page.
  • The new Troubleshooting Axoflow page helps you find the cause of common problems from their symptoms, for example, a source that doesn’t show up or data that doesn’t reach its destination. Many pages link to the related troubleshooting steps.

Version 0.86 (2026-07-28)

CrowdStrike Falcon (HEC) destination

Axoflow now supports sending data to CrowdStrike Falcon using its HTTP Event Data Connector (HEC).

Bulk host management

You can now manage your host inventory in bulk: export the host list to a CSV file, edit it offline, then import it to add, update, or delete hosts. The Export/Import CSV option is available on the Routers and Sources pages. For details, see Bulk update hosts.

Usage metrics

AxoConsole now collects daily and monthly usage metrics about the data your AxoRouters ingest on the About > Usage Metrics page. For details, see Usage metrics.

Search and event details

The visual display of event details (on the Search Logs page and during log tapping and flow tapping) has been redesigned and unified. If a field refers to a pipeline element (for example, a flow or store), you can jump to its page. The new View Options on the Search Logs page lets you set the Timestamp Format, and the other display options that were available in earlier versions.

Log tapping

  • While a log tapping or flow tapping session is active, AxoConsole now shows the status messages of the tapped service inline in the log stream, color-coded by severity. These include service restart and configuration reload events, and their failures. That way you can tell whether a change in the messages is the result of a configuration change you’ve made, and notice when applying a new configuration failed.
  • AxoRouter’s internal representation of a message (the debug field of the event) is now hidden by default in the details of a tapped message. To display it, select Show Debug Data. For details, see Show debug data.
  • The Diff view of Flow tapping is now on a separate tab.

Topology

On the Topology page, select Metric time range to change the period the metrics refer to (the last 15 minutes by default).

Storage

When creating an external store, you can now explicitly select Use TLS to encrypt the connection to the store.

AxoConsole updates

  • The ⋮ action menus are now labeled to make them easier to find, for example, Host Options, Store Options, and Flow Options.
  • Every user can open their own profile page at the identity provider by selecting <their username> > Profile. Users with the IAM-admin role also have an Identity Provider Admin Panel link to the identity provider’s administration page on the Settings page.
  • The Batch Bytes destination option has been renamed to Batch Size.
  • When configuring TLS for destinations and connector rules, you can now select Paste value to paste certificates and keys directly in AxoConsole, which then deploys them to the related AxoRouters automatically. Alternatively, select File path to keep referencing a file you copy to each AxoRouter manually.
  • Probe processing step names are now validated: they can contain only lowercase alphanumeric characters, -, and ., and must start and end with an alphanumeric character.
  • In the diff view of flow tapping, the selected fields no longer reset when new messages arrive, and the selection is highlighted in both the input and the output message.
  • Manual path creation (Topology > Add Item > Path) is available again. It’s useful for observing pipelines that AxoConsole doesn’t generate the configuration file for, such as syslog-ng PE deployments.
  • When creating data collection rules, AxoConsole adds platform-related edge selectors.
  • When opening or reloading the Services page of a host, AxoConsole now automatically triggers service discovery, so the list of services on the page is up to date.

On-premises deployment

  • After a successful installation, the installer writes a prepare-axorouter-host.sh script that automates preparing your AxoRouter and Axoflow agent hosts (adding the AxoConsole hostnames to /etc/hosts and installing the CA certificate). For details, see Prepare AxoRouter hosts.
  • The installer has new flags: --skip-nip-io, --diagnose (inspect pods that aren’t ready), and --uninstall. The new --uninstall flag replaces the manual removal commands and prompts before each step so you can stop at any point.
  • If you omit BASE_HOSTNAME, the installer offers a nip.io wildcard DNS hostname, which lets AxoConsole and its subdomains resolve without any DNS or /etc/hosts configuration. This is handy for testing and demos; use a proper domain name for production.
  • The ingress-nginx ingress controller is no longer supported. New deployments use Traefik. Also, new deployments use axoidp as the default OIDC provider instead of Dex. Contact our support team for details on upgrading your on-premises or air-gapped environments.

Other changes and fixes

  • AxoRouter 0.86 is based on AxoSyslog 4.26.0.
  • On the Analytics page, changing bucketing of a Sankey diagram now reorders the diagram accordingly (for example, putting the most/least frequent buckets to the top).
  • When creating a Set Fields flow processing step, the field names and expression values have autocompletion based on the fields in the message schema.
  • AxoConsole users with the infrastructure-viewer role can no longer see the content of service logs, because error messages in those logs could expose log data.
  • The default template of the S3 destination had no newline delimitation, so downstream consumers couldn’t split objects. This has been corrected.
  • Installing AxoRouter as a non-root user and then setting up a store was broken (the container couldn’t replace the bundled ClickHouse configuration directory). This has been corrected.
  • CEF-formatted PAN-OS start/end timestamps were sometimes parsed incorrectly. This has been corrected.
  • TCP keep-alive settings were hardcoded, so AxoConsole settings didn’t take effect, closing long-lived idle connections. This has been corrected.
  • When AxoRouter sends data to a destination over HTTP or gRPC, it now adds a user agent header (axorouter/<version>).
  • Timestamps sent to the Elasticsearch, Google SecOps, OpenObserve, and S3 destinations were malformed in certain scenarios. This has been corrected.
  • For SC4S edges, AxoConsole didn’t display the SC4S configuration correctly. This has been corrected.

Upgrade notes

SaaS deployments are updated automatically. If you’re running an on-premises AxoConsole deployment, contact our support team for the detailed upgrade instructions.

Version 0.81 (2026-05-26)

Fallback flows

You can now configure fallback flows to process data that wasn’t processed by any other flow.

High-availability AxoRouter clusters

Instructions for creating high-availability AxoRouter clusters using keepalived have been added to AxoRouter high availability.

Source and destination improvements

Store metrics

Store metrics are more detailed and include the total size of a store across AxoRouters.

AxoConsole updates

  • Sensitive values like passwords, secrets, and tokens of destinations aren’t visible on the UI, users can only replace them. Sensitive values aren’t displayed on the Activity Logs page.
  • Automatically detected sources can be registered in AxoConsole in bulk.
  • Code snippets in processing steps are automatically syntax-highlighted.
  • Performance improvements in UI autocomplete with very many available values.

Other changes

  • The Axolet and AxoRouter for Linux provisioning scripts can download the installation images directly from AxoConsole.
  • Axoflow agent disk queue metrics were referred to as memory queue metrics in their description. This has been fixed.
  • AxoRouter 0.81 is based on AxoSyslog 4.25.0.

Upgrade notes

SaaS deployments are updated automatically. If you’re running an on-premises AxoConsole deployment, contact our support team for the detailed upgrade instructions.

Version 0.78 (2026-03-31)

Data rehydration

You can now resend selected data from AxoStores to other destinations. For details, see Rehydrate data.

RBAC configuration

You can now configure role-based access control for AxoConsole on the Settings > Roles page.

Source and destination improvements

  • In syslog connector rules, the Enable dynamic window option enables the dynamic sizing of memory queues by sharing the configured Log window size between active incoming connections dynamically, instead of allocating the same window size to each possible connection. Only available for TCP and TLS.
  • For HTTP-based destinations you can configure Response actions to specify what AxoRouter does with the log message, based on the response code received from the destination. For an example, see the Elastic destination.

Log tapping

  • The Tap agent logs option has been renamed to Tap service logs. If available, you can tap into the systemd logs of the related service. You can also filter the logs for specific services. For details, see Log tapping.
  • You can now tap into the service logs on Axoflow agent for Linux hosts. For details, see Tap service logs.

Store metrics

AxoConsole shows basic metrics of stores on the Routers > Stores page, with more details on the pages of the specific stores.

Other changes

  • The design of the Topology and Dashboard pages has been updated.
  • The global search field (CTRL + K / ⌘ + K) introduced in 0.75 can now find resources (for example, hosts) by name in addition to page navigation.
  • Service restarts are no longer indicated as service reloads on the metrics and health page.
  • The log collector agent is installed as part of Axoflow agent for Linux by default.
  • AxoRouter 0.78 is based on AxoSyslog 4.24.0.

Version 0.75 (2026-02-24)

AxoStore improvements

  • You can now configure how to store metadata and the raw message in AxoStore using the Include Metadata and Include Raw Body options. For details, see Create Store.
  • You can now export the search results into a CSV file.

Source updates

Automatic classification now also supports:

Microsoft Sentinel normalization now supports normalizing:

  • CrowdStrike Falcon events to the CommonSecurityLog table
  • Windows events to the SecurityEvent table
  • Palo Alto Networks firewall logs to the CommonSecurityLog table

AxoConsole updates

  • Data forwarding and collection rules are shown on the related Axoflow agent pages.
  • Collector rules and flows are shown on the related AxoRouter pages.
  • The Set fields processing step now handles boolean fields.
  • You can use the Filter bar on the Alerts page to search and filter for specific alerts.
  • A new global search field is introduced in the page header to navigate to pages of AxoConsole. It’s also available with the CTRL + K / ⌘ + K shortcuts.
  • The dynamic Splunk destinations no longer have the Default Source option. If classification or another processing step doesn’t set the source field, AxoRouter automatically sets it to the name of the AxoRouter connector that received the message.

Performance improvements

  • The amount of memory AxoRouter uses to store queued messages has been significantly reduced, by up to 50%.
  • AxoRouter 0.75 is based on AxoSyslog 4.23.0.
  • Many performance and stability improvements in AxoRouter.

Other changes

  • The axorouter-ctl logs command can display the logs of the store container if AxoStore is in use on the AxoRouter host.
  • The axorouter-ctl wipe -a command can delete abandoned disk buffer files without creating a backup copy.

Version 0.73 (2026-01-27)

Cortex XSIAM destination

Axoflow now supports sending data into Palo Alto Network’s Cortex Extended Security Intelligence and Analytics Management (XSIAM) platform for advanced threat detection and response.

AxoStore improvements

Source and connector improvements

Microsoft Sentinel and Azure Monitor destinations

  • The Microsoft Sentinel and Azure Monitor destinations have a default batch size limit to respect the built-in request size limits of Microsoft Sentinel.
  • The Stream name is no longer a required parameter for Azure Monitor and Sentinel destinations.

Performance improvements

  • Performance improvements for the Google SecOps destination.

  • HTTP-based destinations now support content compressions to reduce bandwidth usage.

  • Performance improvements in disk queue management.

  • Performance improvements in source thread parallelization to leverage available CPU cores more effectively with a single source connection.

  • The defaults of batching related destination parameters have been reviewed.

  • New alerts are introduced to warn about sub-optimal performance parameters across the system.

Other changes

  • Agent logs now contain the output of the systemd units used to launch the containers.
  • The platform=linux or platform=windows label is added by default to AxoRouter and Axoflow agent instances to help setting up platform-specific rules.
  • The host page of Axoflow agent for Windows now contains improved analytics data.

Version 0.70 (2025-12-17)

Edge collection

  • A preview of Axoflow agent is now available for Linux edge hosts as well. For Linux edge hosts, you can configure Journald Collectors.
  • Node metrics is now available for edge hosts as well.

Disk buffer configuration

You can set the size of disk buffers, or if needed, disable disk buffers on AxoRouter hosts in the configuration of each destination. For example, see the Google Pub/Sub destination.

Splunk source

  • When receiving data from Splunk Heavy Forwarders now we recommend using NUL-terminated messages.

  • The behavior of classification when receiving logs from Splunk HF using the Axoflow Forwarder Add-on has changed:

    • If classification is disabled, the original source, sourcetype, index, timestamp and host metadata are preserved.
    • If classification is enabled, then a successful classification overrides the sourcetype and the index, while the timestamp and host are overwritten if the original message contains these data.

Other

  • Almost 60% performance improvement in AxoRouter.
  • AxoSyslog has been updated to 4.21.0.
    • Introducing autoscaling worker partitions to support special batching scenarios (for example, Google SecOps).
    • Improved disk queue scalability to eliminate bottlenecks under high load.
  • Fixed an error that occurred when a destination (Dynatrace) applied normalization by default and the related flow also contained a Normalization processing step.

Version 0.69 (2025-12-03)

Storage solutions

You can now use Stores on AxoRouters to collect logs locally, with pre-configured retention time. In addition to local Stores, you can also use External Stores. For details, see Storage.

Processing steps

  • The new Normalize processing step normalizes data according to the specified standard: Dynatrace, Elastic Common Schema (ECS), or Open Cybersecurity Schema Framework (OCSF).
  • Added the Keep fields option to the Reduce processing step.

AxoRouter

  • If the primary IP address of AxoRouter is not accessible from your edge hosts, you can set a Network address override (IP address or an FQDN) that edge hosts can connect to.
  • You can enable eBPF load balancing for UDP syslog connectors from AxoConsole.
  • Updated AxoSyslog version to 4.20.1.
  • Performance optimization in flow output metrics, saving one message size calculation for every message.

Analytics

You can now use Most frequent and Least frequent options in addition to Alphabetical bucketing on Sankey and Sunburst diagrams.

Classification and normalization

  • Extended specific OCSF normalization rules for F5 BigIP.
  • Detect misparsed CEF and LEEF logs.
  • Classification added for NGINX.

Other

  • Axolet builds for Windows Edge hosts are now signed.
  • When sending data to Dynatrace, you can now add extra fields to the message using the meta.destination.dynatrace.extra_fields field.

Version 0.66 (2025-10-30)

Edge collection and forwarding

  • Collection Rules and Forwarding Rules for Windows edge hosts now available on the Sources page.

    • Collection Rules create Connectors on a set of edge hosts based on a label selector.
    • Forwarding Rules create Flows from edge hosts to the OTLP connector of AxoRouter based on a label selector.

    Windows edge hosts support data collection from Windows Event Logs, Event Tracing for Windows, and files. Event Tracing for Windows supports predefined profiles (DNS full trace and DNS query) for ease of use, and a custom profile with fine tuning options.

Menu structure and page headers

The headers and main controls have been aligned across pages. Also, the structure of the AxoConsole menu has been changed, and menu items have been reordered and grouped into sections:

  • The first section focuses on your data: Dashboard, Analytics, Flows

  • The Infrastructure section gives access to the following pages:

    • Topology page provides a graphical overview about the infrastructure

    • Sources page (new):

      • Where the Inventory tab lists Edges and Appliances by default
      • The new Collection and Forwarding rules configuration tabs allow setting up log forwarding from Edge hosts

    • Routers page (new):

      • With the Inventory of Routers, and
      • The Connector Rules tab allows setting up connectors.

    • Destinations (new) lists all destinations available which were previously only accessible from the Topology page

    • Provisioning page:

      • Provides platform specific commands to provision Edges and Routers
      • Lists hosts by registration state

  • The System section lists active Alerts in the system and the history of user Activities.

AxoConsole performance

  • Improved dashboard response time by using pre-recorded metrics
  • Improved analytics response times by parallelizing queries
  • Better error reporting about invalid requests on the UI

Miscellaneous

  • You can now create a new destination in place when creating flows

  • Google SecOps destination improvements:

  • Processing workers are now configurable for the Windows Event connector for AxoRouters

  • Syslog source: log-fetch-limit and log-iw-size are now available as configuration options

  • Fix syslog processing workers option (UDP)

  • Round robin worker partitions or custom extra partitions key

  • Revamped service reload and restart functions

  • Kubernetes classification support (enable OTLP classification by default)

  • Windows multiline logs (Splunk UF) classification

  • Do not set indexed fields by default for the Splunk destination

Version 0.65.1 (2025-10-06)

Destinations

  • Support for Sumo Logic and Dynatrace destinations
  • The namespace option of Google SecOps destination became optional

Classification and normalization

  • New log format for Cisco ACS
  • ECS normalization for Zscaler
  • Normalization for Fortinet devices
  • ECS normalization for Dell SonicWall
  • Cisco/Meraki timestamp fixes

Other improvements and changes

  • Upgrade infrastructure dependencies (Pomerium, NGINX ingress)
  • Upgrade to AxoSyslog 4.18.1
  • Improve OTLP source default settings
  • Various UI fixes and improvements for AQL search
  • Improve WEC connector performance
  • Support for Cognito custom groups
  • Various fixes for the Windows deployment script