# Release notes

## Version 0.86 (2026-07-28)

### CrowdStrike Falcon (HEC) destination

Axoflow now supports sending data to CrowdStrike Falcon using its [HTTP Event Data Connector (HEC)](../docs/axoflow/destinations/crowdstrike/index.md).

### Bulk host management

You can now manage your host inventory in bulk: export the host list to a CSV file, edit it offline, then import it to add, update, or delete hosts. The **Export/Import CSV** option is available on the **Routers** and **Sources** pages. For details, see [Bulk update hosts](../docs/axoflow/onboard-hosts/hosts/bulk-update-hosts/index.md).

### Usage metrics

AxoConsole now collects daily and monthly usage metrics about the data your AxoRouters ingest on the **About > Usage Metrics** page. For details, see [Usage metrics](../docs/axoflow/metrics/usage-metrics/index.md).

### Search and event details

The visual display of event details (on the [**Search Logs**](../docs/axoflow/storage/search/index.md) page and during [log tapping](../docs/axoflow/onboard-hosts/log-tapping/index.md) and [flow tapping](../docs/axoflow/data-management/flow-tapping/index.md)) has been redesigned and unified. If a field refers to a pipeline element (for example, a flow or store), you can jump to its page. The new **View Options** on the [**Search Logs**](../docs/axoflow/storage/search/index.md) page lets you set the **Timestamp Format** , and the other display options that were available in earlier versions.

### Log tapping

  * While a [log tapping](../docs/axoflow/onboard-hosts/log-tapping/index.md#system-messages) or [flow tapping](../docs/axoflow/data-management/flow-tapping/index.md#system-messages) session is active, AxoConsole now shows the status messages of the tapped service inline in the log stream, color-coded by severity. These include service restart and configuration reload events, and their failures. That way you can tell whether a change in the messages is the result of a configuration change you’ve made, and notice when applying a new configuration failed.
  * AxoRouter’s internal representation of a message (the `debug` field of the event) is now hidden by default in the details of a tapped message. To display it, select **Show Debug Data**. For details, see [Show debug data](../docs/axoflow/onboard-hosts/log-tapping/index.md#debug-data).
  * The **Diff** view of [Flow tapping](../docs/axoflow/data-management/flow-tapping/index.md) is now on a separate tab.



### Topology

On the [**Topology**](../docs/axoflow/onboard-hosts/topology/index.md) page, select **Metric time range** to change the period the metrics refer to (the last 15 minutes by default).

### Storage

When creating an [external store](../docs/axoflow/storage/create-external-store/index.md), you can now explicitly select **Use TLS** to encrypt the connection to the store.

### AxoConsole updates

  * The **⋮** action menus are now labeled to make them easier to find, for example, **Host Options** , **Store Options** , and **Flow Options**.
  * Every user can open their own profile page at the identity provider by selecting **< their username> > Profile**. Users with the **IAM-admin** role also have an **Identity Provider Admin Panel** link to the identity provider’s administration page on the **Settings** page.
  * The **Batch Bytes** destination option has been renamed to **Batch Size**.
  * When configuring TLS for [destinations](../docs/axoflow/destinations/index.md) and [connector rules](../docs/axoflow/data-sources/connector-rules/index.md), you can now select **Paste value** to paste certificates and keys directly in AxoConsole, which then deploys them to the related AxoRouters automatically. Alternatively, select **File path** to keep referencing a file you copy to each AxoRouter manually.
  * [**Probe** processing step](../docs/axoflow/data-management/processing/index.md#probe) names are now validated: they can contain only lowercase alphanumeric characters, `-`, and `.`, and must start and end with an alphanumeric character.
  * In the diff view of [flow tapping](../docs/axoflow/data-management/flow-tapping/index.md), the selected fields no longer reset when new messages arrive, and the selection is highlighted in both the input and the output message.
  * Manual path creation (**Topology > Add Item > Path**) is available again. It’s useful for observing pipelines that AxoConsole doesn’t generate the configuration file for, such as syslog-ng PE deployments.
  * When creating [data collection rules](../docs/axoflow/data-sources/collection-rules/index.md), AxoConsole adds platform-related edge selectors.
  * When opening or reloading the **Services** page of a host, AxoConsole now automatically triggers service discovery, so the list of services on the page is up to date.



### On-premises deployment

  * After a successful installation, the installer writes a `prepare-axorouter-host.sh` script that automates preparing your AxoRouter and Axoflow agent hosts (adding the AxoConsole hostnames to `/etc/hosts` and installing the CA certificate). For details, see [Prepare AxoRouter hosts](../docs/axoflow/deploy/onprem/prepare-axorouter-hosts/index.md).
  * The installer has new flags: `--skip-nip-io`, `--diagnose` (inspect pods that aren’t ready), and `--uninstall`. The new `--uninstall` flag replaces the manual removal commands and prompts before each step so you can stop at any point.
  * If you omit `BASE_HOSTNAME`, the installer offers a `nip.io` wildcard DNS hostname, which lets AxoConsole and its subdomains resolve without any DNS or `/etc/hosts` configuration. This is handy for testing and demos; use a proper domain name for production.
  * The `ingress-nginx` ingress controller is no longer supported. New deployments use Traefik. Also, new deployments use `axoidp` as the default OIDC provider instead of Dex. [Contact our support team](<https://axoflow.com/contact?contact_form_subject=support_request>) for details on upgrading your on-premises or air-gapped environments.



### Other changes and fixes

  * AxoRouter 0.86 is based on [AxoSyslog 4.26.0](<https://github.com/axoflow/axosyslog/releases/tag/axosyslog-4.26.0>).
  * On the **Analytics** page, changing **bucketing** of a Sankey diagram now reorders the diagram accordingly (for example, putting the most/least frequent buckets to the top).
  * When creating a **Set Fields** flow processing step, the field names and expression values have autocompletion based on the fields in the message schema.
  * AxoConsole users with the **infrastructure-viewer** role can no longer see the content of service logs, because error messages in those logs could expose log data.
  * The default template of the S3 destination had no newline delimitation, so downstream consumers couldn’t split objects. This has been corrected.
  * Installing AxoRouter as a non-root user and then setting up a store was broken (the container couldn’t replace the bundled ClickHouse configuration directory). This has been corrected.
  * CEF-formatted PAN-OS start/end timestamps were sometimes parsed incorrectly. This has been corrected.
  * TCP keep-alive settings were hardcoded, so AxoConsole settings didn’t take effect, closing long-lived idle connections. This has been corrected.
  * When AxoRouter sends data to a destination over HTTP or gRPC, it now adds a user agent header (`axorouter/<version>`).
  * Timestamps sent to the Elasticsearch, Google SecOps, OpenObserve, and S3 destinations were malformed in certain scenarios. This has been corrected.
  * For SC4S edges, AxoConsole didn’t display the SC4S configuration correctly. This has been corrected.



### Upgrade notes

SaaS deployments are updated automatically. If you’re running an on-premises AxoConsole deployment, [contact our support team](<https://axoflow.com/contact?contact_form_subject=support_request>) for the detailed upgrade instructions.

## Version 0.81 (2026-05-26)

### Fallback flows

You can now configure [fallback flows](../docs/axoflow/data-management/flow-overview/index.md#fallback-flow) to process data that wasn’t processed by any other flow.

### High-availability AxoRouter clusters

Instructions for creating high-availability AxoRouter clusters using `keepalived` have been added to [AxoRouter high availability](../docs/axoflow/deployment-scenarios/axorouter-high-availability/index.md).

### Source and destination improvements

  * You can now specify **Message Format** and normalization for the following destinations: [Amazon S3](../docs/axoflow/destinations/amazon/s3/index.md), [Elastic Cloud and Elasticsearch](../docs/axoflow/destinations/elastic/elastic-cloud/index.md), [OpenObserve](../docs/axoflow/destinations/openobserve/index.md), [Cortex XSIAM](../docs/axoflow/destinations/palo-alto-networks/xsiam/index.md), [Sumo Logic](../docs/axoflow/destinations/sumo-logic/index.md).
  * You can now rate-limit the [Syslog destination](../docs/axoflow/destinations/generic/syslog/index.md) using the **Throttle** option.
  * The Axoflow agent [Windows Event Log collection rule](../docs/axoflow/data-sources/collection-rules/windows-event-log/index.md) now supports collecting data from custom EVTX files.
  * The measurement unit of the **Maximum object size** and **Chunk size** fields of the S3 destinations was incorrect and has been fixed. If you’re using the S3 destinations, check that your configuration is correct.



### Store metrics

[Store metrics](../docs/axoflow/storage/store-metrics/index.md) are more detailed and include the total size of a store across AxoRouters.

### AxoConsole updates

  * Sensitive values like passwords, secrets, and tokens of destinations aren’t visible on the UI, users can only replace them. Sensitive values aren’t displayed on the **Activity Logs** page.
  * Automatically detected sources can be registered in AxoConsole in bulk.
  * Code snippets in processing steps are automatically syntax-highlighted.
  * Performance improvements in UI autocomplete with very many available values.



### Other changes

  * The Axolet and AxoRouter for Linux provisioning scripts can download the installation images [directly from AxoConsole](../docs/axoflow/provisioning/axorouter/linux/advanced-options/index.md#external-images).
  * Axoflow agent disk queue metrics were referred to as memory queue metrics in their description. This has been fixed.
  * AxoRouter 0.81 is based on [AxoSyslog 4.25.0](<https://github.com/axoflow/axosyslog/releases/tag/axosyslog-4.25.0>).



### Upgrade notes

SaaS deployments are updated automatically. If you’re running an on-premises AxoConsole deployment, [contact our support team](<https://axoflow.com/contact?contact_form_subject=support_request>) for the detailed upgrade instructions.

## Version 0.78 (2026-03-31)

### Data rehydration

You can now resend selected data from AxoStores to other destinations. For details, see [Rehydrate data](../docs/axoflow/data-management/rehydration/index.md).

### RBAC configuration

You can now configure role-based access control for AxoConsole on the [**Settings > Roles**](../docs/axoflow/access-management/index.md) page.

### Source and destination improvements

  * In [syslog connector rules](../docs/axoflow/data-sources/syslog/index.md), the **Enable dynamic window** option enables the dynamic sizing of memory queues by sharing the configured **Log window size** between active incoming connections dynamically, instead of allocating the same window size to each possible connection. Only available for TCP and TLS.
  * For HTTP-based destinations you can configure **Response actions** to specify what AxoRouter does with the log message, based on the response code received from the destination. For an example, see the [Elastic destination](../docs/axoflow/destinations/elastic/elastic-cloud/index.md#response-actions).



### Log tapping

  * The **Tap agent logs** option has been renamed to **Tap service logs**. If available, you can tap into the systemd logs of the related service. You can also filter the logs for specific services. For details, see [Log tapping](../docs/axoflow/onboard-hosts/log-tapping/index.md).
  * You can now tap into the service logs on Axoflow agent for Linux hosts. For details, see [Tap service logs](../docs/axoflow/onboard-hosts/log-tapping/index.md#service-tap).



### Store metrics

AxoConsole shows basic metrics of stores on the [**Routers > Stores** page](../docs/axoflow/storage/overview/index.md), with more details on the pages of the specific stores.

### Other changes

  * The design of the [**Topology**](../docs/axoflow/onboard-hosts/topology/index.md) and [**Dashboard**](../docs/axoflow/onboard-hosts/dashboard/index.md) pages has been updated.
  * The global search field (CTRL + K / ⌘ + K) introduced in 0.75 can now find resources (for example, hosts) by name in addition to page navigation.
  * Service restarts are no longer indicated as service reloads on the metrics and health page.
  * The log collector agent is installed as part of Axoflow agent for Linux by default.
  * AxoRouter 0.78 is based on [AxoSyslog 4.24.0](<https://github.com/axoflow/axosyslog/releases/tag/axosyslog-4.24.0>).



## Version 0.75 (2026-02-24)

### AxoStore improvements

  * You can now configure how to store metadata and the raw message in AxoStore using the **Include Metadata** and **Include Raw Body** options. For details, see [Create Store](../docs/axoflow/storage/create-store/index.md).
  * You can now [export the search results](../docs/axoflow/storage/search/index.md#export-search-results) into a CSV file.



### Source updates

Automatic classification now also supports:

  * [CrowdStrike Falcon Platform](../docs/axoflow/data-sources/appliances/crowdstrike/falcon/index.md)
  * [Tanium Platform](../docs/axoflow/data-sources/appliances/tanium/platform/index.md)
  * Our [Splunk app](../docs/axoflow/data-sources/appliances/splunk/splunk/index.md) is now available on GitHub.



Microsoft Sentinel normalization now supports normalizing:

  * CrowdStrike Falcon events to the `CommonSecurityLog` table
  * Windows events to the `SecurityEvent` table
  * Palo Alto Networks firewall logs to the `CommonSecurityLog` table



### AxoConsole updates

  * Data forwarding and collection rules are shown on the related Axoflow agent pages.
  * Collector rules and flows are shown on the related AxoRouter pages.
  * The [Set fields processing step](../docs/axoflow/data-management/processing/index.md#set-fields) now handles boolean fields.
  * You can use the Filter bar on the [**Alerts**](../docs/axoflow/onboard-hosts/alerts/index.md#filter-alerts) page to search and filter for specific alerts.
  * A new global search field is introduced in the page header to navigate to pages of AxoConsole. It’s also available with the CTRL + K / ⌘ + K shortcuts.
  * The dynamic Splunk destinations no longer have the **Default Source** option. If classification or another processing step doesn’t set the source field, AxoRouter automatically sets it to the name of the AxoRouter connector that received the message.



### Performance improvements

  * The amount of memory AxoRouter uses to store queued messages has been significantly reduced, by up to 50%.
  * AxoRouter 0.75 is based on [AxoSyslog 4.23.0](<https://github.com/axoflow/axosyslog/releases/tag/axosyslog-4.23.0>).
  * Many performance and stability improvements in AxoRouter.



### Other changes

  * The [`axorouter-ctl logs`](../docs/axoflow/reference/man-page/axorouter-ctl/index.md#show-logs) command can display the logs of the `store` container if AxoStore is in use on the AxoRouter host.
  * The [`axorouter-ctl wipe -a`](../docs/axoflow/reference/man-page/axorouter-ctl/index.md#wipe-disk-buffer) command can delete abandoned disk buffer files without creating a backup copy.



## Version 0.73 (2026-01-27)

### Cortex XSIAM destination

Axoflow now supports sending data into [Palo Alto Network’s Cortex Extended Security Intelligence and Analytics Management (XSIAM)](../docs/axoflow/destinations/palo-alto-networks/xsiam/index.md) platform for advanced threat detection and response.

### AxoStore improvements

  * You can select the performance profile to use when creating AxoStores.
  * AxoStore-related configuration changes are available on the [**Activity logs** page](../docs/axoflow/activity-log/index.md).
  * You can now [delete all data from AxoStores](../docs/axoflow/storage/delete-store/index.md) from AxoConsole.



### Source and connector improvements

  * When receiving UDP data with the syslog connector you can now enable eBPF loadbalancing to split the traffic from high-volume sources to multiple workers.

  * For [OTLP source connectors](../docs/axoflow/data-sources/opentelemetry/index.md), you can now configure the window parameters of flow-control (**Initial window size** and **Log fetch limit**).

  * Automatic classification now also supports:

    * [Fortinet FortiProxy](../docs/axoflow/data-sources/appliances/fortinet/fortiproxy/index.md)
    * [Broadcom (VMware) ESX](../docs/axoflow/data-sources/appliances/broadcom/esx/index.md)
    * [Broadcom (VMware) vCenter](../docs/axoflow/data-sources/appliances/broadcom/vcenter/index.md)
    * [Omnissa (VMware) Horizon](../docs/axoflow/data-sources/appliances/omnissa/horizon/index.md).
  * The [WEC Connector](../docs/axoflow/data-sources/wec/index.md) can work with multiple independent certificate authorities at the same time.




### Microsoft Sentinel and Azure Monitor destinations

  * The Microsoft Sentinel and Azure Monitor destinations have a default batch size limit to respect the built-in request size limits of Microsoft Sentinel.
  * The **Stream** name is no longer a required parameter for Azure Monitor and Sentinel destinations.



### Performance improvements

  * Performance improvements for the Google SecOps destination.

  * HTTP-based destinations now support content compressions to reduce bandwidth usage.

  * Performance improvements in disk queue management.

  * Performance improvements in source thread parallelization to leverage available CPU cores more effectively with a single source connection.

  * The defaults of batching related destination parameters have been reviewed.

  * New alerts are introduced to warn about sub-optimal performance parameters across the system.




### Other changes

  * [Agent logs](../docs/axoflow/onboard-hosts/log-tapping/index.md) now contain the output of the systemd units used to launch the containers.
  * The `platform=linux` or `platform=windows` label is added by default to AxoRouter and Axoflow agent instances to help setting up platform-specific rules.
  * The host page of Axoflow agent for Windows now contains improved analytics data.



## Version 0.70 (2025-12-17)

### Edge collection

  * A preview of Axoflow agent is now available for [Linux edge hosts](../docs/axoflow/provisioning/linux-agent/index.md) as well. For Linux edge hosts, you can configure [Journald Collectors](../docs/axoflow/data-sources/collection-rules/journald/index.md).
  * Node metrics is now available for edge hosts as well.



### Disk buffer configuration

You can set the size of disk buffers, or if needed, disable disk buffers on AxoRouter hosts in the configuration of each destination. For example, see the [Google Pub/Sub](../docs/axoflow/destinations/google/pubsub/index.md#disk-buffer) destination.

### Splunk source

  * When receiving data from [Splunk Heavy Forwarders](../docs/axoflow/data-sources/appliances/splunk/splunk/index.md) now we recommend using NUL-terminated messages.

  * The behavior of classification when receiving logs from Splunk HF using the Axoflow Forwarder Add-on has changed:

    * If classification is disabled, the original source, sourcetype, index, timestamp and host metadata are preserved.
    * If classification is enabled, then a successful classification overrides the sourcetype and the index, while the timestamp and host are overwritten if the original message contains these data.



### Other

  * Almost 60% performance improvement in AxoRouter.
  * AxoSyslog has been updated to 4.21.0. 
    * Introducing autoscaling worker partitions to support special batching scenarios (for example, Google SecOps).
    * Improved disk queue scalability to eliminate bottlenecks under high load.
  * Fixed an error that occurred when a destination (Dynatrace) applied normalization by default and the related flow also contained a **Normalization** processing step.



## Version 0.69 (2025-12-03)

### Storage solutions

You can now use Stores on AxoRouters to collect logs locally, with pre-configured retention time. In addition to local Stores, you can also use External Stores. For details, see [Storage](../docs/axoflow/storage/index.md).

### Processing steps

  * The new [**Normalize** processing step](../docs/axoflow/data-management/processing/index.md#normalize) normalizes data according to the specified standard: Dynatrace, Elastic Common Schema (**ECS**), or Open Cybersecurity Schema Framework (**OCSF**).
  * Added the **Keep fields** option to the [Reduce processing step](../docs/axoflow/data-management/processing/index.md#reduce).



### AxoRouter

  * If the primary IP address of AxoRouter is not accessible from your edge hosts, you can set a **Network address override** (IP address or an FQDN) that edge hosts can connect to.
  * You can enable eBPF load balancing for [UDP syslog connectors](../docs/axoflow/data-sources/syslog/index.md#udp-loadbalancing) from AxoConsole.
  * Updated AxoSyslog version to [4.20.1](<https://github.com/axoflow/axosyslog/releases/tag/axosyslog-4.20.1>).
  * Performance optimization in flow output metrics, saving one message size calculation for every message.



### Analytics

You can now use **Most frequent** and **Least frequent** options in addition to **Alphabetical** bucketing on Sankey and Sunburst diagrams.

### Classification and normalization

  * Extended specific OCSF normalization rules for F5 BigIP.
  * Detect misparsed CEF and LEEF logs.
  * Classification added for [NGINX](../docs/axoflow/data-sources/appliances/kubernetes/nginx/index.md).



### Other

  * Axolet builds for Windows Edge hosts are now signed.
  * When sending data to [Dynatrace](../docs/axoflow/destinations/dynatrace/index.md), you can now add extra fields to the message using the `meta.destination.dynatrace.extra_fields` field.



## Version 0.66 (2025-10-30)

### Edge collection and forwarding

  * **Collection Rules** and **Forwarding Rules** for Windows edge hosts now available on the **Sources** page.

    * [**Collection Rules**](../docs/axoflow/data-sources/collection-rules/index.md) create Connectors on a set of edge hosts based on a label selector.
    * [**Forwarding Rules**](../docs/axoflow/data-sources/data-forwarding/index.md) create **Flows** from edge hosts to the OTLP connector of AxoRouter based on a label selector.

Windows edge hosts support data collection from [Windows Event Logs](../docs/axoflow/data-sources/collection-rules/windows-event-log/index.md), [Event Tracing for Windows](../docs/axoflow/data-sources/collection-rules/windows-event-tracing/index.md), and [files](../docs/axoflow/data-sources/collection-rules/file-collector/index.md). Event Tracing for Windows supports predefined profiles (DNS full trace and DNS query) for ease of use, and a custom profile with fine tuning options.




### Menu structure and page headers

The headers and main controls have been aligned across pages. Also, the structure of the AxoConsole menu has been changed, and menu items have been reordered and grouped into sections:

  * The first section focuses on your data: **Dashboard** , **Analytics** , **Flows**

  * The Infrastructure section gives access to the following pages:

    * **Topology** page provides a graphical overview about the infrastructure

    * **Sources** page (new):

      * Where the Inventory tab lists Edges and Appliances by default
      * The new Collection and Forwarding rules configuration tabs allow setting up log forwarding from Edge hosts
    * **Routers** page (new):

      * With the Inventory of Routers, and
      * The **Connector Rules** tab allows setting up connectors.
    * **Destinations** (new) lists all destinations available which were previously only accessible from the **Topology** page

    * **Provisioning** page:

      * Provides platform specific commands to provision Edges and Routers
      * Lists hosts by registration state
  * The System section lists active **Alerts** in the system and the history of user **Activities**.




### AxoConsole performance

  * Improved dashboard response time by using pre-recorded metrics
  * Improved analytics response times by parallelizing queries
  * Better error reporting about invalid requests on the UI



### Miscellaneous

  * You can now create a new destination in place when creating flows

  * Google SecOps destination improvements:

    * Change sshd log type to `OPENSSH`
    * Add [labels support for ingestion](../docs/axoflow/destinations/google/secops/index.md#related-message-fields)
    * Set default timeout to the value recommended by Google
  * Processing workers are now configurable for the [Windows Event connector](../docs/axoflow/data-sources/wec/index.md) for AxoRouters

  * [Syslog source](../docs/axoflow/data-sources/syslog/index.md): `log-fetch-limit` and `log-iw-size` are now available as configuration options

  * Fix syslog processing workers option (UDP)

  * Round robin worker partitions or custom extra partitions key

  * Revamped service reload and restart functions

  * [Kubernetes classification](../docs/axoflow/data-sources/appliances/kubernetes/index.md) support (enable OTLP classification by default)

  * Windows multiline logs (Splunk UF) classification

  * Do not set indexed fields by default for the Splunk destination




## Version 0.65.1 (2025-10-06)

### Destinations

  * Support for [Sumo Logic](../docs/axoflow/destinations/sumo-logic/index.md) and [Dynatrace](../docs/axoflow/destinations/dynatrace/index.md) destinations
  * The namespace option of Google SecOps destination became optional



### Classification and normalization

  * New log format for Cisco ACS
  * ECS normalization for Zscaler
  * Normalization for Fortinet devices
  * ECS normalization for Dell SonicWall
  * Cisco/Meraki timestamp fixes



### Other improvements and changes

  * Upgrade infrastructure dependencies (Pomerium, NGINX ingress)
  * Upgrade to AxoSyslog 4.18.1
  * Improve OTLP source default settings
  * Various UI fixes and improvements for AQL search
  * Improve WEC connector performance
  * Support for Cognito custom groups
  * Various fixes for the Windows deployment script