Changelog for version 5.10.0#
Released 12 August 2026#
Gravwell#
Additions#
Added new AI agents support. AI agents are available as a preview and can be installed by deploying the AI Agent Preview kit.
Added AI agent options to the Logbot flow node.
Added an OpenAI-compliant proxy that acts as a configurable LLM ingester for improved AI auditing capabilities.
Added new read-only tool calls for users, groups, and mail settings.
Added the ability to always allow a particular tool call for a single session.
Added the ability to specify multiple AI endpoints.
Added more AI validation and sanitization.
Added a new
semanticsearch module.
Bug Fixes#
Fixed an issue with Logbot returning 400 errors after completion events had been returned.
Fixed an issue where the Logbot attach search entries button was sometimes incorrectly enabled in tables.
Fixed an issue where strings that contained only numbers were incorrectly rendered as JSON numbers in Data Explorer.
Fixed a query execution performance regression related to multifiltering and acceleration.
Fixed an issue where eval comparisons could appear to be inconsistent due to an issue with hinting args for certain fields from syslog.
Fixed an issue with string indexing not working at index boundaries when using arrays in eval.
Ingester Changes#
Additions#
Added a vector embedding preprocessor.
Added Jamf and Microsoft Graph API to the Hosted Ingester.
Added CEF, IPFIX, and Netflow to the Entry Generator tool.
Added remote IP logging for HTTP ingester errors.
Added fallback static UUIDs for Hosted Ingester plugins.
Bug Fixes#
Fixed an issue where the Azure Event Hubs ingester could crash when clearing an emergency queue when rapidly starting up and failing.
Fixed an issue with extracting WinLog EventData.
Fixed HEC ingester to handle unexpected Basic auth.
Fixed an issue with ingesters not trimming their config blocks.
Improved the resiliency of the Cisco ISE preprocessor to handle changes in timestamp formats.