Release Notes: v2026.8.0

Upgrade note: Migrations run automatically on startup. Review the breaking changes and migration sections below before upgrading.

Highlights

• Route logs to specific destinations — You can now configure individual sources to send their data to specific destinations, giving you fine-grained control over where your security data lands.
• Email notifications via SMTP and Cloudflare — Notification channels now support SMTP and Cloudflare email delivery, so your team can receive alerts wherever they prefer.
• WorkOS integration — Three new sources let you ingest WorkOS audit logs (via S3 or webhook) and WorkOS events (via polling), bringing identity and access activity into your security data.
• Bulk actions across investigations, detections, and alerts — Update status, severity, or assignee for multiple items at once across investigations, detections, and alert views, significantly reducing triage time.

Features

• Source-to-destination routing — Route individual sources to specific destinations for fine-grained data placement control.
• SMTP and Cloudflare email notification channels — Send alert notifications through SMTP or Cloudflare email in addition to existing channels.
• Field-level masking pipeline step — Mask sensitive fields in your pipeline with a new dedicated masking step, complemented by a per-workspace HMAC pseudonymization service.
• Alert grouping into investigations — Group a detection run's alerts into a single investigation and toggle grouped alerts in the detections view.
• Bulk actions for investigations, detections, and agent tasks — Perform bulk status, severity, assignee, update, and delete operations across investigations, detections, and agent skill views.
• Slack DM agent and per-user account linking — Chat with the RunReveal agent directly in Slack DMs, with per-user account linking and a confirmation page.
• Server-side faceted tables — Investigations, detections, alerts, notifications, agent runs, managed detections catalog, parameters, and admin sources now use server-side filtering, sorting, pagination, and facets for faster, more consistent table experiences.
• CrowdStrike FDR materialized views — New ClickHouse materialized views accelerate queries against CrowdStrike FDR data.
• Notification template improvements — Live detection preview in the template editor, item field dropdowns for loop and table builders, configurable Slack alert color, and linked channels/templates with a template overview page.
• Destination health checks on creation — The destination creation page now includes health checks so you can verify connectivity before saving.
• GitHub audit log event type selector — Choose specific event types when configuring GitHub audit log polling.
• S3 batch destination publishing — Events and detections can now be published in batch mode to S3 and PostgreSQL for downstream consumption.
• Explorer histogram loading animation — The explorer histogram now shows an animated wave of bars during loading.
• SOC metrics time-range picker — The investigations SOC metrics page now includes a time-range picker for flexible reporting windows.
• Bedrock spend visibility and budget controls — Admins can view Bedrock token spend and quota, set per-workspace budget overrides, enforce monthly spend caps for shared-role workspaces, and filter usage by model or creator.
• Docker log source — Collect logs directly from Docker containers as a new source type.
• Shift-click range selection in tables — Hold shift and click to select a range of rows in any DataTable.
• ClickHouse skip indexes for CloudTrail — New skip indexes on the CloudTrail logs table improve query performance.
• CLI improvements — Consistent API command naming and improved error messages for profile subcommands.
• Configurable ch-partitioner backfill dates — The ClickHouse partitioner now supports configuring custom start and end dates for log backfills.

New Integrations

Bug Fixes

• Plan gating on source connect — The connect button now correctly honors plan-level gating so users on restricted plans cannot connect unsupported sources.
• Non-commercial AWS partition ARNs — Source configuration now accepts ARNs from GovCloud and other non-commercial AWS partitions.
• Budget pace warnings accuracy — Budget pace warnings now gate on real usage data and only fire when spend is on track to exceed the budget.
• SQS poll queue crash — Fixed a crash caused by concurrent map writes in the SQS polling queue.
• Timepicker calendar clipping — The date calendar in the time picker no longer renders clipped in half.
• Stripe subscription webhooks — Properly handle customer.subscription.updated webhooks and repair the Stripe upgrade flow with a new downgrade path.
• ClickHouse partitioner empty INSERT — Fixed empty INSERT statements by making the date stop boundary exclusive.
• Duplicate ClickHouse UNIQUE_ID — Resolved duplicate unique IDs during migration and removed the stale unique_id cache.
• Agent chat ownership — Run-now chats are now owned by the triggering user and can be cancelled.
• UI tooltip z-index — Layer tooltips above overlays using shared z-index tokens so they are always visible.
• ClickHouse partitioner projections — DROP PROJECTION clauses are now stripped from partitioned CREATE TABLE statements.
• Partitioner progress and stop endpoints — The /progress and /stop endpoints now honor the DSN provided at /start.
• Partitioner progress performance — Capped execution time, memory, and fetch scope on the /progress endpoint to keep responses under one second.
• Webhook connection leak — Stopped webhook notification channels from leaking HTTP connections.
• Orphaned investigation channels — Fixed orphaned Slack channels when detections are updated, deleted, or have managed subscriptions changed.
• Investigation tag parsing — Tags are now correctly parsed whether provided as a JSON array or comma-separated list.
• Dark mode markdown preview — Template markdown preview now uses theme tokens so it renders correctly in dark mode.
• Polling source error handling — Unrecognized polling source types now return an error instead of silently failing; nil poller guard prevents crashes.
• Serval polling — Restored Serval poll frequency to 300 seconds and stopped re-ingesting audit logs on every poll cycle.
• Detection date rendering — Sigma date extras now render as YYYY-MM-DD so edits save correctly.
• Detection list filter preservation — List filters are no longer lost when editing a detection.
• Duplicate pipeline name conflict — Creating a pipeline with a duplicate name now returns a 409 Conflict instead of an opaque error.
• Source webhook settings — Source-specific webhook settings are now preserved on create.
• ALB batched webhooks — Batched object storage webhooks now emit one ALB request per body.
• Destination error context — Destination-error context is now detached from the parent context so transient cancellations do not mask the real error.
• Detection change trigger — The detection_change database trigger now includes all required fields.
• ALB stickiness cookies — API client now carries ALB stickiness cookies across requests for consistent routing.
• UEBA materialized view — The UEBA materialized view hourBucket now uses receivedAt instead of eventTime for more reliable bucketing.
• Explorer settings sync — Debounced settings changes keep the chart and table in sync and prevent redundant queries.
• Dashboard page scrolling — Dashboard pages no longer over-scroll into blank space.
• Agent inference timeout — Replaced the global chat loop timeout with a per-call inference timeout for more predictable agent behavior.
• Agent Claude model recognition — Claude 4.6, 4.7, and 4.8 Bedrock models are now recognized for correct max_tokens handling.
• Sentry error in CE — Sentry is disabled when RUNREVEAL_CE is set, and an empty Frames slice guard prevents panics in beforeSend.
• Bucket-only source categories — Removed the HTTP category from sources that only support bucket ingestion.
• ClickHouse Cloud bootstrap — Improved error surfacing and pre-flight checks for ClickHouse Cloud migrations.
• Geo data enrichment — Moved geo data enrichment inside the step loop so it applies correctly per event.
• Community Edition license call — The frontend license list call now passes the workspace correctly.

Breaking Changes

• ch-partitioner is now serve-only — The ch-partitioner CLI subcommands have been removed; it now runs exclusively as a long-lived server. If you invoke ch-partitioner with subcommands in scripts or process managers, update those invocations to use the server entrypoint only.
• ch-partitioner worker pool configuration split — Analyzer and scheduler worker pools are now configured independently. If you set a single worker pool size for ch-partitioner, you must update your configuration to specify separate values for the analyzer and scheduler pools.

Maintenance

• Internal tooling: added rr-secret CLI for AWS Secrets Manager, Prometheus exporter for local ClickHouse, and improved dev tooling for multi-worktree development with OIDC login.
• UI design system refresh: restyled buttons, badges, menus, signup/login panels, severity badges, and DataTable typography to the Q2 2026 design system.
• Refactored webhook parsing to route all webhook ParseFile calls through a shared framer; added registry-driven batching contract tests for all webhook sources.
• Consolidated filter UI components onto FilterPopover; refactored time-range API to be self-describing.
• Partitioner logging improvements: destination and migration ID now always present in logs.
• Documentation updates: WorkOS source pages, ch-partitioner operations guide, Mask pipeline step, notification template examples, Homebrew install trust step, AWS WIF setup for Google Workspace, and Bedrock AI chat model selection.
• CI updates: bumped GitHub Actions to node24, improved CE image push reliability, and added internal CE image builds.
• Dependency upgrades: upgraded mermaid and js-yaml for confirmed exploitable CVEs; upgraded golang.org/x/crypto to v0.54.0.
• Community Edition: added docker-compose.yml, increased default limits, and added ClickHouse container log forwarding to console.
• Added Baseten inference to the OpenAI allowlist.
• Added MCP template API support.
• Added ClickHouse day-level partitioning for bootstrap tables.
• Replaced server-side @sentry/nextjs with @sentry/cloudflare to fit Cloudflare Worker size limits.

Database Migrations

v2026.8.1

Upgrade note: This is a patch release. Migrations run automatically on startup.

Breaking Changes

No breaking changes in this patch.

Database Migrations

No database migrations in this patch.

Changes

• Fix ClickHouse migration unique ID read permissions — The ClickHouse unique ID used during migrations is now read using the migration_read_role only, fixing a permissions issue that could cause migration failures in environments with restricted database roles.