Release Notes: v2026.9.0

Upgrade note: By default, migrations run automatically on startup. Review the breaking changes and migration sections below before upgrading.

Highlights

• Asynchronous notification queue. Alert notifications are now processed through a reliable async queue with join-table routing, improving delivery throughput and eliminating dropped notifications during spikes.
• New sources: Sandfly Security and Pylon. Two new polling integrations let you pull in endpoint and support security data without additional infrastructure.
• Slack Bot alert delivery is here. You can now receive detection alerts directly in Slack channels via the native RunReveal Slack bot, with live-streamed agent replies and full connection management from the integrations settings page.

⚠️ Breaking Changes

RRQ versions belowv2026.9.0 are incompatible with api versions above v2026.9.0. Both must be upgraded at the same time.

Async notification queue rearchitecture — Notification delivery has moved from inline processing in rrq to a queue based system in postgres to improve development flexibility on notification features. The migration will be applied automatically during the upgrade of the API. During the upgrade there is a small chance that loading the notifications will fail while the migration is running. Existing notification channel associations are backfilled automatically and will continue to operate as before. This error will manifest as a "pq: column "notification_names" does not exist". To eliminate the risk of missing an alert from RRQ during the migration, scale all rrq deployments to 0 before updating the API, update the API, then update rrq next and scale it back up.

Features

• Async notification queue — Notifications are now processed through an asynchronous queue with join-table routing, replacing inline delivery for better reliability and observability.
• Writer service framework — New writer architecture with a generic supervisor, dynamic object-storage writer, dynamic custom-ClickHouse (BYODB) writer, default multi-tenant ClickHouse writer, and per-destination flush settings.
• Global chat sidebar — AI Chat is now available as a persistent sidebar accessible from anywhere in the application.
• Bulk investigation close with details — Add a resolution note and classification when bulk-closing investigations.
• Bulk notification channel management — Add or remove notification channels across multiple detections at once, with a polished channel picker.
• Slack Bot notification channel — Deliver detection alerts through the RunReveal Slack bot, including live-streamed agent replies, channel listing, connection management, RBAC, and integrations settings UI.
• Snowflake key-pair authentication — Snowflake destinations now support key-pair auth alongside OAuth.
• Generic webhook signature verification — Validate inbound webhooks using header-based signature verification.
• Per-user preferences storage — New API for storing per-user UI and workflow preferences.
• Zendesk OAuth client credentials — Authenticate Zendesk sources using OAuth client credentials.
• Okta view columns — Commonly-filtered Okta fields are now exposed as dedicated view columns for easier querying.
• Sandfly Security source — New polling source for ingesting Sandfly Security endpoint data.
• Pylon polling source — New polling source for ingesting Pylon support security logs.
• Chart x-axis tick scaling — X-axis tick labels now scale automatically to match the query time window.
• Detection filter improvements — Category and notification filters are now sorted, with category search support.
• Alert facet type-ahead — Facet type-ahead in alert configuration now correctly matches labels and is wired to the UI.
• AI Chat LLM error surfacing — Typed LLM errors and refusal stop reasons are now surfaced in the chat interface.
• MCP sigma resource — Sigma lite syntax is now exposed as a lazy resource for MCP tool consumers.
• Object-storage write logging — Each object-storage write is now individually logged for auditability.
• Detection activity graph link — The detection drawer's activity graph now links directly to detection results.
• Source plan gating — Source creation now enforces plan-level gating.

New Integrations

Bug Fixes

• AWS Network Firewall logs view — Added the missing ClickHouse view for AWS Network Firewall logs.
• Salesforce field normalization — Shared fields are now normalized consistently across all Salesforce event log types, with better error handling on permission issues and a per-file event cap.
• Non-admin settings requests — The settings page no longer fires admin-only API requests for users without admin roles.
• Google Workspace late activities — Late and truncated Google Workspace activities are no longer silently dropped, and poll errors are summarized across all applications.
• Kandji duplicate pages — Kandji polling no longer re-delivers the last page of results on every poll cycle.
• ClickHouse connection management — ConnectionManager cache is now invalidated on destination changes, role scoping is applied on HTTP/HTTPS DSNs, and user migrations are more resilient with proper connection eviction and DSN encoding.
• Notification delivery — Notification names are repopulated on ClickHouse detections, result links are restored on async queue delivery, permanent delivery failures are no longer retried, and notification event counts are measured after fan-out.
• Chat UI fixes — Page context, scroll pinning, and graph-by-name lookup are fixed in the chat interface.
• Twingate log drops — Twingate logs are no longer dropped when individual event deserialization fails.
• Notion webhook verification — The Notion source now correctly accepts the webhook verification handshake.
• Auth redirect loop — A workspace is now selected on first login to prevent redirect loops.
• Query relative time params — Relative time parameters are re-resolved on each query run instead of being cached from the first execution.
• Wiz runtime logs fields — Wiz runtime log fields are now extracted using the correct camelCase keys.
• R2 access key optional — R2 access key ID is now optional when editing an existing source.
• ALB source verification — ALB source verification no longer incorrectly rejects non-JSON log formats.
• MCP pagination — Cursor and limit are now exposed on paginated MCP tools.
• Filter validation — Remaining filter creation paths are closed and validated.
• Custom views non-object rawLog — Custom views now tolerate non-object rawLog values, with an admin regeneration option.
• Agent fixes — Tool names were fixed from the incorrect snake_case to the consistent PascalCase, run failure reasons are surfaced, and the correct 1M context window is used for Claude on Bedrock and Vertex.
• Abnormal source polling errors — Upstream error details are now surfaced in Abnormal polling error messages.
• Workspace invite links — Expired or invalid invite links now redirect to a proper UI error page.
• Sigma parse errors in CLI — Sigma parse errors are now surfaced during detections sync.
• Shutdown flush errors — Context canceled errors returned from ClickHouse flushes during normal shutdown are no longer reported as destination errors.
• Detection auto-triage opt-out — Explicit auto-triage opt-out is now honored at managed subscribe time.
• Buffered webhook registry — Buffered webhooks now use the proper registry lookup.
• GCP DWD scopes — The cloud-platform scope is kept off domain-wide delegation SignJwt scopes.
• S3 nil pointer fix — Fixed a nil pointer dereference in the S3 object storage error path.
• RPC error codes — Malformed request bodies now return 400 instead of 500.
• Transforms nil guard — Guard against nil configs in processor Validate/Process.
• Azure blob insert conflicts — Blob insert batches are preserved on unique constraint conflicts, with faster queue drain and fixed purge lock retry.
• Postgres audit log polling — Advisory lock and tuned poll parameters for the audit log queue.
• OpenAI model support — Added support for OpenAI gpt-5.6 models in AI Chat.
• AI default model reconciliation — Workspace AI default model and provider models are now reconciled correctly.
• Tooltip backgrounds — Tooltip backgrounds are restored by removing dead DaisyUI classes.
• ClickHouse migration role — The UNIQUE_ID is now read under migration_read_role only during migrations.
• Source docs links — The UI now links to the docs page for the specific source type when possible.

Maintenance

• Dropped per-source Azure queue profiling metrics and channel_name from notification_channel_used.

Database Migrations

Four PostgreSQL migration files create indexes with regular CREATE INDEX. Large installations may want to pre-create these indexes concurrently before upgrading to reduce write blocking.