Kibana 9.4.9 → 9.5.1
2 releases · 0 breaking changes · 0 security fixes · 0 advisories fixed
0security0breaking0deprecated44feature36fix
Breaking changes
None in the release notes.
Security changes
None in the release notes.
Every release in between
featureAdd limits on case templates and fields (200 templates and 200 fields per owner, and size limits on template and field definitions) to keep large template libraries performant, and clean up the field library editor #281650.
featureStore assignee usernames, full names, and email addresses on cases so case analytics dashboards can show assignee details without an extra lookup. Available by default in traditional deployments #281579.
featureAdd an Import from another stream flow in the Data lifecycle tab to reuse another stream's lifecycle configuration #275948.
featureAdd transition animations to the Streams data lifecycle phase preview so editing or switching lifecycle methods no longer flashes between states #277149.
fixFix Agent Builder retrying indefinitely on repeated empty responses from Anthropic models, which could exhaust the conversation before surfacing an error #281616.
fixFix Anthropic chat completion requests unexpectedly setting temperature: 0 when no temperature was configured, which could cause errors for Agent Builder and Attack Discovery #281179.
fixFix the attachment input pill border color in Agent Builder chat #282279.
fixFix ES|QL truncating the Tool Success Rate panel in the Agent Builder overview dashboard to 0% whenever there was at least one failure #282026.
fixFix the all cases list and case activity log to render user-picker, toggle, and checkbox field values correctly, and hide markdown-only fields from the column picker #282870.
fixFix duplicate activity entries when setting legacy custom fields #282813.
fixFix the all cases table column selector and template activity log to read from global fields after migrating to case templates #282129.
fixFix duplicate field-definition records being created when a legacy custom field is edited multiple times #282060.
fixFix the case list metrics bar to reflect the current search, filters, and date range instead of showing unfiltered totals #280576.
fixPrevent deleting a field definition that is still referenced by an active case template #280493.
fixFix the timestamp field in the alerting rule query sandbox not updating after the first selection #281854.
fixFix bulk-disabling alerting rules leaving their background execution tasks running after the rule shows as disabled #281468.
fixFix terms formatting to preserve multi-field grouping and column format on round-trip #282760.
fixFix terms include and exclude values to preserve numbers instead of converting them to strings #282752.
fixFix a Lens panel failing to load after duplicating it and then modifying its ad hoc data view, caused by colliding data view IDs #281786.
fixFix a Visualizations API error when reading back an XY chart with an annotation layer backed by an ad hoc data view #281079.
fixFix the Visualizations API dropping the custom name of an ad hoc, form-based data view on round-trip #280546.
fixFix Metric chart values colored by a value outside the configured range to use the default text color instead of blending into the background #280816.
fixDisable Fast mode for Basic and Platinum licenses; approximate results in Discover and Dashboards require an Enterprise license #279903.
fixFix the dashboards listing page failing to load when the savedObjects:listingLimit advanced setting exceeds 1,000 #282100.
fixIncrease the maximum number of hosts allowed on Elasticsearch, remote Elasticsearch, Logstash, and Kafka outputs from 10 to 100 #282397.
fixRemove the proxy configuration option from Kafka outputs, which never supported it #282313.
fixFix a layout flash and unexpected switch to the Fleet app when you select Add integration from the Integrations app #281493.
fixFix enrollment API keys ignoring the requested expiration so tokens never expired regardless of the value you set #281324.
fixFix Fleet-managed OpenTelemetry metrics data streams to use time series index mode by default for integration packages #281295.
fixFix managed OTLP API keys being created without the required APM privileges, which caused the managed OTLP endpoint to reject events #281261.
fixFix the agent policy filter on the agents list page to match agents assigned to version-specific policies #281195.
fixFix Fleet Server detection to recognize agents assigned to version-specific Fleet Server policies, which could leave the onboarding screen showing indefinitely #281092.
fixFix Fleet secrets being stored inline instead of in the secrets index when package policies are created in bulk #282213.
fixFix the agent policy download endpoint returning an HTTP 500 error for policies that reuse the same permissions object in more than one place #280669.
fixFix ILM Explain data not returning results for hidden and system indices in Index Management #282137.
fixFix the Short Dots transform dropping single-character path segments, for example rendering a.b.c as a.c #281930.
fixAlign the null-value label for server-side date fields with the client so CSV exports and the UI both show (null) #281367.
fixFix the Date Nanos formatter ignoring the configured date format for numeric values, such as aggregation results #281343.
fixFix Geo point degrees-minutes-seconds output rounding near-zero coordinates up to a full degree #281336.
fixFix CSV exports covering a different time window than what was shown in Discover for relative time ranges. For scheduled reports, this applies only to reports created or re-saved after upgrading; existing schedules keep their previous behavior until recreated #278305.
+8 more items in the release notesfeatureCreate skills in Agent Builder chat, preview drafts in attachments, and save them from the conversation #265883.
featureEnable Agent Builder to pause and ask up to five clarifying multiple-choice questions before acting, then resume after you answer #274672.
featureShare private agents with selected people using per-agent access control alongside Public, Shared, and Private visibility #267530.
featureAdd an embeddable Agent Builder conversation input that opens Agent Builder and sends the message with attachments preserved #272166.
featureEnable Agent Builder tracing by default so you can view trace waterfalls for each response, use the built-in traces skill, and monitor activity in the overview dashboard while excluding sensitive prompts and tool parameters by default #276174.
featureAdd install, open, and delete controls to the Agent Builder Traces option on the GenAI Settings page, and prevent deleted dashboards from being reinstalled when Kibana restarts #276643.
featureSet a resizable custom width for Agent Builder attachment canvas flyouts in full-screen view and overlay mode in the sidebar #265200.
featureAdd optional connector_ids to the Agent Builder conversation API to limit which connectors a request can use #267333.
featureShow permitted system indices and aliases in Agent Builder index selection, including alerts, ML anomaly results, SLOs, the entity store, exception lists, SIEM signals, and Stack Monitoring #265819.
featureRun several Agent Builder conversations at the same time, and track each conversation's status in the chats panel with In progress, Awaiting your input, Unread, and Error indicators #267980 #271689.
featureRoute low-effort Agent Builder operations such as ES|QL generation and conversation title generation to a configurable fast model, set per feature in Feature settings, with automatic fallback to the default model #265520 #274849 #275607.
featureEnable Cases as Data by default so you can analyze cases, activity, and attachments through dedicated indices and a prebuilt Case Analytics data view that stays current as custom fields change without replacing the space's default data view #279831 #280001.
featureEnable the redesigned Cases list, details, and settings pages by default #279367.
featureSnooze and unsnooze individual alerts with optional expiry or auto-unsnooze conditions #264090.
featureAdd a Stack Alerts feature privilege so roles can read and act on alerts without rule management access #273804.
featureAdd an Inspect action to view and run the Elasticsearch query used by custom threshold rules from the rule details page #262354.
featureMove the unified Rules page into Stack Management so navigation context remains visible #269568.
featureSearch, summarize, and update cases from Agent Builder chat with a cases skill, tools, and case attachments #271438.
featureAdd Add to chat and Summarize case actions to the case details page #276635 #279105.
featureAttach Lens visualizations to cases from Attach saved object #274959 #277040.
featureAttach Discover sessions, dashboards, and maps to cases #272423.
featureRedesign case attachments with a unified Attachments tab, collapsible sections and item counts by type, Type and Author filters, Refresh, and an Attach action on the Activity and Attachments tabs #270518 #272759 #269560.
featureAdd a warning when a selected file already exists in a case #279327.
featureExtract case observables automatically when alerts are added through the API, workflows, or Agent Builder #273455.
featureImprove case templates with toggle fields, unique template names, and a simplified default starter template #277626.
featureSplit the case template editor into Fields and Configuration tabs #277269.
featureAdd autocomplete and inline validation to the case template YAML editor #279346.
featureSet default connectors and case settings in case templates #275690.
featureAdd a display-only Markdown field type to case templates #278329.
featureAdd public Cases APIs to discover applicable extended_fields and apply template defaults when creating a case #279684 #280143.
featureAdd xpack.alerting.alertsService.totalFieldsLimit (default 2800, range 2500–5000) to control Elasticsearch index.mapping.total_fields.limit on .alerts-* indices and templates #274024.
featureAdd a OneDrive connector to search files, browse drives, and read file content in Agent Builder and Workflows #275244.
featureAdd a Box connector to search files and folders and read file content in Agent Builder and Workflows #271306.
featureAdd an Outlook connector to search and browse email messages and download attachments in Agent Builder and Workflows #266766.
featureAdd a Snowflake connector to run SQL queries, explore databases and tables, and search with Cortex Search in Agent Builder and Workflows #264827.
featureAdd an Azure Blob Storage connector to list containers and blobs, read blob content, and search storage in Agent Builder and Workflows #259439.
featureAdd a HubSpot connector to search and retrieve contacts, companies, deals, tickets, and engagements in Agent Builder and Workflows #257675.
featureAdd a Sublime Security connector to investigate and act on email threats in Agent Builder and Workflows #279707.
featureAdd a Filter by feature control to the create-connector flyout, and show the HTTP connector in standard connector lists #271686.
featureImprove authentication options for Agent Builder connectors by listing recommended methods first with a Recommended badge and hiding legacy options when you create new connectors #273410.
+374 more items in the release notes