Release Notes — 2.68

Covers the 2.68 release series. Most recent patch: 2.68.1.

Unless a subsection notes otherwise, changes apply to both Monad SaaS and self-hosted.

New features & improvements

• Default Data Sender role — a new built-in, least-privilege role for accounts that only need to send data into Monad, so you can grant ingest access without handing out broader permissions.
  • Access: assign it under Settings → Members & Roles when inviting or editing a user.
• Reset API-key expiry on regeneration — when you regenerate an API key you can now set a fresh expiry at the same time, so rotating a key no longer forces you to keep its old expiration.
  • Access: Settings → API keys → Regenerate.
• Alert-rule severity validation — alert-rule severities are now validated against Monad's canonical severity set, so a mistyped or unsupported severity is caught up front instead of producing inconsistent alerts.
• Faster TCP input ingestion — TCP inputs batch records more efficiently per pipeline and connection, improving throughput under load.

New connectors

• CyberArk (Idira) EPM raw events (input) — Beta — ingests endpoint privilege management raw event logs from CyberArk's Idira/EPM, so you can route privilege-elevation and endpoint activity into your downstream security tooling. Available in beta. Docs →

Fixes

• Alert cycles are resilient to a single bad rule — one alert rule failing to evaluate no longer cancels the entire alert cycle; the remaining rules still run.
• Elasticsearch output handles empty SDK responses — the Elasticsearch output no longer errors when the Elastic SDK returns a nil response.
• Pipeline edge labels and selection (V2 builder) — edge labels now render correctly and node/edge selection behaves as expected in the V2 pipeline builder.

Breaking changes

SaaS & self-hosted

• HTTP input rejects unauthenticated ingest (security fix) — the HTTP input now requires credentials to accept data; it no longer ingests records anonymously when no verifier is configured, closing a gap where data could reach a pipeline without authentication. Action: if you rely on an HTTP input without authentication, configure credentials (or a verifier) on that input and update your senders to include them before upgrading — otherwise ingest will be rejected.

Self-hosted only

• Key Encryption Key (KEK) secret is now required — self-hosted installs must provide the KEK secret; the chart no longer deploys without it, and the previous "enable KEK" opt-in step has been removed. Action: create and supply the KEK secret in your chart values before upgrading to this series. Monad SaaS is unaffected — Monad manages the KEK.

Need help?

See the Monad docs for setup guides and reference, or reach out to Monad Customer Support at support@monad.com or via your dedicated Slack customer channel.