# Release Notes — 2.68

Covers the **2.68** release series. Most recent patch: **2.68.1**.

Unless a subsection notes otherwise, changes apply to both Monad SaaS and self-hosted.

## New features & improvements

- **Default Data Sender role** — a new built-in, least-privilege role for accounts that only need to send data into Monad, so you can grant ingest access without handing out broader permissions.
  - *Access:* assign it under Settings → Members & Roles when inviting or editing a user.
- **Reset API-key expiry on regeneration** — when you regenerate an API key you can now set a fresh expiry at the same time, so rotating a key no longer forces you to keep its old expiration.
  - *Access:* Settings → API keys → Regenerate.
- **Alert-rule severity validation** — alert-rule severities are now validated against Monad's canonical severity set, so a mistyped or unsupported severity is caught up front instead of producing inconsistent alerts.
- **Faster TCP input ingestion** — TCP inputs batch records more efficiently per pipeline and connection, improving throughput under load.

## New connectors

- **CyberArk (Idira) EPM raw events (input) — Beta** — ingests endpoint privilege management raw event logs from CyberArk's Idira/EPM, so you can route privilege-elevation and endpoint activity into your downstream security tooling. Available in beta. [Docs →](https://app.monad.com/docs/inputs/idira/idira-raw-events)

## Fixes

- **Alert cycles are resilient to a single bad rule** — one alert rule failing to evaluate no longer cancels the entire alert cycle; the remaining rules still run.
- **Elasticsearch output handles empty SDK responses** — the Elasticsearch output no longer errors when the Elastic SDK returns a nil response.
- **Pipeline edge labels and selection (V2 builder)** — edge labels now render correctly and node/edge selection behaves as expected in the V2 pipeline builder.

## Breaking changes

**SaaS & self-hosted**

- **HTTP input rejects unauthenticated ingest (security fix)** — the HTTP input now requires credentials to accept data; it no longer ingests records anonymously when no verifier is configured, closing a gap where data could reach a pipeline without authentication. **Action:** if you rely on an HTTP input without authentication, configure credentials (or a verifier) on that input and update your senders to include them before upgrading — otherwise ingest will be rejected.

**Self-hosted only**

- **Key Encryption Key (KEK) secret is now required** — self-hosted installs must provide the KEK secret; the chart no longer deploys without it, and the previous "enable KEK" opt-in step has been removed. **Action:** create and supply the KEK secret in your chart values before upgrading to this series. Monad SaaS is unaffected — Monad manages the KEK.

## Need help?

See the [Monad docs](https://app.monad.com/docs) for setup guides and reference, or reach out to Monad Customer Support at [support@monad.com](mailto:support@monad.com) or via your dedicated Slack customer channel.

:::note
Self-hosted deployments upgrade to a `2.68.x` release with
`helm upgrade`. Review the **Breaking changes** section above before upgrading;
when it says "None," the upgrade is drop-in.
:::