Release Notes — 2.72

Covers the 2.72 release series. Most recent patch: 2.72.5.

Unless a subsection notes otherwise, changes apply to both Monad SaaS and self-hosted.

New features & improvements

• Schema Detection — now generally available — turn it on for any pipeline edge and Monad learns the shape of the data flowing through it, then alerts you when a new field appears or a field's type changes, whether the change comes from a vendor update or from a change your team made upstream in Monad. A new Schema Detection page lists every tracked edge with its current schema and a version history with side-by-side diffs. Docs → · Announcement → (2.72.3)

  • Access: opt-in per edge — open a pipeline, click the edge you want to monitor, toggle Schema detection on in the edge panel, and save the pipeline; it starts by learning the schema on that edge. Manage every tracked edge from the Schema Detection page in the side navigation (marked New for the launch month).

• Monad MCP — schema detection tools — seven new tools bring Schema Detection to an assistant. Read: get_schema_drift_summary (how many edges are learning vs. detecting, and which have drifted), list_schema_drift_pipelines (which pipelines have it on), list_schema_drift_events (every new-field and type-change event across the organization), get_edge_schema_state (one edge's current baseline — fields, types, records seen, when learning began) and list_edge_schema_events (one edge's drift history). Act: update_edge_schema_mode graduates an edge from learning to detecting immediately, and delete_edge_schema_state resets an edge — it discards the learned baseline and the edge's event history and restarts learning from scratch. Docs → (2.72.3) (For teams using the Monad MCP integration.)

• Shareable, bookmarkable list views — the Inputs, Outputs, Enrichments, Pipelines, and Transforms pages now keep your search text, filters, sort order, and page position in the page URL, so a filtered view survives a reload and can be shared as a link. (2.72.0)

• Monad MCP — pipeline health in one call — list_pipelines can now return each pipeline's status inline, so an agent answering "which of my pipelines are unhealthy?" makes one call instead of one per pipeline. The tool also moved off a deprecated API route. (2.72.3) (For teams using the Monad MCP integration.)

  • Access: opt-in — pass include_status: true when calling list_pipelines; it is off by default.

• Monad MCP — audit log queries — two new read-only tools let an assistant answer "who changed this, and when?": list_audit_logs returns your organization's audit trail filtered by resource, actor, action, or time window — and asking about a pipeline also returns the changes to the inputs, outputs, transforms, enrichments, and secrets it used during that time — while get_audit_log_histogram summarizes change activity over time (totals, busiest periods, breakdown by action and resource type). Results are summarized by default; pass verbose: true for full before/after snapshots. Docs → (2.72.3) (For teams using the Monad MCP integration.)

• Monad MCP — throughput, storage volume, and cost analysis — get_metric_series reports ingress and egress rates (bytes or records) and errors over time for the whole organization, one pipeline, or one node, so an assistant can pinpoint where volume is being dropped or where a pipeline is falling behind. Four new storage-cost tools (get_storage_cost_summary, list_storage_output_details, get_storage_type_series, get_storage_cost_rates) expose the same figures as the Settings → Storage Costs page — including what filtering saved before data reached each destination — and update_storage_cost_rates sets per-GB rates, refusing to overwrite an existing rate unless you confirm. Docs → (2.72.3) (For teams using the Monad MCP integration.)

  • Access: cost figures need per-storage-type rates — set them under Settings → Storage Costs or with update_storage_cost_rates (requires the mcp:write permission); volume figures work without rates.

• Elasticsearch output — date-based index names — the Index Name field now accepts date tokens, so records can be routed to a daily, monthly, or hourly index (for example security-logs-{yyyy}-{mm}-{dd}) instead of one ever-growing index. Tokens resolve against the current UTC time when a batch is written. Docs → (2.72.5)

  • Access: opt-in — add tokens ({yyyy}, {yy}, {mm}, {dd}, {hh}, {mi}, {ss}) to the output's Index Name; a plain name behaves as before.

New connectors

• Finxact core banking (inputs) — Beta — three new inputs pull security-relevant logs from the Finxact core-banking platform (part of Fiserv): Error Log (errors raised by scheduled core processes such as batch posting and interest calculation), Messages (the msgRq/msgRs API-access audit trail, with each request joined to its response), and Rule Log (executions of tenant-authored business rules). Use them to monitor administrator and service-account activity, correlate platform failures with the API calls that triggered them, and meet audit requirements. Error Log docs → · Messages docs → · Rule Log docs → (2.72.1)

Fixes

• 1Password inputs no longer miss late-published events — the Item Usages, Sign-in Attempts, and Audit Events inputs now resume from 1Password's own event cursor between runs, so events that 1Password publishes hours after they occur are still collected. (2.72.1)

• Anthropic Compliance Activities input no longer skips late-arriving activities — the input now allows for the Compliance API's indexing delay instead of advancing past activities before they are visible. (2.72.1)

• Wiz Audit Logs input no longer drops entries still indexing at poll time — each poll now trails Wiz's indexing lag and checkpoints the window it actually processed, closing a gap that lost entries recorded in the last minute or so before each poll. (2.72.2)

• Slack Enterprise Audit Logs input no longer emits duplicate records — corrected cursor handling that caused a large share of records to be delivered twice within a single fetch. (2.72.2)

• Polymer Activity Logs input reads past the first page — the input now walks Polymer's newest-first activity feed in the right direction, so it no longer stalls after the first page until brand-new activity arrives. (2.72.3)

• Volume Anomaly alerts keep their baseline across pipeline renames — the anomaly baseline is now aggregated per pipeline, so renaming a pipeline (or organization) no longer splits its history or skews the alert's weekly sample count. (2.72.0)

• Monad MCP status tools report complete figures — get_pipeline_status now includes record counts alongside byte totals and flags any node with work queued behind it, and list_pipeline_statuses returns results again instead of reporting that no pipelines were found. (2.72.3)

• Finxact inputs fetch only new records, and Rule Log works — the Rule Log input no longer fails every fetch with an HTTP 500 from Finxact, and all three Finxact inputs (Error Log, Messages, Rule Log) now send their time filter in the form Finxact honors, so each run requests only records newer than the last instead of re-reading the endpoint's full history. (2.72.3)

• Rootly Audit Logs input fetches successfully and no longer misses same-second events — requests now use the content type Rootly requires, and the time filter is inclusive, so an event recorded in the same second as the last one collected is no longer skipped. (2.72.3)

• AWS GuardDuty input no longer drops findings within a page — findings are now retrieved in the same order the cursor advances in, so a finding that arrived out of order on the same page is no longer skipped. (2.72.3)

• Jira and Confluence Audit Logs inputs page safely on short pages — both inputs now advance by the number of records Atlassian actually returned (Jira also pins its page size explicitly), so a server-shortened page no longer causes records to be skipped. (2.72.3)

• AWS CloudTrail input honors a custom Prefix — with a non-default S3 prefix, Test Connection failed and an enabled pipeline silently produced nothing; account and region discovery now use the configured prefix. (2.72.3)

• Slack Team Access Logs input reports repeat logins — the cursor was keyed on a device's first-ever access, so later logins from an already-seen device were never emitted; it now tracks the most recent access. Docs → (2.72.3)

• Google Cloud Storage input no longer skips objects around the UTC day boundary — partition scanning used local-clock day and hour values; it now uses UTC, so objects written late in the previous day are still listed. (2.72.3)

• Tenable Vulnerabilities input collects remediations and stops dropping late-indexed findings — the export now watermarks on when Tenable indexed a finding rather than on scan time, and a new Vulnerability States setting lets you include FIXED findings (the default remains OPEN and REOPENED). Docs → (2.72.3)

• Microsoft Defender XDR Alerts input no longer misses updated alerts — the query filtered on creation time while the cursor advanced on last-update time, leaving bands of alerts unfetched; both now use last-update time. (2.72.3)

• Salesforce Search Events input picks up late-arriving event log files — files are now selected by creation date, so a log file published later for an earlier day is no longer skipped. (2.72.3)

• Bitwarden Events input no longer misses events that arrive late — the query now allows for Bitwarden's short publication delay before advancing. (2.72.3)

• Greenhouse Audit Logs input keeps every record of a multi-record request — records that shared a request ID were dropped as duplicates; deduplication is now by record content. (2.72.3)

• GitHub Enterprise and Organization Audit Logs inputs apply their time filter — the created filter was sent in a form GitHub ignores, so each run fell back to GitHub's default window; it is now sent as ISO 8601. (2.72.3)

• BigQuery input's Test Connection catches a mis-typed timestamp column — a non-TIMESTAMP column previously passed Test Connection and then yielded zero rows from a pipeline that looked healthy. (2.72.3)

• Buildkite Audit Logs input collects every event — newest-first pages collided with the cursor so roughly one event per run was kept; the input now pages in the order Buildkite returns. (2.72.3)

• Cursor Audit Logs input honors its time window — the window was sent under parameter names the API ignores, so every run fell back to Cursor's 7-day default. (2.72.3)

• Figma Activity Logs input stops re-pulling history each run — time bounds are now sent as Unix seconds as Figma expects, instead of re-reading up to a year of activity every run. (2.72.3)

• OpenAI Enterprise Audit Logs input no longer drops same-second events — the lower time bound is now inclusive. (2.72.3)

• Bugsnag Organization Events input resumes correctly after the first run — the incremental filter used an upper-bound parameter as a lower bound, rejecting every event after the first run. (2.72.3)

• Duo Security Admin and Telephony Logs inputs page past the first 1,000 records — pagination stalled after the first page of each run. (2.72.3)

• Workiva Activity Logs input no longer misses late-appearing activities — the query now allows for Workiva's ingestion delay. (2.72.3)

• ServiceNow inputs no longer miss records at the checkpoint boundary — records created in the same second as the last saved checkpoint are now picked up on the next run without being duplicated. (2.72.3)

• Cloudflare HTTP Requests, Firewall Events, and Zero Trust Access Requests inputs page reliably on busy zones — when a time window held more records than one page, these inputs could re-request the same page indefinitely or skip events; each now resumes from a precise position so every record is reached once. (2.72.4)

• Socket Full Scans input reads past the first page and skips in-progress scans — Socket stopped returning a page number, so only 30 scans per interval were collected; the input now follows Socket's cursor and waits for a scan to finish before ingesting it. (2.72.4)

• Teleport Audit Logs input no longer misses events still being indexed — queries now trail Teleport's Athena indexing, so events that become queryable late are still collected. (2.72.4)

• Cloudflare DDoS Attack Analytics input no longer skips attacks — results are now requested in a fixed order and paged on a time-plus-attack-ID key, and each run covers the full lookback window Cloudflare allows rather than a one-hour slice. (2.72.4)

• Snowflake Authentication Logs input no longer misses late-materializing logins — queries now stop short of the latency Snowflake documents for its login-history view, so a login that appears after the checkpoint passed its timestamp is still collected on a later run. After upgrading, an existing input can return no records for up to about three hours while the window catches up; nothing is lost. (2.72.4)

• NetSuite SuiteBilling Audit Logs input pages reliably on long backfills — each run now queries a fixed window, checkpoints after every page, and stays under SuiteQL's 100,000-row result cap, so a long backfill or outage no longer truncates silently and a mid-run failure resumes where it left off. Docs → (2.72.4)

• CrowdStrike Spotlight Vulnerabilities inputs no longer skip same-second updates — the time filter is now inclusive and results are requested in ascending order, so a vulnerability updated in the checkpoint second, or returned out of order within a page, is no longer dropped. (2.72.4)

• Prowler Findings input captures updates and stops dropping findings — the input now keys on when a finding was last updated, so a mute, triage change, or new scan result is delivered rather than only the first sighting, and findings returned out of order within a page are no longer lost. It also polls hourly to keep load off the Prowler API. Docs → (2.72.5)

• Postman Audit Logs input collects every event — Postman returns newest-first by default, which left only one record per fetch; the input now requests ascending order with a date window that includes today. (2.72.5)

• Cloudflare URL Scanner input publishes scans again — the query could loop indefinitely on a full page, keep only one result per page, and exclude the current day; the input now walks scans one day at a time, oldest first. (2.72.5)

• runZero inputs can be created again, and Vulnerabilities is rewritten — configuration type mismatches that blocked creating any runZero input are fixed, and the Vulnerabilities input was rebuilt against live runZero data. (2.72.5)

• Azure Activity Logs input no longer loses late-published or high-volume events — queries now allow for Azure's publish delay and follow every results page, so busy subscriptions are no longer truncated to one page. Docs → (2.72.5)

• Nightfall Posture Events input no longer drops events — requests now specify ascending order and send timestamps as Unix seconds, as Nightfall expects. (2.72.5)

• Splunk Search Results input tracks each saved search separately — a single shared checkpoint let searches on different schedules skip past one another; each saved search now keeps its own. (2.72.5)

• Splunk Notable Events input no longer misses late-indexed notables — the search now bounds and checkpoints on index time rather than event time. Existing inputs see a one-time, bounded re-ingest as the checkpoint shifts. (2.72.5)

• OneLogin Events input no longer skips events while paging — the time filter stays fixed for the whole run and results are sorted by ID, so pages no longer shift underneath the cursor. (2.72.5)

• Idira Audit Events input checkpoints on arrival time — the cursor, filter, and sort now use the server's arrival time, the field Idira returns in chronological order, so late-arriving events are collected reliably. (2.72.5)

• Numeric settings fields can be cleared — emptying a number field in a connector or pipeline form no longer snaps it back to its default value. (2.72.5)

• Full-size jq editor handles very large documents — the expanded editor now uses the same virtualized viewer as JSON views, so large inputs scroll and render correctly instead of freezing. (2.72.5)

Breaking changes

None.

Need help?

See the Monad docs for setup guides and reference, or reach out to Monad Customer Support at support@monad.com or via your dedicated Slack customer channel.