Versions

Director version numbers track DataStream version numbers. The table below lists the Director versions released to date and the Director changes each one carried. Versions that introduced no Director changes are not listed.

Version	Description
v2.6.0	Event split rules — a Director can split one incoming message or file into separate logs, using rule sets kept in the Library. Rules can split by lines, a separator, a regular expression, JSON lines, a JSON array, or a CSV or header-line table such as IIS, W3C and Zeek logs. Sensitive data protection for targets — a target can be set to refuse sensitive data. The Director then redacts, masks, hashes or encrypts sensitive values before it sends each record, and does not send a record it cannot protect. LogChain — on Enterprise, Agents sign the data they queue, and the Director checks each upload before it accepts it. This proves that nobody changed the data on the way. Protected live captures — a Director masks sensitive values in live data and console log captures, and encrypts each record so only the browser that started the capture can read it. Smart Engine field control — the Smart Engine of a Microsoft Sentinel target can always keep chosen fields of a table, or drop them. Browser clients for OTLP — an OpenTelemetry Protocol (OTLP) device can accept data from browsers, from the origins it allows.
v2.5.0	Event Hubs through the Kafka endpoint — an Azure Event Hubs device can read through the namespace's Kafka endpoint (Standard tier and above) instead of AMQP. Event Hubs keeps the consumer group's positions and balances partitions between the Directors reading it, so the device needs no checkpoint container, storage account or Storage Blob Data Contributor role. A device with no start position starts at the latest event, through either protocol. Message queue log — the warnings and errors of a Director's embedded message queue reach its log and the recent_errors of its /health endpoint. Fixed statistics forwarding and automation stopping for good on a Director whose Windows host was powered off without a clean shutdown. Fixed an Azure Event Hubs pipeline bus now and then having batches refused by the broker for a compression codec Event Hubs does not accept. The bus sends uncompressed unless gzip is configured. Fixed an Event Hubs pipeline bus address written with its port (:9093) not resolving. Fixed a NetFlow, IPFIX or sFlow device resetting the Director's service settings until a restart, which turned off its file log and marked /health degraded. Fixed a dataset attached to, changed on or removed from a running device not reaching its collector.
v2.4.0	Smaller Agent binary — the Agent binary is about half its previous size. A Director sends each Agent the Library entries, table definitions and GeoIP data its pipelines need together with its configuration. Agents on Solaris, AIX and macOS — a Director serves the Agent installer for Oracle Solaris and AIX hosts, and leaves a Solaris, AIX or macOS host that has an Agent to that Agent instead of reading it over SSH. Managed identity for Event Hubs — a Director whose pipeline bus is Azure Event Hubs can sign in with the Azure managed identity or workload identity it runs under, instead of a connection string. Upload starvation warning — a Director in In-memory processing mode warns, in its log and on its /health endpoint, when a target sends batches far smaller than its batch size while its backlog grows. Fixed a Serverless Director in Persistent processing mode with a Kafka or Event Hubs pipeline bus keeping its data on its embedded queue instead of the configured broker. Fixed a Kafka or Event Hubs pipeline bus that the broker refused reading nothing without reporting an error. Fixed data that one target failed to accept being acknowledged at the source, and a source's position being committed past records that had not yet been delivered. Fixed a Kafka pipeline bus refusing payloads close to the payload size limit. Fixed time-stamped data not being delivered in In-memory processing mode. Fixed a re-enabled device waiting up to a minute for collection to resume.
v2.3.0	Azure Container Apps self-update — a Director installed with self-update enabled restarts its own revision to pick up a new version. Container logging — a Director running in a container logs to standard output and reports why it could not start. Fixed Agent installs from a container Director failing to download the Agent binary.
v2.2.2	Autoscaling metric — a Serverless Director reports one scaling metric for its whole replica set, built from backlog, CPU and memory, and does not ask for more replicas when its backlog cannot be spread across them. Statistics retention — while the platform connection is down, a Director keeps its statistics on disk for up to 24 hours and delivers them when the connection returns. Fixed an issue where a Director created in Persistent processing mode kept its data in memory until the Director was restarted.
v2.2.1	Replica coordination — Director replicas that share one identity (Serverless and Orchestrated Directors) coordinate through the platform with leader election, device ownership and shared checkpoints, so each device is collected by one replica only. Cluster work sharing — Kafka, RabbitMQ, NATS, Google Pub/Sub and Azure Event Hubs listeners run on every cluster node instead of a single one. Cluster device placement — a device that must run on a single node is guarded by an ownership lease, so two nodes never collect it at the same time. A device can be limited to named cluster nodes, and devices are rebalanced gradually rather than all at once after a node restart.
v2.2.0	Reload and Restart — a Director can reload its services in place, pausing collection for a few seconds, or restart through its service manager. Smaller Agent configurations — a Director sends each Agent only the pipelines its datasets use. Update rollback — a failed self-update is rolled back to the previous version, and an interrupted one is recovered. Message queue recovery — a Director recovers its message queue when it fails at runtime, without a restart. Fixed a Director running out of memory under a high volume of small Agent files. Fixed a Director being left without its listeners after a reload. Fixed a pushed configuration occasionally not being loaded by the Director. Fixed Agents on v2.0.6 or earlier being unable to self-update from a current Director. Fixed a relative TLS CA path being resolved against the configuration folder instead of the Director's root folder.
v2.1.0	Serverless Mode — Directors can be deployed to Kubernetes, Docker, Azure Container Instances, and Azure Container Apps in addition to Windows and Linux hosts. Processing Mode — data storage behavior is configurable per Director: in-memory, crash-resistant, or persistent.
v2.0.1	Legacy Agent payloads — a Director detects and accepts the older VMF payload format that Agents from before v2.0.0 send. Fixed live capture for records that arrive from an Agent: they are now captured under their device, without repeating the pre-processing stage.
v2.0.0	Director 2.0 — new Director core with faster log collection and processing, and higher sustained throughput. Director Proxy — proxy settings moved into the Director configuration, so connectivity is managed in one place. Director TLS — Director-to-Agent communication can be encrypted in transit.
v1.10.4	Fixed an issue where a high number of entries in the Director configuration could cause errors.
v1.10.1	Director configuration delivery is now version-aware, so Directors running earlier versions handle the Vault configurations introduced in v1.10.0 correctly.
v1.10.0	Fixed an issue where notifications in self-managed Director environments prevented the latest available version from being downloaded.
v1.9.0	Orchestrated Director — Director type for auto-scaling environments in which instances are created, scaled, and replaced by the platform rather than managed directly. Cluster IP — cluster traffic can be routed through a single IP address.
v1.8.1	Fixed Director configuration not being published when a Dataset is created or deleted.
v1.8.0	Update Management — version management for Directors and Agents, with a choice between automatic and manually triggered updates.
v1.7.0	Cluster Director — Directors can run in odd-numbered clusters (3, 5, 7) for quorum-based decisions, with cluster-level configuration distribution and failover. Token authentication and network access controls — Director configurations support token management for credential rotation and revocation, and restriction of Director connectivity to authorized endpoints.
v1.6.1	Fixed configuration strings sent from the web interface to the Director being incorrectly formatted, which caused configurations to fail and blocked data flow.
v1.5.0	Self Managed Director — two configuration management modes. Managed mode pushes configuration changes to the Director automatically; self-managed mode requires the configuration to be downloaded and uploaded to the Director manually, with a warning shown while a newer configuration is pending.