Release notes

16.0.0

This release contains breaking changes. Please read the Breaking Changes section below before upgrading.

Saved objects with missing metadata were previously fully public. They are now inaccessible. For details, see Missing metadata objects.

Breaking changes

Removed Elasticsearch 7

Support for Elasticsearch 7 has been completely removed. The minimum supported Elasticsearch version is now 8.2.3. Deployments running Elasticsearch 7 must upgrade before migrating to this version of Investigate.

KbnTopNavController button label change

The KbnTopNavController no longer automatically derives a button label from the key property. Plugin authors who register top navigation buttons via topNavMenu or addItems() must now explicitly define a label property on each button object. Previously, omitting label would fall back to capitalizing each word of key (for example, key: 'my action' would render as My Action). That fallback has been removed.

// Before (label was auto-generated from key — no longer works)
{ key: 'my action', run: () => { ... } }

// After (label must be explicitly provided)
{ key: 'my action', label: i18n.translate('my.plugin.nav.myAction', { defaultMessage: 'My Action' }), run: () => { ... } }

Removed a High Availability setup for Siren Alert

Removed the deprecated gun-based High Availability (HA) setup for Siren Alert. The sentinl.settings.cluster configuration option (and all of its nested properties) no longer exists. Any leftover sentinl.settings.cluster configuration in investigate.yml now causes Investigate to fail at startup. Use the Elasticsearch-based high_availability configuration instead. For details, see the High Availability documentation.

React 19

Upgraded React from 18 to 19. This introduces a breaking change to all Investigate plugins that use React. Plugin writers need to update how they mount their root React component from this:

import { render } from 'react-dom';
...
render(<App/>, domElement);

to this:

import { createRoot } from 'react-dom/client';
...
createRoot(domElement).render(<App/>);

Please see the React documentation for other changes that may be required depending on the React APIs your plugins use.

Deprecations

Timelion App and Visualization

The Timelion app and visualization are deprecated and will be removed in a future release. A warning banner is now shown on the Timelion page, and the Timelion visualization is marked as deprecated in the visualization wizard. Existing Timelion visualizations continue to work.

Renaming and deleting fields in entity tables

Renaming and deleting fields for an entity table in Data model > Fields is deprecated and will be removed in a future release. A deprecation warning is now shown when renaming or deleting fields.

Node to edge lens

Deprecated the Node to Edge lens in Graph Browser. A deprecation warning is now shown when attempting to create one; the lens will be removed in a future release.

New features

  • Semantic search support introduced for semantic_text and dense_vector fields in dashboard filters, Siren Search, and the global search. For additional details, see the Semantic Search documentation.

  • Siren Investigate now supports connecting to an array of Elasticsearch hosts. The elasticsearch.url property in investigate.yml is now deprecated and should be replaced with elasticsearch.hosts. This eliminates the single point of failure between the Investigate node and an Elasticsearch node. For example:

    elasticsearch.hosts:
  - 'https://localhost:9221'
  - 'https://localhost:9222'
  - 'https://localhost:9223'

    When one host becomes unreachable, Investigate will seamlessly switch to either of the remaining hosts. As long as the cluster is in a healthy state, Investigate will keep working.

  • Added the ability for set nodes, and groups, to show a count of connected nodes or connected edges. For more information, see Node Connection Counts.

  • Added the capability to add nodes by their entity type. For more information, see Adding nodes by entity.

  • The Dashboard sidebar now shows a single, unified tree. You can also create private folders. For more information, see Sidebar folders.

Bug fixes

  • Fixed an issue where long dataspace names could overflow the sidebar and cause UI issues.

  • Fixed an issue in the Graph Browser where nested groups became visible after changing the zoom level in the map mode.

  • Fixed an issue where the default script for sampled positions would throw an error when adding nodes to the Graph Browser.

  • Fixed an issue where pinging non-existent nodes in the graph using the scripting API could result in an error.

  • Fixed an issue where the expandByRelation API ignored the graph expansion limit.

  • Fixed an issue where cancelling the 'name already exists' modal during a sidebar group rename did not properly cancel the rename action.

  • Fixed an issue where selecting or clearing checkboxes on the Management > Objects page did not update the object count.

  • Fixed an issue where graph nodes inside a closed group could not be deselected.

  • Fixed an issue where switching between Graph Browser and Siren Search did not persist node positions after applying a radial layout.

  • Fixed an issue where copying Graph Browser edge styles did not copy the arrow direction.

  • Fixed an issue where Expand by Relation ignored dashboard filters and did not expand groups when adding nodes to the graph.

  • Fixed an issue where Elasticsearch scroll requests failed because they were redirected to Siren Federate.

  • Fixed an issue where nodes disappeared when the link between them was edited.

  • Fixed an issue where the unauthorized message did not appear on the login screen after the first failed login attempt.

  • Fixed an issue where refreshing the Graph Browser re-added count badges to excluded entity nodes.

  • Fixed an issue where the relations side panel in Graph Browser updated slowly when selecting or clearing all relations.

  • Fixed an issue where the option to disable exports was missing from record tables.

  • Fixed an issue where some internal requests were incorrectly redirected when server-side SSL was enabled.

  • Fixed an issue where cloning a dataspace created an extra, unused metadata document.

  • Fixed an issue where the SAML re-authentication flow would produce errors when Siren Investigate was opened in multiple browser tabs.

  • Fixed an issue where Siren Investigate attempted to upload audit messages from the frontend after restarting with audit disabled.

  • Fixed an issue where expanding all aggregate relations in the Graph Browser could fail when nodes from multiple entities were selected.

Security fixes

  • Bumped Node.js version to 24.21.0. For more details, see changelog.