RSS

Sysdig On-Premises Release Notes

Here are the most recent release notes for the On-Premises version of Sysdig Platform. Review the entries to learn about the latest features and enhancements.
  • Supported Web Browsers: Sysdig supports, tests, and verifies the latest versions of Chrome and Firefox. Other browsers may also work but are not tested with the same rigour.
  • Falco Rules: You may also want to review the update log for Falco Rules. used in the Sysdig Secure Policy Editor.

7.10.0 Release, October 2026

Upgrade Process

Direct upgrades are supported from version: 6.x, 7.x

For compatibility matrix, see Kubernetes support matrix. For installation and upgrade instructions, see Installation overview.

Sysdig Secure

Vulnerability Policies: Base Image Allow List and Deny List Rules

Rule bundles now include the Base Image Allow List and Base Image Deny List rules under Image Configuration. Use them to control which base images you can build from. Each rule takes a list of base image pull strings, so a single entry can approve or block a whole registry or namespace. When a rule fails, the results show which base image Sysdig detected and what to change.

For more information, see Base Image Allow List.

Standalone Binary Scanning

Sysdig Vulnerability Management now detects standalone binaries that were copied into an image or compiled from source. Each binary appears as an Application component with a name, version, and hash and receives CVE findings alongside other components. To also report unrecognised executables, use the --detect-unknown-executables flag.

For more information, see Standalone Binary Scanning.

Rule Validation Warnings

Rules written with overly broad conditions can negatively impact Shield performance. Sysdig now warns you in such cases. You can ignore the warning and save the rule, or return and refine it.

Warnings are shown in these places:

  • Rules Editor: When you save a rule you created or edited.
  • Terraform: In the output of terraform apply.

Sysdig Monitor

Custom Notification Templates

Sysdig Monitor now lets you customize notifications at two levels:

  • Alert Notification Templates: Define the title and body sent for an individual alert.
  • Custom Notification Templates: Apply templates at the channel level and adapt the notification payload to the format the receiving third-party platform expects.

Custom Notification Templates are created per channel type, starting with PagerDuty, and apply to all notification channels of that type.

Both levels use the same dynamic variables, so one template can serve multiple alerts. Each variable is replaced with values from the alert that triggered the notification.

For more information, see Custom Notification Templates.

Sysdig Platform

Custom Storage

Sysdig Secure now supports Custom Storage. You can connect multiple S3 or S3-compatible buckets, such as MinIO or Google Cloud Storage, and use them across Captures, Response Actions, and Rapid Response.

Configure buckets from Integrations > Data Sources > Storage using one of the following:

  • AWS access keys
  • AWS role delegation (AssumeRole)
  • An S3-compatible endpoint

Sysdig tests the connection when you save, and keeps a failure history for each bucket.

Custom Storage replaces the previous single, shared S3 Capture Storage configuration. For more information, see Custom Storage.

7.9.1 Hotfix Release, September 2026

Upgrade Process

Direct upgrades are supported from version: 6.x, 7.x

For compatibility matrix, see Kubernetes support matrix. For installation and upgrade instructions, see Installation overview.

Defect Fixes

Fixed an issue where users could not create vulnerability exceptions for Pipeline findings.

7.9.0 Release, August 2026

Upgrade Process

Direct upgrades are supported from version: 6.x, 7.x

For compatibility matrix, see Kubernetes support matrix. For installation and upgrade instructions, see Installation overview.

Minimum Agent Version Enforcement

Starting with backend version v7.9.0, Sysdig enforces a 1-year minimum agent version policy at the collector, in line with the existing Sysdig Shield support policy. Agents older than v13.9.2 will be blocked from connecting. Before upgrading to v7.9.0, ensure all agents are running version v13.9.2 or later to avoid losing connectivity.

Sysdig Secure

Risks

You can now use the Risks module in Sysdig Secure, giving you a single view that correlates findings to help you prioritize the greatest risks in your environment.

The Risks module consolidates findings across Vulnerability Management, Posture, and Runtime/Threat Detection, adding attack path analysis and severity-based prioritization on top. This enables:

  • Risk Definitions: Out-of-the-box, SysQL-based definitions that detect problematic combinations of findings (e.g., a workload with a critical, in-use, exploitable vulnerability and a high-confidence runtime detection).
  • Attack Path Visualization: A visual breakdown of how an affected resource is impacted, with drill-down into the underlying insecure configurations, vulnerabilities, and events.
  • Severity-Based Prioritization: Risks are triaged into Critical, High, Medium, and Low tiers, with additional prioritization for “Live” risks (high-confidence events detected within the last 3 hours) and by the number of affected resources.
  • Custom Risk Definitions: You can define your own risk correlations in addition to the managed definitions Sysdig provides.

For more information, see Risks.

Response Actions in Resource Drawer

You can now perform Response Actions directly from the resource drawer. Use them to fetch data for threat hunting or to stop incidents without leaving the resource view.

Supported resource types include:

  • Hosts: Host, Container, and File actions when Response Actions is configured on Host Shield.
  • Kubernetes workloads: Kubernetes actions compatible with the selected resource when Response Actions is enabled on Cluster Shield.

You can also review the Response History for a resource and inspect action details, including execution status, target information, and configuration.

For more information, see Resources.

Software Lifecycle and End-of-Life Visibility in Vulnerability Management

Sysdig Vulnerability Management now provides end-of-life (EOL) visibility for supported operating systems and the Go runtime, letting you identify components that are no longer receiving vendor support directly alongside your vulnerability data.

Lifecycle information appears in the Resource Details drawer, with a new Lifecycle column and filter in the Components tab, and in the Findings Details drawer, the CVE Details drawer, and scan result side panels. CLI scanner JSON output and the scan results API also include lifecycle metadata for use in pipelines and integrations.

A new Component Lifecycle rule type in Rule Bundles lets you fail policy evaluations when a component has reached its end-of-life date or is within 90 days of it.

For supported operating systems, lifecycle states, limitations, and how to use lifecycle data in automation and policies, see Software Lifecycle and End-of-Life Visibility.

Sysdig Monitor

Alert Automations

You can now create automated workflows that run when an alert fires, using conditional logic to route notifications to the right channels. For more information, see Alert Automations.

7.8.0 Release, June 2026

Upgrade Process

Direct upgrades are supported from version: 6.x, 7.x

For compatibility matrix, see Kubernetes support matrix. For installation and upgrade instructions, see Installation overview.

Sysdig Secure

Response History

You can now see what Response Actions have been taken, where, when, and by whom in the Response History page. The page collects all Response Actions performed across the product - manually from events, automatically from Automations, or through APIs providing a single place to retrieve collected artifacts or revert containment actions performed by mistake.

For more information, see Response History.

Sysdig Secure Main Navigation Update

Sysdig has updated the Secure main navigation to improve access to key workflows and consolidate product areas. The navigation now includes:

  • Dashboards (formerly Home): Gives you insights into posture, vulnerabilities, and runtime events.
  • Graph Search: Lets you use a unified search to explore resources and relationships in ways that are faster and more complete.
  • Detection & Response: Monitors and detects events, audit activity, and captures, and configures Rapid Response flows.
  • Inventory: Displays all your resources.
  • Reporting: Allows you to access Reports Manager and Scheduled Reports.
  • Policies: Lets you view and set up policies.
  • Integrations: Lets you connect your environments, data sources, and third-party tools.
  • Settings: Manages account configuration, including API keys, SSO, users, teams, and certificates.

Legacy navigation items remain available under Legacy submenus.

Sysdig Monitor

Legacy Metrics Storage Backend Disabled by Default

Starting v7.8.0, access to the legacy metrics storage backend is disabled by default. Dashboards are migrated from the legacy metrics backend to the Prometheus-based ones. Form editor panels are automatically translated to PromQL and executed via the Sysdig Prometheus API, so queries keep working but now use a single PromQL engine and higher-granularity data.

For more information, see Automatic Query Translation.

Note: This change only affects customers who have not been running v6.1.0 or higher for at least 12 months.

7.7.1 Hotfix Release, April 2026

Upgrade Process

Direct upgrades are supported from version: 6.x, 7.x

For compatibility matrix, see Kubernetes support matrix. For installation and upgrade instructions, see Installation overview.

Defect Fixes

Improved PostgreSQL maintenance to automatically clean up unused large objects and prevent excessive WAL and disk growth.

7.7.0 Release, April 2026

Upgrade Process

Direct upgrades are supported from version: 6.x, 7.x

For compatibility matrix, see Kubernetes support matrix. For installation and upgrade instructions, see Installation overview.

Sysdig Secure

Local Scanning for Kubernetes Container Workloads

Sysdig Secure now supports Local Scanning, a new deployment option for Sysdig Vulnerability Management that runs scanners directly on Kubernetes nodes and hosts to discover and analyze images in place, including ephemeral and non‑registry images. This reduces dependence on central registries, closes visibility gaps across complex environments, and makes it easier to scale vulnerability coverage. Local Scanning requires Host Shield 14.5.0) or later.

For more information, see Local Scanning.

Host and Kubernetes Response Actions in Automations

Automations triggered from Runtime Events now support the full set of response actions, enabling faster containment and forensics directly from detections:

  • Kill container
  • Stop container
  • Pause container
  • Kill Process
  • File acquire
  • File quarantine
  • Kill Pod
  • Kubernetes Rollout restart
  • Kubernetes Volume snapshot
  • Kubernetes Get Logs
  • Kubernetes Network isolate

For more information, see Response Actions in Automations.

Graph Search introduces an intuitive query builder on top of our graph database, allowing users to explore relationships across their On-Premise environments and Kubernetes assets and quickly surface the security issues that matter most in their environments. For more information, see Graph Search.

Sysdig Platform

On-Prem Platform Version in UI

You can now access the On-Prem platform version directly in the UI from the Version & License page under Settings, making it easier for administrators to see which Sysdig On-Prem release is running.

7.6.0 Release, February 2026

Upgrade Process

Direct upgrades are supported from version: 6.x, 7.x

For compatibility matrix, see Kubernetes support matrix. For installation and upgrade instructions, see Installation overview.

Sysdig Secure

Runtime Detection: File Integrity Monitoring (FIM)

A new runtime detection type, File Integrity Monitoring (FIM), is now available. FIM enables you to monitor file changes and create detection policies aligned with PCI DSS requirements 10.5.5 and 11.5. FIM monitoring requires Host Shield version 14.3 or later.

For more information, see FIM Policies.

Events Feed: Customizable Columns

You can now customize the columns displayed in the Events Feed to view relevant attributes directly in the event list, without opening individual events. For more information, see Events Feed.

In Use (Risk Spotlight) Support for Non-Kubernetes Containers

In Use (Risk Spotlight) prioritization now supports non-Kubernetes container workloads, including Docker and Podman containers running on Linux hosts protected by Sysdig Host Shield. This enhancement allows you to reduce vulnerability noise and prioritize remediation efforts for your entire Linux ecosystem by focusing on the vulnerabilities that are actively executable across your Linux container environments.

For more information, see In Use.

Changes to List Matching Policies and Rules

Creation of new List Matching Policies and Rules is no longer supported. Existing policies and rules continue to function and can still be modified.

For new detections, use Falco rules, which provide expanded detection capabilities and flexibility.

For more information, see List Matching Policy.

Zones: Additional Filtering Operators

Two new filtering operators are available for Zones:

  • is not
  • does not contain

These operators enable more precise exclusion filtering for events and findings.

Sysdig Monitor

Recurring Alert Silencing Rules

Alert silencing rules now support recurring schedules, allowing you to automatically mute alerts during defined maintenance windows (for example, daily or weekly). Silences can be applied to the entire infrastructure within the selected team scope.

For more information, see Configure Recurring Silence Rule.