RSS

Sysdig On-Premises Release Notes

Here are the most recent release notes for the On-Premises version of Sysdig Platform. Review the entries to learn about the latest features and enhancements.
  • Supported Web Browsers: Sysdig supports, tests, and verifies the latest versions of Chrome and Firefox. Other browsers may also work but are not tested with the same rigour.
  • Falco Rules: You may also want to review the update log for Falco Rules. used in the Sysdig Secure Policy Editor.

7.9.0 Release, August 2026

Upgrade Process

Direct upgrades are supported from version: 6.x, 7.x

For compatibility matrix, see Kubernetes support matrix. For installation and upgrade instructions, see Installation overview.

Minimum Agent Version Enforcement

Starting with backend version v7.9.0, Sysdig enforces a 1-year minimum agent version policy at the collector, in line with the existing Sysdig Shield support policy. Agents older than v13.9.2 will be blocked from connecting. Before upgrading to v7.9.0, ensure all agents are running version v13.9.2 or later to avoid losing connectivity.

Sysdig Secure

Risks

You can now use the Risks module in Sysdig Secure, giving you a single view that correlates findings to help you prioritize the greatest risks in your environment.

The Risks module consolidates findings across Vulnerability Management, Posture, and Runtime/Threat Detection, adding attack path analysis and severity-based prioritization on top. This enables:

  • Risk Definitions: Out-of-the-box, SysQL-based definitions that detect problematic combinations of findings (e.g., a workload with a critical, in-use, exploitable vulnerability and a high-confidence runtime detection).
  • Attack Path Visualization: A visual breakdown of how an affected resource is impacted, with drill-down into the underlying insecure configurations, vulnerabilities, and events.
  • Severity-Based Prioritization: Risks are triaged into Critical, High, Medium, and Low tiers, with additional prioritization for “Live” risks (high-confidence events detected within the last 3 hours) and by the number of affected resources.
  • Custom Risk Definitions: You can define your own risk correlations in addition to the managed definitions Sysdig provides.

For more information, see Risks.

Response Actions in Resource Drawer

You can now perform Response Actions directly from the resource drawer. Use them to fetch data for threat hunting or to stop incidents without leaving the resource view.

Supported resource types include:

  • Hosts: Host, Container, and File actions when Response Actions is configured on Host Shield.
  • Kubernetes workloads: Kubernetes actions compatible with the selected resource when Response Actions is enabled on Cluster Shield.

You can also review the Response History for a resource and inspect action details, including execution status, target information, and configuration.

For more information, see Resources.

Software Lifecycle and End-of-Life Visibility in Vulnerability Management

Sysdig Vulnerability Management now provides end-of-life (EOL) visibility for supported operating systems and the Go runtime, letting you identify components that are no longer receiving vendor support directly alongside your vulnerability data.

Lifecycle information appears in the Resource Details drawer, with a new Lifecycle column and filter in the Components tab, and in the Findings Details drawer, the CVE Details drawer, and scan result side panels. CLI scanner JSON output and the scan results API also include lifecycle metadata for use in pipelines and integrations.

A new Component Lifecycle rule type in Rule Bundles lets you fail policy evaluations when a component has reached its end-of-life date or is within 90 days of it.

For supported operating systems, lifecycle states, limitations, and how to use lifecycle data in automation and policies, see Software Lifecycle and End-of-Life Visibility.

Sysdig Monitor

Alert Automations

You can now create automated workflows that run when an alert fires, using conditional logic to route notifications to the right channels. For more information, see Alert Automations.

7.8.0 Release, June 2026

Upgrade Process

Direct upgrades are supported from version: 6.x, 7.x

For compatibility matrix, see Kubernetes support matrix. For installation and upgrade instructions, see Installation overview.

Sysdig Secure

Response History

You can now see what Response Actions have been taken, where, when, and by whom in the Response History page. The page collects all Response Actions performed across the product - manually from events, automatically from Automations, or through APIs providing a single place to retrieve collected artifacts or revert containment actions performed by mistake.

For more information, see Response History.

Sysdig Secure Main Navigation Update

Sysdig has updated the Secure main navigation to improve access to key workflows and consolidate product areas. The navigation now includes:

  • Dashboards (formerly Home): Gives you insights into posture, vulnerabilities, and runtime events.
  • Graph Search: Lets you use a unified search to explore resources and relationships in ways that are faster and more complete.
  • Detection & Response: Monitors and detects events, audit activity, and captures, and configures Rapid Response flows.
  • Inventory: Displays all your resources.
  • Reporting: Allows you to access Reports Manager and Scheduled Reports.
  • Policies: Lets you view and set up policies.
  • Integrations: Lets you connect your environments, data sources, and third-party tools.
  • Settings: Manages account configuration, including API keys, SSO, users, teams, and certificates.

Legacy navigation items remain available under Legacy submenus.

Sysdig Monitor

Legacy Metrics Storage Backend Disabled by Default

Starting v7.8.0, access to the legacy metrics storage backend is disabled by default. Dashboards are migrated from the legacy metrics backend to the Prometheus-based ones. Form editor panels are automatically translated to PromQL and executed via the Sysdig Prometheus API, so queries keep working but now use a single PromQL engine and higher-granularity data.

For more information, see Automatic Query Translation.

Note: This change only affects customers who have not been running v6.1.0 or higher for at least 12 months.

7.7.1 Hotfix Release, April 2026

Upgrade Process

Direct upgrades are supported from version: 6.x, 7.x

For compatibility matrix, see Kubernetes support matrix. For installation and upgrade instructions, see Installation overview.

Defect Fixes

Improved PostgreSQL maintenance to automatically clean up unused large objects and prevent excessive WAL and disk growth.

7.7.0 Release, April 2026

Upgrade Process

Direct upgrades are supported from version: 6.x, 7.x

For compatibility matrix, see Kubernetes support matrix. For installation and upgrade instructions, see Installation overview.

Sysdig Secure

Local Scanning for Kubernetes Container Workloads

Sysdig Secure now supports Local Scanning, a new deployment option for Sysdig Vulnerability Management that runs scanners directly on Kubernetes nodes and hosts to discover and analyze images in place, including ephemeral and non‑registry images. This reduces dependence on central registries, closes visibility gaps across complex environments, and makes it easier to scale vulnerability coverage. Local Scanning requires Host Shield 14.5.0) or later.

For more information, see Local Scanning.

Host and Kubernetes Response Actions in Automations

Automations triggered from Runtime Events now support the full set of response actions, enabling faster containment and forensics directly from detections:

  • Kill container
  • Stop container
  • Pause container
  • Kill Process
  • File acquire
  • File quarantine
  • Kill Pod
  • Kubernetes Rollout restart
  • Kubernetes Volume snapshot
  • Kubernetes Get Logs
  • Kubernetes Network isolate

For more information, see Response Actions in Automations.

Graph Search introduces an intuitive query builder on top of our graph database, allowing users to explore relationships across their On-Premise environments and Kubernetes assets and quickly surface the security issues that matter most in their environments. For more information, see Graph Search.

Sysdig Platform

On-Prem Platform Version in UI

You can now access the On-Prem platform version directly in the UI from the Version & License page under Settings, making it easier for administrators to see which Sysdig On-Prem release is running.

7.6.0 Release, February 2026

Upgrade Process

Direct upgrades are supported from version: 6.x, 7.x

For compatibility matrix, see Kubernetes support matrix. For installation and upgrade instructions, see Installation overview.

Sysdig Secure

Runtime Detection: File Integrity Monitoring (FIM)

A new runtime detection type, File Integrity Monitoring (FIM), is now available. FIM enables you to monitor file changes and create detection policies aligned with PCI DSS requirements 10.5.5 and 11.5. FIM monitoring requires Host Shield version 14.3 or later.

For more information, see FIM Policies.

Events Feed: Customizable Columns

You can now customize the columns displayed in the Events Feed to view relevant attributes directly in the event list, without opening individual events. For more information, see Events Feed.

In Use (Risk Spotlight) Support for Non-Kubernetes Containers

In Use (Risk Spotlight) prioritization now supports non-Kubernetes container workloads, including Docker and Podman containers running on Linux hosts protected by Sysdig Host Shield. This enhancement allows you to reduce vulnerability noise and prioritize remediation efforts for your entire Linux ecosystem by focusing on the vulnerabilities that are actively executable across your Linux container environments.

For more information, see In Use.

Changes to List Matching Policies and Rules

Creation of new List Matching Policies and Rules is no longer supported. Existing policies and rules continue to function and can still be modified.

For new detections, use Falco rules, which provide expanded detection capabilities and flexibility.

For more information, see List Matching Policy.

Zones: Additional Filtering Operators

Two new filtering operators are available for Zones:

  • is not
  • does not contain

These operators enable more precise exclusion filtering for events and findings.

Sysdig Monitor

Recurring Alert Silencing Rules

Alert silencing rules now support recurring schedules, allowing you to automatically mute alerts during defined maintenance windows (for example, daily or weekly). Silences can be applied to the entire infrastructure within the selected team scope.

For more information, see Configure Recurring Silence Rule.