Why releases, what changed?

We have decided to bring much needed visibility to the development of Zentral. The recommendation so far has been to always deploy the main branch (= stable branch) and to read the CHANGELOG.md file to find out about the new features and the breaking changes. That has led us to the current state of things where our customers see that they are running v2022.2-944-ged013fc5 which is 944 😅commits after release v2022.2…
We are changing this today. We will release more often, and summarize the changes in the release notes published on GitHub (we will keep the more detailed list of changes in the CHANGELOG.md file). We will keep the same format YYYY.MM. In case a bug is found and a fix has to be released quickly, we will use patch releases YYY.MM.P. For example, 2025.8.1 would be a patch release for 2025.8. The recommendation for running Zentral stays about the same: always use the latest tagged version (latest patch release or if no patch release is available, latest minor release).

Summary of the changes since … v2022.2

There is a good reason to tag releases more often: It will be easier to write about the new features, fixes and breaking changes. Obviously, a lot has happened since v2022.2. About 950 commits! Here is our attempt at summarizing the main changes. For future releases, we will be able to go into more detail. Remember that the reference is the CHANGELOG.md file.

MDM

The MDM has seen a lot of development since 2022. DDM is fully supported. Some functionalities like rolling software updates can be automatically managed by Zentral. You can also send custom payloads, which make it easy to test the new Apple MDM features.

Santa

2024 saw the release of our voting system that enables end-users to request exceptions when running in allowlist mode. We have also improved the admin console workflows. Administrators can use usage aggregates to easily build their allowlists.
We will continue our efforts (10 years in November) to support all the Santa features that can be supported by third party sync servers. Last month, we released the support for the new and really powerful CEL rules for example.

Munki

Munki is a very important part of our vision for a MacOS client. Zentral can leverage it to run script based compliance checks. You can now import a mSCP benchmark via Terraform and see the metrics in Prometheus!
We have also improved the distribution of packages and client resources with the support of multiple Munki repositories that can be configured via API.

Core

Zentral is an event driven solution. We are consolidating all the events generated when a piece of configuration is changed with the Audit Events.
The probes and their associated actions can be configured via API too. That enables our SaaS customers to filter their events and trigger webhooks or slack notifications.
The events stores can be also configured via API. SaaS customers can now also ship their Santa events to their Splunk instances.
IdP integration plays an important role for device management. We have updated our integrations to support SCIM for real-time synchronization of group memberships.

GitOps

All of the above is configurable via our official Terraform provider. The first release was in July 2022. We have since added a lot of resources and the APIs to support them. Most of the day-to-day tasks are covered. You can use it to distribute MDM configuration profiles, Munki apps, update Santa rules, Osquery packs. You can also rotate your Splunk token, start a new event shipper, … all from your config-as-code repository and CI/CD system.

Breaking Changes

Please refer to the CHANGELOG.md file for a detailed list of the breaking changes. If you have a custom deployment of Zentral, please make sure to migrate to Redis or Valkey for the cache. Memcached is not supported anymore. The other breaking changes are the migration of the probes, actions and stores from the base.json configuration file into the Database, with APIs for their management. You need to plan carefully for this upgrade. Please contact us on the macadmins slack channel, and we will help you migrate without loss of functionality.

🎤 Announcement

This is the first release of Zentral under the new licensing scheme. After nearly 7 years, we have decided to concentrate our business on Zentral as a product. Most of the code stays under the Apache license but some modules, like the SAML authentication or the Splunk event store are licensed under a new source available license and require a subscription when used in production.

Do not hesitate to contact us if you need more information!

🥁 Some highlights

• GitHub workflow to build and push three flavours of the docker container to the docker hub.
• sumo logic event store module.
• Extra API endpoints for the new verified terraform provider.
• Automated MDM payload renewals.
• Flexible SCEP configuration for the MDM payloads.
• Separated OpenSearch and Elasticsearch store modules for higher compatibility.
• Upgrade to python3.10 bullseye docker base images.

See the CHANGELOG for more details and breaking changes.

🥁 Long overdue new release

It is time to cut a release, after so many new features have been implemented. Here are some of the highlights:

• Osquery and inventory based compliance checks, with Prometheus metrics
• Munki / Monolith metrics and sharding for package installs
• Santa team ID rules
• Event routing keys for the event stores
• Secrets engines to encrypt secrets in PostgreSQL

See the CHANGELOG for a more complete list.

🎤 Announcement

This is probably the last fully opensource release of Zentral (if no patch release is necessary). After nearly 7 years, we have decided to concentrate our business on Zentral as a product. To support this new orientation, we are going to change the license scheme in the coming weeks. Most of the code is going to stay under the Apache license, but some modules, like the SAML authentication, or the Splunk event store are going to be licensed under a new source available license, and will require a subscription when used in production. Do not hesitate to contact us if you need more information!

🚀 Santa module overhaul

The Santa module has been completely overhauled.

Breaking changes

Rules are not managed in the Probes anymore. They are managed under each Configuration in the Santa Setup.

If you upgrade from a previous Zentral release, please, make a backup! The existing rules in the Santa probes will be automatically migrated to each existing Zentral Santa Configuration. You need to carefully review them afterwards.

You can read more about it in the updated documentation.

🚀 Santa module overhaul

The Santa module has been completely overhauled.

Breaking changes

Rules are not managed in the Probes anymore. They are managed under each Configuration in the Santa Setup.

If you upgrade from a previous Zentral release, please, make a backup! The existing rules in the Santa probes will be automatically migrated to each existing Zentral Santa Configuration. You need to carefully review them afterwards.

You can read more about it in the updated documentation – Sorry, still a work in progress.

Main new features:

• Implementation of the Bundle info/events part of the Santa sync
• ALLOWLIST_COMPILER rules
• API endpoint to apply sets of rules to one or many Santa configurations
• API endpoint to ingest the santactl fileinfo JSON output to populate the sha256 and apps in Zentral

Main things

• Realms for SSO (LDAP / OpenID Connect / SAML)
• MDM / DEP authentication using the realms, and auto user setup

Smaller thing

• Santa EnableBadSignatureProtection

Fixes

• Santa enrollment packages

Small things

• Link from incident to Kibana linked events
• Better enrollment package download buttons

Fixes

• Timestamp in Azure Log Analytics
• probe payload filters
• osquery release choices

New features

• inventory exporters
• Okta webhook events
• Azure Log Analytics as event store
• osquery powershell enrollment script
• jamf client log shipping

Fixes

• jamf server log ingestion
• santa log event parsing
• filebeat enrollment on linux

New feature

• new xnumon event type for the agent stats

Fixes

• jamf and santa app dependencies on the filebeat app.
• separate FQDN for the client cert authentication

New features

• unified filebeat enrollment (with micromdm scepserver and scepclient), configuration, and event processing for the santa logs, the xnumon logs and the jamf server logs.
• API to export the inventory reports as XLSX and zipped CSV files
• Better jamf webhooks events:
  • computer policy finished events are enriched via an extra API call
  • fixed issues with the v10.12 changes
• celery worker for the background tasks:
  • inventory exports
  • osquery file carving archive building
  • MDM device push notifications
• refactoring of all the event pre-processors in one zentral worker.

Breaking changes

• The zentral.contrib.jamf and zentral.contrib.santa apps depend on the zentral.contrib.filebeat app. You may need to include it in the base.json.
• Some tasks which use to happen in dedicated workers have been migrated to celery tasks. You need to run a celery worker (see the docker-compose.yml file for example).
• You need to restart the workers and the gunicorn processes after the update. A reload is not enough.
• The zentral.contrib.audit app has been removed.