Changelog and Release Notes

Last published : Oct 14, 2026
Related information
uberAgent® Event Generator for Splunk

Version 8\.0

Release Notes

  • Increased \.NET version to version 10\.

Improvements

  • The eventgen now displays events for Linux-based machines\.

New sourcetypes

  • Sourcetype: new sourcetype uberAgent:ApplicationBrowserPerformance\.

Version 7\.5\.0

New sourcetypes

  • Sourcetype: new sourcetype uberAgentESA:System:MacOsSystemLogForwarding\.
  • Sourcetype: new sourcetype uberAgent:Session:SessionProfile\.

Version 7\.4\.0

Updated Sourcetypes

  • Sourcetype (Windows): uberAgent:Logon:LogonDetail has new field(s): AppXFileAssocStart, AppXFileAssocEnd, AppXLoadPackagesStart, AppXLoadPackagesEnd and AppXPackages\.

Version 7\.3\.0

Improvements

  • Fixed a memory leak within the event generator\.

New Sourcetypes

  • Sourcetype: new sourcetype uberAgentESA:CitrixEB:Event with fields: CEBEventName, CEBProdVer, CEBPublicIpv4, CEBTenant, CEBEventPayload, ProcUser, ProcID, ProcParentID, ProcGUID, and ProcParentGUID\.
  • Sourcetype: new sourcetype uberAgentESA:System:WinEvtLogForwarding with fields: ProviderName, EventID, Level, ProcessID, Channel, User, and EventData\.

Updated Sourcetypes

  • Sourcetype (Windows): uberAgent:Citrix:Databases has new field(s): DBSizeMB, DBDataSpaceUsageMB, DBIndexSpaceUsageMB and DBSpaceAvailableMB\.
  • Sourcetype (Windows): uberAgent:Citrix:DesktopGroups has new field(s): Enabled and IsInMaintenanceMode\.
  • Sourcetype (Windows): uberAgent:Citrix:Licenses has new field(s): LicenseUserUsage, LicenseDeviceUsage and CustomerId\.
  • Sourcetype (Windows): uberAgent:CitrixADC:Gateway has new field(s): VpnUsers and SslVpnUsers\.
  • Sourcetype (Windows): uberAgent:CitrixADC:vServer has new field(s): HitsRate, RequestsRate, ResponsesRate, CurrentClientConnections, and CurrentServerConnections\.
  • Sourcetype (Windows): uberAgent:CitrixADC:vServer has removed field(s): TotHits2, TotalRequests2, TotalResponses2, RequestMBRate, ResponseMBRate, RequestResponseRateMB\.
  • Sourcetype (Windows): uberAgent:CitrixADC:AppliancePerformance has removed field(s): ApplianceMBReceived and ApplianceMBSent\.

Version 7\.2

Release notes

  • Increased \.NET version to version 8\.

Improvements

  • The sourcetype uberAgent:Process:ProcessStop is now available on macOS too.
  • The sourcetype uberAgentESA:System:SecurityInventory is now available on macOS too.

Version 7\.1

Release notes

  • Increased \.NET version to 7\.
  • Changed configuration file format to JSON\.

Improvements

  • Log messages are written to stdout and a log file located in the %TEMP% (Windows) or /tmp (Linux) directory\.
  • The fields SessionFgBrowserType, SessionFgBrowserType and SessionFgBrowserActiveTabHost of sourcetype uberAgent:Session:SessionDetail are now available on macOS, too\.

New Sourcetypes

  • New sourcetype uberAgentESA:System:SecurityInventory with fields: SecurityInventoryCategory, SecurityInventoryName, SecurityInventoryScore, SecurityInventoryRiskScore, SecurityInventoryResultData, SecurityInventoryErrorCode, SecurityInventoryErrorMessage, SecurityInventoryScope, SecurityInventoryScopeEntity\.

Updated Sourcetypes

  • Sourcetype : uberAgent:Process:ProcessStatistics has new field(s): ProcInputDelayMaxMs, ProcInputDelaySumMs and ProcInputDelayCount\.
  • Sourcetype : uberAgent:Session:SessionDetail has new field(s): SessionInputDelayMaxMs, SessionInputDelaySumMs and SessionInputDelayCount\.
  • Sourcetype : uberAgent:OnOffTransition:BootDetail2 has new field(s): UserLogonWaitDurationMs\.
  • Sourcetype : uberAgentESA:Process:DnsQuery has new field(s): DnsRisk52Chars, DnsRisk27UniqueChars, DnsRiskEmptyResponse, DnsRiskTXTRecord, DnsRiskHighEntropy, DnsResponseStatus\.

Version 7\.0

Release notes

  • macOS client machines are now supported\.

Improvements

  • Machines get their IP addresses once and they do not change\.
  • Machines get their disk volumes only once and they do not change during their lifetime\.
  • A random in-session process needs a long time to start\.
  • Application UI delay events can now only be generated by processes started during a session\.
  • WiFi data is now sent only for WiFi adapters\.
  • BSODs are now sent less frequently\.

New Sourcetypes

  • Sourcetype: new sourcetype uberAgent:CitrixSession:VirtualChannelDetail with fields: SessionGUID, SessionUser, VirtualChannelVendorName, VirtualChannelDataVolumeInputMB, VirtualChannelDataVolumeOutputMB\.
  • Sourcetype: new sourcetype uberAgent:CitrixSession:SessionConfig with fields: SessionGUID, SessionUser, AudioActualPriority, AudioPolicyAllowMicrophoneRedirection, AudioPolicyAllowRedirection, AudioPolicyPriority, AudioPolicySoundQuality, CdmActualPriority, CdmVolumes, CdmPolicyAllowDriveRedirection, CdmPolicyPriority, CdmPolicyReadOnly, DisplayMode, ThinwireActualPriority, ThinwireColorDepth, ThinwireComponentEncoder, ThinwireHardwareEncodeInUse, ThinwireVideoCodecType, ThinwireColorspace, ThinwireVideoCodecUse, ThinwirePolicyFps, ThinwirePolicyPriority, ThinwirePolicyUseHardwareEncoding, ThinwirePolicyUseVideoCodec, ThinwirePolicyVisualQuality, FramehawkActualPriority, FramehawkPolicyPriority, D3DActualPriority, D3DPolicyAeroRedirection, D3DPolicyGraphicsQuality, D3DPolicyPriority, GraphicsActualPriority, GraphicsPolicyDisplayDegradeNotifyUser, GraphicsPolicyDisplayDegradePolicy, GraphicsPolicyPriority, NetworkConnectedVia, NetworkEdtMtu, NetworkPolicyAcceptSessionReliabilityConnections, NetworkPolicyICAListenerPortNumber, NetworkPolicySessionReliabilityPort, NetworkPolicySessionReliabilityTimeout, PrinterActualPriority, PrinterSessionPrinter, PrinterPolicyAllowRedirection, PrinterPolicyAutoCreateClientPrinters, PrinterPolicyPriority, USBActualPriority, USBPolicyAllowPNPRedirection, USBPolicyAllowUSBSupport, USBPolicyPriority\.
  • Sourcetype: new sourcetype uberAgent:Process:ProcessStatistics with fields: ProcHandleCount, ProcThreadCount, ProcPriority, ProcPrivateMB, ProcVirtualSizeMB, ProcPageFaultsPS, ProcPageFileMB, ProcName, ProcID, ProcGUID, ProcUser and AppId\.
  • Sourcetype: new sourcetype uberAgent:System:PerformanceCounter with fields: PerformanceCounterObject, PerformanceCounterInstance, PerformanceCounterName, PerformanceCounterValue\.

Updated Sourcetypes

  • Sourcetype: uberAgent:Application:NetworkConnectFailure has new field(s): NetTargetSourcePort\.
  • Sourcetype: uberAgent:System:MachineInventory has new field(s): HwHypervisorVendor\.
  • Sourcetype: uberAgent:Session:SessionDetail has new field(s): SessionRoundTripTimeMs, SessionFps, SessionTransportProtocols\.
  • Sourcetype: uberAgent:Citrix:Applications has new field(s): CustomerId\.
  • Sourcetype: uberAgent:Citrix:Catalogs has new field(s): CustomerId\.
  • Sourcetype: uberAgent:Citrix:DesktopGroups has new field(s): CustomerId\.
  • Sourcetype: uberAgent:Citrix:Machines has new field(s): CustomerId\.
  • Sourcetype: uberAgent:Citrix:PublishedDesktops has new field(s): CustomerId\.
  • Sourcetype: replaced KV sourcetype uberAgent:PerformanceCounter:<TimerName> with CSV sourcetype uberAgent:System:PerformanceCounter\.
  • Sourcetype: uberAgent:Application:ApplicationUsage has been removed (it was marked as deprecated as of version 6\.1\.1)\.

Version 6\.2\.0

Updated Sourcetypes

  • Sourcetype: uberAgent:Application:NetworkConnectFailure has new field(s): NetTargetSourcePort\.
  • Sourcetype: uberAgent:Process:NetworkTargetPerformance has new field(s): NetTargetSourcePort\.

Version 6\.1\.1\.4416

Improvements

  • Improved number of sent events during session lifetime\.
  • Improved values in Application Performance dashboard\.

Bugfixes

  • Added chmod call to "StartEventgen\.cmd"\.

Version 6\.1\.1

Improvements

  • Added some more hardware models\.
  • Added ModuleName and ExceptionCode to the sourcetype uberAgent:Application:Errors (applications crashes)\.
  • Generated outliers for Process DNS\.

Updated Sourcetypes

  • Sourcetype: uberAgent:Process:ProcessStartup has new field(s): HashMD5, HashSHA1, HashSHA256, HashIMP, SignatureStatus, IsSignedByOSVendor, SignerName\.
  • Sourcetype: uberAgent:Process:ProcessStartup: fields ProcHash and HashType have been removed\.
  • Sourcetype: uberAgent:Process:ProcessStop has new field(s): HashMD5, HashSHA1, HashSHA256, HashIMP\.
  • Sourcetype: uberAgent:Process:ProcessStop: fields ProcHash and HashType have been removed\.
  • Sourcetype: uberAgent:Process:ProcessDetail has new field(s): SessionID\.
  • Sourcetype: uberAgent:CitrixADC:AppliancePerformance has new field(s): CpuFan0Speed, CpuFan1Speed, SystemFanSpeed, Cpu0Temp, Cpu2Temp, InternalTemp, PowerSupply1Status, PowerSupply2Status, PowerSupply3Status, PowerSupply4Status, VoltageV33Main, ICAOnlySessions, ICAOnlyConnections, SmartAccessSessions, SmartAccessICAConnections, SSLSessions\.
  • Sourcetype: uberAgent:CitrixADC:Gateway has new field(s): HSTS, HSTSMaxAge, HSTSInclSubdom, TLS13\.
  • Sourcetype: uberAgent:CitrixADC:vServer has new field(s): HSTS, HSTSMaxAge, HSTSInclSubdom, TLS13\.
  • Sourcetype: uberAgent:System:NetworkConfigInformation has new field(s): NetworkConfigWiFiSignalQuality, NetworkConfigWiFiType, NetworkConfigWiFiAuthentication\.

New Sourcetypes

  • Sourcetype: new sourcetype uberAgentESA:Process:DnsQuery with fields: ProcName, ProcGUID, DnsRequest, DnsResponse, DnsResponseType and DnsEventCount\.

Bugfixes

  • SMB paths had only one backslash\.