Kibana Updates & Release Notes

<important> The 9.5.5 release contains fixes for potential security vulnerabilities. Check our [security advisory](https://discuss.elastic.co/t/kibana-9-4-8-9-5-5-security-update-esa-2026-193/390866) for more details. </important>

Fixes

Elastic Agent Builder:

• Fix Agent Builder tools hanging or timing out on data streams that span the frozen tier. Tools now skip frozen tier indices #292349.
• Fix Agent Builder tracing applying the default space's GenAI privacy settings in every space. Each conversation now uses the privacy settings of its own space #290750.
• Add the case template ID and version fields to the Agent Builder cases-analytics skill so agents can filter and group cases by template #291716.

Alerting and cases:

• Fix forced rule runs and schedule changes being silently dropped when you request them while the rule is finishing a run #293492.
• Fix Agent Builder rules failing after about an hour because they kept the agent's temporary API key #291318.
• Fix bulk alert tag updates also changing matching alerts in other Kibana spaces #285874. …

Fixes

Elastic Agent Builder:

• Fix MCP tools dropping extra arguments that the schema allows through additionalProperties before execution #287815.

Alerting and cases:

• Relabel the top-level Alerting privilege as Alerting V2 in the Roles UI and mark it experimental #288163.
• Fix the Tracking containment rule editor breaking when you select a data view #289778.
• Fix Sync alerts and Extract observables not applying when you change a case template from the sidebar #288636.
• Fix Alerting V2 rules from not saving when you remove all rule tags #288962.

Dashboards and Visualizations:

• Fix the Update filter button being unreachable when the filter editor is taller than the screen #289163.
• Fix sibling dashboard panels not dimming during inline editing on dashboards that have no controls #288939.
• Fix ES|QL visualizations dropping field variable controls (??field) after you save them through the Visualizations API #288785. …

Features and enhancements

Alerting and cases:

• Warn in the field library and template editors when a required case field has no default value, because automated case creation can't fill it in, and show a field's name and type as permanent as soon as you create it #285453.
• Enforce required global fields on API and workflow case creation when case templates are enabled, and accept extended_fields on the public and workflow case create and update APIs #283350.

Developer tools:

• Raise the Dev Tools Console Copy to curl limit so a request-body string of up to 100000 characters copies successfully #287526.

Fixes

Elastic Agent Builder:

• Fix the research agent re-asking clarifying questions you already answered in the same round #284800.
• Fix disabled pre-execution workflows disappearing from Agent Builder settings so you cannot remove them. A disabled workflow stays visible and is labeled (disabled) #286826.

Alerting and cases:

• Fix legacy custom fields and their v2 field-definition counterparts falling out of sync, by linking each legacy field to its definition and keeping both representations equal on every write #282772. …

Features and enhancements

Alerting and cases:

• Add a public API to create, update, and delete case templates (POST, PUT, and DELETE /api/cases/templates), including a dry-run mode that validates a template without saving it #280144.
• Improve the Cases view, cases list, and field library by keeping the case details panel in view as you scroll, saving status and other fields immediately when changed, and adding drag-and-drop field reordering to the field library #282197.
• Add an Agent Builder tool to attach saved dashboards, maps, Discover sessions, and Lens visualizations to a case #279680.

Dashboards and Visualizations:

• Restore Defer loading panels below "the fold" (labs:dashboard:deferBelowFold) so off-screen dashboard panels wait to fetch data until they scroll into view. The setting is off by default #284004.

Elastic Observability solution: For the Elastic Observability 9.5.2 release information, refer to Elastic Observability Solution Release Notes. Elastic Security solution: For the Elastic Security 9.5.2 release information, refer to Elastic Security Solution Release Notes. Elasticsearch solution: …

Features and enhancements

Alerting and cases:

• Add limits on case templates and fields (200 templates and 200 fields per owner, and size limits on template and field definitions) to keep large template libraries performant, and clean up the field library editor #281650.
• Store assignee usernames, full names, and email addresses on cases so case analytics dashboards can show assignee details without an extra lookup. Available by default in traditional deployments #281579.

Data management:

• Add an Import from another stream flow in the Data lifecycle tab to reuse another stream's lifecycle configuration #275948.
• Add transition animations to the Streams data lifecycle phase preview so editing or switching lifecycle methods no longer flashes between states #277149.

Elastic Observability solution: For the Elastic Observability 9.5.1 release information, refer to Elastic Observability Solution Release Notes. Elastic Security solution: For the Elastic Security 9.5.1 release information, refer to Elastic Security Solution Release Notes.

Fixes

Elastic Agent Builder: …

Features and enhancements

Elastic Agent Builder:

• Create skills in Agent Builder chat, preview drafts in attachments, and save them from the conversation #265883.
• Enable Agent Builder to pause and ask up to five clarifying multiple-choice questions before acting, then resume after you answer #274672.
• Share private agents with selected people using per-agent access control alongside Public, Shared, and Private visibility #267530.
• Add an embeddable Agent Builder conversation input that opens Agent Builder and sends the message with attachments preserved #272166.
• Enable Agent Builder tracing by default so you can view trace waterfalls for each response, use the built-in traces skill, and monitor activity in the overview dashboard while excluding sensitive prompts and tool parameters by default #276174.
• Add install, open, and delete controls to the Agent Builder Traces option on the GenAI Settings page, and prevent deleted dashboards from being reinstalled when Kibana restarts #276643. …

<important> The 9.4.8 release contains fixes for potential security vulnerabilities. Check our [security advisory](https://discuss.elastic.co/t/kibana-9-4-8-9-5-5-security-update-esa-2026-193/390866) for more details. </important>

Fixes

Elastic Agent Builder:

• Fix Agent Builder tools hanging or timing out on data streams that span the frozen tier. Tools now skip frozen tier indices #292349.

Alerting and cases:

• Fix forced rule runs and schedule changes being silently dropped when you request them while the rule is finishing a run #293492.
• Fix bulk alert tag updates also changing matching alerts in other Kibana spaces #285874.
• Fix Jira Service Management and Opsgenie connector actions failing when the rendered alert message exceeds 130 characters. The connectors now truncate the message instead #291698.

Dashboards and Visualizations:

• Increase the TinyMath expression length limit so longer visualization formulas don't fail #290314.
• Fix Go to URL drilldowns leaving Mustache tokens such as event.values.[0] unreplaced in the drilldown name #290363.

Data ingestion and Fleet: …

Fixes

Alerting and cases:

• Fix alerting resource installation using unbounded concurrency, which could exhaust Kibana heap when many contexts and namespaces install at once #287643.
• Fix the Additional fields editor on the ServiceNow ITSM, ServiceNow SecOps, and Jira connectors rejecting Mustache context variables as invalid JSON #286578.

Dashboards and Visualizations:

• Fix the Update filter button being unreachable when the filter editor is taller than the screen #289163.
• Fix Options list filters stopping after you delete a collapsible dashboard section #287923.
• Fix Canvas functions API creating data tables with more than 50 columns per row #287935.
• Fix the Maps timeslider close button registering clicks only on the top quarter of the control #287441.

Data ingestion and Fleet:

• Fix Fleet blocking a package policy save when every enrolled agent is incompatible with the package version, including agents that report a pre-release version. Fleet shows a warning instead of blocking the save #289596. …

<important> The 9.4.6 release contains fixes for potential security vulnerabilities. For details, go to [security announcements](https://discuss.elastic.co/c/announcements/security-announcements/31). </important>

Features and enhancements

Alerting:

• Add [Elastic Cloud Trial] prefix to email subjects sent through the built-in Elastic Cloud email service on trial deployments #276705.

Workflows:

• Add step-level if skip conditions to all workflow step types except the if step, which continues to use condition #279210.

Fixes

Agent Builder:

• Fix Agent Builder entering an infinite retry loop and hitting a recursion error when the plain-text answering path receives an empty model response #285823.
• Fix Anthropic inference endpoint stream parsing and Agent Builder silent retry loops on empty model responses #281616.
• Fix Agent Builder queries failing with a security exception on Elasticsearch 9.4 when cross-cluster search index patterns are configured without the remote cluster client role #281609. …

Fixes

Elastic Agent Builder:

• Fix auto-created conversations overwriting an existing conversation that shares the same ID #280189.

Alerting and cases:

• Fix attaching AIOps charts (change point, pattern analysis, log rate analysis) to a case failing with an "Attachment type is not registered" error #281157.
• Fix CSV exports covering a different time window than what was shown in Discover for relative time ranges. For scheduled reports, the corrected behavior applies only to reports created or re-saved after upgrading; existing schedules keep their previous time-window behavior until they are recreated #278305.
• Fix the alerts-as-data setup overriding an index's total fields limit that was already set to a higher value #277402.

Dashboards and Visualizations:

• Fix duplicated Lens panels backed by a form-based ad hoc data view failing to load after you rename the data view or add a runtime field, caused by colliding ad hoc data view IDs #281786.
• Fix ad hoc data view resolution for Lens XY annotation layers created through the Visualizations API #281079. …