Release 1.6.0
June 17, 2026
Qualys Container Runtime Sensor (CRS) 1.6.0 delivers six targeted enhancements that improve operational visibility, simplify sensor management, and optimize event processing. This release adds periodic and exit-time event logging, remote log collection via service job, tag-based sensor profile assignment at provisioning time, default enablement of service job support for policy application, and an increase in the global event rate limit to support higher-volume workloads.
Qualys strongly recommends upgrading your Qualys Runtime Sensor to version 1.6.0 along with latest Helm chart (qualys-tc-2.9.0) or Yaml files to avail the latest features and enhancements.
Gain Visibility into Runtime Event Volumes with Periodic Info Logs
CRS now writes a periodic summary to the information (INFO) log every minute using the Service job, capturing the number of network, file, and process events processed during that interval.
Without this log, monitoring event volumes required manual inspection or external tooling. Now, operations and security teams can assess sensor activity, spot unexpected event spikes, directly from the log output.
- The logging interval is fixed at one minute and is not configurable in this release.
Understand Full Sensor Activity with Exit-Time Event Summaries
When the CRS shuts down, it writes a final summary log entry that reports the total number of events across key categories (Network, File, and Process) for the complete sensor session.
The exit-time event summary can be viewed when persistent storage path is available and the sensor shuts down gracefully.
Previously, no session-level summary was available at shutdown. This exit log provides security and platform teams with a consolidated view of sensor activity, which is especially useful for post-incident analysis, auditing, and capacity planning.
Collect CRS Logs Remotely without Node Access using Service Job
CRS 1.6.0 expands service job support to include remote log collection. You can now trigger log collection from a CRS sensor without requiring direct access to the node.
To support this, you need to set the 'enableServiceJob' flag to true during the CRS installation.
Direct node access is often unavailable or impractical in production environments and support scenarios. This capability removes that barrier, enabling log retrieval through a standardized workflow. Once the service job runs, the CRS sensor collects its logs and transmits them to the message server, where you can download them.
Assign the Right Sensor Profile at Provisioning Time with Tag-Based Profile Support
CRS 1.6.0 introduces tag-based profile assignment, allowing you to specify tags in the Helm chart at install time. The Qualys Enterprise TruRisk™ Platform evaluates those tags, identifies the associated profile, and assigns it to the sensor in the provisioning response.
This change eliminates the need to manually reassign profiles after provisioning. If a sensor needs a specific profile from day one, you can now define that intent during its deployment.
Provide tags under the runtime_sensor_type entry in the Helm chart > runtime sensor > values.yaml. Two tag types are supported:
- Special tags: Use the prefix
runtime_sensor_profile_.Only one special tag is supported during an installation. - Generic tags: No prefix required. Multiple generic tags can be provided alongside the special tag.
The maximum number of tags is 10. If more than 10 tags are submitted, the CRS sends no tags during provisioning. An error is logged, and provisioning continues without tag-based profile assignment.
After provisioning, check the assigned profile displayed on the Sensors page in the Qualys Enterprise TruRisk™ Platform. If the profile does not match expectations, review the provisioning logs for details.
Apply Policies Remotely at Scale with Service Job Support Enabled by Default
Prior to CRS 1.6.0, service job binding for policy application was disabled by default and required manual configuration to activate. Starting with this release, service job support is enabled by default. The CRS polls for available service jobs every five (5) minutes and applies any pending policies it finds.
This enhancement removes a configuration step that previously blocked teams from leveraging service-job-based policy distribution. New deployments can now receive and apply policies remotely without any additional setup or flags.
Increase in Global Rate Limit
The global rate limits for all events (Process, File, and Network) have been significantly increased. The default limit has been raised from 10 to 200 events per minute per event type, while the maximum configurable limit has been expanded from 30 to 500. The minimum allowed value remains 10. You can now handle a significantly larger volume of events without throttling, leading to improved performance, reduced delays, and a smoother experience during high-demand scenarios. This enhancement enables sensors in high-volume workloads to process more runtime events efficiently, without being constrained by the previous limit of 30 events per minute per event type.
- Rate limits set below 10 will automatically be adjusted to 10 (minimum value), while values above 500 will be adjusted to 500.
- Keep processAllowList.enabled=true to avoid excessive process event generation. Disabling it can significantly increase in the volume of events. Configure only required processes using the allow-list.
You can configure this setting using this Helm (qualys-tc) parameter: runtimeSensor.eventGlobalRateLimit
| Parameter | Old Values | New Values |
|---|---|---|
| runtimeSensor.eventGlobalRateLimit |
|
|