SIEM Plugin
Real-time security monitoring and compliance reporting
SIEM Plugin
Event Forwarding
- Multiple Destinations - Configure and manage several SIEM endpoints at once, each with its own protocol, address, and format
- Flexible Protocols - HTTP/HTTPS REST API, Syslog (UDP or TCP with optional TLS), or local log file
- Flexible Formats - CEF, JSON, or LEEF, so events arrive in the shape your SIEM expects
Platform Presets
- Ready-made presets - Elastic Stack, Splunk (HEC), IBM QRadar, and Wazuh fill in the recommended protocol and format automatically
- Other / Custom - Connect any platform that accepts HTTP/HTTPS, Syslog, or a log file (e.g. ArcSight)
- 5-step wizard - Guided Add Destination flow, no SIEM expertise required
Control & Monitoring
- Master switch - Enable or disable all SIEM forwarding at once
- Per-destination toggle - Disable individual destinations without deleting their configuration
- Delivery health - Monitor forwarding from the Statistics tab
- Backup & Restore - Export and import the SIEM configuration as a file
AI Assistant Plugin
AI-powered assistant for BridgeLink
AI Assistant Plugin
Editor Actions
- Explain Code - Select any code and get a plain-language explanation of what it does
- Generate Code - Describe what you want in natural language and get working code inserted into the editor
- Fix/Improve Code - Review a diff of the suggested rewrite, refine it, then accept or reject
- AI Assistant Chat - Ask context-aware questions about the channel, code template, or script you have open
Message Tools
- Generate Sample Messages - Synthetic test messages for Message Templates, using fictional data only
- Explain Message Errors - Plain-language diagnosis of a failed message from the message browser
- Channel Descriptions - Generate or improve a channel's description from its own configuration
Privacy & Control
- One org-wide API key - Your Anthropic API key is entered once and shared by all users
- Model picker - Choose from Anthropic's current Claude model catalog, refreshed live
- Privacy by default - Message templates are excluded from AI prompts unless you opt in
- Tuned for BridgeLink - Aware of the Rhino (ES5) JavaScript runtime and healthcare message formats
Advanced Access Control Plugin
Manage secure, role-based permissions
Channel History Plugin
Audit and view historical channel activity
Cognito Plugin
Enable AWS Cognito single sign-on
OIDC Plugin
OpenID Connect integration for secure authentication
SSL Plugin
Configure SSL settings and certificates
SSL Plugin
New Features
- Validation Mode Selector - Choose PKIX Chain, Pinned Leaf, or Trust All per connector
- Certificate Revocation Checking - OCSP, CRL, or OCSP with CRL fallback (opt-in)
- Expiration Notifications - Daily background check, 30-day advance warning (configurable)
- Subject/SAN Policy Filter - Regex rules to restrict inbound client certs on listeners
Security Updates
- Password required on export - Private keys now require keystore password before exporting
- Lockout protection - 3 failed attempts triggers a 60-second lockout
- Audit logging - All certificate export attempts are written to the audit log
Improvements
- TLS 1.1 disabled by default - New channels default to TLS 1.2 & 1.3; legacy still available with warning
- Expanded key formats - Auto-detects PKCS#8, PKCS#12 (.p12/.pfx), and DER on import
- JKS export - Java KeyStore format now surfaced in the Export Format dropdown
🚀 New Features
Certificate Chain Validation Modes
A formal Validation Mode selector gives you explicit control over how inbound certificates are evaluated. Three modes are available:
PKIX Chain Validation (default)
Standard X.509 chain validation. The full certificate chain is verified against your configured truststores. This remains the default for all existing and new connectors.
Pinned Leaf Certificate
For zero-trust and high-security environments. Select one or more specific leaf certificates - only those exact certificates are trusted at runtime, regardless of what the chain says.
Trust All
Disables all certificate validation. Intended for development and testing only. Not recommended for production use.
Certificate Revocation Checking
Connectors can now optionally check whether a certificate has been revoked before accepting it. Four modes:
- Disabled (default) - No revocation checking. Existing connectors are unaffected.
- OCSP Only - Checks the OCSP responder specified in the certificate.
- CRL Only - Downloads and checks the Certificate Revocation List.
- OCSP with CRL Fallback - Attempts OCSP first; falls back to CRL if unavailable.
Certificate Expiration Notifications
A new background service runs daily and alerts you when certificates are approaching expiration - 30 days in advance by default. The advance warning window is configurable. All server, client, and truststore certificates are checked automatically.
Subject/SAN Policy Filter (Listeners only)
An opt-in security layer for SSL Listener connectors. Define regex rules evaluated against the connecting client's Subject DN and SANs. Connections from non-matching certificates are rejected, adding an enforcement point beyond chain trust.
🛡️ Security Updates
Certificate Export Now Requires Password Authentication
The Certificate Manager now requires you to enter the keystore password before exporting any certificate that contains a private key. Previously, private keys could be exported without any authentication.
- Password dialog on export: A prompt appears when you click Export on any certificate entry.
- Lockout protection: 3 consecutive failed attempts triggers a 60-second lockout.
- Audit logging: All export attempts - successful or failed - are written to the audit log.
✨ Improvements
- TLS 1.1 disabled by default: New channels default to TLS 1.2 and TLS 1.3 only. TLS 1.1 can still be manually enabled for legacy compatibility but is marked with a ⚠️ warning in the UI. Existing channels are unaffected.
- Expanded private key format support: Auto-detects and imports PKCS#8, PKCS#12 (.p12, .pfx), and DER-encoded formats. Clearer error messages indicate which formats were attempted if auto-detection fails.
- JKS export format: Certificate export to JKS (Java KeyStore) is now clearly surfaced in the Export Format dropdown.
⚙️ Configuration Notes
No changes to mirth.properties or other configuration files are required.
This is a non-breaking release. All existing channel configurations and SSL settings are fully preserved on upgrade. New features are strictly opt-in.