Coralogix U.S. GovOps is now FedRAMP(R) Certified at Class C (Moderate). Certification enables U.S. federal agencies and government partners to deploy Coralogix U.S. GovOps for telemetry data workloads under OMB M-26-14, bringing real-time visibility across complex IT environments. September 09, 2026 09:00 ET | Source: Coralogix Inc. BOSTON, Sept. 09, 2026 (GLOBE NEWSWIRE) - Coralogix, the data and AI platform for observability, today announced that Coralogix U.S. GovOps is FedRAMP(R) Certified at Class C (Moderate), enabling federal agencies and government partners to deploy the offering for workloads requiring FedRAMP-authorized cloud services. Federal Student Aid, an office of the U.S. Department of Education, is already running workloads on Coralogix U.S. GovOps under an Authorization to Operate. The certification opens Coralogix U.S. GovOps to a broader set of federal civilian agencies as they modernize their technology infrastructure while maintaining the security and compliance standards required for federal data. M-26-14 Resets Federal Logging Priorities In May, the Office of Management and Budget issued Memorandum M-26-14, which rescinded M-21-31 effective immediately, and reset the federal approach to cybersecurity logging. In OMB's words, "the retention of vast quantities of logging data without clear utility,"had proved "neither operationally feasible nor cost-effective for most agencies." The new framework shifts toward a more risk-based model focused on whether agencies can actually use their data for continuous monitoring, threat hunting, and incident response. The replacement framework organizes agency logging around two objectives: * Continuous event monitoring (CEM), enabling agencies to monitor network activity in real time, promptly flag anomalous activity and respond in a timely manner. * Threat hunting, investigation, response and forensics (THIRF), enabling investigation and forensic analysis after a known or suspected compromise to support mitigation, remediation and recovery. To support both, M-26-14 requires retained logs to remain actively searchable for six months and retrievable for a year, across every system they own or that runs on their behalf. CISA's new Logging Reference Architecture provides agencies with implementation guidance, with Agency Logging Plans due to OMB and CISA by November 18, 2026. This is a harder requirement than it sounds. Agencies now must hold six months of data in a state where it can be queried on demand, across more systems than before, including the operational technology and IoT the memo brings into scope. On platforms that index data before it can be queried, searchable data is indexed data, and the index is the most expensive line on the invoice. The question is how to do that without compromising coverage or fidelity in the effort to control cost. The answer is architectural. "Agencies are not being asked to log less. They are being asked to stop paying for data they cannot use," said Ariel Assaraf, CEO and co-founder of Coralogix. "That is a fair thing to ask. The challenge for agencies is that they cannot answer it with a policy change alone, because the constraint sits in the architecture. We built this platform on the premise that you should not have to index data in order to search it, or move it in order to investigate it. Agencies working through M-26-14 are solving a version of the problem we have been building against for years. Certification for U.S. GovOps means we can do that work alongside them." What matters for agencies planning against M-26-14 Coralogix U.S. GovOps brings Coralogix's in-stream architecture into a dedicated FedRAMP-certified boundary. Rather than indexing data before it can be analyzed, Coralogix processes telemetry as it arrives and queries it directly from object storage in open format. Three consequences follow: * Detection happens in real time. Parsing, enrichment, correlation and alerting run on the data while it is still moving, so continuous event monitoring does not wait for an index to be written and committed. * There is no rehydration step. Cold data is queried with the same syntax as recent data, with no thaw step and no archive to retrieve from. This can keep historical data directly available for investigation without the additional preparation steps M-26-14 associates with 'retrievable' data. * Coverage is not rationed by the index. Schema-free ingestion reduces the need to predefine every telemetry format, helping agencies onboard diverse IT, OT and IoT data sources as they expand logging coverage. And because the searchable window is a function of storage rather than index size, extending it changes what an agency pays for cloud storage rather than what it pays for a license. The result is that prioritization stays a risk decision instead of becoming a budget decision. Coralogix U.S. GovOps brings that next-generation architecture to federal agencies, designed to help address the searchability, coverage and cost challenges M-26-14 puts into focus. Scope and Ongoing Obligations Coralogix U.S. GovOps provides access to Coralogix technology within a dedicated FedRAMP-certified boundary. The certification applies specifically to the U.S. GovOps offering and does not extend automatically to Coralogix's commercial platform. It also represents a continuing operational commitment: Coralogix U.S. GovOps is subject to continuous monitoring, monthly evidence requirements and annual independent assessment to maintain its certified status. About Coralogix Coralogix is a leading provider of observability solutions that help engineering teams monitor, understand, and act on their system data in real time. Through Olly, its built-in AI investigator, along with MCP and CLI interfaces for agent-based workflows, Coralogix supports three modes of operation on a single data foundation: human-led investigation, conversational AI collaboration, and fully automated agent workflows. Built on a streaming engine and a schema-free data lake with customer-owned storage in open formats, Coralogix captures all production data, not a sampled subset, and makes it available to human engineers and AI agents alike. The company is trusted by thousands of teams worldwide across financial services, media and entertainment, retail, and cloud-native enterprises. Media Contact FedRAMP(R) is a registered trademark of the U.S. General Services Administration. Use of the FedRAMP name does not imply endorsement of Coralogix or its products or services by the U.S. Government.

Best eBPF observability tools in 2026: zero-code instrumentation compared. DevToolLab Team September 8, 2026 Every cluster has services nobody can instrument. A vendored Go binary with no build pipeline you control, a Python service whose owning team left, a Java app where adding an agent means a change window three weeks out. The SDK story assumes you can recompile and redeploy every one of them, and in a real fleet you cannot. That gap is why eBPF instrumentation stopped being a curiosity. In 2026 the category's reference implementation changed hands: Grafana Labs donated Beyla, its eBPF auto-instrumentation agent, to the OpenTelemetry project, where it now lives as OpenTelemetry eBPF Instrumentation. The donation was announced at GrafanaCON 2025, and the first alpha came out of a collaboration between Grafana Labs, Splunk, Coralogix and Odigos. Version 0.13.0 shipped on September 4, 2026 under Apache 2.0. If you evaluated this space a year ago against a tool called Beyla, your notes are out of date. What does eBPF Instrumentation actually give you? It gives you spans and RED metrics, rate, errors and duration, for traffic your services send and receive, without touching the code. The agent attaches probes in the kernel and reads the protocol on the wire, so it works on a binary you cannot rebuild. The OpenTelemetry eBPF Instrumentation documentation, checked September 8, 2026, states that data capture "occurs without any modifications to application code or configuration" and lists language support for Java (JDK 8+), .NET, Go, Python, Ruby, Node.js, C, C++ and Rust. Protocol coverage on both client and server side includes HTTP/S, HTTP/2, gRPC, Kafka, NATS, MQTT, Memcached, SunRPC including NFS, and JSON-RPC, with AMQP 1.0 and DNS queries client-side only. It also reports capturing transactions over TLS and SSL without decrypting them. What it does not give you is meaning. eBPF sees a POST to /v2/checkout that took 240 milliseconds and returned 500. It does not see that the failure was a declined card rather than a database timeout, because that distinction lives in your business logic and never crosses a socket. Grafana Labs makes this argument itself in a post titled "Why OpenTelemetry instrumentation needs both eBPF and SDKs." Treat eBPF as the floor of coverage across everything, and SDK spans as the depth you add where the domain matters. If you want the SDK half, its OpenTelemetry Node.js setup guide covers it. The tools at a glance. | Tool | What it collects | License and version, September 8, 2026 | Published price | | OpenTelemetry eBPF Instrumentation | Spans, RED metrics, network relationships | Apache 2.0, v0.13.0 | Free, self-hosted | | Coroot | Metrics, logs, traces, profiles, service map | Apache 2.0, 1.26.0 | Community free; Standard $1 per core/mo | | Odigos | Distributed traces, OTLP to any backend | Apache 2.0, v1.36.0 | Free, self-hosted; commercial trial | | Pixie | Full-body requests, metrics, profiles, in-cluster | Apache 2.0, CNCF Sandbox | Free, self-hosted | | groundcover | Full-stack observability, bring your own cloud | Proprietary | $30 per node/mo (Pro) | OpenTelemetry eBPF Instrumentation. OpenTelemetry eBPF Instrumentation, or OBI, is the one to start with if you already run an OpenTelemetry Collector, because it is a producer rather than a platform. It emits OTLP and stops there, so it slots in front of whatever backend you already pay for. Two caveats matter. It is still pre-1.0 at v0.13.0, and the release notes read like it: v0.12.2 on August 22, 2026 was an expedited patch for a log-enricher defect that could deadlock instrumented shell workloads. Its own documentation carries a Limitations page, which is worth reading before you commit. Grafana Beyla has not disappeared either; it continues as Grafana Labs' distribution of upstream OBI, with Beyla 2.5 the first release to vendor most of the upstream code. Pick OBI if you want the vendor-neutral upstream, Beyla if you want Grafana's packaging of it. Coroot. Coroot is the most complete of the open-source options, and the only one here that collects all four signals from eBPF. Its homepage states that it uses eBPF to capture metrics, logs, traces and profiles with zero code changes, then identifies the root cause when something breaks. Release 1.26.0 landed on September 7, 2026 under Apache 2.0, and the repository has roughly 7,900 stars. The differentiator is the service map. Because the agent sees every socket, the map includes dependencies you never declared: the external endpoint a library calls, the Redis instance a legacy service still talks to. Coroot claims coverage with no blind spots, which is a fair description of what socket-level capture gets you. Pricing is unusual for this category and worth noting because it is metered on compute rather than hosts: the Standard plan is $1 per monitored CPU core per month, with Premium quoted by sales, and the Community edition is free and self-hosted.

Coralogix has added Macquarie Capital Venture Capital as an investor in an extension of its Series F funding round. The Boston-based observability platform provider will use the investment to accelerate expansion across Australia and New Zealand. The investment reflects growing demand for AI-native observability across enterprise sectors including financial services, banking, energy and infrastructure. Macquarie Capital Venture Capital's regional presence is expected to help Coralogix deepen partnerships with enterprises modernising their technology stacks. Coralogix's platform enables organisations to retain, analyse and operationalise production data at scale whilst providing infrastructure for AI-driven investigation and automation. The company built its architecture for full-fidelity data ingestion, real-time streaming analytics and customer-owned storage. CEO Ariel Assaraf said Macquarie Capital Venture Capital brings deep relationships across Australia and New Zealand in industries where observability has become mission critical.