Splunk Enterprise Security

No entries match these filters. Clear filters

1. updated seen Sep 7, 2026 · issue 067

   Splunk ES 8.2 adds AI Assistant for investigations, TAXII 2.xTAXII 2.xAn HTTPS-based protocol for exchanging threat intelligence, maintained by OASIS, that gives cyber tools a standard REST API for pushing and pulling STIX objects between organizations. feed support, expanded REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services., detection versioning, and a KV StoreKV StoreA key-value store is a database that maps arbitrary keys to values with no fixed schema, offering fast lookups that cyber tools use for caching, state sharing, or configuration at scale. retention policy.

   • Adds expanded API capabilities to create findings, add findings to investigations, and create/read/update/delete notes.
   • Adds support for TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. version 2.0 and TAXII version 2.1 threat intelligence feeds via Add a TAXII 2 feed.
   • New Splunk Enterprise Security APIs are now searchable using the SPL REST command.
   • Adds AI Assistant for investigations: summarize findings, generate SPL searches, and produce investigation reports.
   • Adds AI Assistant model selection — choose between Frontier or Splunk-hosted models to meet compliance requirements.

   +18 more show less

   • Adds AI Assistant ability to summarize individual findings in the analyst queue.
   • Adds detection version activity view to track the history of changes to a detection.
   • Adds a detection audit trail showing when detections are turned on or off, modified, or deployed, including who made changes and when.
   • Adds ability to test detections and review search results directly in the detection editor.
   • Adds SPL query validation for custom finding-based detections in the detection editor.
   • Adds KV Store retention policy to automatically remove old records from KV Store collections based on a configured time-based or size-based policy.
   • Adds hybrid pairing support between Enterprise Security (Cloud) and a single Splunk SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. (On-premises) instance.
   • Adds ability to configure whether closed finding groups are reopened when additional findings are added.
   • Adds lookback finding groups to group historical findings based on the first time a detection runs.
   • Adds overlap finding groups to catch edge cases that might represent risk.
   • Adds filter buttons — Findings, Investigations, Finding groups, and All types — to the analyst queue for quick type-based filtering.
   • Adds configurable note and note title requirements (optional or required) when analysts update a finding or investigation.
   • Adds option to hide duplicate findings from the top-level analyst queue when they are already nested under an investigation.
   • Adds ability to sync changes made in an investigation or finding group to all of its included findings.
   • Adds ability to view notes on findings or finding groups included in an investigation for full context during investigation review.
   • Adds manual and auto-refresh controls for the analyst queue, now available in the quick actions menu.
   • Findings that are part of an investigation are hidden from the top-level analyst queue by default to focus attention on actionable alerts.
   • Search ID reuse improves load times across the analyst queue and investigations by reusing cached search job results.
   • Adds expanded API capabilities to create findings, add findings to investigations, and create/read/update/delete notes.
   • Adds support for TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. version 2.0 and TAXII version 2.1 threat intelligence feeds via Add a TAXII 2 feed.
   • New Splunk Enterprise Security APIs are now searchable using the SPL REST command.
   • Adds AI Assistant for investigations: summarize findings, generate SPL searches, and produce investigation reports.
   • Adds AI Assistant model selection — choose between Frontier or Splunk-hosted models to meet compliance requirements.

   +14 more show less

   • Adds detection version activity view to track the history of changes to a detection.
   • Adds a detection audit trail showing when detections are turned on or off, modified, or deployed, including who made changes and when.
   • Adds ability to test detections and review search results directly in the detection editor.
   • Adds SPL query validation for custom finding-based detections in the detection editor.
   • Adds KV Store retention policy to automatically remove old records from KV Store collections based on a configured time-based or size-based policy.
   • Adds hybrid pairing support between Enterprise Security (Cloud) and a single Splunk SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. (On-premises) instance.
   • Adds ability to configure whether closed finding groups are reopened when additional findings are added.
   • Adds lookback finding groups to group historical findings based on the first time a detection runs.
   • Adds overlap finding groups to catch edge cases that might represent risk.
   • Adds filter buttons — Findings, Investigations, Finding groups, and All types — to the analyst queue for quick type-based filtering.
   • Adds configurable note and note title requirements (optional or required) when analysts update a finding or investigation.
   • Adds option to hide duplicate findings from the top-level analyst queue when they are already nested under an investigation.
   • Adds ability to sync changes made in an investigation or finding group to all of its included findings.
   • Adds ability to view notes on findings or finding groups included in an investigation for full context during investigation review.

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Upgrading to Splunk Enterprise Security 8.x is a one-way operation — you can no longer access any investigations created prior to the upgrade.
   • !Upgrades from versions 6.x and earlier are not supported; you must first upgrade to version 7.3.2 before upgrading to 8.x.
   • !You cannot upload Splunk Enterprise Security 8.x on an on-premises Splunk Enterprise 10.x deployment via the UI — installation must be done from the command line.
   • !The Investigation bar, Investigation Workbench, and Investigation dashboard are removed and replaced by the Mission Control UI.
   • !The edit_timeline and manage_all_investigations capabilities have been removed.
   • !Workbench and workbench-related views (ess_investigation_list, ess_investigation_overview, ess_investigation) have been removed.
   • !Configuring the investigation type macro is no longer available.
   • !Sequence templates are no longer available.
   • !Enhanced workflows are no longer available.
   • !Incident Review row expansion is no longer available.
   • !The Content management page no longer includes Workbench Profile, Workbench Panel, or Workbench Tab content types.
   • !The ability to require a note when an analyst updates a finding in the analyst queue (previously available in 7.3) is no longer supported in 8.x.
2. 8.2.1 Sep 17, 2025 · release notes

   Splunk ES 8.2.1 adds AI Assistant finding summaries and Hybrid pairing with Splunk SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions..

   └──▷ HOW TO FIND IT
   Summarize a specific finding in the analyst queue to speed up triage.
   📍Select a finding in the analyst queue and click Summarize with AI › Select model (Frontier or Splunk-hosted)
   Pair your cloud ES deployment with an on-premises SOAR instance.
   📍Navigate to Setup › Integration Settings › Pair with Splunk SOAR and configure the hybrid connection.
   • Adds ability to summarize individual findings in the analyst queue using the AI Assistant
   • Adds choice between Frontier or Splunk-hosted models for the AI Assistant based on compliance requirements
   • Enables hybrid pairing of Enterprise Security (Cloud) with a single Splunk SOAR (On-premises) instance

   3 details in Everything

3. 8.2.0 Sep 9, 2025 · release notes

   Splunk ES 8.2 introduces AI Assistant, TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. 2 feed support, detection versioning/auditing, and expanded APIs

   • Adds AI Assistant for investigations to summarize findings, generate SPL searches, and create investigation reports.
   • Adds ability to view version activity for detections and a detection audit trail that logs who made changes and when.
   • Adds ability to test detections in the detection editor to evaluate performance and review search results without deploying.
   • Adds Validation of SPL conditions for custom finding-based detections directly within the detection editor.
   • Adds support for TAXII version 2.0 and TAXII version 2.1 threat intelligence feeds.

   +10 more show less

   • Expands API capabilities to include creating findings, adding findings to investigations, and CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. operations on notes.
   • Adds ability to configure whether finding groups reopen when additional intermediate findings are added.
   • Adds lookback finding groups to group historical findings based on the first detection run time.
   • Adds overlap finding groups to prevent overlooking edge cases that might represent risk.
   • Allows filtering the analyst queue by type using buttons for Findings, Investigations, Finding groups, or All types.
   • Makes notes and note titles either required or optional when analysts update a finding or investigation.
   • Adds option to hide duplicate findings in the analyst queue so they only appear nested under an investigation (ESSI-I-426).
   • Allows syncing changes made in an investigation or finding group to all included findings (ESSI-I-425, ESSI-I-457.
   • Adds KV Store retention policy to automatically remove old records from KV StoreKV StoreA key-value store is a database that maps arbitrary keys to values with no fixed schema, offering fast lookups that cyber tools use for caching, state sharing, or configuration at scale. collections based on time or size.
   • Makes new Splunk Enterprise Security APIs searchable using the SPL REST command.

   15 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. user tokens support is no longer required for native SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. functionality.