https://cybertoolchain.io/tools/splunk-enterprise-security New releases and features in Splunk Enterprise Security, tracked by The Cyber Toolchain. en Mon, 07 Sep 2026 07:33:00 GMT https://docs.splunk.com/Documentation/ES/8.2.0/RN/NewFeatures https://docs.splunk.com/Documentation/ES/8.2.0/RN/NewFeatures Mon, 07 Sep 2026 07:33:00 GMT Splunk ES 8.2 adds AI Assistant for investigations, TAXII 2.x feed support, expanded REST APIs, detection versioning, and a KV Store retention policy. • Adds expanded API capabilities to create findings, add findings to investigations, and create/read/update/delete notes. • Adds support for TAXII version 2.0 and TAXII version 2.1 threat intelligence feeds via 'Add a TAXII 2 feed'. • New Splunk Enterprise Security APIs are now searchable using the SPL `REST` command. • Adds AI Assistant for investigations: summarize findings, generate SPL searches, and produce investigation reports. • Adds AI Assistant model selection — choose between Frontier or Splunk-hosted models to meet compliance requirements. • Adds AI Assistant ability to summarize individual findings in the analyst queue. • Adds detection version activity view to track the history of changes to a detection. • Adds a detection audit trail showing when detections are turned on or off, modified, or deployed, including who made changes and when. • Adds ability to test detections and review search results directly in the detection editor. • Adds SPL query validation for custom finding-based detections in the detection editor. • Adds KV Store retention policy to automatically remove old records from KV Store collections based on a configured time-based or size-based policy. • Adds hybrid pairing support between Enterprise Security (Cloud) and a single Splunk SOAR (On-premises) instance. • Adds ability to configure whether closed finding groups are reopened when additional findings are added. • Adds lookback finding groups to group historical findings based on the first time a detection runs. • Adds overlap finding groups to catch edge cases that might represent risk. • Adds filter buttons — `Findings`, `Investigations`, `Finding groups`, and `All types` — to the analyst queue for quick type-based filtering. • Adds configurable note and note title requirements (optional or required) when analysts update a finding or investigation. • Adds option to hide duplicate findings from the top-level analyst queue when they are already nested under an investigation. • Adds ability to sync changes made in an investigation or finding group to all of its included findings. • Adds ability to view notes on findings or finding groups included in an investigation for full context during investigation review. • Adds manual and auto-refresh controls for the analyst queue, now available in the quick actions menu. • Findings that are part of an investigation are hidden from the top-level analyst queue by default to focus attention on actionable alerts. • Search ID reuse improves load times across the analyst queue and investigations by reusing cached search job results. Breaking changes: • Upgrading to Splunk Enterprise Security 8.x is a one-way operation — you can no longer access any investigations created prior to the upgrade. • Upgrades from versions 6.x and earlier are not supported; you must first upgrade to version 7.3.2 before upgrading to 8.x. • You cannot upload Splunk Enterprise Security 8.x on an on-premises Splunk Enterprise 10.x deployment via the UI — installation must be done from the command line. • The Investigation bar, Investigation Workbench, and Investigation dashboard are removed and replaced by the Mission Control UI. • The `edit_timeline` and `manage_all_investigations` capabilities have been removed. • Workbench and workbench-related views (`ess_investigation_list`, `ess_investigation_overview`, `ess_investigation`) have been removed. • Configuring the investigation type macro is no longer available. • Sequence templates are no longer available. • Enhanced workflows are no longer available. • Incident Review row expansion is no longer available. • The Content management page no longer includes `Workbench Profile`, `Workbench Panel`, or `Workbench Tab` content types. • The ability to require a note when an analyst updates a finding in the analyst queue (previously available in 7.3) is no longer supported in 8.x. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-enterprise-security https://docs.splunk.com/Documentation/ES/8.2.0/RN/NewFeatures#ariaid-title4 https://docs.splunk.com/Documentation/ES/8.2.0/RN/NewFeatures#ariaid-title4 Wed, 17 Sep 2025 00:00:00 GMT Splunk ES 8.2.1 adds AI Assistant finding summaries and Hybrid pairing with Splunk SOAR. • Adds ability to summarize individual findings in the analyst queue using the AI Assistant • Adds choice between Frontier or Splunk-hosted models for the AI Assistant based on compliance requirements • Enables hybrid pairing of Enterprise Security (Cloud) with a single Splunk SOAR (On-premises) instance Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-enterprise-security https://docs.splunk.com/Documentation/ES/8.2.0/RN/NewFeatures#ariaid-title5 https://docs.splunk.com/Documentation/ES/8.2.0/RN/NewFeatures#ariaid-title5 Tue, 09 Sep 2025 00:00:00 GMT Splunk ES 8.2 introduces AI Assistant, TAXII 2 feed support, detection versioning/auditing, and expanded APIs • Adds `AI Assistant for investigations` to summarize findings, generate SPL searches, and create investigation reports. • Adds ability to view `version activity for detections` and a `detection audit trail` that logs who made changes and when. • Adds ability to `test detections in the detection editor` to evaluate performance and review search results without deploying. • Adds `Validation of SPL` conditions for custom finding-based detections directly within the detection editor. • Adds support for `TAXII version 2.0` and `TAXII version 2.1` threat intelligence feeds. • Expands `API capabilities` to include creating findings, adding findings to investigations, and CRUD operations on notes. • Adds ability to configure whether `finding groups reopen` when additional intermediate findings are added. • Adds `lookback finding groups` to group historical findings based on the first detection run time. • Adds `overlap finding groups` to prevent overlooking edge cases that might represent risk. • Allows filtering the analyst queue by type using buttons for `Findings`, `Investigations`, `Finding groups`, or `All types`. • Makes notes and note titles either required or optional when analysts update a finding or investigation. • Adds option to hide duplicate findings in the analyst queue so they only appear nested under an investigation (`ESSI-I-426`). • Allows syncing changes made in an investigation or finding group to all included findings (`ESSI-I-425`, `ESSI-I-457`. • Adds `KV Store retention policy` to automatically remove old records from KV Store collections based on time or size. • Makes new Splunk Enterprise Security APIs searchable using the `SPL REST command`. Breaking changes: • SAML user tokens support is no longer required for native SOAR functionality. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-enterprise-security