CINXE.COM

<!DOCTYPE html><html><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width"/><meta name="next-head-count" content="2"/><link rel="apple-touch-icon-precomposed" sizes="57x57" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/apple-touch-icon-57x57.png"/><link rel="apple-touch-icon-precomposed" sizes="114x114" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/apple-touch-icon-114x114.png"/><link rel="apple-touch-icon-precomposed" sizes="72x72" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/apple-touch-icon-72x72.png"/><link rel="apple-touch-icon-precomposed" sizes="144x144" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/apple-touch-icon-144x144.png"/><link rel="apple-touch-icon-precomposed" sizes="60x60" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/apple-touch-icon-60x60.png"/><link rel="apple-touch-icon-precomposed" sizes="120x120" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/apple-touch-icon-120x120.png"/><link rel="apple-touch-icon-precomposed" sizes="76x76" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/apple-touch-icon-76x76.png"/><link rel="apple-touch-icon-precomposed" sizes="152x152" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/apple-touch-icon-152x152.png"/><link rel="icon" type="image/png" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/favicon-196x196.png" sizes="196x196"/><link rel="icon" type="image/png" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/favicon-96x96.png" sizes="96x96"/><link rel="icon" type="image/png" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/favicon-32x32.png" sizes="32x32"/><link rel="icon" type="image/png" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/favicon-16x16.png" sizes="16x16"/><link rel="icon" type="image/png" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/favicon-128.png" sizes="128x128"/><link rel="shortcut icon" type="image/x-icon" href="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/favicon.ico"/><meta name="msapplication-TileImage" content="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/mstile-144x144.png"/><meta name="msapplication-square70x70logo" content="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/mstile-70x70.png"/><meta name="msapplication-square150x150logo" content="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/mstile-150x150.png"/><meta name="msapplication-wide310x150logo" content="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/mstile-310x150.png"/><meta name="msapplication-square310x310logo" content="https://www.splunk.com/content/dam/splunk2/images/icons/favicons/mstile-310x310.png"/><link rel="preload" href="https://cdn.splunkbase.splunk.com/_next/static/css/4b6138b56fa00d7b.css" as="style"/><link rel="stylesheet" href="https://cdn.splunkbase.splunk.com/_next/static/css/4b6138b56fa00d7b.css" data-n-g=""/><noscript data-n-css=""></noscript><script defer="" nomodule="" src="https://cdn.splunkbase.splunk.com/_next/static/chunks/polyfills-78c92fac7aa8fdd8.js"></script><script src="https://cdn.splunkbase.splunk.com/_next/static/chunks/webpack-453a2894b470dc57.js" defer=""></script><script src="https://cdn.splunkbase.splunk.com/_next/static/chunks/framework-9620da855a94eb57.js" defer=""></script><script src="https://cdn.splunkbase.splunk.com/_next/static/chunks/main-9313876f5b9c0070.js" defer=""></script><script src="https://cdn.splunkbase.splunk.com/_next/static/chunks/pages/_app-050222cf5c782d21.js" defer=""></script><script src="https://cdn.splunkbase.splunk.com/_next/static/chunks/1-790feced844c1496.js" defer=""></script><script src="https://cdn.splunkbase.splunk.com/_next/static/chunks/2-0ab63ddcb683ce34.js" defer=""></script><script src="https://cdn.splunkbase.splunk.com/_next/static/chunks/33-92994135e57e504b.js" defer=""></script><script src="https://cdn.splunkbase.splunk.com/_next/static/chunks/947-7b0789bdd0f98ca6.js" defer=""></script><script src="https://cdn.splunkbase.splunk.com/_next/static/chunks/pages/index-0cfc864d9880c7d1.js" defer=""></script><script src="https://cdn.splunkbase.splunk.com/_next/static/a7zd-eGVjfMkUYBr9q15-/_buildManifest.js" defer=""></script><script src="https://cdn.splunkbase.splunk.com/_next/static/a7zd-eGVjfMkUYBr9q15-/_ssgManifest.js" defer=""></script><style data-styled="" data-styled-version="5.3.10"></style></head><body style="margin:0;background-color:#08090A"><noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-TPV7TP" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript><div id="__next"></div><script id="__NEXT_DATA__" type="application/json">{"props":{"pageProps":{"allCollections":[{"id":8,"name":"cisco","display_name":"Getting Started with Cisco Apps","tagline":"See the power of Cisco + Splunk with these improved apps for Security and Observability","description":null,"icon_url":"https://cdn.splunkbase.splunk.com/media/public/collections/img-splunkbase-collection-cisco.png","position":1,"app_count":24,"subcollections":[{"id":22,"name":"cisco_observability","display_name":"Observability","tagline":"Unlock more insights across any environment and any stack","apps":[7719,6668,6656,5781,5580,4991,3471,2731,1917,1915,1761,1747,1620,1467],"position":2},{"id":21,"name":"cisco_security","display_name":"Security","tagline":"Accelerate comprehensive visibility with best-in-class integrations","apps":[7219,6398,5887,5580,4388,3670,3504,1761,1747,1620],"position":1}]},{"id":7,"name":"machine_learning","display_name":"Getting Started with AI","tagline":"These Machine Learning and AI powered apps and assistants give you the power of Machine Learning for common use cases with just a couple of clicks.","description":null,"icon_url":"https://cdn.splunkbase.splunk.com/media/public/collections/img_machine_learning_dark.png","position":2,"app_count":9,"subcollections":[{"id":20,"name":"Advanced_Experimentation","display_name":"Advanced Experimentation","tagline":"Dive deeper into Data Science, build your own algorithms, and leverage Deep Learning.","apps":[4607],"position":3},{"id":19,"name":"Foundational_Capabilities","display_name":"Foundational Capabilities","tagline":"Essential apps to get you started on your ML journey. Some are prerequisites for our intelligent experiences.","apps":[2890,2884,2883,2882,2881],"position":2},{"id":18,"name":"Intelligent_Experiences","display_name":"Intelligent Experiences","tagline":"These ML-powered apps and assistants give you the power of ML for common use cases with just a couple of clicks.","apps":[7245,6843,6415],"position":1}]},{"id":2,"name":"pipeline","display_name":"Pipeline Analytics for DevOps","tagline":"Create visibility across your software development lifecycle","description":null,"icon_url":"https://cdn.splunkbase.splunk.com/media/public/collections/pipeline.png","position":3,"app_count":13,"subcollections":[{"id":5,"name":"auditing_compliance","display_name":"Auditing and Compliance for DevSecOps","tagline":"Shift left security with confidence","apps":[6139,5330,5093,5023,4356],"position":3},{"id":4,"name":"dora_metrics","display_name":"Measure Success with DORA Metrics","tagline":"Quantify business outcomes from your delivery chain.","apps":[6254,5596,5589,4886],"position":2},{"id":3,"name":"monitor","display_name":"Monitor","tagline":"Support the uptime and performance of your delivery chain.","apps":[6352,5141,5135,3332],"position":1}]},{"id":3,"name":"detection_response","display_name":"Detection and Response","tagline":"Collect data across multiple security layers and manage threats quickly. Provide comprehensive protection for your organization.","description":null,"icon_url":"https://cdn.splunkbase.splunk.com/media/public/collections/detection_response.png","position":4,"app_count":31,"subcollections":[{"id":8,"name":"email_security","display_name":"Email Security","tagline":"See and contain email threats at patient zero before the next user is compromised.","apps":[6049,5819,4075,3080],"position":3},{"id":6,"name":"endpoint","display_name":"Endpoint","tagline":"Pull in endpoint detections to jump start your detection and response workflows.","apps":[6084,6056,5947,5433,5177,5094,4137,3921],"position":1},{"id":10,"name":"identity","display_name":"Identity","tagline":"Link attacks to users and proactively block attacks from potentially compromised accounts.","apps":[5921,5771,5763,3682,1151,976],"position":5},{"id":7,"name":"network","display_name":"Network","tagline":"Track lateral movement or monitor agentless endpoints, like internet of things or operational technology devices.","apps":[6073,6015,5830,4471,3938,3827,3539,491],"position":2},{"id":9,"name":"workload_monitoring","display_name":"Server/Cloud Workload Monitoring","tagline":"Keep an eye on containers and serverless functions in your cloud infrastructure.","apps":[5813,5761,4882,3088,1274],"position":4}]},{"id":4,"name":"accenture","display_name":"Accenture Cloud Services","tagline":"Get to value faster with Cloud First.","description":null,"icon_url":"https://cdn.splunkbase.splunk.com/media/public/collections/accenture.png","position":5,"app_count":3,"subcollections":[{"id":11,"name":"cloud_first","display_name":"Cloud First, value first","tagline":"Speed, cost, and innovation–Accenture Cloud First makes cloud’s promise real.\\n We harness the power of change to create new and extraordinary 360 degree value by putting cloud at the core of your business. Our approach puts your business needs first, creating industry-specific solutions to get you moved to—and benefiting from—the cloud now.\\n Move to the cloud with us and you’ll find new and better ways to harness the power of cloud computing. From migration to cloud management, we work with you to help your business realize its full promise and achieve measurable, extraordinary 360 degree value.","apps":[],"position":1},{"id":13,"name":"learn_more_accenture","display_name":"Learn More","tagline":"To learn more visit us at: www.accenture.com/us-en/cloud/services-index","apps":[],"position":3},{"id":12,"name":"splunk_built_accenture","display_name":"Splunk built apps","tagline":"Splunk supported apps delivered through Accenture Cloud Services","apps":[3546,3449,1841],"position":2}]},{"id":5,"name":"security","display_name":"Getting Started with Security","tagline":"These are the best apps to help you get started with security.","description":null,"icon_url":"https://cdn.splunkbase.splunk.com/media/public/collections/security.png","position":6,"app_count":15,"subcollections":[{"id":14,"name":"detect","display_name":"Detect","tagline":"Use these apps and add-ons to detect threats in your environment","apps":[4305,3749,3435,263],"position":1},{"id":15,"name":"enrich","display_name":"Enrich","tagline":"Supplement your data with threat intelligence","apps":[5542,4283],"position":2},{"id":16,"name":"respond","display_name":"Respond","tagline":"Use these Splunk SOAR apps to help respond to threats","apps":[5947,5921,5905,5848,5847,5824,5806,5798,5786],"position":3}]}],"trendingSplunkApps":[{"id":263,"by":"Splunk LLC","description":"Splunk Enterprise Security (ES) solves a wide range of security analytics and operations use cases including continuous security monitoring, advanced threat detection, compliance, incident investigation, forensics and incident response. Splunk ES delivers an end-to-end view of organizations’ security postures with flexible investigations, unmatched performance, and the most flexible deployment options offered in the cloud, on-premises or hybrid deployment models. Splunk ES enables you to: \n\n- Conquer alert fatigue with high-fidelity Risk-Based Alerting.\n- Bring visibility across your hybrid environment with multicloud security monitoring.\n- Conduct flexible investigations for effective threat hunting across security, IT and DevOps data sources.\n\nSplunk ES is a premium security solution requiring a paid license.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/4f4c67a2-251c-11ef-aa96-ae4e248a2471.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":220,"average":4},"support":"premium","title":"Splunk Enterprise Security","app_type":"app"},{"id":742,"by":"Splunk LLC","description":"*** Important: Read upgrade instructions and test add-on update before deploying to production ***\nThe Splunk Add-on for Windows 5.0.0 introduced breaking changes. If you are upgrading from a version of the Splunk Add-on for Windows that is earlier than 5.0.0, you must follow the documented upgrade instructions to avoid data loss. A best practice is to test the upgraded version in a non-production environment before deploying to production.\n\nNeither the Splunk Add-on for Windows DNS version 1.0.1 nor the Splunk Add-on for Windows Active Directory version 1.0.0 is supported when installed alongside the Splunk Add-on for Windows version 6.0.0. The Splunk Add-on for Windows version 6.0.0 includes the Splunk Add-on for Windows DNS and the Splunk Add-on for Microsoft Active Directory.\n\nThe Splunk for Microsoft Windows add-on includes predefined inputs to collect data from Windows systems and maps to normalize the data to the Common Information Model.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/e8543eb6-a172-11ef-8a33-36a81105bd3e.png","is_archived":false,"product_types":["enterprise","cloud","itsi"],"rating":{"count":46,"average":4},"support":"splunk","title":"Splunk Add-on for Microsoft Windows","app_type":"addon"},{"id":3110,"by":"Splunk LLC","description":"The Splunk Add-on for Microsoft Cloud Services allows a Splunk software administrator to pull activity logs, service status, operational messages, Azure audit, Azure resource data and Azure Storage Table and Blob data from a variety of Microsoft cloud services using Event Hubs, Azure Service Management APIs and Azure Storage API.\n\nThis add-on provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance and Splunk IT Service Intelligence.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/895ddda8-ee03-11ef-be6a-82a750ea227f.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":35,"average":3},"support":"splunk","title":"Splunk Add-on for Microsoft Cloud Services","app_type":"addon"},{"id":7186,"by":"Splunk Works","description":"Ever questioned if you're getting the most out of Splunk? Wonder no more. The Insights Suite for Splunk is your key to continuous analysis and trending of usage analytics, adoption metrics, performance issues, and capability analysis. Our goal is to guide you in understanding if your Splunk usage aligns perfectly with your investment goals, ensuring you're making the most of every investment dollar.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/d09d4b7c-ee3a-11ef-b6a0-dade8d230595.png","is_archived":false,"product_types":["enterprise"],"rating":{"count":1,"average":5},"support":"not_supported","title":"Insights Suite for Splunk (IS4S)","app_type":"app"},{"id":833,"by":"Splunk LLC","description":"*** Important: Read upgrade Instructions and test add-on update before deploying to production ***\nThere are changes to default indexes and .conf changes in version 6.0 of Splunk Add-on for Unix and Linux that can break an existing installation if upgrade instructions are not followed in detail. If an existing Splunk Add-on for Unix and Linux is being upgraded, please test in a non-production environment first.\n\n\nThe Splunk Add-on for Unix and Linux works with the Splunk App for Unix and Linux to provide rapid insights and operational visibility into large-scale Unix and Linux environments. With its new pre-packaged alerting capability, flexible service-based hosts grouping, and easy management of many data sources, it arms administrators with a powerful ability to quickly identify performance and capacity bottlenecks and outliers in Unix and Linux environments.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/93972c06-e23d-11ef-9e75-fe84a3f4a099.png","is_archived":false,"product_types":["enterprise","cloud","itsi"],"rating":{"count":55,"average":3},"support":"splunk","title":"Splunk Add-on for Unix and Linux","app_type":"addon"},{"id":1876,"by":"Splunk LLC","description":"The Splunk Add-on for AWS, from version 7.0.0 and above, includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This allows you to configure the Splunk Add-on for AWS to ingest data across all AWS data sources, facilitating the integration of AWS data into your Splunk platform deployment.\n\nIf you use both the Splunk Add-on for Amazon Security Lake as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Security Lake before upgrading the Splunk Add-on for AWS to version 7.0.0 or later in order to avoid any data duplication and discrepancy issues.\n__________________________________________________________________________________________________________\n\nIngesting data from AWS to Splunk Cloud? Have you tried the new Splunk Data Manager yet? Data Manager makes AWS data ingestion simpler, more automated and centrally managed for you, while co-existing with AWS and/or Kinesis TAs. Read our blog post to learn more about Data Manager and it’s availability on your Splunk Cloud instance: https://splk.it/3e9F863\n__________________________________________________________________________________________________________\n\nThe Splunk Add-on for Amazon Web Services allows a Splunk software administrator to collect:\n* Configuration snapshots, configuration changes, and historical configuration data from the AWS Config service.\n* Metadata for your AWS EC2 instances, reserved instances, and EBS snapshots.\n* Compliance details, compliance summary, and evaluation status of your AWS Config Rules.\n* Assessment Runs and Findings data from the Amazon Inspector service.\n* Management and change events from the AWS CloudTrail service.\n* VPC flow logs and other logs from the CloudWatch Logs service.\n* Performance and billing metrics from the AWS CloudWatch service.\n* Billing reports that you have configured in AWS.\n* S3, CloudFront, and ELB access logs.\n* Generic data from your S3 buckets.\n* Generic data from your Kinesis streams.\n* Generic data from SQS.\n* Security events from Amazon Security Lake\n\nThis add-on provides modular inputs and CIM-compatible knowledge to use with other apps, such as the Splunk App for AWS, Splunk Enterprise Security and Splunk IT Service Intelligence.\n\nVersions 5.0.0 and later of the Splunk Add-on for AWS is compatible only with Splunk Enterprise version 8.0.0 and above.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/3aa6681e-c0f5-11ef-8bfb-b6f777b3d133.png","is_archived":false,"product_types":["enterprise","itsi"],"rating":{"count":30,"average":4},"support":"splunk","title":"Splunk Add-on for Amazon Web Services (AWS)","app_type":"addon"},{"id":3435,"by":"Splunk LLC","description":"Get started with Splunk for Security with Splunk Security Essentials (SSE). Explore security use cases and discover security content to start address threats and challenges. \n\nSecurity Content Library\nFind security content for Splunk Cloud and Splunk's SIEM and SOAR offerings and deploy out-of-the-box security detections and analytic stories to enhance your investigations and improve your security posture. \n\nCybersecurity Frameworks\nIdentify gaps in your defenses and take control of your security posture with automatic mapping of data and security detections to MITRE ATT\u0026CK® and Cyber Kill Chain® framework.\n\nData and Content Introspection\nGain visibility of the data coming into your environment to add context and telemetry to security events. Enrich your security detections with metadata and tags from the Security Content Library.\n\nSecurity Data Journey\nGet prescriptive security and data recommendations and establish a data strategy to develop a security maturity roadmap. \n\nWe have changed the security content delivery endpoint for ESCU to comply with Splunk guidance. This means that if you have SSE version 3.7.1 or lower, the last supported ESCU version is ESCU 4.22.0. In order to get the latest ESCU version, you will need to upgrade SSE to version 3.8.0.\n\nLearn more:\nDownload the Product Brief : https://www.splunk.com/pdfs/product-briefs/splunk-security-essentials.pdf\nTry out Splunk Security Essentials: https://www.splunk.com/en_us/form/splunk-security-essentials-online-demo.html\nCheck out the Documentation site: https://docs.splunk.com/Documentation/SSE","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/d5448e0c-e863-11ee-b82c-3ae09d0cd103.png","is_archived":false,"product_types":["enterprise"],"rating":{"count":56,"average":4},"support":"splunk","title":"Splunk Security Essentials","app_type":"app"},{"id":2686,"by":"Splunk LLC","description":"Splunk DB Connect is a generic SQL database extension for Splunk that enables easy integration of database information with Splunk queries and reports. Splunk DB Connect supports DB2/Linux, Informix, MemSQL, MySQL, AWS Aurora, Microsoft SQL Server, Oracle, PostgreSQL, AWS RedShift, SAP SQL Anywhere, Sybase ASE, Sybase IQ, Teradata, InfluxDB and MongoDB Atlas \u0026 Standalone.\n\nUse Splunk DB Connect's Inputs to import structured data for powerful indexing, analysis, and visualization. Use Outputs to export machine data insights to a legacy database to increase your organization's insight. Use Lookups to add meaningful information to your event data by referencing fields in an external database. Use query commands to build live dashboards mixing structured and unstructured data.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/6cc59d3a-eac9-11ef-aebc-86b1163fcc56.png","is_archived":false,"product_types":["enterprise","cloud","itsi"],"rating":{"count":134,"average":3},"support":"splunk","title":"Splunk DB Connect","app_type":"addon"},{"id":4055,"by":"Splunk LLC","description":"The Splunk Add-on for Microsoft Office 365 allows a Splunk software administrator to pull service status, service messages, and management activity logs from the Office 365 Management API. You can collect:\n\n* Audit logs for Azure Active Directory, Sharepoint Online, and Exchange Online, supported by the Office 365 Management API. \n* Historical and current service status, and service messages for the corresponding Microsoft Office 365 Management API.\n* Data Loss Prevention on Microsoft Office 365 Management API.\n\nAfter the Splunk platform indexes the events, you can then directly analyze the data or use it as a contextual data feed to correlate with other data in the Splunk platform","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/ebc8836e-ccb4-11ef-a904-4acf1ce585f6.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":23,"average":2},"support":"splunk","title":"Splunk Add-on for Microsoft Office 365","app_type":"addon"},{"id":3449,"by":"Splunk LLC","description":"The Splunk ES Content Update (ESCU) app delivers pre-packaged Security Content. ESCU provides regular Security Content updates to help security practitioners address ongoing time-sensitive threats, attack methods, and other security issues.\n\nSecurity Content consists of tactics, techniques, and methodologies that help with detection, investigation, and response. Security Content enables security teams to directly operationalize detection searches, investigative searches, and other supporting details. ESCU can generate Notable/Risk Events in Splunk Enterprise Security. Security Content also contains easy-to-read background information and guidance, for key context on motivations and risks associated with attack techniques, as well as pragmatic advice on how to combat those techniques.\n\nThe analytic stories and their searches are also available at - https://github.com/splunk/security_content.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/c65fdece-dffb-11ef-8c1a-9ee9203a2f7f.png","is_archived":false,"product_types":["enterprise","cloud","es"],"rating":{"count":24,"average":5},"support":"splunk","title":"Splunk ES Content Update","app_type":"addon"},{"id":3757,"by":"Splunk Works","description":"This add-on collects data from Microsoft Azure including the following:\n\nMicrosoft Entra ID (formerly Azure Active Directory) Data\n- Users - Microsoft Entra ID user data\n- Interactive Sign-ins - Microsoft Entra ID sign-ins including conditional access policies and MFA\n- Directory audits - Microsoft Entra ID directory changes including old and new values\n- Devices - Registered devices \n- Groups\n- Risk Detection\n\nMicrosoft Security Graph API\n\nTopology - IaaS relationships\nAzure Security Center\n- Alerts\n- Tasks\nAzure Resource Graph\n\nThis add-on contains the following alert actions:\n\n- Stop Azure VM - stops an Azure Virtual Machine.\n- Add member to group - adds a user to a group. This can be useful if you need to enable additional policies like MFA based on search results.\n- Dismiss Azure Alert - dismisses an Azure Security Center alert.\n\nVersion 3.0.0 and later of the Microsoft Azure Add-on for Splunk is compatible only with Splunk Enterprise version 8.0.0 and above.\n\nWhile this app is not formally supported, the developer can be reached at https://github.com/splunk/splunk-add-on-microsoft-azure/issues. Responses are made on a best-effort basis. Feedback is always welcome and appreciated!","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/7c069fa4-a304-11ef-9e77-7e72ae1d76a7.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":23,"average":3},"support":"not_supported","title":"Splunk Add on for Microsoft Azure","app_type":"addon"},{"id":1621,"by":"Splunk LLC","description":"The Common Information Model is a set of field names and tags which are expected to define the least common denominator of a domain of interest. It is implemented as documentation on the Splunk docs website and JSON data model files in this add-on. Use the CIM add-on when modeling data or building apps to ensure compatibility between apps, or to just take advantage of these data models to pivot and report.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/9f99098e-e59e-11ef-af9c-62ba87d147ef.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":21,"average":5},"support":"splunk","title":"Splunk Common Information Model (CIM)","app_type":"addon"},{"id":7404,"by":"Cisco Security","description":"The Cisco Security Cloud application offers seamless integration for connecting your Cisco devices with Splunk. It features a modular UX input design, built-in health checks, and constant monitoring to ensure operational integrity.\n\nProduct(s) Enabled:\n Cisco Duo\n Cisco Email Threat Defense (ETD)\n Cisco Identity Intelligence (CII)\n Cisco Multicloud Defense\n Cisco Secure Endpoint\n Cisco Secure Firewall (FTD/eStreamer/ASA)\n Cisco Secure Malware Analytics (SMA)\n Cisco Secure Network Analytics (SNA)\n Cisco Vulnerability Intelligence\n Cisco XDR (Incident Import \u0026 Promote to ES Notable)","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/c40967c0-e94d-11ef-91c9-9667be2d4263.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":9,"average":4},"support":"developer","title":"Cisco Security Cloud","app_type":"addon"},{"id":2890,"by":"Splunk LLC","description":"The Splunk Machine Learning Toolkit delivers new SPL commands, custom visualizations, assistants, and examples to explore a variety of ML concepts.\n\nEach assistant includes end-to-end examples with datasets, plus the ability to apply the visualizations and SPL commands to your own data. You can inspect the assistant panels and underlying code to see how it all works.\nMLTK Quick Reference Guide: https://docs.splunk.com/images/3/3f/Splunk-MLTK-QuickRefGuide-2019-web.pdf\n\nAssistants:\n* Predict Numeric Fields (Linear Regression): e.g. predict median house values.\n* Predict Categorical Fields (Logistic Regression): e.g. predict customer churn.\n* Detect Numeric Outliers (distribution statistics): e.g. detect outliers in IT Ops data.\n* Detect Categorical Outliers (probabilistic measures): e.g. detect outliers in diabetes patient records.\n* Forecast Time Series: e.g. forecast data center growth and capacity planning.\n* Cluster Numeric Events: e.g. cluster business anomalies to reduce noise.\n\nSmart Assistants (new assistants with revamped UI and better ml pipeline/experiment management):\n* Smart Forecasting Assistant:: e.g. forecasting app logons with special days.\n* Smart Outlier Detection Assistant: e.g. find anomalies in supermarket purchases.\n* Smart Clustering Assistant: e.g. cluster houses by property descriptions.\n* Smart Prediction Assistant: e.g. predict vulnerabilities in firewall data. \n\nAvailable on both on-premises and cloud.\n(c) Splunk 2024. All rights reserved.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/687cb868-95c8-11ef-93be-2aa36ef6c091.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":38,"average":5},"support":"splunk","title":"Splunk Machine Learning Toolkit","app_type":"app"},{"id":7523,"by":"Splunk LLC","description":"The Splunk Add-on for Palo Alto Networks lets you collect data from Cortex XDR, IoT Security, Firewalls, Panorama, and Strata Logging Service. The new Add-on provides a health check monitoring dashboard and CIM-compatible knowledge objects. \n\nKey Highlights of the release:\n\nModular inputs for IoT Security \u0026 Cortex XDR \nCIM normalisation\nHealth check monitoring dashboard\nSupport for the latest PanOS\n\nImportant information for users of the Palo Alto Networks-owned Add-on and App:\n\nDue to certain differences between the Palo Alto Networks-owned Add-on and the Splunk-supported Add-on, it's important to understand the key changes, such as revised CIM mapping, macro adjustments, and configuration updates for IoT Security and Cortex XDR inputs. Familiarizing yourself with these changes and their impact is crucial to ensuring a smooth migration to the Splunk-supported Add-on and App. More details can be found in the Migration section of the Add-on documentation.\n\nDocumentation for this add-on is posted at [Splunk Docs](https://splunk.github.io/splunk-add-on-for-palo-alto-networks)","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/e52cb0aa-e98a-11ef-9736-e2c5326cfd2f.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":2,"average":5},"support":"splunk","title":"Splunk Add-on for Palo Alto Networks","app_type":"addon"},{"id":1724,"by":"Splunk LLC","description":"Ever want to edit a lookup within Splunk with a user interface? Now you can. This app provides an Excel-like interface for editing, importing, and exporting lookup files (KV store and CSV-based).\n\nThis app also makes your lookups work in Search Head Clustered environments (edits to lookups will be propagated to other search heads).\n\nRevision history is maintained for lookups so that you can view or restore older lookups quickly in the interface.\n\nCheck out the Documentation site: \nhttps://docs.splunk.com/Documentation/LookupEditor\n\nhttps://docs.splunk.com/Documentation/LookupEditor/4.0.4/User/Whatsnew","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/2cf56976-e270-11ef-9d83-ae1b95a41573.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":91,"average":5},"support":"splunk","title":"Splunk App for Lookup File Editing","app_type":"app"}],"newSplunkApps":[{"id":5542,"by":"Splunk LLC","description":"TruSTAR integration for TruSTAR + Enterprise Security Customers. \n\nNote: The TruSTAR product is no longer sold by Splunk. Support for the TruSTAR product and this app is per policy stated here: https://www.splunk.com/en_us/legal/splunk-software-support-policy.html [see section titled, \"Splunk Intelligence Management (TruSTAR Legacy System)\"]\n\nInstallation Docs: \n\nhttps://docs.splunk.com/Documentation/SIM/current/Apps/Splunk#Integrate_Splunk_Intelligence_Management_with_Splunk_Enterprise_Security_deployments_to_improve_detection_and_triage\n\n(video) Using this app to improve detection \u0026 triage: https://lantern.splunk.com/Splunk_Product_Learning_Guides/Splunk_Int_Mgmt/UnifiedApp_UseCase?mt-learningpath=intelmgmtunifiedappconfig#\n\n\n** Notes to SplunkCloud SRE:\n- This app must be installed on Enterprise Security searchheads (NOT IDM), and includes a modinput, which must be allowed to run on the searchhead. This app will not work on an IDM, indexer, or a search head which does not have Enterprise Security. \n- This app's modinput contains checks to ensure that it will only run on the cluster Captain when installed on an ES SHC. \n- The modinput fetches cyber threat observables from TruSTAR's REST API and posts them to the searchheads' kvstores using the kvstore \"batch_save\" endpoint, not an index as most modinputs do. This is why it must run on the searchheads, not an IDM. There is no config option that would allow the user to tell the modinput to post the observables to that endpoint on a different host, it's hard-coded to post to \"localhost\".\n- This app is compatible with ES SHC, but its ES SHC compatibility is implemented in a way which requires replicating \"inputs.conf\" from all Splunk apps on the stack to all nodes in the SHC by setting \"conf_replication_include.inputs = true\" in \"server.conf\". This is standard for all Splunk apps created using Splunk's Addon Builder. If this behavior is problematic for other Splunk apps on the user's SHC, user will need to decide which app they prefer to use: TruSTAR Unified or the app with which that conflicts. See SINT-3685 for more details / information. \n- The app contains modactions that need to be available on all ES SHC nodes, so the app needs to be installed on all SHC nodes. \n\n\nReferences for exceptions to \"no modinputs on SHs policy\": \n- Case #1685202 \"Vet and Install TruSTAR App for Splunk ES.\" (Circa April 7, 2020) (TruSTAR App for Splunk ES was this app's predecessor)\n- Case # 2646540","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/6a55a01e-e4e2-11ef-86f8-d664e0b5f49b.png","is_archived":false,"product_types":["cloud","enterprise"],"rating":{"count":2,"average":5},"support":"splunk","title":"TruSTAR Unified","app_type":"app"},{"id":3110,"by":"Splunk LLC","description":"The Splunk Add-on for Microsoft Cloud Services allows a Splunk software administrator to pull activity logs, service status, operational messages, Azure audit, Azure resource data and Azure Storage Table and Blob data from a variety of Microsoft cloud services using Event Hubs, Azure Service Management APIs and Azure Storage API.\n\nThis add-on provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance and Splunk IT Service Intelligence.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/895ddda8-ee03-11ef-be6a-82a750ea227f.png","is_archived":false,"product_types":["cloud","enterprise"],"rating":{"count":35,"average":3},"support":"splunk","title":"Splunk Add-on for Microsoft Cloud Services","app_type":"addon"},{"id":5867,"by":"Splunk LLC","description":"This app implements investigative actions that query the whois database","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/f54c5182-ee19-11ef-8ed3-b6cec20169dc.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"WHOIS","app_type":"connector"},{"id":5403,"by":"Splunk LLC","description":"IT Essentials Work helps you correlate logs and metrics for each entity, and then use that information to observe and understand the performance of your infrastructure. The app helps you get started monitoring and analyzing IT infrastructures such as *nix, Windows, virtualization with out-of-the-box dashboards, and pre-configured performance metrics.\n\nThis app is not yet available for self-service installation on Splunk Cloud. Please contact Splunk Support and submit a Cloud App Request to install IT Essentials Work on your Splunk Cloud deployment. You can find support info at: https://www.splunk.com/en_us/support-and-services/support-programs.html","icon_url":"https://cdn.splunkbase.splunk.com/static/image/default_icon.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":12,"average":4},"support":"splunk","title":"IT Essentials Work","app_type":"app"},{"id":1841,"by":"Splunk LLC","description":"Splunk IT Service Intelligence (ITSI) is a monitoring and analytics solution powered by artificial intelligence for IT Operations (AIOps). It provides visibility into the health of critical IT and business services and their infrastructure. Use ITSI to solve a variety of IT challenges, including deriving service-level insights and analysis on events, metrics, and logs to find and fix the most important issues first.\n\nUse Splunk ITSI to perform the following tasks:\n- Aggregate data across your organization to reduce the complexity of tools and IT silos and visually map your key services.\n- Organize and correlate events cross-functionally and understand their service context for quicker investigations, root cause analysis, and reduced time to incident resolution.\n- Use machine learning to baseline normal behavior, be alerted of anomalous conditions, and dynamically adapt thresholds in real-time. \n- Improve your service operations, team productivity, and cross-functional collaboration.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/0c0a86e2-bdeb-11e4-9b2e-02ca5bf692fe.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":75,"average":4},"support":"premium","title":"Splunk IT Service Intelligence","app_type":"app"},{"id":5688,"by":"Splunk LLC","description":"The Splunk App for Chargeback aids customers in understand Splunk Virtual Compute (SVC) usage categorized by business units and departments, utilizing the identical SVC usage data available in the Cloud Monitoring Console (CMC) App within the customer's stack.\n\nTo access bonus videos from conf23, click on the \"Details\" tab.\n\nIMPORTANT NOTES:\n1. The document is now integrated into the app, accessible from the home dashboard.\n2. For an optimal experience, consider installing the app independently. Search for \"chargeback\" among available apps, then click \"Install\" next to the Splunk App for Chargeback. Refer to the document on the home page for guidance.\n3. If you're comfortable reviewing a slightly older document, visit this site: https://docs.splunk.com/Documentation/ChargebackApp/current/Use/Overview\n\nDescription\nSplunk App for Chargeback provides an easy-to-use experience to analyze how internal business units are leveraging Splunk. The App provides the framework necessary for Chargeback and/or Showback use cases for:\n1. Splunk Virtual Compute (SVC)\n2. Dynamic Data: Active Searchable (DDAS)\n3. Dynamic Data: Active Archive (DDAA)\n4. Dynamic Data: Self-Storage (DDSS)\n5. SmartStore\n\nThe app provide the following functionally to all Splunk customers:\n- Framework for customers to build their own Chargeback and/or Showback models\n- Means to determine how many SVCs are allocated to various business units, departments, and users in those departments [Accounting].\n- Means to automatically determine how Splunk Cloud stack resources are being used by the various business units [Utilization].\n- Ability to drill-down and break down the usage starting at the highest level in the business all the way down to the user level\n- Ability to forecast SVC usage for the entire organization and by business unit using Splunk Machine Learning\n- Accurately maintained up-to-date list of identities along with corresponding Business Unit \u0026 Department information by way of indexing the data from a source like DB Connect or Active Directory\n\nODS Support\nYou can open an ODS request under task Install/Configure App or TA/Add-On in the support portal (https://www.splunk.com/pdfs/professional-services/splunk-ondemand-services-portal.pdf). Select after choosing Pick your Product = Splunk Core - Enterprise/Splunk Cloud. Enter under the subject/description that you need help configuring the Splunk App for Chargeback specifically. \n\nFeedback is always welcome and appreciated.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/bebcc60e-eb14-11ef-b2ef-9667be2d4263.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":9,"average":4},"support":"splunk","title":"Splunk App for Chargeback","app_type":"app"},{"id":2686,"by":"Splunk LLC","description":"Splunk DB Connect is a generic SQL database extension for Splunk that enables easy integration of database information with Splunk queries and reports. Splunk DB Connect supports DB2/Linux, Informix, MemSQL, MySQL, AWS Aurora, Microsoft SQL Server, Oracle, PostgreSQL, AWS RedShift, SAP SQL Anywhere, Sybase ASE, Sybase IQ, Teradata, InfluxDB and MongoDB Atlas \u0026 Standalone.\n\nUse Splunk DB Connect's Inputs to import structured data for powerful indexing, analysis, and visualization. Use Outputs to export machine data insights to a legacy database to increase your organization's insight. Use Lookups to add meaningful information to your event data by referencing fields in an external database. Use query commands to build live dashboards mixing structured and unstructured data.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/6cc59d3a-eac9-11ef-aebc-86b1163fcc56.png","is_archived":false,"product_types":["enterprise","itsi","cloud"],"rating":{"count":134,"average":3},"support":"splunk","title":"Splunk DB Connect","app_type":"addon"},{"id":7095,"by":"Splunk LLC","description":"The Splunk DBX Add-on for MongoDB JDBC driver offers seamless connectivity to MongoDB databases and is specifically designed as an add-on for Splunk DB Connect.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/548f8322-dee2-11ef-b73c-aab149293110.png","is_archived":false,"product_types":["cloud","enterprise"],"rating":{"count":1,"average":5},"support":"splunk","title":"Splunk DBX Add-on for MongoDB JDBC","app_type":"addon"},{"id":7745,"by":"Splunk LLC","description":"This app interfaces with Cisco Firepower devices to add, update and delete network objects, network object groups, access policies and access rules","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/bdf8a7ce-eb1e-11ef-9b69-c6e7bb0e7285.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"Cisco Secure Firewall","app_type":"connector"},{"id":5579,"by":"Splunk LLC","description":"The Splunk Add-on for CrowdStrike FDR lets you collect event data stored in CrowdStrike and bring it into your own Splunk instance for retention and further analysis.\u2028The Add-on collects different logs and events from different sources monitored by the CrowdStrike platform and provides CIM-compatible knowledge to use with other Splunk apps.\n\nCrowdstrike FDR events must be fetched from an AWS S3 bucket that is provisioned for you. The integration utilizes AWS SQS to support scaling horizontally if required.\n\nVersion 2.0.0 of the Splunk Add-on for Crowdstrike FDR contains the following new and changed features:\n\n-New monitoring dashboard\n-New events for CIM normalization\n-Updated events CIM normalization\n-FedRAMP certification\n-IPv6 compatibility","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/1d65400c-e87f-11ef-bff6-b246d30caf0f.png","is_archived":false,"product_types":["enterprise"],"rating":{"count":4,"average":3},"support":"splunk","title":"Splunk Add-on for CrowdStrike FDR","app_type":"addon"},{"id":2897,"by":"Splunk LLC","description":"The Splunk App for PCI Compliance (for Splunk Enterprise Security) is a Splunk developed and supported App designed to help organizations meet PCI DSS 4.0 requirements. It reviews and measures the effectiveness and status of PCI compliance technical controls in real time. It can also identify and prioritize any control areas that may need to be addressed and let you quickly address any auditor report or data request. \n\nThe App provides out-of-the-box searches, dashboards, reports, an incident response framework, and integration with employee and asset information to give you visibility into system, application, and device activity relevant to PCI compliance. \n\nNOTE: There are two installer options for this App. If you are installing the App on Splunk Enterprise Security use the installer on this page. If you are installing the App stand-alone on Splunk Enterprise, use the installer https://splunkbase.splunk.com/app/1143\n\nThe Splunk App for PCI Compliance requires a paid license. PCI DSS 3.2.1 is supported until version 5.2.0 of the app and later versions are updated to PCI DSS 4.0.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/a98b0c16-e874-11ef-aae4-feda191a76a9.png","is_archived":false,"product_types":["enterprise","es","cloud"],"rating":{"count":5,"average":4},"support":"premium","title":"Splunk App for PCI Compliance - Splunk Enterprise Security","app_type":"app"},{"id":1143,"by":"Splunk LLC","description":"The Splunk App for PCI Compliance (for Splunk Enterprise) is a Splunk developed and supported App designed to help organizations meet PCI DSS 4.0 requirements. It reviews and measures the effectiveness and status of PCI compliance technical controls in real time. It can also identify and prioritize any control areas that may need to be addressed and let you quickly address any auditor report or data request. \n\nThe App provides out-of-the-box searches, dashboards, reports, an incident response framework, and integration with employee and asset information to give you visibility into system, application, and device activity relevant to PCI compliance. \n\nNOTE: There are two installer options for this App. If you are installing the App on Splunk Enterprise 6.4+ use the installer on this page. But if you are installing the App on Splunk Enterprise Security, use the installer at https://splunkbase.splunk.com/app/2897/\n\nThe Splunk App for PCI Compliance requires a paid license. PCI DSS 3.2.1 is supported until version 5.2.0 of the app and later versions are updated to PCI DSS 4.0.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/43bc36ac-251b-11ef-b11f-aa84fc713e5e.png","is_archived":false,"product_types":["enterprise","es","cloud"],"rating":{"count":23,"average":4},"support":"splunk","title":"Splunk App for PCI Compliance - Splunk Enterprise","app_type":"app"},{"id":7711,"by":"Splunk LLC","description":"This app provides investigative actions for Cisco Talos Intelligence. It is only supported on Splunk SOAR Cloud, and it is not supported for FedRAMP customers","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/debdce58-e8da-11ef-a614-5eb71d79a591.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"Cisco Talos Intelligence","app_type":"connector"},{"id":3549,"by":"Splunk LLC","description":"*** Important: Read upgrade instructions and test your add-on update before deploying to production ***\nVersion 2.0.0 of the Splunk Add-on for Salesforce introduces breaking changes. To avoid data loss or data duplication, follow the documented upgrade instructions in detail. If your are upgrading an earlier version of the Splunk Add-on for Salesforce, a best practice is to test your update in a non-production environment before deploying to production.\n\nThe Splunk Add-on for Salesforce allows a Splunk software administrator to collect different types of data from Salesforce using REST APIs. The data includes:\n\n* Event log file data, https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/using_resources_event_log_files.htm.\n* Output of Salesforce object queries (SOQL). \n\nThis add-on provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security, the Splunk App for PCI Compliance, and Splunk IT Service Intelligence.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/4a0d9622-d8d0-11ef-aa8c-9ac4a85b5318.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":9,"average":3},"support":"splunk","title":"Splunk Add-on for Salesforce","app_type":"addon"},{"id":6143,"by":"Splunk LLC","description":"This app supports investigative actions against a Microsoft SQL Server","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/817aaefe-e548-11ef-a5db-8a287d7f8a6c.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"Microsoft SQL Server","app_type":"connector"},{"id":7245,"by":"Splunk LLC","description":"Splunk AI Assistant for SPL offers bi-directional translation between natural language (NL) and Splunk Search Processing Language (SPL).\nBefore you can use Splunk AI Assistant for SPL, you must review and sign the legal terms for the app. This specialized End-User License Agreement (EULA) covers data usage and is only accessible if you have a Splunk.com account. See: https://www.splunk.com/en_us/download/ai-assistant.html\n\nOnce the EULA is signed,, please wait 3-4 business days for email notification that you can install Splunk AI Assistant for SPL.\n\nWhat's in the app . . .\nOn the Write SPL tab, compose what you want to search in plain English, and the Splunk AI Assistant for SPL translates the request into Splunk Search Processing Language (SPL). You can execute or build on that SPL search, all within a familiar Splunk interface. \nOn the Explain SPL tab, Splunk AI Assistant for SPL explains what any SPL search is doing in plain English, along with a detailed breakdown of the search. \nOn the Tell me about tab, Splunk AI Assistant for SPL answers questions about Splunk documentation and any Splunk platform term or product.\n\n(c) Splunk 2025. All rights reserved.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/fe064dc2-df3d-11ef-b0a4-620be65c968d.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":2,"average":5},"support":"splunk","title":"Splunk AI Assistant for SPL (Cloud Version)","app_type":"app"}],"popularSOARApps":[{"id":5814,"by":"Splunk LLC","description":"This app supports investigative actions against a Microsoft Azure SQL Server","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/9e9ff36e-d7e1-11ef-b4a4-36d1dae94739.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":1,"average":0},"support":"splunk","title":"Microsoft Azure SQL","app_type":"connector"},{"id":5834,"by":"Splunk LLC","description":"This App exposes various Phantom APIs as actions","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/06a5ffca-d2de-11ef-8878-22c390c7630b.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"Phantom","app_type":"connector"},{"id":5806,"by":"Splunk LLC","description":"This app integrates with JIRA to perform several ticket management actions","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/cac31930-c18e-11ef-a886-26e0c50c7267.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"Jira","app_type":"connector"},{"id":5865,"by":"Splunk LLC","description":"This app integrates with the VirusTotal cloud to implement investigative and reputation actions using v3 APIs","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/80e3feaa-4b2e-11ef-bff3-06faa8466ec0.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"VirusTotal v3","app_type":"connector"},{"id":5925,"by":"Splunk LLC","description":"This app implements URL investigative capabilities utilizing PhishTank","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/f191587c-74ca-11ee-92b3-6e3c758e154e.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"PhishTank","app_type":"connector"},{"id":5847,"by":"Splunk LLC","description":"This app provides the ability to send email using SMTP","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/f473608e-c14b-11ef-a886-26e0c50c7267.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"SMTP","app_type":"connector"},{"id":5848,"by":"Splunk LLC","description":"This app integrates with Splunk to update data on the device, in addition to investigate and ingestion actions","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/ca64affa-d3a2-11ef-818f-86aa5b9ebddb.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":2,"average":5},"support":"splunk","title":"Splunk","app_type":"connector"},{"id":5788,"by":"Splunk LLC","description":"This app performs email ingestion, investigative and containment actions on an on-premise Exchange installation","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/aca222c0-80de-11ef-a95f-0693e4457c45.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":2,"average":5},"support":"splunk","title":"Microsoft Exchange On-Premise EWS","app_type":"connector"},{"id":5932,"by":"Splunk LLC","description":"This app integrates with ServiceNow to perform investigative and generic actions","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/94838ec0-e27e-11ef-a5d7-bad10aa7074b.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":1,"average":5},"support":"splunk","title":"ServiceNow","app_type":"connector"},{"id":5933,"by":"Splunk LLC","description":"This app integrates with the Screenshot Machine service","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/2147b30a-299c-11ef-94f2-ce857fec5ae2.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"Screenshot Machine","app_type":"connector"},{"id":5846,"by":"Splunk LLC","description":"Integrate with Slack to post messages and attachments to channels","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/59de83cc-e410-11ef-b575-5a532bd751f4.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":2,"average":3},"support":"splunk","title":"Slack","app_type":"connector"},{"id":5875,"by":"Splunk LLC","description":"This app integrates with the Windows Remote Management service to execute various actions","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/6a325ebc-d3e2-11ef-a746-06097d1812c4.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":1,"average":5},"support":"splunk","title":"Windows Remote Management","app_type":"connector"},{"id":5829,"by":"Splunk LLC","description":"This app ingests emails from a mailbox in addition to supporting various investigative and containment actions on an Office 365 service","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/7eb7ec62-a476-11ef-bd39-1ed0134224bb.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"EWS for Office 365","app_type":"connector"},{"id":5872,"by":"Splunk LLC","description":"This app implements containment and investigative actions on Zscaler","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/78e5d570-8d8c-11ef-a090-d628a99ce4ff.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"Zscaler","app_type":"connector"},{"id":5798,"by":"Splunk LLC","description":"This app supports email ingestion and various investigative actions over IMAP","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/5c3ace56-a7a6-11ef-a983-0a9ad16b3e53.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":0,"average":0},"support":"splunk","title":"IMAP","app_type":"connector"},{"id":5755,"by":"Splunk LLC","description":"App specifically designed for interacting with Microsoft Active Directory's LDAP Implementation","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/d3bab370-b682-11ef-bef8-ce6e5d7f77a9.svg","is_archived":false,"product_types":["soar","soar_cloud"],"rating":{"count":1,"average":5},"support":"splunk","title":"AD LDAP","app_type":"connector"}],"popularCloudApps":[{"id":1876,"by":"Splunk LLC","description":"The Splunk Add-on for AWS, from version 7.0.0 and above, includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This allows you to configure the Splunk Add-on for AWS to ingest data across all AWS data sources, facilitating the integration of AWS data into your Splunk platform deployment.\n\nIf you use both the Splunk Add-on for Amazon Security Lake as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Security Lake before upgrading the Splunk Add-on for AWS to version 7.0.0 or later in order to avoid any data duplication and discrepancy issues.\n__________________________________________________________________________________________________________\n\nIngesting data from AWS to Splunk Cloud? Have you tried the new Splunk Data Manager yet? Data Manager makes AWS data ingestion simpler, more automated and centrally managed for you, while co-existing with AWS and/or Kinesis TAs. Read our blog post to learn more about Data Manager and it’s availability on your Splunk Cloud instance: https://splk.it/3e9F863\n__________________________________________________________________________________________________________\n\nThe Splunk Add-on for Amazon Web Services allows a Splunk software administrator to collect:\n* Configuration snapshots, configuration changes, and historical configuration data from the AWS Config service.\n* Metadata for your AWS EC2 instances, reserved instances, and EBS snapshots.\n* Compliance details, compliance summary, and evaluation status of your AWS Config Rules.\n* Assessment Runs and Findings data from the Amazon Inspector service.\n* Management and change events from the AWS CloudTrail service.\n* VPC flow logs and other logs from the CloudWatch Logs service.\n* Performance and billing metrics from the AWS CloudWatch service.\n* Billing reports that you have configured in AWS.\n* S3, CloudFront, and ELB access logs.\n* Generic data from your S3 buckets.\n* Generic data from your Kinesis streams.\n* Generic data from SQS.\n* Security events from Amazon Security Lake\n\nThis add-on provides modular inputs and CIM-compatible knowledge to use with other apps, such as the Splunk App for AWS, Splunk Enterprise Security and Splunk IT Service Intelligence.\n\nVersions 5.0.0 and later of the Splunk Add-on for AWS is compatible only with Splunk Enterprise version 8.0.0 and above.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/3aa6681e-c0f5-11ef-8bfb-b6f777b3d133.png","is_archived":false,"product_types":["enterprise","itsi"],"rating":{"count":30,"average":4},"support":"splunk","title":"Splunk Add-on for Amazon Web Services (AWS)","app_type":"addon"},{"id":742,"by":"Splunk LLC","description":"*** Important: Read upgrade instructions and test add-on update before deploying to production ***\nThe Splunk Add-on for Windows 5.0.0 introduced breaking changes. If you are upgrading from a version of the Splunk Add-on for Windows that is earlier than 5.0.0, you must follow the documented upgrade instructions to avoid data loss. A best practice is to test the upgraded version in a non-production environment before deploying to production.\n\nNeither the Splunk Add-on for Windows DNS version 1.0.1 nor the Splunk Add-on for Windows Active Directory version 1.0.0 is supported when installed alongside the Splunk Add-on for Windows version 6.0.0. The Splunk Add-on for Windows version 6.0.0 includes the Splunk Add-on for Windows DNS and the Splunk Add-on for Microsoft Active Directory.\n\nThe Splunk for Microsoft Windows add-on includes predefined inputs to collect data from Windows systems and maps to normalize the data to the Common Information Model.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/e8543eb6-a172-11ef-8a33-36a81105bd3e.png","is_archived":false,"product_types":["enterprise","itsi","cloud"],"rating":{"count":46,"average":4},"support":"splunk","title":"Splunk Add-on for Microsoft Windows","app_type":"addon"},{"id":3088,"by":"Splunk LLC","description":"The Splunk Add-on for Google Cloud Platform allows a Splunk software administrator to collect google cloud platform events, logs, performance metrics and billing data using Google Cloud Platform API. \nAfter the Splunk platform indexes the events, you can analyze the data using the prebuilt panels included with the add-on. You can then directly analyze the data or use it as a contextual data feed to correlate with other Google Cloud-related data in the Splunk platform.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/4164bcce-dc74-11ef-96c6-a66d3e78b9e5.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":10,"average":4},"support":"splunk","title":"Splunk Add-on for Google Cloud Platform","app_type":"addon"},{"id":3110,"by":"Splunk LLC","description":"The Splunk Add-on for Microsoft Cloud Services allows a Splunk software administrator to pull activity logs, service status, operational messages, Azure audit, Azure resource data and Azure Storage Table and Blob data from a variety of Microsoft cloud services using Event Hubs, Azure Service Management APIs and Azure Storage API.\n\nThis add-on provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance and Splunk IT Service Intelligence.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/895ddda8-ee03-11ef-be6a-82a750ea227f.png","is_archived":false,"product_types":["cloud","enterprise"],"rating":{"count":35,"average":3},"support":"splunk","title":"Splunk Add-on for Microsoft Cloud Services","app_type":"addon"},{"id":833,"by":"Splunk LLC","description":"*** Important: Read upgrade Instructions and test add-on update before deploying to production ***\nThere are changes to default indexes and .conf changes in version 6.0 of Splunk Add-on for Unix and Linux that can break an existing installation if upgrade instructions are not followed in detail. If an existing Splunk Add-on for Unix and Linux is being upgraded, please test in a non-production environment first.\n\n\nThe Splunk Add-on for Unix and Linux works with the Splunk App for Unix and Linux to provide rapid insights and operational visibility into large-scale Unix and Linux environments. With its new pre-packaged alerting capability, flexible service-based hosts grouping, and easy management of many data sources, it arms administrators with a powerful ability to quickly identify performance and capacity bottlenecks and outliers in Unix and Linux environments.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/93972c06-e23d-11ef-9e75-fe84a3f4a099.png","is_archived":false,"product_types":["enterprise","itsi","cloud"],"rating":{"count":55,"average":3},"support":"splunk","title":"Splunk Add-on for Unix and Linux","app_type":"addon"},{"id":2890,"by":"Splunk LLC","description":"The Splunk Machine Learning Toolkit delivers new SPL commands, custom visualizations, assistants, and examples to explore a variety of ML concepts.\n\nEach assistant includes end-to-end examples with datasets, plus the ability to apply the visualizations and SPL commands to your own data. You can inspect the assistant panels and underlying code to see how it all works.\nMLTK Quick Reference Guide: https://docs.splunk.com/images/3/3f/Splunk-MLTK-QuickRefGuide-2019-web.pdf\n\nAssistants:\n* Predict Numeric Fields (Linear Regression): e.g. predict median house values.\n* Predict Categorical Fields (Logistic Regression): e.g. predict customer churn.\n* Detect Numeric Outliers (distribution statistics): e.g. detect outliers in IT Ops data.\n* Detect Categorical Outliers (probabilistic measures): e.g. detect outliers in diabetes patient records.\n* Forecast Time Series: e.g. forecast data center growth and capacity planning.\n* Cluster Numeric Events: e.g. cluster business anomalies to reduce noise.\n\nSmart Assistants (new assistants with revamped UI and better ml pipeline/experiment management):\n* Smart Forecasting Assistant:: e.g. forecasting app logons with special days.\n* Smart Outlier Detection Assistant: e.g. find anomalies in supermarket purchases.\n* Smart Clustering Assistant: e.g. cluster houses by property descriptions.\n* Smart Prediction Assistant: e.g. predict vulnerabilities in firewall data. \n\nAvailable on both on-premises and cloud.\n(c) Splunk 2024. All rights reserved.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/687cb868-95c8-11ef-93be-2aa36ef6c091.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":38,"average":5},"support":"splunk","title":"Splunk Machine Learning Toolkit","app_type":"app"},{"id":1621,"by":"Splunk LLC","description":"The Common Information Model is a set of field names and tags which are expected to define the least common denominator of a domain of interest. It is implemented as documentation on the Splunk docs website and JSON data model files in this add-on. Use the CIM add-on when modeling data or building apps to ensure compatibility between apps, or to just take advantage of these data models to pivot and report.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/9f99098e-e59e-11ef-af9c-62ba87d147ef.png","is_archived":false,"product_types":["cloud","enterprise"],"rating":{"count":21,"average":5},"support":"splunk","title":"Splunk Common Information Model (CIM)","app_type":"addon"},{"id":1924,"by":"Splunk LLC","description":"The Splunk Event Generator (Eventgen) is a utility which allows its users to easily build real-time event generators.\n\nEventgen allows an app developer to get events into Splunk to test their applications. It provides a somewhat ridiculous amount of configurability to allow users to simulate real data.\n\nTo join the development community, please go to https://github.com/splunk/eventgen.\nFor documentation, please go to the Eventgen Documentation(http://splunk.github.io/eventgen/).","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/53e6a222-f960-11eb-97a2-3a6fb3f26e50.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":26,"average":4},"support":"splunk","title":"Eventgen","app_type":"app"},{"id":2686,"by":"Splunk LLC","description":"Splunk DB Connect is a generic SQL database extension for Splunk that enables easy integration of database information with Splunk queries and reports. Splunk DB Connect supports DB2/Linux, Informix, MemSQL, MySQL, AWS Aurora, Microsoft SQL Server, Oracle, PostgreSQL, AWS RedShift, SAP SQL Anywhere, Sybase ASE, Sybase IQ, Teradata, InfluxDB and MongoDB Atlas \u0026 Standalone.\n\nUse Splunk DB Connect's Inputs to import structured data for powerful indexing, analysis, and visualization. Use Outputs to export machine data insights to a legacy database to increase your organization's insight. Use Lookups to add meaningful information to your event data by referencing fields in an external database. Use query commands to build live dashboards mixing structured and unstructured data.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/6cc59d3a-eac9-11ef-aebc-86b1163fcc56.png","is_archived":false,"product_types":["enterprise","itsi","cloud"],"rating":{"count":134,"average":3},"support":"splunk","title":"Splunk DB Connect","app_type":"addon"},{"id":3435,"by":"Splunk LLC","description":"Get started with Splunk for Security with Splunk Security Essentials (SSE). Explore security use cases and discover security content to start address threats and challenges. \n\nSecurity Content Library\nFind security content for Splunk Cloud and Splunk's SIEM and SOAR offerings and deploy out-of-the-box security detections and analytic stories to enhance your investigations and improve your security posture. \n\nCybersecurity Frameworks\nIdentify gaps in your defenses and take control of your security posture with automatic mapping of data and security detections to MITRE ATT\u0026CK® and Cyber Kill Chain® framework.\n\nData and Content Introspection\nGain visibility of the data coming into your environment to add context and telemetry to security events. Enrich your security detections with metadata and tags from the Security Content Library.\n\nSecurity Data Journey\nGet prescriptive security and data recommendations and establish a data strategy to develop a security maturity roadmap. \n\nWe have changed the security content delivery endpoint for ESCU to comply with Splunk guidance. This means that if you have SSE version 3.7.1 or lower, the last supported ESCU version is ESCU 4.22.0. In order to get the latest ESCU version, you will need to upgrade SSE to version 3.8.0.\n\nLearn more:\nDownload the Product Brief : https://www.splunk.com/pdfs/product-briefs/splunk-security-essentials.pdf\nTry out Splunk Security Essentials: https://www.splunk.com/en_us/form/splunk-security-essentials-online-demo.html\nCheck out the Documentation site: https://docs.splunk.com/Documentation/SSE","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/d5448e0c-e863-11ee-b82c-3ae09d0cd103.png","is_archived":false,"product_types":["enterprise"],"rating":{"count":56,"average":4},"support":"splunk","title":"Splunk Security Essentials","app_type":"app"},{"id":1724,"by":"Splunk LLC","description":"Ever want to edit a lookup within Splunk with a user interface? Now you can. This app provides an Excel-like interface for editing, importing, and exporting lookup files (KV store and CSV-based).\n\nThis app also makes your lookups work in Search Head Clustered environments (edits to lookups will be propagated to other search heads).\n\nRevision history is maintained for lookups so that you can view or restore older lookups quickly in the interface.\n\nCheck out the Documentation site: \nhttps://docs.splunk.com/Documentation/LookupEditor\n\nhttps://docs.splunk.com/Documentation/LookupEditor/4.0.4/User/Whatsnew","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/2cf56976-e270-11ef-9d83-ae1b95a41573.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":91,"average":5},"support":"splunk","title":"Splunk App for Lookup File Editing","app_type":"app"},{"id":1151,"by":"Splunk LLC","description":"This app (also known as SA-ldapsearch) provides support functions to the Content Pack for Windows Dashboards and Reports (https://docs.splunk.com/Documentation/CPWindowsDash/latest/CP/About), Content Pack for Microsoft Exchange (https://docs.splunk.com/Documentation/CPExchange/latest/CP/About) that enable you to extract information from an Active Directory database. For instance, you can search Active Directory for records, presenting the records as events, or augment existing events with information from Active Directory based on information within the events.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/c6b2bc1c-b214-11ef-a1e5-6e40c79c81fa.png","is_archived":false,"product_types":["enterprise"],"rating":{"count":44,"average":3},"support":"splunk","title":"Splunk Supporting Add-on for Active Directory","app_type":"addon"},{"id":6553,"by":"Splunk LLC","description":"The Splunk Add-on for Okta Identity Cloud:\n\n- Handles System Log event ingestion using Okta's REST API endpoints and simplifies data correlation.\n- Can periodically ingest Okta Universal Directory (UD) data, including users, groups, and apps. This data is not treated as time-series events.\n- Provides the inputs and CIM-compatible knowledge to use with other Splunk apps.\n\nThe Splunk Add-on for Okta Identity Cloud provides complete data collection parity with the Okta Identity Cloud Add-on for Splunk, and corresponding features except the following two adaptive response actions: 1) Updating user's lifecycle/status, 2) Add or Remove a user from a group. In addition to this, Splunk built TA provides comprehensive CIM coverage, high reliability and multiple features and enhancements. Please see the Reference section of the documentation for more details.\n\nThe Splunk Add-on for Okta Identity Cloud provides support of the below-mentioned sourcetypes:\n\nOktaIM2:log\nOktaIM2:user\nOktaIM2:group\nOktaIM2:app\nOktaIM2:groupUser\nOktaIM2:appUser","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/cefdd83c-b92d-11ef-9c1a-d669776a5801.png","is_archived":false,"product_types":["enterprise"],"rating":{"count":3,"average":3},"support":"splunk","title":"Splunk Add-on for Okta Identity Cloud","app_type":"addon"},{"id":6207,"by":"Splunk LLC","description":"The Splunk Add-on for Microsoft Security collects incidents and alerts from Microsoft 365 Defender OR alerts from Microsoft Defender for Endpoint. \n\nCustomers currently utilizing Microsoft 365 Defender Add-on for Splunk are strongly recommended to migrate to this new Splunk supported add-on after reading the migration section of the documentation. https://docs.splunk.com/Documentation/AddOns/released/MSSecurity/Migrate\n\nCustomers migrating from Microsoft 365 Defender Add-on for Splunk who would like to continue using the dashboards it includes should install Microsoft 365 App for Splunk, as the functionality has been moved there.\nhttps://splunkbase.splunk.com/app/3786/\n\nMicrosoft 365 Defender Incidents\n* Incident (impossible travel, activity from Tor IP, suspicious inbox forwarding, successful logon using potentially stolen credentials, etc.)\n* Assignee\n* Classification\n* Severity\n* Status\n* Alerts associated with the Incident\n\nMicrosoft Defender for Endpoint Alerts\n* Categories (Malware, Initial Access, Execution, etc.)\n* Detection source\n* Evidence\n* Computer name\n* Related user\n* Severity\n* Status","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/b0d19ac4-b24d-11ef-ab68-3e94c07c4a4f.png","is_archived":false,"product_types":["cloud","enterprise"],"rating":{"count":1,"average":5},"support":"splunk","title":"Splunk Add-on for Microsoft Security","app_type":"addon"},{"id":2882,"by":"Splunk LLC","description":"This add-on contains a Python interpreter bundled with the following scientific and machine learning libraries: numpy, scipy, pandas, scikit-learn, and statsmodels. With this add-on, you can import these powerful libraries in your own custom search commands, custom rest endpoints, modular inputs, and so forth.\n\nThis add-on is available for Linux (64-bit), Windows (64-bit) and Mac. Make sure you install the appropriate one for your Splunk deployment.","icon_url":"https://cdn.splunkbase.splunk.com/static/image/default_icon.png","is_archived":false,"product_types":["enterprise","cloud"],"rating":{"count":18,"average":5},"support":"splunk","title":"Python for Scientific Computing (for Linux 64-bit)","app_type":"addon"},{"id":3449,"by":"Splunk LLC","description":"The Splunk ES Content Update (ESCU) app delivers pre-packaged Security Content. ESCU provides regular Security Content updates to help security practitioners address ongoing time-sensitive threats, attack methods, and other security issues.\n\nSecurity Content consists of tactics, techniques, and methodologies that help with detection, investigation, and response. Security Content enables security teams to directly operationalize detection searches, investigative searches, and other supporting details. ESCU can generate Notable/Risk Events in Splunk Enterprise Security. Security Content also contains easy-to-read background information and guidance, for key context on motivations and risks associated with attack techniques, as well as pragmatic advice on how to combat those techniques.\n\nThe analytic stories and their searches are also available at - https://github.com/splunk/security_content.","icon_url":"https://cdn.splunkbase.splunk.com/media/public/icons/c65fdece-dffb-11ef-8c1a-9ee9203a2f7f.png","is_archived":false,"product_types":["enterprise","es","cloud"],"rating":{"count":24,"average":5},"support":"splunk","title":"Splunk ES Content Update","app_type":"addon"}]},"__N_SSG":true},"page":"/","query":{},"buildId":"a7zd-eGVjfMkUYBr9q15-","assetPrefix":"https://cdn.splunkbase.splunk.com","isFallback":false,"isExperimentalCompile":false,"gsp":true,"scriptLoader":[{"src":"https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js","strategy":"afterInteractive"},{"src":"https://cdn.cookielaw.org/scripttemplates/otSDKStub.js","type":"text/javascript","charSet":"UTF-8","data-domain-script":"9ff638b7-8097-449d-9741-7b3c526b0da7","strategy":"afterInteractive"},{"id":"cookie_snippet","type":"text/javascript","strategy":"afterInteractive","children":"\n function OptanonWrapper() { }\n "},{"id":"gtm_script","strategy":"afterInteractive","children":"\n (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':\n new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],\n j=d.createElement(s),dl=l!='dataLayer'?'\u0026l='+l:'';j.async=true;j.src=\n 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);\n })(window,document,'script','dataLayer','GTM-TPV7TP');\n "}]}</script></body></html>