Splunk Enterprise Security (ES) solves a wide range of security analytics and operations use cases including continuous security monitoring, advanced threat detection, compliance, incident investigation, forensics and incident response. Splunk ES delivers an end-to-end view of organizations’ security postures with flexible investigations, unmatched performance, and the most flexible deployment options offered in the cloud, on-premises or hybrid deployment models. Splunk ES enables you to: - Conquer alert fatigue with high-fidelity Risk-Based Alerting. - Bring visibility across your hybrid environment with multicloud security monitoring. - Conduct flexible investigations for effective threat hunting across security, IT and DevOps data sources. Splunk ES is a premium security solution requiring a paid license.

NumLookup is a phone intelligence app that provides reverse phone lookup services for phone number. Get owner's name and carrier information associated with any phone number. Are you frequently haunted by unknown numbers? Looking to find out who’s behind that mysterious call you just received? Say hello to NumLookup, the ultimate reverse phone lookup solution. Features: Comprehensive Database: With access to millions of records, we offer one of the most detailed and expansive databases in the reverse phone lookup industry. Fast Results: Just enter the phone number, and within seconds, get comprehensive details about its owner, including their name, location, carrier, and more. Privacy First: We understand the importance of your privacy. Our platform ensures that your searches are confidential and never stored. Global Reach: Whether you’re looking up a local landline or an international mobile number, NumLookup has got you covered. User-Friendly Interface: Our sleek design and easy-to-navigate interface mean anyone can use it without any tech hurdles. Spam Detection: Protect yourself from unwanted spam calls. We offer insights into the nature of the call and community ratings, helping you decide whether to answer, ignore, or block. Join millions of satisfied users who trust NumLookup for their reverse phone lookup needs. Stay informed, safe, and connected.

*** Important: Read upgrade instructions and test add-on update before deploying to production *** The Splunk Add-on for Windows 5.0.0 introduced breaking changes. If you are upgrading from a version of the Splunk Add-on for Windows that is earlier than 5.0.0, you must follow the documented upgrade instructions to avoid data loss. A best practice is to test the upgraded version in a non-production environment before deploying to production. Neither the Splunk Add-on for Windows DNS version 1.0.1 nor the Splunk Add-on for Windows Active Directory version 1.0.0 is supported when installed alongside the Splunk Add-on for Windows version 6.0.0. The Splunk Add-on for Windows version 6.0.0 includes the Splunk Add-on for Windows DNS and the Splunk Add-on for Microsoft Active Directory. The Splunk for Microsoft Windows add-on includes predefined inputs to collect data from Windows systems and maps to normalize the data to the Common Information Model.

MCP Server for Splunk Platform The Model Context Protocol (MCP) is an open standard and framework that enables seamless, secure, and standardized two-way communication between AI applications (like large language models) and external data sources or tools. It acts as a universal adapter allowing AI systems to access, execute, and integrate functionalities from diverse systems through a common protocol, simplifying data sharing and tool interoperability without custom coding for each integration. Splunk's Model Context Protocol (MCP) server leverages this to provide a standardized, secure, and scalable interface to connect AI assistants, agents, and other intelligent systems with data in the Splunk platform for both Enterprise & Cloud customers in beta. 🔑 Key Features - Universal Connectivity Seamlessly connects AI agents and tools to Splunk data resources in a secure and efficient manner. - Enterprise-Grade Security Includes built-in authentication, authorization, and Role-Based Access Control (RBAC). - Rapid Deployment Offers a plug-and-play solution, eliminating the need for custom integrations. ⚙️ Core Capabilities - Explore the Data Navigate and interact with Splunk data effortlessly. - Discover Knowledge Objects Identify and access relevant saved searches, lookups, and other knowledge assets. - Execute Searches Run powerful Splunk queries to extract insights and drive intelligent workflows. - Leverage AI capabilities from Splunk’s AI Assistant for SPL & MLTK SPL search generation from natural language, search optimization, search explanation, retrieve MLTK models and algorithms.

Get started with Splunk for Security with Splunk Security Essentials (SSE). Explore security use cases and discover security content to start address threats and challenges. Security Content Library Find security content for Splunk Cloud and Splunk's SIEM and SOAR offerings and deploy out-of-the-box security detections and analytic stories to enhance your investigations and improve your security posture. Cybersecurity Frameworks Identify gaps in your defenses and take control of your security posture with automatic mapping of data and security detections to MITRE ATT&CK® and Cyber Kill Chain® framework. Data and Content Introspection Gain visibility of the data coming into your environment to add context and telemetry to security events. Enrich your security detections with metadata and tags from the Security Content Library. Security Data Journey Get prescriptive security and data recommendations and establish a data strategy to develop a security maturity roadmap. We have changed the security content delivery endpoint for ESCU to comply with Splunk guidance. This means that if you have SSE version 3.7.1 or lower, the last supported ESCU version is ESCU 4.22.0. In order to get the latest ESCU version, you will need to upgrade SSE to version 3.8.0. Learn more: Download the Product Brief : https://www.splunk.com/pdfs/product-briefs/splunk-security-essentials.pdf Try out Splunk Security Essentials: https://www.splunk.com/en_us/form/splunk-security-essentials-online-demo.html Check out the Documentation site: https://docs.splunk.com/Documentation/SSE

The Splunk ES Content Update (ESCU) app delivers pre-packaged Security Content. ESCU provides regular Security Content updates to help security practitioners address ongoing time-sensitive threats, attack methods, and other security issues. Security Content consists of tactics, techniques, and methodologies that help with detection, investigation, and response. Security Content enables security teams to directly operationalize detection searches, investigative searches, and other supporting details. ESCU can generate Notable/Risk Events in Splunk Enterprise Security. Security Content also contains easy-to-read background information and guidance, for key context on motivations and risks associated with attack techniques, as well as pragmatic advice on how to combat those techniques. The analytic stories and their searches are also available at - https://github.com/splunk/security_content.

Warning: You can't upgrade DB Connect directly from versions earlier than 3.18.0 to versions 4.0.0 or later. Make sure to follow upgrade path guide. Splunk DB Connect is a generic SQL database extension for Splunk that enables easy integration of database information with Splunk queries and reports. Splunk DB Connect supports DB2/Linux, Informix, MemSQL, MySQL, AWS Aurora, Microsoft SQL Server, Oracle, PostgreSQL, AWS RedShift, SAP SQL Anywhere, Sybase ASE, Sybase IQ, Teradata, InfluxDB and MongoDB Atlas & Standalone. Use Splunk DB Connect's Inputs to import structured data for powerful indexing, analysis, and visualization. Use Outputs to export machine data insights to a legacy database to increase your organization's insight. Use Lookups to add meaningful information to your event data by referencing fields in an external database. Use query commands to build live dashboards mixing structured and unstructured data.

Fortinet FortiGate Add-On for Splunk is the technical add-on (TA) developed by Fortinet, Inc. The add-on enables Splunk Enterprise to ingest or map security and traffic data collected from FortiGate physical and virtual appliances across domains. The key features include: • Streamlining authentication and access from FortiGate such as administrator login, user login, VPN termination authentication into to Splunk Enterprise Security Access Center • Mapping FortiGate virus report into Splunk Enterprise Security Endpoint Malware Center • Ingesting traffic logs, IPS logs, system configuration logs and Web filtering data etc. Fortinet FortiGate Add-On for Splunk provides common information model (CIM) knowledge, advanced “saved search”, indexers and macros to use with other Splunk Enterprise apps such as Splunk App for Enterprise Security. The compatible FOS version is 5.0 and later.

The Splunk AI Toolkit delivers new SPL commands, custom visualizations, assistants, and examples to explore a variety of ML concepts. Each assistant includes end-to-end examples with datasets, plus the ability to apply the visualizations and SPL commands to your own data. You can inspect the assistant panels and underlying code to see how it all works. AI Toolkit Quick Reference Guide: https://docs.splunk.com/images/3/3f/Splunk-MLTK-QuickRefGuide-2019-web.pdf Generative AI: With release 5.6, AI Toolkit supports Generative AI, allowing customers to integrate Large Language Models (LLMs) and Time Series Foundational Models directly into their search pipelines. Agentic Capabilities: With release 6.0.0, AI Toolkit introduces Agent Launchpad, enabling customers to create AI agents directly within the app, connect their own MCP servers, Knowledge bases and build agentic workflows. Assistants: * Predict Numeric Fields (Linear Regression): e.g. predict median house values. * Predict Categorical Fields (Logistic Regression): e.g. predict customer churn. * Detect Numeric Outliers (distribution statistics): e.g. detect outliers in IT Ops data. * Detect Categorical Outliers (probabilistic measures): e.g. detect outliers in diabetes patient records. * Forecast Time Series: e.g. forecast data center growth and capacity planning. * Cluster Numeric Events: e.g. cluster business anomalies to reduce noise. Smart Assistants (new assistants with revamped UI and better ml pipeline/experiment management): * Smart Forecasting Assistant:: e.g. forecasting app logons with special days. * Smart Outlier Detection Assistant: e.g. find anomalies in supermarket purchases. * Smart Clustering Assistant: e.g. cluster houses by property descriptions. * Smart Prediction Assistant: e.g. predict vulnerabilities in firewall data.

*** Important: Read upgrade Instructions and test add-on update before deploying to production *** There are changes to default indexes and .conf changes in version 6.0 of Splunk Add-on for Unix and Linux that can break an existing installation if upgrade instructions are not followed in detail. If an existing Splunk Add-on for Unix and Linux is being upgraded, please test in a non-production environment first. The Splunk Add-on for Unix and Linux works with the Splunk App for Unix and Linux to provide rapid insights and operational visibility into large-scale Unix and Linux environments. With its new pre-packaged alerting capability, flexible service-based hosts grouping, and easy management of many data sources, it arms administrators with a powerful ability to quickly identify performance and capacity bottlenecks and outliers in Unix and Linux environments.

This app integrates with the VirusTotal cloud to implement investigative and reputation actions using v3 APIs

The Splunk Add-On for Sysmon enables customers to create and persist connection to Microsoft Sysmon so that the available detection, events, incident and audit data can be continually streamed to their Splunk Environment. This connection enables organisations to combine the power of the Splunk platform with the visibility and rich event data source of the Microsoft Sysmon utility running on Windows platforms. The Splunk Add-on for Sysmon collects data from Sysmon’s dedicated Windows Event log. Add-On map events for CIM data models: Endpoint, Network Resolution (DNS), Network Traffic, Change. The Splunk Add-on for Sysmon provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.

The Splunk Add-on for AWS, from version 7.0.0 and above, includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This allows you to configure the Splunk Add-on for AWS to ingest data across all AWS data sources, facilitating the integration of AWS data into your Splunk platform deployment. If you use both the Splunk Add-on for Amazon Security Lake as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Security Lake before upgrading the Splunk Add-on for AWS to version 7.0.0 or later in order to avoid any data duplication and discrepancy issues. __________________________________________________________________________________________________________ Ingesting data from AWS to Splunk Cloud? Have you tried the new Splunk Data Manager yet? Data Manager makes AWS data ingestion simpler, more automated and centrally managed for you, while co-existing with AWS and/or Kinesis TAs. Read our blog post to learn more about Data Manager and it’s availability on your Splunk Cloud instance: https://splk.it/3e9F863 __________________________________________________________________________________________________________ The Splunk Add-on for Amazon Web Services allows a Splunk software administrator to collect: * Configuration snapshots, configuration changes, and historical configuration data from the AWS Config service. * Metadata for your AWS EC2 instances, reserved instances, and EBS snapshots. * Compliance details, compliance summary, and evaluation status of your AWS Config Rules. * Assessment Runs and Findings data from the Amazon Inspector service. * Management and change events from the AWS CloudTrail service. * VPC flow logs and other logs from the CloudWatch Logs service. * Performance and billing metrics from the AWS CloudWatch service. * Billing reports that you have configured in AWS. * S3, CloudFront, and ELB access logs. * Generic data from your S3 buckets. * Generic data from your Kinesis streams. * Generic data from SQS. * Security events from Amazon Security Lake This add-on provides modular inputs and CIM-compatible knowledge to use with other apps, such as the Splunk App for AWS, Splunk Enterprise Security and Splunk IT Service Intelligence. Versions 5.0.0 and later of the Splunk Add-on for AWS is compatible only with Splunk Enterprise version 8.0.0 and above.

The Common Information Model is a set of field names and tags which are expected to define the least common denominator of a domain of interest. It is implemented as documentation on the Splunk docs website and JSON data model files in this add-on. Use the CIM add-on when modeling data or building apps to ensure compatibility between apps, or to just take advantage of these data models to pivot and report.

This add-on contains a Python interpreter bundled with the following scientific and machine learning libraries: numpy, scipy, pandas, scikit-learn, and statsmodels. With this add-on, you can import these powerful libraries in your own custom search commands, custom rest endpoints, modular inputs, and so forth. This add-on is available for Linux (64-bit), Windows (64-bit) and Mac. Make sure you install the appropriate one for your Splunk deployment.

The Splunk Event Generator (Eventgen) is a utility which allows its users to easily build real-time event generators. Eventgen allows an app developer to get events into Splunk to test their applications. It provides a somewhat ridiculous amount of configurability to allow users to simulate real data. To join the development community, please go to https://github.com/splunk/eventgen. For documentation, please go to the Eventgen Documentation(http://splunk.github.io/eventgen/).

This app supports investigative actions against a Microsoft SQL Server

This app supports investigative actions against a Microsoft Azure SQL Server

This app integrates with an instance of Mimecast to perform generic, investigative, and containment actions

App integration for Cisco SMA, Secure Email and Web Manager

This app integrates with an instance of Carbon Black defense to run investigative and generic actions

This app integrates with an instance of Carbon Black defense to run investigative and generic actions

*** Important: Read upgrade instructions and test add-on update before deploying to production *** The Splunk Add-on for Windows 5.0.0 introduced breaking changes. If you are upgrading from a version of the Splunk Add-on for Windows that is earlier than 5.0.0, you must follow the documented upgrade instructions to avoid data loss. A best practice is to test the upgraded version in a non-production environment before deploying to production. Neither the Splunk Add-on for Windows DNS version 1.0.1 nor the Splunk Add-on for Windows Active Directory version 1.0.0 is supported when installed alongside the Splunk Add-on for Windows version 6.0.0. The Splunk Add-on for Windows version 6.0.0 includes the Splunk Add-on for Windows DNS and the Splunk Add-on for Microsoft Active Directory. The Splunk for Microsoft Windows add-on includes predefined inputs to collect data from Windows systems and maps to normalize the data to the Common Information Model.

The Splunk Add-on for Google Cloud Platform allows a Splunk software administrator to collect google cloud platform events, logs, performance metrics and billing data using Google Cloud Platform API. After the Splunk platform indexes the events, you can analyze the data using the prebuilt panels included with the add-on. You can then directly analyze the data or use it as a contextual data feed to correlate with other Google Cloud-related data in the Splunk platform.

The Splunk Add-on for Microsoft Exchange collects mailbox, client access, and hub transport data from your Microsoft Exchange Server hosts. This add-on is comprised of four separate add-ons that can be selectively installed: Exchange-ClientAccess, Exchange-Mailbox, Windows-Exchange-IIS, SMTP-Reputation. You ONLY need to install these add-ons on FORWARDERS. You have to also install the Splunk Add-on for Microsoft Exchange Indexes to define the indexes used by Splunk Add-on for Microsoft Exchange on your indexers. Note: This add-on is neither supported nor required on Splunk Cloud. We are working on updating the splunkbase to reflect that.

*** Important: Read upgrade instructions and test your add-on update before deploying to production *** Version 2.0.0 of the Splunk Add-on for Salesforce introduces breaking changes. To avoid data loss or data duplication, follow the documented upgrade instructions in detail. If your are upgrading an earlier version of the Splunk Add-on for Salesforce, a best practice is to test your update in a non-production environment before deploying to production. The Splunk Add-on for Salesforce allows a Splunk software administrator to collect different types of data from Salesforce using REST APIs. The data includes: * Event log file data, https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/using_resources_event_log_files.htm. * Output of Salesforce object queries (SOQL). This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security, the Splunk App for PCI Compliance, and Splunk IT Service Intelligence.

The Splunk Add-on for ServiceNow allows a Splunk software administrator to collect data from ServiceNow and create incidents and events in ServiceNow. The add-on collects incident, event, change, user, user group, location, and CMDB CI information from ServiceNow via ServiceNow REST APIs. The add-on also provides workflow actions that allow users to link directly from events in the Splunk platform search results to relevant ServiceNow incidents, events, and Knowledge Base articles. The Splunk Add-on for ServiceNow allows Splunk software administrators to use custom commands, alert actions, and scripts to create new incidents and events in your ServiceNow instance, as well as update the incidents created from the Splunk platform. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.

The Splunk AI Toolkit delivers new SPL commands, custom visualizations, assistants, and examples to explore a variety of ML concepts. Each assistant includes end-to-end examples with datasets, plus the ability to apply the visualizations and SPL commands to your own data. You can inspect the assistant panels and underlying code to see how it all works. AI Toolkit Quick Reference Guide: https://docs.splunk.com/images/3/3f/Splunk-MLTK-QuickRefGuide-2019-web.pdf Generative AI: With release 5.6, AI Toolkit supports Generative AI, allowing customers to integrate Large Language Models (LLMs) and Time Series Foundational Models directly into their search pipelines. Agentic Capabilities: With release 6.0.0, AI Toolkit introduces Agent Launchpad, enabling customers to create AI agents directly within the app, connect their own MCP servers, Knowledge bases and build agentic workflows. Assistants: * Predict Numeric Fields (Linear Regression): e.g. predict median house values. * Predict Categorical Fields (Logistic Regression): e.g. predict customer churn. * Detect Numeric Outliers (distribution statistics): e.g. detect outliers in IT Ops data. * Detect Categorical Outliers (probabilistic measures): e.g. detect outliers in diabetes patient records. * Forecast Time Series: e.g. forecast data center growth and capacity planning. * Cluster Numeric Events: e.g. cluster business anomalies to reduce noise. Smart Assistants (new assistants with revamped UI and better ml pipeline/experiment management): * Smart Forecasting Assistant:: e.g. forecasting app logons with special days. * Smart Outlier Detection Assistant: e.g. find anomalies in supermarket purchases. * Smart Clustering Assistant: e.g. cluster houses by property descriptions. * Smart Prediction Assistant: e.g. predict vulnerabilities in firewall data.

This app connects to Office 365 national cloud deployments (US Government GCC High L4 and DoD L5) using the Microsoft Graph API to support investigative and generic actions related to email messages and calendar events

This app performs email ingestion, investigative and containment actions on an on-premise Exchange installation

This app integrates with Microsoft Defender for Endpoint to execute various containment, corrective, generic, and investigative actions

This app integrates with Microsoft Teams to support various generic and investigative actions

The Splunk Add-on for AWS, from version 7.0.0 and above, includes a merge of all the capabilities of the Splunk Add-on for Amazon Security Lake. This allows you to configure the Splunk Add-on for AWS to ingest data across all AWS data sources, facilitating the integration of AWS data into your Splunk platform deployment. If you use both the Splunk Add-on for Amazon Security Lake as well as the Splunk Add-on for AWS on the same Splunk instance, then you must uninstall the Splunk Add-on for Amazon Security Lake before upgrading the Splunk Add-on for AWS to version 7.0.0 or later in order to avoid any data duplication and discrepancy issues. __________________________________________________________________________________________________________ Ingesting data from AWS to Splunk Cloud? Have you tried the new Splunk Data Manager yet? Data Manager makes AWS data ingestion simpler, more automated and centrally managed for you, while co-existing with AWS and/or Kinesis TAs. Read our blog post to learn more about Data Manager and it’s availability on your Splunk Cloud instance: https://splk.it/3e9F863 __________________________________________________________________________________________________________ The Splunk Add-on for Amazon Web Services allows a Splunk software administrator to collect: * Configuration snapshots, configuration changes, and historical configuration data from the AWS Config service. * Metadata for your AWS EC2 instances, reserved instances, and EBS snapshots. * Compliance details, compliance summary, and evaluation status of your AWS Config Rules. * Assessment Runs and Findings data from the Amazon Inspector service. * Management and change events from the AWS CloudTrail service. * VPC flow logs and other logs from the CloudWatch Logs service. * Performance and billing metrics from the AWS CloudWatch service. * Billing reports that you have configured in AWS. * S3, CloudFront, and ELB access logs. * Generic data from your S3 buckets. * Generic data from your Kinesis streams. * Generic data from SQS. * Security events from Amazon Security Lake This add-on provides modular inputs and CIM-compatible knowledge to use with other apps, such as the Splunk App for AWS, Splunk Enterprise Security and Splunk IT Service Intelligence. Versions 5.0.0 and later of the Splunk Add-on for AWS is compatible only with Splunk Enterprise version 8.0.0 and above.

*** Important: Read upgrade instructions and test add-on update before deploying to production *** The Splunk Add-on for Windows 5.0.0 introduced breaking changes. If you are upgrading from a version of the Splunk Add-on for Windows that is earlier than 5.0.0, you must follow the documented upgrade instructions to avoid data loss. A best practice is to test the upgraded version in a non-production environment before deploying to production. Neither the Splunk Add-on for Windows DNS version 1.0.1 nor the Splunk Add-on for Windows Active Directory version 1.0.0 is supported when installed alongside the Splunk Add-on for Windows version 6.0.0. The Splunk Add-on for Windows version 6.0.0 includes the Splunk Add-on for Windows DNS and the Splunk Add-on for Microsoft Active Directory. The Splunk for Microsoft Windows add-on includes predefined inputs to collect data from Windows systems and maps to normalize the data to the Common Information Model.

The Splunk Add-on for Google Cloud Platform allows a Splunk software administrator to collect google cloud platform events, logs, performance metrics and billing data using Google Cloud Platform API. After the Splunk platform indexes the events, you can analyze the data using the prebuilt panels included with the add-on. You can then directly analyze the data or use it as a contextual data feed to correlate with other Google Cloud-related data in the Splunk platform.

The Splunk Add-on for Microsoft Cloud Services allows a Splunk software administrator to pull activity logs, service status, operational messages, Azure audit, Azure resource data and Azure Storage Table and Blob data from a variety of Microsoft cloud services using Event Hubs, Azure Service Management APIs and Azure Storage API. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance and Splunk IT Service Intelligence.

*** Important: Read upgrade Instructions and test add-on update before deploying to production *** There are changes to default indexes and .conf changes in version 6.0 of Splunk Add-on for Unix and Linux that can break an existing installation if upgrade instructions are not followed in detail. If an existing Splunk Add-on for Unix and Linux is being upgraded, please test in a non-production environment first. The Splunk Add-on for Unix and Linux works with the Splunk App for Unix and Linux to provide rapid insights and operational visibility into large-scale Unix and Linux environments. With its new pre-packaged alerting capability, flexible service-based hosts grouping, and easy management of many data sources, it arms administrators with a powerful ability to quickly identify performance and capacity bottlenecks and outliers in Unix and Linux environments.

The Common Information Model is a set of field names and tags which are expected to define the least common denominator of a domain of interest. It is implemented as documentation on the Splunk docs website and JSON data model files in this add-on. Use the CIM add-on when modeling data or building apps to ensure compatibility between apps, or to just take advantage of these data models to pivot and report.

The Splunk AI Toolkit delivers new SPL commands, custom visualizations, assistants, and examples to explore a variety of ML concepts. Each assistant includes end-to-end examples with datasets, plus the ability to apply the visualizations and SPL commands to your own data. You can inspect the assistant panels and underlying code to see how it all works. AI Toolkit Quick Reference Guide: https://docs.splunk.com/images/3/3f/Splunk-MLTK-QuickRefGuide-2019-web.pdf Generative AI: With release 5.6, AI Toolkit supports Generative AI, allowing customers to integrate Large Language Models (LLMs) and Time Series Foundational Models directly into their search pipelines. Agentic Capabilities: With release 6.0.0, AI Toolkit introduces Agent Launchpad, enabling customers to create AI agents directly within the app, connect their own MCP servers, Knowledge bases and build agentic workflows. Assistants: * Predict Numeric Fields (Linear Regression): e.g. predict median house values. * Predict Categorical Fields (Logistic Regression): e.g. predict customer churn. * Detect Numeric Outliers (distribution statistics): e.g. detect outliers in IT Ops data. * Detect Categorical Outliers (probabilistic measures): e.g. detect outliers in diabetes patient records. * Forecast Time Series: e.g. forecast data center growth and capacity planning. * Cluster Numeric Events: e.g. cluster business anomalies to reduce noise. Smart Assistants (new assistants with revamped UI and better ml pipeline/experiment management): * Smart Forecasting Assistant:: e.g. forecasting app logons with special days. * Smart Outlier Detection Assistant: e.g. find anomalies in supermarket purchases. * Smart Clustering Assistant: e.g. cluster houses by property descriptions. * Smart Prediction Assistant: e.g. predict vulnerabilities in firewall data.

The Splunk Event Generator (Eventgen) is a utility which allows its users to easily build real-time event generators. Eventgen allows an app developer to get events into Splunk to test their applications. It provides a somewhat ridiculous amount of configurability to allow users to simulate real data. To join the development community, please go to https://github.com/splunk/eventgen. For documentation, please go to the Eventgen Documentation(http://splunk.github.io/eventgen/).

The Splunk Add-on for Okta Identity Cloud: - Handles System Log event ingestion using Okta's REST API endpoints and simplifies data correlation. - Can periodically ingest Okta Universal Directory (UD) data, including users, groups, and apps. This data is not treated as time-series events. - Provides the inputs and CIM-compatible knowledge to use with other Splunk apps. The Splunk Add-on for Okta Identity Cloud provides complete data collection parity with the Okta Identity Cloud Add-on for Splunk, and corresponding features except the following two adaptive response actions: 1) Updating user's lifecycle/status, 2) Add or Remove a user from a group. In addition to this, Splunk built TA provides comprehensive CIM coverage, high reliability and multiple features and enhancements. Please see the Reference section of the documentation for more details. The Splunk Add-on for Okta Identity Cloud provides support of the below-mentioned sourcetypes: OktaIM2:log OktaIM2:user OktaIM2:group OktaIM2:app OktaIM2:groupUser OktaIM2:appUser

Ever want to edit a lookup within Splunk with a user interface? Now you can. This app provides an Excel-like interface for editing, importing, and exporting lookup files (KV store and CSV-based). This app also makes your lookups work in Search Head Clustered environments (edits to lookups will be propagated to other search heads). Revision history is maintained for lookups so that you can view or restore older lookups quickly in the interface. Check out the Documentation site: https://docs.splunk.com/Documentation/LookupEditor https://docs.splunk.com/Documentation/LookupEditor/4.0.4/User/Whatsnew

Warning: You can't upgrade DB Connect directly from versions earlier than 3.18.0 to versions 4.0.0 or later. Make sure to follow upgrade path guide. Splunk DB Connect is a generic SQL database extension for Splunk that enables easy integration of database information with Splunk queries and reports. Splunk DB Connect supports DB2/Linux, Informix, MemSQL, MySQL, AWS Aurora, Microsoft SQL Server, Oracle, PostgreSQL, AWS RedShift, SAP SQL Anywhere, Sybase ASE, Sybase IQ, Teradata, InfluxDB and MongoDB Atlas & Standalone. Use Splunk DB Connect's Inputs to import structured data for powerful indexing, analysis, and visualization. Use Outputs to export machine data insights to a legacy database to increase your organization's insight. Use Lookups to add meaningful information to your event data by referencing fields in an external database. Use query commands to build live dashboards mixing structured and unstructured data.

The Splunk Add-on for Microsoft Security collects incidents and alerts from Microsoft 365 Defender OR alerts from Microsoft Defender for Endpoint. Customers currently utilizing Microsoft 365 Defender Add-on for Splunk are strongly recommended to migrate to this new Splunk supported add-on after reading the migration section of the documentation. https://docs.splunk.com/Documentation/AddOns/released/MSSecurity/Migrate Customers migrating from Microsoft 365 Defender Add-on for Splunk who would like to continue using the dashboards it includes should install Microsoft 365 App for Splunk, as the functionality has been moved there. https://splunkbase.splunk.com/app/3786/ Microsoft 365 Defender Incidents * Incident (impossible travel, activity from Tor IP, suspicious inbox forwarding, successful logon using potentially stolen credentials, etc.) * Assignee * Classification * Severity * Status * Alerts associated with the Incident Microsoft Defender for Endpoint Alerts * Categories (Malware, Initial Access, Execution, etc.) * Detection source * Evidence * Computer name * Related user * Severity * Status

Get started with Splunk for Security with Splunk Security Essentials (SSE). Explore security use cases and discover security content to start address threats and challenges. Security Content Library Find security content for Splunk Cloud and Splunk's SIEM and SOAR offerings and deploy out-of-the-box security detections and analytic stories to enhance your investigations and improve your security posture. Cybersecurity Frameworks Identify gaps in your defenses and take control of your security posture with automatic mapping of data and security detections to MITRE ATT&CK® and Cyber Kill Chain® framework. Data and Content Introspection Gain visibility of the data coming into your environment to add context and telemetry to security events. Enrich your security detections with metadata and tags from the Security Content Library. Security Data Journey Get prescriptive security and data recommendations and establish a data strategy to develop a security maturity roadmap. We have changed the security content delivery endpoint for ESCU to comply with Splunk guidance. This means that if you have SSE version 3.7.1 or lower, the last supported ESCU version is ESCU 4.22.0. In order to get the latest ESCU version, you will need to upgrade SSE to version 3.8.0. Learn more: Download the Product Brief : https://www.splunk.com/pdfs/product-briefs/splunk-security-essentials.pdf Try out Splunk Security Essentials: https://www.splunk.com/en_us/form/splunk-security-essentials-online-demo.html Check out the Documentation site: https://docs.splunk.com/Documentation/SSE

This add-on contains a Python interpreter bundled with the following scientific and machine learning libraries: numpy, scipy, pandas, scikit-learn, and statsmodels. With this add-on, you can import these powerful libraries in your own custom search commands, custom rest endpoints, modular inputs, and so forth. This add-on is available for Linux (64-bit), Windows (64-bit) and Mac. Make sure you install the appropriate one for your Splunk deployment.

The Splunk Add-On for Sysmon enables customers to create and persist connection to Microsoft Sysmon so that the available detection, events, incident and audit data can be continually streamed to their Splunk Environment. This connection enables organisations to combine the power of the Splunk platform with the visibility and rich event data source of the Microsoft Sysmon utility running on Windows platforms. The Splunk Add-on for Sysmon collects data from Sysmon’s dedicated Windows Event log. Add-On map events for CIM data models: Endpoint, Network Resolution (DNS), Network Traffic, Change. The Splunk Add-on for Sysmon provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.

The Splunk Add-on for Microsoft Office 365 allows a Splunk software administrator to pull service status, service messages, and management activity logs from the Office 365 Management API. You can collect: * Audit logs for Azure Active Directory, Sharepoint Online, and Exchange Online, supported by the Office 365 Management API. * Historical and current service status, and service messages for the corresponding Microsoft Office 365 Management API. * Data Loss Prevention on Microsoft Office 365 Management API. After the Splunk platform indexes the events, you can then directly analyze the data or use it as a contextual data feed to correlate with other data in the Splunk platform

This app supports investigative actions against a Microsoft Azure SQL Server

This app integrates with JIRA to perform several ticket management actions

This app integrates with the VirusTotal cloud to implement investigative and reputation actions using v3 APIs

This App exposes various Phantom APIs as actions

This app integrates with Splunk to update data on the device, in addition to investigate and ingestion actions

This app integrates with ServiceNow to perform investigative and generic actions

This app provides the ability to send email using SMTP

App specifically designed for interacting with Microsoft Active Directory's LDAP Implementation

This app performs email ingestion, investigative and containment actions on an on-premise Exchange installation

This app implements investigative actions that query the whois database

This app implements URL investigative capabilities utilizing PhishTank

Integrate with Slack to post messages and attachments to channels

This app supports executing various endpoint-based investigative and containment actions on an SSH endpoint

This app supports email ingestion and various investigative actions over IMAP

This app integrates with the Windows Remote Management service to execute various actions

Integrates with G Suite for various investigative and containment actions