Splunk ES Content Update
Splunk Built
Overview
Details
This subscription service delivers pre-packaged Security Content for use with Splunk Enterprise Security. Subscribers get regular updates to help security practitioners more quickly address ongoing and time-sensitive customer problems and threats.
Requires Splunk Enterprise Security version 4.5 or greater.
Requires Splunk Enterprise Security version 4.5 or greater.
For more information please visit the Splunk ES Content Update user documentation.
Release Notes
Version 1.0.36
March 5, 2019
Splunk Enterprise Security Content Updates 1.0.36 Copyright (C) 2019 Splunk Inc. All rights reserved.
Splunk Enterprise Security Content Update version 1.0.36 was released on March 6, 2019, and introduced the following improvement:
1) Updated Windows security searches to use eventtype instead of sourcetype.
2) Updated Sysmon searches to leverage the Endpoint Data Model.
3) Bug Fixes:
* Fixed markdown rendering errors in UI
* Updated time preset to 24 hours in the search window
For full documentation, visit http://docs.splunk.com/Documentation/ESSOC/1.0.36/user/About