🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In the Ideas Portal, “Better Audit Logs” became one of the top-voted customer requests. Through surveys and Audit Beta sessions, you told us exactly where v1 fell short.  One security lead told us:  “Identity and access events aren’t optional—they’re the core of any compliance review. Without them, our auditors just shake their heads.” – Beta feedback, May 2025  Another noted how CIM alignment was critical:  “If it’s not CIM-compatible, we spend weeks normalizing data ourselves. That time is money.” – Audit Feedback Survey  We heard you. And every one of those insights shaped what became Audit Trail v2.    ✨ The Breakthrough  Audit Trail v2 is more than an upgrade. It’s a reset.  For the first time, audit logs are structured JSON—clean, parseable, and CIM-compatible out of the box – available for both Splunk Enterprise and Splunk Cloud Platform. We’ve added around 20 new events across IAM, server settings, and knowledge objects. And we finally cut out the redundant “capability checks” that made up more than half your v1 storage volume.  One admin summed it up in the beta:  “Audit logs used to be a chore. Now, they actually tell a story we can use.” – Security Admin, Fortune 500 Retailer    🔐 Why It Matters  Audit Trail v2 transforms audit from a burden into a benefit.  Compliance Confidence: Aligned with ISO/IEC 27001, PCI DSS Requirement 10, SOC 2 CC7.2, and NIST 800-53 AU controls.  Security Visibility: Rich IAM and config logs reduce blind spots.  Faster Investigations: As NIST SP 800-92 stresses, strong log management accelerates incident detection and forensics.  No more “logs for the sake of logs.” Now, your auditors and security teams both get what they need.    🚀 Just the Beginning  Audit Trail v2 is the foundation. All new audit events will use this format. Existing v1 logs will migrate over time, ensuring continuity while building toward the future.  On the roadmap: long-term retention, process auditing, APIs, and side-by-side change visibility.  👉 This is just the beginning. More to come.    🛠 How to Get Started  Upgrade to Splunk v10.1.  Open the Audit_Trail app and enable v2 with a single checkbox (no restart needed).  Explore more in the:  Audit Trail Documentation  What’s New    📑 References  NIST SP 800-53 Rev. 5 – Security & Privacy Controls (PDF)  NIST SP 800-92 – Guide to Computer Security Log Management  ISO/IEC 27001 Logging Requirements – BluewolfCerts explainer  PCI DSS Requirement 10 – PCI SSC Document Library  SOC 2 Criteria – AICPA Trust Services Criteria    ✨ From the valley of despair to clarity—Audit Trail v2 is here. And it’s only the start of the story.  ... View more

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox feature. It was a response to what customers were asking for—and what regulators were starting to expect.  Here's what we heard: Enterprises wanted to protect internal Splunk traffic from lateral movement and spoofed services.  Government contracts required mutual authentication by default, especially on sensitive deployments.  Teams moving toward Zero Trust needed strong identity validation at the network layer.  And of course…auditors started asking, “Can you prove that the client connecting to your indexer is really who it claims to be?”  So, we went to work. As of Splunk Enterprise 10.0, mTLS is now supported across 10 essential communication paths in your deployment—from forwarders and HTTP Event Collector (HEC) to clustered search heads and indexers.  The Certificate Conundrum (and How We Solved It)  We get it. When someone says “mTLS,” most admins think: "Ah, great…double the certificates, double the complexity." And yes, mTLS does need both sides to have certificates. That used to mean:  You had to manually rotate certs every few months  Restart services just to load new certs  Risk downtime if a cert expired unexpectedly  Maintain complex trust models across clusters  So, we tackled those, too:  Auto-rotation of Indexer and Forwarder certificates (introduced in 9.3 and 9.4) automates certificate updates, removing manual work.  Hot-Reload Support lets you update certs without restarts  Federated search between Search Heads in different Splunk deployments can now be secured with mTLS, requiring both sides to authenticate with certificates.   In short, we're making mTLS secure and operationally manageable, even at an enterprise scale. This isn’t just a security feature—it’s a business enabler.  What’s Actually Supported?  With Splunk Enterprise 10.0, you can now turn mTLS on for these connections:  Forwarders to Indexers (S2S over TCP port 9997)  HTTP Event Collector (HEC on TCP port 8088)  Search Head and Indexer REST APIs  Search Head Cluster Replication  Indexer Clusters  KV Store and Federated Search  And more...  What is out of scope?  Splunk does not enforce mTLS for localhost connections that originate and terminate on the local machine due to implicit trust boundaries. Examples of such connections include the CLI on localhost and other internal localhost-style connections between Splunk components.  mTLS support on Splunk Cloud Platform.  How mTLS Helps You Meet Regulatory and Security Goals  Whether you’re preparing for an audit, adopting Zero Trust, or securing traffic between different regions (e.g. EMEA and APAC) - mTLS is a smart move. And it aligns with major frameworks:  National Institute of Standards and Technology (NIST) Special Publication #800-207 (Zero Trust): Mandates mutual authentication  Payment Card Industry Data Security Standard (PCI DSS) v4.0: Requires secure, verified communication channels  Federal Risk and Authorization Management Program (FedRAMP): Demands strong identity controls in cloud-based systems  International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) Publication #27001 A.13: Emphasizes secured service-to-service communications  With mTLS built into Splunk Enterprise 10.0, you’re a big step closer to meeting all of these—without needing extra tooling or agents.  Getting Started Is Easier Than You Think  Here’s how to begin:  Upgrade to Splunk 10.0 (available now)  Identify your key traffic paths—forwarders, indexers, HEC endpoints  Follow the public mTLS guide to test and secure your first channel  Reach out to your Splunk rep if you want help with validating the applicability of mTLS in your current architecture.  You don’t have to turn everything on at once. Start with the most security-critical paths, validate, and expand from there.  What’s Next?  mTLS is just the beginning. Here’s what else is coming:  TLS version 1.3 support, which is already mandated in some regions  Certificate Revocation List (CRL) support for better compromise response  Unique certificates for any new forwarder  Administrator-controlled certificate lifespans for better certificate management  We're building toward a world where security is both strong and seamless.   The Bottom Line  You asked us for stronger, smarter security.  You asked us for easier certificate management.  You asked us for Zero Trust readiness, without turning the Splunk platform into a full-time cert babysitting job.  mTLS in Splunk Enterprise 10.0 is the answer.  You now have the power to verify every connection, reduce attack surfaces, and meet the bar that your regulators set—without the pain of legacy Public Key Infrastructure (PKI) operations.  Ready to explore more?  Configure mutually authenticated transport layer security (mTLS) on the Splunk platform   NIST 800-207: Zero Trust Architecture  PCI DSS v4.0 Summary  FedRAMP High Baseline Controls  Ask your Customer Success Manager for our mTLS documentation and rollout checklist  Let’s raise the bar—together.  Welcome to a more trusted Splunk.  ... View more

We’re excited to introduce a new release of Splunk Assist! This release will streamline the activation flow. While we still require users to enable Assist (opt-in) explicitly, they will not have to go through a complex set of steps. For example, with the new release, customers will no longer have to log into a separate portal and download an activation code - they can push a button and start seeing the benefits! If you missed the buzz about Splunk Assist we’ll fill you in: Splunk Assist is a cloud-connected service for Splunk® Enterprise that puts your telemetry data to work. Assist provides you with a single place to monitor your deployment and see recommendations to improve your security posture. The primary objective of Assist is to keep your deployment secure and in prime condition. Assist does this by providing the following: Active monitoring: No need to hunt for critical security gaps Actionable insights: No need to look for docs and tutorials to fix issues as you go Powered by the cloud: Continuous improvements at your doorstep mean no need to keep up with version upgrades and security patch upgrades Security first mindset: Data isolation and authentication best practices We created Splunk Assist because we found that ~55% of an admin's efforts are spent on platform management tasks (e.g., certification updates, version upgrades, app, and tech add-on updates, etc), which were considered “low-value” tasks. Admins could only allocate about 5% of their time to high-value tasks. Splunk Assist gives admins back more time so that they can get back to doing more of what they love. Want to learn more? Check out this detailed blog and our release documentation to learn more and take steps to activate Splunk Assist. — Kuntal Das, Product Manager for Splunk Assist ... View more

Hello from Splunk Assist Team, Splunk Assist is a cloud-connected service for Splunk® Enterprise that puts your telemetry data to work! It inspects Splunk deployments and makes cloud-powered recommendations to help bridge security gaps, optimize cost and improve performance in your environment. With Assist, you can: 1) detect critical issues, 2) receive in-product recommendations to fix detected issues, and 3) receive continuous improvements (i.e. no need to keep up with version upgrades and security patch upgrades). We will bring new capabilities to Assist regularly and would love to answer any questions you might have about the Assist app. Before you search through previous conversations looking for assistance, we want to provide you with some basic information and quick resources. Want to get a high-level overview without reading the docs on What Splunk Assist is? See Splunk Assist: Cloud-Powered Insights Just for You, at Your Fingertips, or view the .conf22 video presentation + demo. Want to get into the nitty-gritty details? Start with the Splunk Assist documentation.  Want to request more features? Add your ideas and vote on other ideas at the Assist ideas Portal Please reply to this thread for any questions or to get extra help! ... View more