Purpose-Built AI Agents for the Agentic SOC  Splunk Enterprise Security 8.6 expands AI in Security with purpose-built AI capabilities built into the workflows analysts already use across detection, triage, investigation, automation, malware analysis, and response. These capabilities help teams summarize findings, prioritize and explain alerts, create and tune detections, build response workflows, analyze malware behavior, and apply standard operating procedures directly within Enterprise Security.  The focus is practical: reduce the manual work that slows analysts down and helps teams move faster from alert to action. Analysts stay in control of key decisions, while AI helps gather context, recommend next steps, and make routine tasks more consistent. For SOC teams, this means more capacity across day-to-day operations without adding more disconnected tools or losing governance, accountability, and confidence in the response process.  And for the organization this means proactively reducing risk exposure.    Translate Multilingual Phishing Threats Directly in ES  Automated Threat Analysis (available in ES Premier 8.5+) now includes built-in translation, enabling security analysts to quickly understand phishing emails and documents written in virtually any language. This helps global SOCs investigate multilingual phishing campaigns without relying on external translation tools or language expertise.  When an analyst receives a suspected document or email in a language their analysts aren’t familiar with, they can:  See the original content extracted by Automated Threat Analysis  Click “View translation” to see a translated version of the content  By eliminating the language barriers directly within ES, analysts gain immediate context to assess suspicious content, reducing investigation time and accelerating phishing response all without leaving their existing workflow or switching to a separate translation tool.     Accelerate Investigations with Entity Intelligence and Attribution  ES 8.6 expands Exposure Analytics from continuous entity discovery into deeper, actionable intelligence. Building on the foundation introduced in ES 8.5, analysts can now move faster from visibility to investigation with new Entity Discovery Insights dashboards that highlight asset trends, operating systems, cloud environments, default accounts, and non-human identities. From these insights, teams can drill directly into Entity Discovery Inventory and pivot into Entity Analysis for focused investigation.  Exposure Analytics in ES 8.6 also adds improved context for investigations and prioritization. New subnet discovery data helps analysts understand unfamiliar IPs or subnets by showing related assets within the same network boundary, while Historical Entity Intelligence tracks how assets and users change over time to support forensics and timeline reconstruction. With customizable Inventory Enrichment, teams can align discovered entities to business-specific context such as locations, legacy operating systems, and default account standards. Together, these capabilities help SOC teams investigate threats more efficiently, reduce analyst efforts, and make faster, more confident decisions all from within ES.  These capabilities are available across all ES editions.  Unified View into Threat Intelligence Data  We’ve introduced a Threat Intelligence dashboard that provides a unified view of the threat intelligence ingested in your environment across TIM Cloud and ES Native data sources that's used for threat matching.  Analysts can quickly understand the quality and coverage of their threat intelligence by viewing ingested threat intelligence sources including quantity, associated threat actors, MITRE TTPs, and malware indicators within your collections.  As a reminder, for customer-managed environments, access to Threat Intelligence Management is available now via Cloud Connect.  We’ve also enhanced Threat Intelligence Management documentation, making it easier to integrate and operationalize Cisco Talos intelligence to enrich investigations, improve threat attribution, and accelerate threat hunting.    Elevating Federal Security with FedRAMP Moderate Authorization  And finally, we are excited to announce a significant milestone in our commitment to the public sector. ES Premier has achieved FedRAMP Moderate authorization (as of June 25, 2026). The complexity of modern cyber threats requires a unified approach. ES Premier provides the visibility and intelligence necessary to unify data across hybrid and multi-cloud environments. With this new authorization, agencies can now harness the full power of our premier security analytics platform to defend their perimeters, detect lateral movement, and automate incident responses all within a secure, FedRAMP-compliant framework.  Ready to experience ES 8.6? Upgrade today!    ... View more

Splunk is not only building stronger resilience within organizations while helping to deliver amazing outcomes, but it’s also changing people’s lives!  Recently conducted studies on Splunk users and their knowledge of the product have revealed some amazing benefits as users become more proficient with Splunk and its expansive features across IT, Security, and Observability. These professionals are experiencing greater job satisfaction, increased influence within their teams and organizations, greater mobility in their roles – and, not to mention, getting a bit more cash in their pockets! The key to tapping into these benefits can be found in Splunk Education! Making Education a Priority to Uplift Your Career We’ve heard from our users about making more Splunk learning content accessible so that even more professionals can realize these benefits. Now, Splunk is introducing a number of new foundational and advanced topic courses available for free. These courses will allow users to have the opportunity to learn new features and capabilities across Splunk’s industry-leading products, unlocking more ways to drive actions with data. Courses such as Enriching Data with Lookups, Introduction to Splunk APM, and Introduction to SOAR are examples of just some of these courses that are now available for free – with many more!  When asked how Splunk Education has helped users along their careers and at their workplace, it’s clear that by taking these courses, users are making an impact from both a professional development perspective, as well as with helping their organizations deliver successful outcomes.      Learning Splunk as a Career Growth Driver When it comes to Splunk’s impact on professional development, the newly released ESG research report found that users with a higher proficiency of Splunk knowledge (compared to those with a beginner or adequate level of proficiency with Splunk) were 2.4x more likely to be very satisfied with their job, while; in addition, nearly 73% of all respondents indicated that they felt they have more influence and greater credibility among colleagues and peers. The impact of Splunk knowledge on one’s compensation also scales with proficiency, showing that those with a higher proficiency earn a 48% premium over users that have beginner or adequate levels of Splunk skills.  Plainly speaking, users that are taking their Splunk know-how to the next level are happier in their roles, making meaningful contributions within their organizations, and are earning more in their job roles! Where better to sharpen your Splunk skills than with Splunk Education?     Unlock the Potential of Your Career Today Taking your Splunk skills to the next level is not only going to help develop and transform your organization, it’s a game-changing move that can yield success along your career journey. Check out more information on the full career impact report or to find out more about courses that are now being offered free at Save the Day with Splunk Education. — Mike Marti, Customer Success Marketing Manager at Splunk ... View more