We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only vendor to bring truly unified threat detection, investigation, and response (TDIR) workflows fueled by automation to both customer managed deployments and FedRAMP Moderate environments. Splunk empowers security operations centers (SOCs) to strengthen their digital resilience with increased visibility, more accurate detections, and tightly integrated, automated workflows delivered through a unified SecOps platform that increases efficiency by 50%. Highlights include: Splunk SOAR on-premises customers can seamlessly integrate with Splunk Enterprise Security. This enables enhanced deployment options so that both on-premises and cloud customers have a completely integrated workflow experience for case management, alert triage, incident investigation, and incident response use cases. Splunk Enterprise Security administrators are now able to pair Splunk Enterprise Security and Splunk SOAR in secure FedRAMP environments. Threat Intelligence Management tenants will be provisioned for and delivered to Splunk Enterprise Security on-premises customers between August 2025 and August 2026, with instructions for requesting access being posted in Enterprise Security documentation on 1 August 2025 (On-premises customers are not required to obtain a Threat Intelligence Management cloud tenant if they prefer not to). Analysts will be able to fully investigate security events by accessing relevant and normalized intelligence to better understand threat context and accelerate time to triage. They can manage security events and leverage threat intelligence feeds directly within Splunk Enterprise Security without pivoting to other tools, ultimately reducing time to investigate. Enhancements to Finding-Based Detections (Available in Preview with Splunk Enterprise Security 8.1). Read more on the  Splunk.com Blog here! Upgrade today to Splunk Enterprise Security 8.1! Recent Splunk Enterprise Security Releases Version Number Release Date 8.1.1 July 17, 2025 8.1.0 June 10, 2025 ... View more

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v5.3.0 and v5.4.0). With these releases, there are 42 new analytics and 14 new analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: New analytic stories and detections to enhance coverage for Apache Tomcat RCE (CVE-2025-24813) and Windows shortcut exploit abuse (ZDI-CAN-25373), expanded ransomware mappings to track emerging threats like Medusa and Salt Typhoon, and standardized detection output fields across the board to improve consistency, correlation, and analyst workflows. The Splunk Threat Research Team has partnered with Cisco Talos to release new analytic stories and detections that significantly improve TDIR efforts for Cisco Secure Firewall alerts. These new ESCU detections go beyond basic alert forwarding and simple string matching to enable advanced detection logic and richer story creation by integrating Snort-based and non-Snort telemetry. Additionally, this content strengthens the ability to detect vulnerability exploitation and track threat actor follow-up activity. This release marks the first in a series focused on expanding ESCU’s network detection coverage for Cisco products, driven through continued collaboration between the Splunk Threat Research Team and Cisco Talos team. Cisco Secure Firewall Threat Defense Analytics: We published a new analytic story and added new detections for Cisco Secure Firewall focusing on three primary event types—file events, network connections, and intrusion alerts. These detections identify activity such as malicious or uncommon file downloads, connections over suspicious ports or to file-sharing domains, and Snort rule-based intrusion events across multiple hosts. This enables broader visibility into network-based threats and host-level indicators of compromise. AWS Bedrock Security: Released a new analytic story to monitor for adversary techniques targeting AWS Bedrock, a managed service used to build and scale generative AI applications. This includes detections for the deletion of security guardrails, knowledge bases, and logging configurations, as well as high volumes of model invocation failures. Mapping Threat Campaigns: Several detections have been mapped to known threat actors and malware campaigns, including Cactus Ransomware, Earth Alux, Storm-2460 CLFS Zero Day Exploitation and Water Gamayun, to improve attribution to TTPs and provide insights into observed behaviors. New Detections: Introduced additional detections for tactics such as directory path manipulation via MSC files, IP address collection using PowerShell Invoke-RestMethod, process spawning from CrushFTP, and deletion of Volume Shadow Copies via WMIC. These detections target adversary behavior related to discovery, lateral movement, and anti-forensics. New Analytics (42) Detect Large ICMP Traffic Tomcat Session Deserialization Attempt Tomcat Session File Upload Attempt Windows AD Self DACL Assignment Windows ConsoleHost History File Deletion Windows Explorer LNK Exploit Process Launch With Padding (Contributor: @aj King, @jesse Hunter) Windows Explorer.exe Spawning PowerShell or Cmd (Contributor: @aj King, @jesse Hunter) Windows Firewall Rule Added Windows Firewall Rule Deletion Windows Firewall Rule Modification Windows MSTSC RDP Commandline Windows Powershell History File Deletion Windows Process Injection into Commonly Abused Processes (Contributor: @0xC0FFEEEE) Windows Remote Host Computer Management Access Windows SSH Proxy Command (Contributor: @aj King, @jesse Hunter) AWS Bedrock Delete GuardRails AWS Bedrock Delete Knowledge Base AWS Bedrock Delete Model Invocation Logging Configuration AWS Bedrock High Number List Foundation Model Failures AWS Bedrock Invoke Model Access Denied Cisco Secure Firewall - Binary File Type Download Cisco Secure Firewall - Bits Network Activity Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint Cisco Secure Firewall - Blocked Connection Cisco Secure Firewall - Communication Over Suspicious Ports Cisco Secure Firewall - Connection to File Sharing Domain Cisco Secure Firewall - File Download Over Uncommon Port Cisco Secure Firewall - High EVE Threat Confidence Cisco Secure Firewall - High Volume of Intrusion Events Per Host Cisco Secure Firewall - Malware File Downloaded Cisco Secure Firewall - Potential Data Exfiltration Cisco Secure Firewall - Rare Snort Rule Triggered Cisco Secure Firewall - Repeated Blocked Connections Cisco Secure Firewall - Repeated Malware Downloads Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts Cisco Secure Firewall - Wget or Curl Download CrushFTP Authentication Bypass Exploitation CrushFTP Max Simultaneous Users From IP Windows MSC EvilTwin Directory Path Manipulation Windows PowerShell Invoke-RestMethod IP Information Collection Windows Shell Process from CrushFTP Windows WMIC Shadowcopy Delete New Analytic Stories (14) Apache Tomcat Session Deserialization Attacks Medusa Ransomware PHP-CGI RCE Attack on Japanese Organizations Salt Typhoon Seashell Blizzard Termite Ransomware VanHelsing Ransomware ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day (Contributor: @aj King, @jesse Hunter) AWS Bedrock Security Cactus Ransomware Cisco Secure Firewall Threat Defense Analytics Earth Alux Storm-2460 CLFS Zero Day Exploitation Water Gamayun The team also published the following blogs:  Cloak and Firewall: Exposing Netsh’s Hidden Command Tricks For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to announce that Splunk Enterprise Security 8.0 is available now for our on-premise customers!  Splunk Enterprise Security 8.0 revolutionizes the SOC workflow experience from the ground up. Now security analysts can seamlessly detect what matters, investigate holistically, and respond to threats —faster and more efficiently than ever before. The SIEM of the future is here: unified TDIR with automated workflows, modern aggregation and triage capabilities, enhanced detections and simplified terminology. In this release, you’ll experience:  Complete threat detection, investigation, and response (TDIR) all within Splunk Enterprise Security Improved case management capabilities Direct Splunk® SOAR integration  Enhanced detection engineering capabilities Simplified terminology for security analytics aligned with Open Cybersecurity Schema Framework (OCSF) See our latest release in action! Take a product tour or visit our features page. ... View more

Large Security Operations Centers (SOCs) with multiple teams need help to make fast decisions when overwhelmed with security events.  A few short weeks ago in our Splunk Enterprise Security 7.2 release, we introduced optional enhancements to the Incident Review Dashboard that provide a more customizable experience when investigating notable events. This allows analysts to customize and configure the Incident Review Dashboard with table filters and columns to help isolate and rapidly investigate events that matter to them. Additionally, analysts can create saved views of their customized Incident Review Dashboard and share them with other Enterprise Security analysts. Saved Views allows analysts with different use cases to share their tailored views of notable events with other incident investigators in order to collaborate on notable events seamlessly. Splunk Enterprise Security Administrators also have access to a new level of control over the analyst experience in Incident Review, including configuring default views for all users.  This refined analyst experience is now on by default in Splunk Enterprise Security 7.3! In order to ease customers into these new workflows, we’ve also launched an interactive, in-product onboarding experience that will guide users through these new features.  Splunk Ideas continues to be front and center in Splunk Enterprise Security Customer feedback continues to drive innovation and enhancements in Splunk Enterprise Security. In this release, we added Drill-Down Dashboards to Incident Review, allowing content engineers to drill-down into a Splunk dashboard directly from the incident workflow. Users can now create multiple drill-down dashboard links and then use them to investigate a specific notable event. This enables analysts to seamlessly access critical details during an investigation, while reducing manual workloads. Content engineers can now customize the text of the drill-down link and also configure the fields that will be passed as tokens to the dashboard. The use cases for custom dashboards are endless with this new flexibility, and we can’t wait to see how the world’s most advanced SOCs leverage it.  Additionally, customers tell us that there are rare instances outside their control where data is not forwarded to Splunk in real-time, but that they still want Enterprise Security to check those data feeds for threats and anomalies. In this release, we’ve added Index Time Correlation Searches that allow administrators to run specific correlation rules on index time instead of event time for the data sources that routinely arrive after real-time. With this enhancement, Splunk continues to ensure complete visibility no matter where, or when, the data originates.   Risk-Based Alerting is now even more powerful Risk-Based Alerting is an innovative approach to help organizations prioritize security threats, aligned to the MITRE ATT&CK framework and an entity risk score. The SOC can reduce false positive investigations by up to 80% and speed the time needed to investigate and remediate true positive incidents by 50%. In Splunk Enterprise Security 7.3, the Risk Event Timeline is updated to include Drill-down Searches, Drill-down Dashboards, and Contributing Events so that analysts can quickly gather contextual information about risk events as they respond to Risk Notables. With Splunk Enterprise Security 7.3 you’ll get to experience the following enhancements:  Drill-down Searches are a long standing feature of Splunk Enterprise Security’s Incident Review Dashboard. Recently in Splunk Enterprise Security 7.2, we added support for multiple Drill-down Searches so that content engineers can provide analysts with as many options as they need to gather additional information via pre-made searches. Now, all available Drill-down Searches are available in the Risk Event Timeline, when applicable.  The new Drill-down Dashboards, launched in this new release, now also appear in Risk Event Timeline in addition to the Incident Review dashboard, if applicable.  Contributing Events are now refined in Risk Event Timeline to show analysts the raw events associated with a Risk Event, regardless of the presence of drill-down searches or drill-down dashboards having been defined. This provides analysts with the opportunity to gather more information about Risk Events. Additionally, risk events generated by cloud-based streaming analytics, included with Splunk Enterprise Security for customers operating in Splunk Cloud, will also benefit from the Contributing Events refinement for Risk Event Timeline.  Upgrade today to Enterprise Security 7.3! Splunk Enterprise Security 7.3 updates are available now in both cloud and on-prem environments.  We’re listening! If you have ideas and requests, please submit them to Splunk Ideas. To learn more about Splunk Enterprise Security 7.3, check out the release notes. Happy Splunking! ... View more

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.15.0 and v4.16.0). With these releases, there are 20 new detections, 4 new analytic stories, 7 updated analytics, 2 updated behavioral analytics detections, 3 new behavioral analytics detections, 2 updated analytic stories, and  2 deprecated analytics now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: Malware story that groups 6 new analytics to help detect a new phishing-driven malware campaign distributing DarkGate malware, which utilizes stolen email threads to trick users into downloading malicious payloads via hyperlinks. A new zero-day vulnerability in SysAid On-Prem Software (CVE-2023-47246) that allows attackers to upload a WebShell and other payloads, gaining unauthorized access and control. A new analytic Risk Rule for Dev Sec Ops by Repository that detects by correlating repository and risk score to identify patterns and trends in the data based on the level of risk associated, to provide a comprehensive view of the risk landscape and helps to make informed decisions. Additionally, we released an updated Analytics Story, which groups 10 new analytics to help security operations teams identify the potential compromise of Azure Active Directory accounts. A critical security update, CVE-2023-4966, for the NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. This vulnerability, if exploited, can lead to unauthorized data disclosure and possibly session hijacking. Along with "PlugX RAT" or "Kaba" known as the "silent infiltrator," it's the go-to tool for sophisticated hackers with one goal in mind: espionage. Additionally, we updated three existing analytics to identify suspicious file creation in the root drive observed in NjRAT, and two vulnerabilities privilege escalation flaws in Atlassian Confluence. New Analytics (20) Azure AD Device Code Authentication Azure AD Tenant Wide Admin Consent Granted Azure AD Multiple AppIDs and UserAgents Authentication Spike Azure AD Block User Consent For Risky Apps Disabled Azure AD User Consent Blocked for Risky Application Azure AD OAuth Application Consent Granted By User Azure AD User Consent Denied for OAuth Application Azure AD New MFA Method Registered Azure AD Multiple Denied MFA Requests For User Azure AD Multi-Source Failed Authentications Spike Risk Rule for Dev Sec Ops by Repository Windows ConHost with Headless Argument Windows CAB File on Disk Windows WinDBG Spawning AutoIt3 Windows MSIExec Spawn WinDBG Windows Modify Registry Default Icon Setting Windows AutoIt3 Execution Splunk App for Lookup File Editing RCE via User XSLT Splunk XSS in Highlighted JSON Events Citrix ADC and Gateway Unauthorized Data Disclosure New Analytic Stories (4)  DarkGate Malware SysAid On-Prem Software CVE-2023-47246 Vulnerability Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966 PlugX Updated Analytics (7) AWS ECR Container Scanning Findings High AWS ECR Container Scanning Findings Medium AWS ECR Container Scanning Findings Low Informational Unknown AWS ECR Container Upload Outside Business Hours  Windows Admin Permission Discovery Confluence CVE-2023-22515 Trigger Vulnerability Confluence Data Center and Server Privilege Escalation Updated Behavioral Analytics Detections (2) All BA detections updated to use IN command in SPLv2 instead of using multiple ORs in the detection analytic Added a new key detection_type = STREAMING in the generated BA yaml files New Behavioral Analytics Detections (3) Detect Prohibited Applications Spawning cmd exe browsers (validation) Detect Prohibited Applications Spawning cmd exe office (validation) Detect Prohibited Applications Spawning cmd exe powershell (validation) Updated Analytic Stories (2) Azure Active Directory Account Takeover Splunk Vulnerabilities Deprecated Analytics (2)     Correlation by Repository and Risk Correlation by User and Risk The team has also published the following blogs:  More Than Just a RAT: Unveiling NjRAT's MBR Wiping Capabilities For all our tools and security content, please visit research.splunk.com.  — The Splunk Threat Research Team   ... View more

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.13.0, v4.14.0.). With these releases, there are 22 new detections and 6 new analytic stories, and 3 updated analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: An analytic story for a previously unknown vulnerability in the Cisco IOS XE software's Web User Interface (Web UI) feature that is currently being exploited and effectively grants full control of the compromised device.  An analytic story focused on Windows SIP WinVerifyTrust subversion and an analytic story for Microsoft SharePoint Server to detect a flaw in handling authentication tokens, which allows an attacker to escalate privileges and gain unauthorized access to the SharePoint environment.  A NjRat analytic story that contains 7 detections to detect attack techniques relating to NjRat, a notorious remote access trojan (RAT). The detections include tracking file write operations for dropped files, scrutinizing registry modifications to provide persistence mechanisms, monitoring suspicious processes, self-deletion behaviors, browser credential parsing, firewall configuration alterations, spreading itself via removable drive, and other potentially malicious actions. Additionally, we released new analytics to address Splunk CVEs that focus on attacker behavior targeting Splunk environments, along with 2 new analytics for CVEs related to Remote Code Execution (RCE) in WS_FTP and TeamCity On-Premises.  New Analytics (22) Cisco IOS XE Implant Access Detect Certipy File Modifications (External Contributor: Steven Dick) Windows Domain Admin Impersonation Indicator Windows Registry SIP Provider Modification Microsoft SharePoint Server Elevation of Privilege Windows Steal Authentication Certificates - ESC1 Abuse (External Contributor: Steven Dick) Windows SIP Provider Inventory Windows SIP WinVerifyTrust Failed Trust Validation Confluence CVE-2023-22515 Trigger Vulnerability Windows Abused Web Services Windows Admin Permission Discovery JetBrains TeamCity RCE Attempt WS FTP Remote Code Execution Splunk Reflected XSS on App Search Table Endpoint Splunk RCE via Serialized Session Payload Splunk DoS Using Malformed SAML Request Splunk Absolute Path Traversal Using runshellscript Windows Modify Registry With MD5 Reg Key Name Windows Njrat Fileless Storage via Registry Windows Executable in Loaded Modules Windows Disable or Modify Tools Via Taskkill Windows Delete or Modify System Firewall New Analytic Stories (6) Subvert Trust Controls SIP and Trust Provider Hijacking Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357 Cisco IOS XE Software Web Management User Interface vulnerability NjRat WS FTP Server Critical Vulnerabilities JetBrains TeamCity Unauthenticated RCE Updated Analytics (3) Citrix ADC Exploitation CVE-2023-3519 Windows Replication Through Removable Media TOR Traffic For all our tools and security content, please visit research.splunk.com.  — The Splunk Threat Research Team ... View more

In our latest release of Splunk Enterprise Security 7.2, we are excited to introduce capabilities that deliver an improved workflow experience for simplified investigations; enhanced visibility and reduced manual workload; and customized investigation workflows for faster decision-making. The majority of these updates and new features were requested directly from Splunk Enterprise Security (ES) users and submitted through the Splunk Ideas portal! Keep the great ideas and suggestions coming - we’re listening! With these new capabilities, ES helps you see more, act faster, and simplify your investigations.  Improved workflow experience for simplified investigations  Multiple Drill-down Searches on Correlation Rules: Users can now create multiple drill-down searches on correlation rules to quickly narrow their investigation stemming from a notable event.   Enhanced Risk Analysis Dashboard: With the enhanced risk analysis dashboard, security analysts have a deeper, more holistic layer of visibility across all detection events. The SOC can assess organizational risk faster from users and entities, and analysts can drill down on specific users and entities for additional context on risk contributions.  Dispositions in Incident Review: With ES 7.2, ES Administrators can require disposition when closing notables. This provides a feedback loop into detection engineering, allowing efficient review of security detections. Hyperlinks in Correlation Search “Next Steps”: This new capability enables ES administrators to include a link to resources such as wiki pages, runbooks, Splunk dashboards, or even third party websites, as part of an analysts’ response workflow. Analysts are able to view details as part of an event’s “Next Steps” which enhances and accelerates the analyst’s investigation process. Enhanced visibility and reduced manual workload With the new Auto Refresh in Incident Review, ES will automatically showcase the most up-to-date events for the SOC. Administrators can now customize and control the frequency of the auto refresh.  Security analysts can currently prioritize notable events within Splunk Enterprise Security, but often want to visualize it by date and time. That’s why we brought back the Timeline function in Incident Review. This interactive timeline for notables supports analysts by enabling the SOC to quickly gain insight into anomalous activity, such as an unusually high number of notables around a certain time, and therefore prioritize time-sensitive critical incidents.  Customize investigation workflows for faster decision-making ES 7.2 introduces optional enhancements to the Incident Review dashboard that provides a more customizable experience when investigating notable events. Analysts are now able to customize and configure the Incident Review dashboard with table filters and columns that provide the capability for practitioners to look at events that matter to them.  Additionally, they can now create saved views of their customized Incident Review Dashboard and share them with other Enterprise Security analysts.   Upgrade today to Splunk Enterprise Security 7.2!  Ready to get hands on with Enterprise Security 7.2? Register for our Tech Talk! If you have ideas and requests, please submit them to Splunk Ideas! ... View more

In the last month, the Splunk Threat Research Team (STRT) has had 1 release of new security content via the Enterprise Security Content Update (ESCU) app (v4.12.0.). With this release, there are 8 new detections and 1 new analytic story now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: A Forest Blizzard analytic story that contains detections to detect “Living Off The Land” attack techniques using headless web browsers to exfiltrate data files through legitimate platforms like Mockbin via ZIP archives containing LNK files. These techniques were observed in the cyberattack on Ukraine’s energy infrastructure, orchestrated via deceptive emails to steal NTLMv2 hashes by various advanced persistent threat (APT) groups. Six new detections related to Windows Active Directory enumeration, specifically to detect activity related to the usage of a popular red team tool such as Powerview, which are typically used for reconnaissance by attackers.  New Analytic Story:  Forest Blizzard New Detections: Windows Find Domain Organizational Units with GetDomainOU Headless Browser Usage Headless Browser Mockbin or Mocky Request Windows Get Local Admin with FindLocalAdminAccess Windows Forest Discovery with GetForestDomain Windows Find Interesting ACL with FindInterestingDomainAcl Windows AD Privileged Object Access Activity (External Contributor: Steven Dick) Windows AD Abnormal Object Access Activity (External Contributor: Steven Dick) The team has also published the following blogs: Sharing is Not Caring: Hunting for Network Share Discovery Defending the Gates: Understanding and Detecting Ave Maria (Warzone) RAT Mockbin and the Art of Deception: Tracing Adversaries, Going Headless and Mocking APIs For all our tools and security content, please visit research.splunk.com.  — The Splunk Threat Research Team ... View more

In this release, we provide three new capabilities to help security teams detect suspicious behavior in real-time, quickly discover the scope of an incident to respond accurately, and improve security workflow efficiencies using embedded frameworks.  We've introduced cloud-based streaming analytics* cloud-based streaming analytics integrates with Splunk’s risk-based alerting (RBA) framework to deliver enhanced analytics for improved situational awareness and response time to suspicious behavior.  This feature brings scalable real-time streaming analytics for a broader range of advanced security detections and focuses on addressing common use cases including insider threat, credential access and compromise, lateral movement, and living off the land attacks. *Initial availability to eligible US-East Splunk Cloud customers only   Splunk Enterprise Security 7.1 also brings a new visualization feature, Threat Topology, which provides a comprehensive view into security incidents, enabling analysts to quickly determine the scope of security incidents, and achieve faster time to initiate an investigation. Last but not least, with our new MITRE ATT&CK® visualization security analysts can quickly build situational awareness around an incident in the context of the MITRE ATT&CK Matrix. Security analysts can leverage and visualize MITRE ATT&CK annotations in Splunk Enterprise Security risk events and get a comprehensive picture of how the asset or identity has been impacted by various tactics and techniques. So Why Wait? Upgrade today to Splunk Enterprise Security 7.1!      ... View more