Release Notes for Splunk Enterprise Security
This version of Splunk Enterprise Security is compatible only with specific versions of the Splunk platform. See Splunk Enterprise system requirements in the Installation and Upgrade Manual.
Because the navigation now respects your local changes, you might need to make changes to the navigation menu bar after upgrading. See Configure > General > Navigation to see which views are upgraded, new, or deprecated.
Splunk Enterprise Security version 5.3.0 includes the following enhancements.
|New Feature or Enhancement||Description|
|Improved Splunk Enterprise Security installer to better support Search Head Clustering|| The ES installer now integrates directly on the deployer in a search head cluster environment and no longer requires a staging server. In addition, the shipped technology add-ons are no longer installed as part of the post-install configuration. See Install Splunk Enterprise Security in a search head cluster environment and Upgrade Splunk Enterprise Security in a search head cluster environment.
|Improved App Import and Export Support|| Splunk Enterprise Security no longer selectively imports apps and add-ons based on the name of the app or add-on. Knowledge objects in apps and add-ons that are installed on the same search head as Splunk Enterprise Security and exported to other apps or globally are visible in Splunk Enterprise Security. To verify a global export from the search head, check the |
|Migration of CSV-based trackers to KV-Store|| The following CSV-based trackers have now been migrated to the KV Store to improve performance in large deployments:
|Managed Lookups Audit dashboard||The Managed Lookups Audit dashboard reports on managed lookups and collections such as services, data, transforms, KV Store lookups, and CSV lookups in Enterprise Security. You can use this to help determine if any managed lookups are growing too large for your particular environment's performance and need to be pruned. See Managed Lookups Audit|
|Improved the default maximum age for threat intelligence feed||The threat intelligence feed now has a 30 day default maximum age for KV Store retention. If you purposely store this data in the KV Store indefinitely, you need to revise your settings. See Configure threat source retention.|
|Improved the filter for lookup generating search type||Content Management includes a new menu option for filtering on the lookup generating search type. The lookup generating search is editable in the search-driven lookup editor. See Create and manage search-driven lookups in Splunk Enterprise Security.|
|Updated the performance test results||The performance test results are updated. See Performance test results.|
The audit dashboard for Content Profile is removed in favor of the Content Management data model row expansion. See Expand Content Management searches to view dependency and usage information in Splunk Enterprise Security.
The deprecated lookup generating search for Traffic Volume Tracker is now removed, resolving an issue with exporting all objects in Content Management.
In a future release, the Extreme Search app (Splunk_SA_ExtremeSearch) will be deprecated from the Splunk Enterprise Security package. As part of this process, there will be replacements for some saved searches and correlation searches that currently ship with Enterprise Security.
notable_adhoc_invocations macro in the SA-ThreatIntelligence app is deprecated in favor of the incident review saved search to fix ad-hoc alerts on sequenced events. This macro will be removed in a future release.
The automatic (continuous) creation and deployment of the "indexer package" (Splunk_TA_ForIndexers) to the Indexer tier via deployment server proxy feature is deprecated. See Deploy add-ons to indexers.
Alexa Top 1 Million Sites is deprecated. See Included generic intelligence sources for alternatives.
Technology-specific add-ons are supported differently than the add-ons that make up the Splunk Enterprise Security framework. See Support for Splunk Enterprise Security and provided add-ons in the Release Notes manual.
The automatic inclusion of add-ons listed in Technology-specific add-ons provided with Enterprise Security that was previously deprecated is no longer deprecated. The add-ons are still included. The current change is that they are no longer automatically installed as part of the post-install configuration in a search head cluster environment. See Install Splunk Enterprise Security in a search head cluster environment and Upgrade Splunk Enterprise Security in a search head cluster environment.
End of Life
- Splunk Add-on for NetFlow announced: March 18, 2019 | Ends: June 16, 2019
- Splunk Add-on for Tenable announced: April 8, 2019 | Ends: July 7, 2019
The Common Information Model Add-on is updated to version 4.13.0.
Fixed Issues for Splunk Enterprise Security
This documentation applies to the following versions of Splunk® Enterprise Security: 5.3.0