Release notes for Splunk Enterprise Security
This version of Splunk Enterprise Security is compatible only with specific versions of the Splunk platform. See Splunk Enterprise system requirements in the Installation and Upgrade Manual.
Because the navigation now respects your local changes, you might need to make changes to the navigation menu bar after upgrading. See Configure > General > Navigation to see which views are upgraded, new, or deprecated.
Typically new enhancements or features are carried over from previous releases (for both on-prem and Cloud versions), unless mentioned otherwise in the list of deprecated or removed features. For information on features introduced in the earlier releases, refer to the corresponding version of the release notes.
No new features are introduced in this maintenance release.
Following is a list of bug fixes and behavior changes:
|Ability to delete asset and identity lookup source||Delete source file configuration of an asset or an identity lookup configuration if you do not want a specific asset or identity lookup source file to be processed when the Identity Manager modular input runs. For more information on deleting asset and identity lookup source, see Delete the Identity lookup or Delete the Asset lookup in the Administer Splunk Enterprise Security manual.|
Following is a list of deprecated features in Enterprise Security:
|Domain Dossier is deprecated as of Enterprise Security 6.4.0||Domain Dossier is scheduled for removal in a future release.|
|Option to search with Google within the ES application may pose inherent security risks as it may direct you to third party websites.||Option to search with Google will not be available in Enterprise Security 6.5.0 or higher.|
||Settings are obsolete for Enterprise Security 6.3.0 and higher.|
|Bundled technology add-ons in the ES installer. See Add-ons.||Bundled technology add-ons are not included in Enterprise Security 6.2.0 and higher.|
|Compatibility with Python 2 and Machine Learning Toolkit 4.0.||Enterprise Security 6.1.x is compatible with Python 3 only.|
Enterprise Security 6.1.x release is compatible with Splunk Enterprise versions that ship with only Python 3 interpreter and MLTK 5.0 and higher.
|Splunk Add-on for Tenable and Splunk_TA_nessus||These add-ons are removed from the ES installer.|
|Threat intelligence sample files||These threat intelligence sample files are removed from |
|Setting that enables SSL for Splunk Web||A system setting that is not enabled and disabled by the Enterprise Security app.|
|Extreme Search app (Splunk_SA_ExtremeSearch) from the Splunk Enterprise Security package||The following Extreme Search macros are deprecated: |
||Enterprise Security uses |
||join my_saved_search_name [| rest splunk_server=local count=0 /services/saved/searches | table title,cron_schedule | rename title as my_saved_search_name, cron_schedule as cron] instead of the search command:|
|Audit dashboard for content profile||Use Content Management data model row expansion instead of using Audit dashboard for content profile. See Expand Content Management searches to view dependency and usage information in Splunk Enterprise Security.|
|Lookup generating search for Traffic Volume Tracker||Removing this search resolves issues with exporting all objects in Content Management.|
|Automatic (continuous) creation and deployment of the "indexer package" (Splunk_TA_ForIndexers) to the Indexer tier via deployment server proxy feature||See Deploy add-ons to indexers.|
||Use the incident review saved search to fix ad-hoc alerts on sequenced events instead.|
|Alexa Top 1 Million Sites||See Included generic intelligence sources for alternatives.|
End of support schedule
Refer to Splunk Support Policy to verify the end of support date for your Enterprise Security version.
Technology-specific add-ons are supported differently than the add-ons that make up the Splunk Enterprise Security framework. For more information on the support provided for add-ons, see Support for Splunk Enterprise Security and provided add-ons in the Release Notes manual.
Deprecated or removed add-ons
Splunk Enterprise Security no longer includes many of the technology add-ons in the Splunk Enterprise Security package. Instead, you can download the technology add-ons that you need directly from Splunkbase. This change improves the performance of Splunk ES by reducing the number of unnecessary enabled add-ons, and allows you to install the most appropriate and updated versions of add-ons when you install Splunk ES.
The following technology add-ons are removed from the installer, but still supported:
- Splunk Add-on for Blue Coat ProxySG
- Splunk Add-on for Bro IDS
- Splunk Add-on for Juniper
- Splunk Add-on for Microsoft Windows
- Splunk Add-on for Oracle Database
- Splunk Add-on for OSSEC
- Splunk Add-on for RSA SecurID
- Splunk Add-on for Sophos
- Splunk Add-on for FireSIGHT
- Splunk Add-on for Symantec Endpoint Protection
- Splunk Add-on for Unix and Linux
- Splunk Add-on for Websense Content Gateway
The following technology add-ons are removed from the installer, supported for the next year, but are deprecated and will reach end of support one year from the release date of this Enterprise Security version:
End of Life
- Splunk Add-on for NetFlow announced: March 18, 2019 | Ends: June 16, 2019
- Splunk Add-on for Tenable announced: April 8, 2019 | Ends: July 7, 2019
The Common Information Model Add-on is updated to version 4.18.0.
Fixed issues for Splunk Enterprise Security
This documentation applies to the following versions of Splunk® Enterprise Security: 6.4.1