Release notes for Splunk Enterprise Security

This version of Splunk Enterprise Security is compatible only with specific versions of the Splunk platform. See Splunk Enterprise system requirements in the Installation and Upgrade Manual.

Because the navigation now respects your local changes, you might need to make changes to the navigation menu bar after upgrading. See Configure > General > Navigation to see which views are upgraded, new, or deprecated.

The ES Health app is installed and will be disabled for all Splunk Cloud customers. This app is enabled by the Splunk Cloud Platform only during upgrades to ensure that the stacks get upgraded faster. Do not turn on the ES Health app.

Current versions of Splunk Enterprise Security only support TAXII version 1.0 and TAXII version 1.1.

What's new

Splunk Enterprise Security version 7.3.0 was released on December 19, 2023 and includes the following enhancements based on suggestions provided in the Splunk Ideas portal:

Splunk Idea	New feature	Description
ESSID-I-67 and ESSID-I-69	Ability to create, delete, edit, and access multiple drill-down dashboards for a notable.	Ability to create, delete, edit, and access multiple drill-down dashboards for a notable event to get additional context during investigations. See Use drilldown searches and dashboards in Splunk Enterprise Security during investigations.
EID-I-455	Prevent event lag by using index time for correlation searches.	Configure correlation searches using index time to focus on the most recent events during an investigation. For more information on configuring correlation searches using index time, see Set a timestamp for correlation searches. For more information on troubleshooting search results when using index time, see Troubleshoot search results.

Splunk Enterprise Security version 7.3.0 also includes the following new features and improvements:

New feature	Description
Option to include suppressed notables in dashboard metrics.	Ability to turn on or turn off suppressed notables for displaying the metrics on the Executive Summary dashboard and the SOC Operations dashboard. For more information, see Include or exclude suppressed notables in dashboard metrics.
Enhancements to the Risk Timeline visualization.	Ability to customize the Risk Timeline visualization using the risk_event_timeline_search saved search. For more information on the Risk Timeline visualization, see How the Risk Timeline gets populated.
Improvements to investigation workflows on the Incident Review page.	Additional warning messages prior to deleting a shared view or make a default global view private so that users don't lose access. For more information, see Delete a shared view.
On-boarding guidance on how to find features on the Incident Review page.	A 3-step guided onboarding tutorial to help analysts find Incident Review features, which can help improve their workflow through focused insight on notables and shared views with colleagues. For more information on the onboarding guidance, see Onboarding guidance to improve analyst workflow on Incident Review page in Splunk Enterprise Security.
Detection enrichment for specific tiers of behavioral analytics service	Ability to enrich detections using asset and identity modular inputs to ingest data into the behavioral analytics service. See Use behavioral analytics service with Splunk Enterprise Security 7.1.0 or higher.
Updates to the supported data sources supported by the behavioral analytics service	For more information on the supported data sources, see Supported data sources with behavioral analytics service.

Limitations

When you upgrade to Splunk Enterprise Security version 7.1.x, contributing risk events for risk notables might not be visible in the Risk Event Timeline if the risk notables are created before the upgrade and any one of the following conditions are met:

• CIM entity zones are enabled
• Changes are made to the CIM entity zones that apply to existing risk notables
• Asset and identity framework is disabled

For more information, see After upgrading to Splunk Enterprise Security Version 7.1.0.

Additionally, if you make changes to the CIM entity zones or the assets and identity framework, you might cause a change to the risk object normalization, which might result in contributing risk events not being visible in the Risk Event Timeline visualization. This pertains to risk notables that were created prior to making the changes to the CIM entity zones and assets and identity framework.

Deprecated or removed features

Following is a list of deprecated or removed features in Enterprise Security:

Deprecated Feature	Comments
No support for sending notable events from Splunk Enterprise Security to Splunk UBA	Support for sending notable events from Splunk ES to Splunk UBA will be removed in a future release. Configure a Splunk ES Notables data source or use Splunk Direct to pull notable events from Splunk ES to Splunk UBA. See Pull notable events from Splunk ES to Splunk UBA.
No browser support for Internet Explorer	Browser support for Internet Explorer 11 is no longer available in Enterprise Security version 6.6.0 or higher.
No support for glass tables	Glass tables are no longer available in Enterprise Security version 6.6.0 or higher. A comparable feature called Dashboard Studio is available in the Splunk platform. See What is the Splunk Dashboard Studio? in the Splunk Cloud Platform Splunk Dashboard Studio manual and What is the Splunk Dashboard Studio? in the Splunk Enterprise Splunk Dashboard Studio manual. Do not upgrade to ES 6.6.0 or higher if you need to continue using Glass Tables.
Extreme Search (Splunk_SA_ExtremeSearch) macros removed	The following Extreme Search macros that were previously deprecated are removed as of Enterprise Security version 6.6.0: [xs_default_direction_concepts], [xs_default_magnitude_concepts], and [xs_default_change_concepts]
No support for Malware Domains threatlist	The Malware Domains threatlist is not supported in Enterprise security version 6.5.0 or higher.
Domain Dossier is removed from Enterprise Security	Domain Dossier is not available in Enterprise Security 6.5.0 or higher.
Option to search with Google within the ES application may pose inherent security risks as it may direct you to third party websites.	Option to search with Google is not available in Enterprise Security 6.5.0 or higher.
The master_host settings for Identity Manager and Intelligence Downloads in search head pooling	Settings are obsolete for Enterprise Security 6.3.0 and higher.
Bundled technology add-ons in the ES installer. See Add-ons.	Bundled technology add-ons are not included in Enterprise Security 6.2.0 and higher.
Compatibility with Python 2 and Machine Learning Toolkit 4.0.	Enterprise Security 6.1.x is compatible with Python 3 only. Enterprise Security 6.1.x release is compatible with Splunk Enterprise versions that ship with only Python 3 interpreter and MLTK 5.0 and higher.
Splunk Add-on for Tenable and Splunk_TA_nessus	These add-ons are removed from the ES installer.
Threat intelligence sample files	These threat intelligence sample files are removed from DA-ESS-ThreatIntelligence/default/data/threat_intel/: Appendix_D_FQDNs.xml, Appendix_F_SSLCertificates.xml, Appendix_G_IOCs_No_OpenIOC.xml, fireeye-pivy-report-with-indicators.xml, and Mandiant_APT1_Report.xml
Setting that enables SSL for Splunk Web	A system setting that is not enabled and disabled by the Enterprise Security app.
The luhn_lookup custom lookup script for detecting personally identifiable credit card information	Enterprise Security uses luhn_lite_lookup instead of luhn_lookup.
The getcron search command	join my_saved_search_name [| rest splunk_server=local count=0 /services/saved/searches | table title,cron_schedule | rename title as my_saved_search_name, cron_schedule as cron] instead of the search command: | getcron inputField=my_saved_search_name outputField=cron.
Audit dashboard for content profile	Use Content Management data model row expansion instead of using Audit dashboard for content profile. See Expand Content Management searches to view dependency and usage information in Splunk Enterprise Security.
Lookup generating search for Traffic Volume Tracker	Removing this search resolves issues with exporting all objects in Content Management.
Automatic (continuous) creation and deployment of the "indexer package" (Splunk_TA_ForIndexers) to the Indexer tier via deployment server proxy feature	See Deploy add-ons to indexers.
The notable_adhoc_invocations macro in the SA-ThreatIntelligence app	Use the incident review saved search to fix ad-hoc alerts on sequenced events instead.
Alexa Top 1 Million Sites	See Included generic intelligence sources for alternatives.

End of support schedule

Refer to Splunk Support Policy to verify the end of support date for your Enterprise Security version.

Add-ons

Technology-specific add-ons are supported differently than the add-ons that make up the Splunk Enterprise Security framework. For more information on the support provided for add-ons, see Support for Splunk Enterprise Security and provided add-ons in the Release Notes manual.

Deprecated or removed add-ons

Splunk Enterprise Security no longer includes many of the technology add-ons in the Splunk Enterprise Security package. Instead, you can download the technology add-ons that you need directly from Splunkbase. This change improves the performance of Splunk ES by reducing the number of unnecessary enabled add-ons, and allows you to install the most appropriate and updated versions of add-ons when you install Splunk ES.

The following technology add-ons are removed from the installer, but still supported:

• Splunk Add-on for Blue Coat ProxySG
• Splunk Add-on for McAfee
• Splunk Add-on for Juniper
• Splunk Add-on for Microsoft Windows
• Splunk Add-on for Oracle Database
• Splunk Add-on for OSSEC
• Splunk Add-on for RSA SecurID
• Splunk Add-on for Sophos
• Splunk Add-on for FireSIGHT
• Splunk Add-on for Symantec Endpoint Protection
• Splunk Add-on for Unix and Linux
• Splunk Add-on for Websense Content Gateway

The following technology add-ons are removed from the installer, supported for the next year, but are deprecated and will reach end of support one year from the release date of this Enterprise Security version:

• TA-airdefense
• TA-alcatel
• TA-cef
• TA-fortinet
• TA-ftp
• TA-nmap
• TA-tippingpoint
• TA-trendmicro

End of Life

• Splunk Add-on for NetFlow announced: March 18, 2019 | Ends: June 16, 2019
• Splunk Add-on for Tenable announced: April 8, 2019 | Ends: July 7, 2019

Updated add-ons

The Common Information Model Add-on is updated to version 5.3.1.

Libraries

The following libraries are included in this release:

• Splunk_ML_Toolkit-5.4.0-1677171559342
• Splunk_SA_Scientific_Python_linux_x86_64-3.1.0-0
• Splunk_SA_Scientific_Python_windows_x86_64-3.1.0-0