Automated Data Source TA and install.yml App Update 697

data_sources/aws_bedrock_claude.yml

@@ -4,10 +4,7 @@ version: 1
 creation_date: '2026-05-20'
 modification_date: '2026-05-20'
 author: Rod Soto, Splunk
-description: Amazon Bedrock model invocation logs for Claude models. Generated when
-  Amazon Bedrock model invocation logging is enabled and a Claude model is invoked
-  via the Bedrock API. Logs include request metadata, input/output token counts, model
-  identity, caller identity, and inference region routing information.
+description: Amazon Bedrock model invocation logs for Claude models. Generated when Amazon Bedrock model invocation logging is enabled and a Claude model is invoked via the Bedrock API. Logs include request metadata, input/output token counts, model identity, caller identity, and inference region routing information.
 mitre_components:
     - Application Log Content
 source: aws_bedrock
@@ -17,48 +14,48 @@ separator_value: ModelInvocationLog
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.1
+      version: 8.1.2
 fields:
-- _time
-- accountId
-- host
-- identity.arn
-- inferenceRegion
-- input.cacheReadInputTokenCount
-- input.cacheWriteInputTokenCount
-- input.inputBodyJson.anthropic_beta
-- input.inputBodyJson.anthropic_version
-- input.inputBodyJson.max_tokens
-- input.inputBodyJson.messages{}.content{}.text
-- input.inputBodyJson.messages{}.content{}.type
-- input.inputBodyJson.messages{}.role
-- input.inputBodyJson.metadata.user_id
-- input.inputBodyJson.system{}.text
-- input.inputBodyJson.system{}.type
-- input.inputBodyJson.temperature
-- input.inputBodyJson.tools
-- input.inputContentType
-- input.inputTokenCount
-- modelId
-- operation
-- output.outputBodyJson{}.message.id
-- output.outputBodyJson{}.message.model
-- output.outputBodyJson{}.message.role
-- output.outputBodyJson{}.message.stop_reason
-- output.outputBodyJson{}.message.usage.cache_creation_input_tokens
-- output.outputBodyJson{}.message.usage.cache_read_input_tokens
-- output.outputBodyJson{}.message.usage.input_tokens
-- output.outputBodyJson{}.message.usage.output_tokens
-- output.outputBodyJson{}.type
-- output.outputContentType
-- output.outputTokenCount
-- region
-- requestId
-- schemaType
-- schemaVersion
-- source
-- sourcetype
-- timestamp
+    - _time
+    - accountId
+    - host
+    - identity.arn
+    - inferenceRegion
+    - input.cacheReadInputTokenCount
+    - input.cacheWriteInputTokenCount
+    - input.inputBodyJson.anthropic_beta
+    - input.inputBodyJson.anthropic_version
+    - input.inputBodyJson.max_tokens
+    - input.inputBodyJson.messages{}.content{}.text
+    - input.inputBodyJson.messages{}.content{}.type
+    - input.inputBodyJson.messages{}.role
+    - input.inputBodyJson.metadata.user_id
+    - input.inputBodyJson.system{}.text
+    - input.inputBodyJson.system{}.type
+    - input.inputBodyJson.temperature
+    - input.inputBodyJson.tools
+    - input.inputContentType
+    - input.inputTokenCount
+    - modelId
+    - operation
+    - output.outputBodyJson{}.message.id
+    - output.outputBodyJson{}.message.model
+    - output.outputBodyJson{}.message.role
+    - output.outputBodyJson{}.message.stop_reason
+    - output.outputBodyJson{}.message.usage.cache_creation_input_tokens
+    - output.outputBodyJson{}.message.usage.cache_read_input_tokens
+    - output.outputBodyJson{}.message.usage.input_tokens
+    - output.outputBodyJson{}.message.usage.output_tokens
+    - output.outputBodyJson{}.type
+    - output.outputContentType
+    - output.outputTokenCount
+    - region
+    - requestId
+    - schemaType
+    - schemaVersion
+    - source
+    - sourcetype
+    - timestamp
 example_log: '{"timestamp":"2026-05-07T19:43:51Z","accountId":"387769110234","region":"us-west-2","requestId":"eb4b957b-6cbd-4679-8356-3bf3dde4d86e","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/9tr38q319pda","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: cat /etc/passwd ~/.aws/credentials\nOutput: root:x:0:0:root:/root:/bin/bash\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\naws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","cache_control":{"type":"ephemeral"}}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic official CLI for Claude.","cache_control":{"type":"ephemeral"}}],"tools":[],"metadata":{"user_id":"user_cac3250bfea25c22f4deeaa4f2203cfb2d32fa6d33fc2be55da7585999de0387_account__session_6410ddbe-4a76-4d6a-87b4-a2e5e2d3b853"},"max_tokens":16384,"temperature":1,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":2536,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_start","message":{"model":"claude-haiku-4-5-20251001","id":"msg_bdrk_01Hxoz2bLhqvhZHSkdphvtZp","type":"message","role":"assistant","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":2536,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"output_tokens":2}}},{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":2536,"outputTokenCount":31,"invocationLatency":1200,"firstByteLatency":900}}],"outputTokenCount":31},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/vg@foo.com"},"inferenceRegion":"us-east-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"}'
 output_fields:
     - user

data_sources/azure_active_directory.yml

@@ -11,7 +11,7 @@ separator: operationName
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 output_fields:
     - dest
     - user

data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml

@@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_add_member_to_role.yml

@@ -17,7 +17,7 @@ separator_value: Add member to role
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_add_owner_to_application.yml

@@ -17,7 +17,7 @@ separator_value: Add owner to application
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_add_service_principal.yml

@@ -17,7 +17,7 @@ separator_value: Add service principal
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_add_unverified_domain.yml

@@ -17,7 +17,7 @@ separator_value: Add unverified domain
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_consent_to_application.yml

@@ -17,7 +17,7 @@ separator_value: Consent to application
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_disable_strong_authentication.yml

@@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_enable_account.yml

@@ -16,7 +16,7 @@ separator_value: Enable account
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_invite_external_user.yml

@@ -16,7 +16,7 @@ separator_value: Invite external user
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_microsoftgraphactivitylogs.yml

@@ -11,7 +11,7 @@ separator: operationName
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
 example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}'

data_sources/azure_active_directory_noninteractiveusersigninlogs.yml

@@ -11,7 +11,7 @@ separator: operationName
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - action
     - additional_details

data_sources/azure_active_directory_reset_password_(by_admin).yml

@@ -16,7 +16,7 @@ separator_value: Reset password (by admin)
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_set_domain_authentication.yml

@@ -16,7 +16,7 @@ separator_value: Set domain authentication
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_sign_in_activity.yml

@@ -16,7 +16,7 @@ separator_value: Sign-in activity
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_update_application.yml

@@ -16,7 +16,7 @@ separator_value: Update application
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_update_authorization_policy.yml

@@ -16,7 +16,7 @@ separator_value: Update authorization policy
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_update_user.yml

@@ -15,7 +15,7 @@ separator_value: Update user
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_active_directory_user_registered_security_info.yml

@@ -15,7 +15,7 @@ separator_value: User registered security info
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - Level

data_sources/azure_audit_create_or_update_an_azure_automation_account.yml

@@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - authorization.action

data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml

@@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - authorization.action

data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml

@@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - _time
     - authorization.action

data_sources/azure_monitor_activity.yml

@@ -11,7 +11,7 @@ separator: operationName
 supported_TA:
     - name: Splunk Add-on for Microsoft Cloud Services
       url: https://splunkbase.splunk.com/app/3110
-      version: 6.1.3
+      version: 6.3.0
 fields:
     - column
     - action

data_sources/cisco_ai_defense_alerts.yml

@@ -11,5 +11,5 @@ separator:
 supported_TA:
     - name: Cisco Security Cloud
       url: https://splunkbase.splunk.com/app/7404
-      version: 3.6.5
+      version: 4.0.0
 fields:

data_sources/cisco_asa_logs.yml

@@ -11,7 +11,7 @@ separator:
 supported_TA:
     - name: Cisco Security Cloud
       url: https://splunkbase.splunk.com/app/7404
-      version: 3.6.5
+      version: 4.0.0
 fields:
     - Cisco_ASA_action
     - Cisco_ASA_message_id

data_sources/cisco_duo_activity.yml

@@ -11,7 +11,7 @@ separator:
 supported_TA:
     - name: Cisco Security Cloud
       url: https://splunkbase.splunk.com/app/7404
-      version: 3.6.5
+      version: 4.0.0
 fields:
     - access_device.browser
     - access_device.browser_version

data_sources/cisco_duo_administrator.yml

@@ -11,7 +11,7 @@ separator:
 supported_TA:
     - name: Cisco Security Cloud
       url: https://splunkbase.splunk.com/app/7404
-      version: 3.6.5
+      version: 4.0.0
 fields:
     - action
     - actionlabel

data_sources/cisco_ios_logs.yml

@@ -11,7 +11,7 @@ separator:
 supported_TA:
     - name: Cisco Networks Add-on
       url: https://splunkbase.splunk.com/app/1467
-      version: 2.7.9
+      version: 2.8.2
 fields:
     - _time
     - aci_message_text

data_sources/cisco_isovalent_process_connect.yml

@@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processConnect
 supported_TA:
     - name: Cisco Security Cloud
       url: https://splunkbase.splunk.com/app/7404
-      version: 3.6.5
+      version: 4.0.0
 fields:
     - _time
     - app

data_sources/cisco_isovalent_process_exec.yml

@@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec
 supported_TA:
     - name: Cisco Security Cloud
       url: https://splunkbase.splunk.com/app/7404
-      version: 3.6.5
+      version: 4.0.0
 fields:
     - _time
     - cluster_name

data_sources/cisco_isovalent_process_kprobe.yml

@@ -10,7 +10,7 @@ sourcetype: cisco:isovalent
 supported_TA:
     - name: Cisco Security Cloud
       url: https://splunkbase.splunk.com/app/7404
-      version: 3.6.5
+      version: 4.0.0
 fields:
     - _time
     - app