Replaced the six compatibility shim with the standard library urllib.parse.
Fixed an invalid regular-expression escape sequence (raw-string) flagged under Python 3.12+.
Search command, alert action, and REST handler stanzas now declare python.required = 3.13, 3.9 alongside python.version = python3.
Splunk Enterprise compatibility updated to 10.2.x, 10.4.x.
Enhancements
Alert tuning updates
Windows - EDR Service Stopped: added a 5-minute service-stop threshold to reduce noise.
Ransomware - Common Ransomware File Extensions: added parent process to the results.
O365 - Bulk Email Deletion: added source IP field to the results.
Basic Network Scanning: results now list all destination IPs.
Removed duplicate alert stanzas
Some alerts existed under both an old and a renamed current name at the same time, causing the same detection to fire twice (duplicate notables/emails). Removed the redundant legacy stanza in each case:
Sysmon - Network Reconnaissance or Packet Capture Tool Execution (superseded by Windows - Network Reconnaissance or Packet Capture Tool Execution)
Sysmon - PowerShell Encoded Command Detection (superseded by Windows - PowerShell Encoded Command Detected)
Sysmon - Suspicious Privilege Escalation Command Detected (superseded by Windows - Suspicious Privilege Escalation Command Detected)
Sysmon - Suspicious Script Host Execution Detected (superseded by Windows - Suspicious Script Host Execution Detected)
Windows - Malicious Process from Office Applications (superseded by Sysmon - Malicious Process from Office Applications)
Windows authentication alerts accuracy improvements
Failed-logon detection now requires a specific Failure_Reason (bad password / logon type not granted) or a Kerberos pre-auth failure (EventCode=4776, Error_Code=0xC000006A), reducing false positives from unrelated 4625/4776 events.
Excluded Kerberos-only events from brute-force-by-user and brute-force-by-source authentication alerts.
Account name is now resolved via coalesce(Account_Name, Logon_Account) before filtering out machine accounts.
Adjusted several Windows alert dispatch windows to a consistent -17m@m to -2m@m search range.
Widened the dispatch window to -2h@m – +2h@m for Windows - Multiple Host Login Failures by User, Windows - Multiple Failed Logins by User, and Windows - Multiple Failed Logins from One Source IP (the search itself still scopes matched events to the -17m@m–-2m@m window internally via _index_earliest/_index_latest).
O365 / authentication brute-force and impossible-travel alerts now exclude win:unknown app noise in addition to OktaIM2:log.
Web dashboard/alert noise reduction
Added cs_web_filter_sources macro excluding sophos:xg:content_filtering, pan:threat, and fortigate_utm sourcetypes from Web datamodel-based alerts (unusual request patterns, unusual user agents, sensitive path access, brute force, exploit attempts, Spring4Shell detection).
SOAR field mapping
Added src_ips, Source_Address and sources fields to the SOAR/CIM-to-CEF field mapping list (both map to sourceAddress).
SOAR forwarding action improvements and bug fix
Fixed bug related to one notable event posted one container but posting many artifacts over and over again.
Performance improvement.
Duplicated code execution has been removed.
Product Setup page improvements
Multi-value fields are now displayed comma-separated.
Data review panels now refresh when the time range is changed for a product.
Fixed slow loading on the Product Setup page by using summariesonly=true for the sourcetype discovery search.