Merge pull request #3072 from splunk/data_source_improvements

Improve TA names to match the naming in Splunk

data_sources/aws_cloudfront.yml

@@ -7,9 +7,9 @@ description: Data source object for AWS Cloudfront
 source: aws
 sourcetype: aws:cloudfront:accesslogs
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail.yml

@@ -8,7 +8,7 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 

data_sources/aws_cloudtrail_assumerolewithsaml.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_consolelogin.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_copyobject.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - additionalEventData.AuthenticationMethod

data_sources/aws_cloudtrail_createaccesskey.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_createkey.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_createloginprofile.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_createnetworkaclentry.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_createpolicyversion.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_createsnapshot.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_createtask.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_createvirtualmfadevice.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deactivatemfadevice.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deletedetector.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_deletegroup.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deleteipset.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_deleteloggroup.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - apiVersion

data_sources/aws_cloudtrail_deletelogstream.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - apiVersion

data_sources/aws_cloudtrail_deletenetworkaclentry.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deletepolicy.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deleterule.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - apiVersion

data_sources/aws_cloudtrail_deletetrail.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_deletevirtualmfadevice.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_deletewebacl.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - apiVersion

data_sources/aws_cloudtrail_describeeventaggregates.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_describeimagescanfindings.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_getobject.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - additionalEventData.AuthenticationMethod

data_sources/aws_cloudtrail_getpassworddata.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_jobcreated.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_modifydbinstance.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_modifyimageattribute.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_modifysnapshotattribute.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_putbucketacl.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_putbucketlifecycle.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - additionalEventData.AuthenticationMethod

data_sources/aws_cloudtrail_putbucketreplication.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - additionalEventData.AuthenticationMethod

data_sources/aws_cloudtrail_putbucketversioning.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - additionalEventData.AuthenticationMethod

data_sources/aws_cloudtrail_putimage.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_putkeypolicy.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_replacenetworkaclentry.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_setdefaultpolicyversion.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_stoplogging.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_updateloginprofile.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_updatesamlprovider.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - action

data_sources/aws_cloudtrail_updatetrail.yml

@@ -8,9 +8,9 @@ source: aws_cloudtrail
 sourcetype: aws:cloudtrail
 separator: eventName
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - app

data_sources/aws_cloudwatchlogs_vpcflow.yml

@@ -0,0 +1,68 @@
+name: AWS CloudWatchLogs VPCflow
+id: 38a34fc4-e128-4478-a8f4-7835d51d5135
+version: 1
+author: Bhavin Patel, Splunk
+date: '2024-07-18'
+description: Data source object for AWS CloudWatchLogs VPCflow
+source: aws_cloudwatchlogs_vpcflow
+sourcetype: aws:cloudwatchlogs:vpcflow
+separator: eventName
+supported_TA:
+  - name: Splunk Add-on for AWS
+    version: 7.6.0
+    url: https://splunkbase.splunk.com/app/1876
+fields:
+- _raw
+- _time
+- account_id
+- action
+- app
+- aws_account_id
+- bytes
+- date_hour
+- date_mday
+- date_minute
+- date_month
+- date_second
+- date_wday
+- date_year
+- date_zone
+- dest
+- dest_ip
+- dest_port
+- duration
+- dvc
+- end_time
+- eventtype
+- host
+- index
+- interface_id
+- linecount
+- log_status
+- packets
+- protocol
+- protocol_code
+- protocol_full_name
+- protocol_version
+- punct
+- region
+- source
+- sourcetype
+- splunk_server
+- splunk_server_group
+- src
+- src_ip
+- src_port
+- start_time
+- tag
+- tag::action
+- tag::eventtype
+- timeendpos
+- timestartpos
+- transport
+- user_id
+- vendor_account
+- vendor_product
+- version
+- vpcflow_action
+example_log: '2 123397614277 eni-0b0f9f261f45e6489 10.0.1.30 10.0.1.1 47254 22 17 2 98 1697608042 1697608070 ACCEPT OK'

data_sources/aws_security_hub.yml

@@ -7,9 +7,9 @@ description: Data source object for AWS Security Hub
 source: aws_securityhub_finding
 sourcetype: aws:securityhub:finding
 supported_TA:
-- name: Splunk Add-on for Amazon Web Services (AWS)
+- name: Splunk Add-on for AWS
   url: https://splunkbase.splunk.com/app/1876
-  version: 7.4.1
+  version: 7.6.0
 fields:
 - _time
 - AwsAccountId

data_sources/azure_active_directory.yml

@@ -10,4 +10,4 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2

data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml

@@ -11,7 +11,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_add_member_to_role.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_add_owner_to_application.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_add_service_principal.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_add_unverified_domain.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_consent_to_application.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_disable_strong_authentication.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_enable_account.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_invite_external_user.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_reset_password_(by_admin).yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_set_domain_authentication.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_sign_in_activity.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_update_application.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_update_authorization_policy.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_update_user.yml

@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_active_directory_user_registered_security_info.yml

@@ -11,7 +11,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - Level

data_sources/azure_audit_create_or_update_an_azure_automation_account.yml

@@ -11,7 +11,7 @@ separator: operationName.localizedValue
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - authorization.action

data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml

@@ -11,7 +11,7 @@ separator: operationName.localizedValue
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - authorization.action

data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml

@@ -11,7 +11,7 @@ separator: operationName.localizedValue
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.2.2
+  version: 5.3.2
 fields:
 - _time
 - authorization.action

data_sources/bro.yml

@@ -6,5 +6,4 @@ author: Patrick Bareiss, Splunk
 description: Data source object for Bro
 source: bro:http:json
 sourcetype: bro:http:json
-supported_TA:
-- {}
+supported_TA: []

data_sources/crowdstrike_processrollup2.yml

@@ -10,7 +10,7 @@ separator: event_simpleName
 supported_TA:
 - name: Splunk Add-on for CrowdStrike FDR
   url: https://splunkbase.splunk.com/app/5579
-  version: 1.5.0
+  version: 2.0.0
 fields:
 - AuthenticationId
 - AuthenticationId_meaning

data_sources/crushftp.yml

@@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk
 description: Data source object for CrushFTP
 source: crushftp
 sourcetype: crushftp:sessionlogs
-supported_TA:
-- {}
+supported_TA: []
 fields:
 - _time
 - _raw

data_sources/g_suite_drive.yml

@@ -9,7 +9,7 @@ sourcetype: gsuite:drive:json
 supported_TA:
 - name: Splunk Add-on for Google Workspace
   url: https://splunkbase.splunk.com/app/5556
-  version: 2.6.3
+  version: 2.8.1
 fields:
 - _time
 - email

data_sources/g_suite_gmail.yml

@@ -9,7 +9,7 @@ sourcetype: gsuite:gmail:bigquery
 supported_TA:
 - name: Splunk Add-on for Google Workspace
   url: https://splunkbase.splunk.com/app/5556
-  version: 2.6.3
+  version: 2.8.1
 fields:
 - _time
 - action_type

data_sources/github.yml

@@ -9,7 +9,7 @@ sourcetype: aws:firehose:json
 supported_TA:
 - name: Splunk Add-on for Github
   url: https://splunkbase.splunk.com/app/6254
-  version: 2.2.1
+  version: 3.0.0
 fields:
 - _time
 - action

data_sources/google_workspace_login_failure.yml

@@ -10,7 +10,7 @@ separator: event.name
 supported_TA:
 - name: Splunk Add-on for Google Workspace
   url: https://splunkbase.splunk.com/app/5556
-  version: 2.6.3
+  version: 2.8.1
 fields:
 - _time
 - actor.email

data_sources/google_workspace_login_success.yml

@@ -10,7 +10,7 @@ separator: event.name
 supported_TA:
 - name: Splunk Add-on for Google Workspace
   url: https://splunkbase.splunk.com/app/5556
-  version: 2.6.3
+  version: 2.8.1
 fields:
 - _time
 - actor.email

data_sources/kubernetes_audit.yml

@@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk
 description: Data source object for Kubernetes Audit
 source: kubernetes
 sourcetype: _json
-supported_TA:
-- {}
+supported_TA: []
 fields:
 - _time
 - annotations.authorization.k8s.io/decision

data_sources/kubernetes_falco.yml

@@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk
 description: Data source object for Kubernetes Falco
 source: kubernetes
 sourcetype: kube:container:falco
-supported_TA:
-- {}
+supported_TA: []
 fields:
 - _time
 - command

data_sources/linux_secure.yml

@@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk
 description: Data source object for Linux Secure
 source: /var/log/secure
 sourcetype: linux_secure
-supported_TA:
-- {}
+supported_TA: []
 fields:
 - _time
 - action

data_sources/nginx_access.yml

@@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk
 description: Data source object for Nginx Access
 source: /var/log/nginx/access.log
 sourcetype: nginx:plus:kv
-supported_TA:
-- {}
+supported_TA: []
 fields:
 - _time
 - action

data_sources/osquery.yml

@@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk
 description: Data source object for osquery
 source: osquery
 sourcetype: osquery:results
-supported_TA:
-- {}
+supported_TA: []
 fields:
 - _time
 - calendarTime

data_sources/palo_alto_network_threat.yml

@@ -7,9 +7,9 @@ description: Data source object for Palo Alto Network Threat
 source: pan:threat
 sourcetype: pan:threat
 supported_TA:
-- name: Palo Alto Networks Add-on for Splunk
+- name: Palo Alto Networks Add-on
   url: https://splunkbase.splunk.com/app/2757
-  version: 8.1.1
+  version: 8.1.3
 fields:
 - _time
 - date_hour

data_sources/palo_alto_network_traffic.yml

@@ -7,9 +7,9 @@ description: Data source object for Palo Alto Network Traffic
 source: screenconnect_palo_traffic
 sourcetype: pan:traffic
 supported_TA:
-- name: Palo Alto Networks Add-on for Splunk
+- name: Palo Alto Networks Add-on
   url: https://splunkbase.splunk.com/app/2757
-  version: 8.1.1
+  version: 8.1.3
 fields:
 - _time
 - date_hour

data_sources/powershell_installed_iis_modules.yml

@@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk
 description: Data source object for Powershell Installed IIS Modules
 source: powershell://AppCmdModules
 sourcetype: Pwsh:InstalledIISModules
-supported_TA:
-- {}
+supported_TA: []
 fields:
 - _time
 - Schema

data_sources/powershell_script_block_logging_4104.yml

@@ -9,7 +9,7 @@ sourcetype: xmlwineventlog
 supported_TA:
 - name: Splunk Add-on for Microsoft Windows
   url: https://splunkbase.splunk.com/app/742
-  version: 8.8.0
+  version: 8.9.0
 fields:
 - _time
 - ActivityID

data_sources/powershell_sip_inventory.yml

@@ -6,5 +6,4 @@ author: Patrick Bareiss, Splunk
 description: Data source object for Powershell SIP Inventory
 source: powershell://SubjectInterfacePackage
 sourcetype: PwSh:SubjectInterfacePackage
-supported_TA:
-- {}
+supported_TA: []

data_sources/splunk_stream_http.yml

@@ -7,9 +7,9 @@ description: Data source object for Splunk Stream HTTP
 source: stream:http
 sourcetype: stream:http
 supported_TA:
-- name: Splunk App for Stream
+- name: Splunk Stream
   url: https://splunkbase.splunk.com/app/1809
-  version: 8.1.1
+  version: 8.1.3
 fields:
 - _time
 - bytes

data_sources/splunk_stream_ip.yml

@@ -7,9 +7,9 @@ description: Data source object for Splunk Stream IP
 source: stream:ip
 sourcetype: stream:ip
 supported_TA:
-- name: Splunk App for Stream
+- name: Splunk Stream
   url: https://splunkbase.splunk.com/app/1809
-  version: 8.1.1
+  version: 8.1.3
 fields:
 - _time
 - action

data_sources/splunk_stream_tcp.yml

@@ -7,6 +7,6 @@ description: Data source object for Splunk Stream TCP
 source: stream:tcp
 sourcetype: stream:tcp
 supported_TA:
-- name: Splunk App for Stream
+- name: Splunk Stream
   url: https://splunkbase.splunk.com/app/1809
-  version: 8.1.1
+  version: 8.1.3

data_sources/suricata.yml

@@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk
 description: Data source object for Suricata
 source: suricata
 sourcetype: suricata
-supported_TA:
-- {}
+supported_TA: []
 fields:
 - _time
 - app_proto

data_sources/sysmon_eventid_1.yml

@@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 1
 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 sourcetype: xmlwineventlog
 separator: EventID
+configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
-  url: https://splunkbase.splunk.com/app/5709/
-  version: 4.0.0
+  url: https://splunkbase.splunk.com/app/5709
+  version: 4.0.1
 fields:
 - _time
 - Channel

data_sources/sysmon_eventid_10.yml

@@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 10
 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 sourcetype: xmlwineventlog
 separator: EventID
+configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
-  url: https://splunkbase.splunk.com/app/5709/
-  version: 4.0.0
+  url: https://splunkbase.splunk.com/app/5709
+  version: 4.0.1
 fields:
 - _time
 - CallTrace

data_sources/sysmon_eventid_11.yml

@@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 11
 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 sourcetype: xmlwineventlog
 separator: EventID
+configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
-  url: https://splunkbase.splunk.com/app/5709/
-  version: 4.0.0
+  url: https://splunkbase.splunk.com/app/5709
+  version: 4.0.1
 fields:
 - _time
 - Channel

data_sources/sysmon_eventid_12.yml

@@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 12
 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 sourcetype: xmlwineventlog
 separator: EventID
+configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
-  url: https://splunkbase.splunk.com/app/5709/
-  version: 4.0.0
+  url: https://splunkbase.splunk.com/app/5709
+  version: 4.0.1
 fields:
 - _time
 - Channel

data_sources/sysmon_eventid_13.yml

@@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 13
 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 sourcetype: xmlwineventlog
 separator: EventID
+configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
-  url: https://splunkbase.splunk.com/app/5709/
-  version: 4.0.0
+  url: https://splunkbase.splunk.com/app/5709
+  version: 4.0.1
 fields:
 - _time
 - Channel

data_sources/sysmon_eventid_15.yml

@@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 15
 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 sourcetype: xmlwineventlog
 separator: EventID
+configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
-  url: https://splunkbase.splunk.com/app/5709/
-  version: 4.0.0
+  url: https://splunkbase.splunk.com/app/5709
+  version: 4.0.1
 fields:
 - _time
 - Channel

data_sources/sysmon_eventid_17.yml

@@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 17
 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 sourcetype: xmlwineventlog
 separator: EventID
+configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
-  url: https://splunkbase.splunk.com/app/5709/
-  version: 4.0.0
+  url: https://splunkbase.splunk.com/app/5709
+  version: 4.0.1
 fields:
 - _time
 - Channel

data_sources/sysmon_eventid_18.yml

@@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 18
 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 sourcetype: xmlwineventlog
 separator: EventID
+configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
-  url: https://splunkbase.splunk.com/app/5709/
-  version: 4.0.0
+  url: https://splunkbase.splunk.com/app/5709
+  version: 4.0.1
 fields:
 - _time
 - Channel