v2.0.17

• Alert investigation shows its retrieval trace: each search the agent ran, with its
  SPL, hit count and duration. Searches the read-only or index guard blocked are marked
  refused, separately from searches that failed. The trace is saved with the analysis
  record and shows again when the record is reopened.
• When the agentic investigation does not finish, the simplified analysis that takes
  over reuses the evidence the agent already gathered instead of seeing only the alert,
  and the result carries a notice saying so. The context count on an investigation is
  now the number of events and rows it was built from.
• Claims in an investigation report that the retrieved evidence does not back (an IP,
  user, host, hash or time that no search returned) are marked unverified in the
  dialog, the exported report, tickets and notification cards.
• Cloud and private masking now replace values with placeholders that are reversible
  for the current request only. The agent's searches run on the real values, so
  entity-based follow-up searches find events again, while the LLM still never sees
  them. Reports and generated SPL show the real values. IPv6 addresses are masked like
  IPv4, and a sample pasted into data onboarding or a generated query sent back to be
  explained is masked before it reaches the LLM.
• Masking protects what is sent to the LLM. Incident reports, tickets and notification
  cards sent to your own channels carry the real values; the documentation now says so.
• The chat page's result table shows real values; masking applies only when those rows
  are sent to the LLM (explain, triage, investigate). Previously cloud mode showed lossy
  masks such as j***n, which also merged different users into one triage cluster.
• The chat answer header now counts events or statistics rows, in Splunk's own terms;
  streamstats / eventstats searches count as events.
• PowerShell -enc / -EncodedCommand payloads are decoded by the app instead of being
  left for the model to guess, and in cloud and private mode the raw encoded payload is
  no longer sent to the LLM.
• AI answers (investigation, triage, explain, NL→SPL explanations, detection rules,
  platform and onboarding readouts) follow the language selected in the Copilot UI
  instead of the Splunk URL locale. Incident reports, tickets and notification cards are
  fully localized.
• Triage: index-mode triage on a non-ES alert index now clusters on its search-time
  fields (signature, source, user) instead of folding all alerts into one cluster.
  Clusters the model left unrated are shown as not rated, without a placeholder
  severity, rank or attack intent, and are no longer counted as scored. Rated clusters
  get unique ranks.
• Agent searches: ISO-8601 timestamps in earliest= / latest= now work instead of
  matching nothing. The default cap is 12 tool calls per turn (was 8), and NL→SPL and
  detection get a 150 s budget (was 120 s). Changes to [agentic] settings and the
  agent index whitelist apply without a restart, and if copilot.conf cannot be read the
  agent index whitelist allows no index instead of every index.
• Triage samples keep the user, source, destination and rule fields; Splunk's
  date_* / punct fields no longer push them out, so the model sees who an alert
  is about. A masked name the model writes without its number is no longer guessed:
  it is shown marked [unresolved] / [未还原].
• Triage: a cluster grouped by a username (or another value masked by field name)
  no longer sends that value to the LLM in clear; it gets the same placeholder as
  the alert samples. The agent no longer runs a search on a real name with a
  placeholder number attached (j.chen#1), or on a masked name or IP it altered or
  made up (x.***n for j.***n#1, 10.9.x.x), or on a numbered placeholder it was
  never given, which could have searched other users' data or matched nothing; it is
  told to copy the placeholder exactly.
• Masked IPs the model abbreviates (10.10.20.x#1/x#2) are restored to both
  addresses in what the analyst sees in interactive triage, investigation, readouts,
  chat and reports. An agent search that still contains such a fragment is refused
  instead of running with the second address silently dropped.
• History lists and "latest" views now really show newest first: analysis records,
  reports, conversations, favorites, notification deliveries, baseline results and
  triage runs. The app's sort requests were in a form the Splunk KV store ignores, so
  these came back in storage order.
• Investigations (and event explanations) keep their searches on the alert's own time.
  The alert time is now recognized in every form Splunk shows it (with a zone name such
  as GMT, as an epoch, or as m/d/Y), and a search window relative to "now" is refused with
  the absolute window to use instead. The agent is also given the alert time as a
  search bound, so it no longer mistakes the end of the suggested window for the alert.
• SPL in AI answers (recommended actions, triage recommendations, explanations, generated
  and optimized SPL) now runs as written: ISO-8601 earliest= / latest= time bounds are
  converted to forms Splunk matches (they used to match nothing), including inline SPL
  outside code spans, and a trailing | is removed. A | written before a leading
  search term (| index=… sourcetype=…, which Splunk rejects as an unknown command) is
  dropped too.
• SPL suggested in triage recommendations, investigation recommended actions and
  explanation next steps is checked with Splunk's own parser (parsed only, never run). A
  snippet Splunk would reject is marked "Syntax error" / 「语法错误」 next to its item,
  with the parser's message. A snippet that names an index you can't see is marked
  "Index not found or not permitted" / 「无此索引或无权限」, and one that names an
  index with no events "Index has no data" / 「索引无数据」. Index marks are given on
  standalone search heads only, not on search heads with distributed search peers.
• | copilot "<question>" accepts questions that contain = (for example
  | copilot "show events where user=admin"), which used to fail with "Unrecognized
  option". A mistyped option such as rn=f is reported with the option it resembles.
• Date-only time bounds in suggested and generated SPL (earliest=10/01/2026, or an
  ISO date) are completed to midnight (10/01/2026:00:00:00), so they run on Splunk
  instead of failing with "Invalid value".
• The agent's searches are refused, with the form to use instead, when their time
  bounds would be rejected or silently mishandled by Splunk: an invalid time format, a
  bound inside an OR branch or NOT group, the same modifier written twice, or an empty
  window where earliest is at or after latest, absolute or relative (equal bounds such
  as earliest=@d latest=@d used to return nothing without an error).
• Prompts ask the model for full timestamps with four-digit years, each time modifier
  once, latest after earliest (a window around an alert's time, not the same value
  twice), and no write commands (collect, outputlookup, sendalert, …) in SPL
  suggested to analysts.
• SPL the AI writes for analysts (triage, investigation, explanations, NL→SPL,
  | copilot, platform readouts) is asked to use only index, sourcetype, field and
  lookup names from the question, the alert, the schema or its own search results; to
  use the index the question names, else the alert's, rather than assuming
  index=main; and not to invent lookups or command options.
• When an agent search names no index and finds nothing, the agent is told that only
  the default indexes were searched and to list the indexes first, so it stops
  repeating empty searches before finding where the data is.
• The chat result table's row selector reads "First [50] rows" instead of
  "SIZE [50] rows".
• Investigation recommended actions no longer show double numbering. The English UI
  shows English alert-type and attack-phase labels and incident-report titles. Long
  record titles are cut at a word boundary with "…", and long indicator chips wrap
  instead of overflowing.

Download and install

File	Use it for
RST-AI-Copilot-for-Splunk-2.0.17-selfcontained.spl	Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-AI-Copilot-for-Splunk-2.0.17-fallback.spl	Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
RST-AI-Copilot-for-Splunk-2.0.17-splunkbase.spl	The fallback package as listed on Splunkbase: in-app update off, Splunk offers new versions under Manage Apps
*.spl.sha256	SHA-256 checksums
release-manifest.token	Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → License unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-AI-Copilot-for-Splunk-2.0.17-selfcontained.spl.sha256
tar xzf RST-AI-Copilot-for-Splunk-2.0.17-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot

v2.0.16

• New Splunkbase package RST-AI-Copilot-for-Splunk-<version>-splunkbase.spl. Its
  in-app updater is off; update it through Splunk's Apps > Manage Apps. The updater is
  controlled by [update] enabled in copilot.conf, so admins of a GitHub install can
  also turn it off with enabled = 0 in local/copilot.conf.
• Ticketing (Jira Data Center): wiki markup in alert data (strike-through, underline,
  superscript, subscript, images, headings, and lines that would close a code block) is
  now shown as plain text instead of being rendered, and dates and hostnames no longer
  show stray backslashes.
• License page: non-admin users see the admin-only notice on first load instead of a
  backend error.
• An offline license bound to another host now says so and points to Settings → License,
  and English license messages name the real Settings → License page.

Download and install

File	Use it for
RST-AI-Copilot-for-Splunk-2.0.16-selfcontained.spl	Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-AI-Copilot-for-Splunk-2.0.16-fallback.spl	Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
RST-AI-Copilot-for-Splunk-2.0.16-splunkbase.spl	The fallback package as listed on Splunkbase: in-app update off, Splunk offers new versions under Manage Apps
*.spl.sha256	SHA-256 checksums
release-manifest.token	Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → License unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-AI-Copilot-for-Splunk-2.0.16-selfcontained.spl.sha256
tar xzf RST-AI-Copilot-for-Splunk-2.0.16-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot

v2.0.15

• Right after a splunkd restart, while the KV store is still starting up, users who had
  accepted the EULA are no longer asked to accept it again, and saving push or
  notification settings (targets, SMTP, schedule) no longer overwrites the stored
  configuration with defaults. These requests now fail with "KV Store is not available
  right now" and succeed on retry; the EULA check stays closed until the KV store answers.

Download and install

File	Use it for
RST-AI-Copilot-for-Splunk-2.0.15-selfcontained.spl	Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-AI-Copilot-for-Splunk-2.0.15-fallback.spl	Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
*.spl.sha256	SHA-256 checksums
release-manifest.token	Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → Activation unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-AI-Copilot-for-Splunk-2.0.15-selfcontained.spl.sha256
tar xzf RST-AI-Copilot-for-Splunk-2.0.15-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot

v2.0.14

• Release packages are renamed to RST-AI-Copilot-for-Splunk-<version>-selfcontained.spl
  and -fallback.spl, and the GitHub repositories to Reallysec/RST-AI-Copilot-for-Splunk.
  The app id is unchanged, so license, data and settings carry over. The in-app update
  from 2.0.13 or earlier fails once: install this release from the Releases page via
  Apps > Manage Apps > Install app from file with "Upgrade app" checked; later updates
  work online again.
• The selfcontained package supports Linux x86_64 only. On ARM (aarch64) hosts use the
  fallback package.
• LLM failover is out of Beta. When the primary provider times out, refuses the
  connection or returns a server error, the request moves to the next provider, and the
  audit log records which provider served it. A hung provider now fails over after
  [llm] timeout_seconds instead of waiting for the whole agentic turn.
• Trusted time for license checks uses HTTPS only; the UDP/NTP fallback is removed.
• Ticketing: Jira Data Center is supported (personal access token); Jira Cloud tickets
  keep bold text and links; ServiceNow incidents no longer set non-default category and
  contact type values. Ticketing stays Beta.
• Microsoft Teams: current Workflows webhook addresses (*.environment.api.powerplatform.com)
  are accepted. Webhook credentials no longer appear in delivery errors.
• Update downloads that fail report the HTTP status or "update source unreachable"
  instead of an internal error.
• License page: features that cannot run on this host are shown as locked, including on
  hosts without a readable hardware fingerprint, with a hint that names the cause; legacy
  licenses show "All features".
• Scheduled report push: a target bound after a schedule was enabled no longer triggers
  a catch-up push; a hint shows when the push hour falls on the next local day; a
  hand-edited schedule no longer stops pushes.
• | copilot and | splexplain errors use the user's language right after a Splunk
  restart.
• The EULA dialog's language toggle switches the whole dialog.

Download and install

File	Use it for
RST-AI-Copilot-for-Splunk-2.0.14-selfcontained.spl	Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-AI-Copilot-for-Splunk-2.0.14-fallback.spl	Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
*.spl.sha256	SHA-256 checksums
release-manifest.token	Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → Activation unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-AI-Copilot-for-Splunk-2.0.14-selfcontained.spl.sha256
tar xzf RST-AI-Copilot-for-Splunk-2.0.14-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot

v2.0.13

• Scheduled report push: a report missed while Splunk was down is pushed once when it
  comes back. Pushes configured before 2.0.13 start catching up from the first push
  after the upgrade, so the upgrade itself never sends two reports at once.
• Alert push cards follow the report language setting.
• An unknown push time zone is now reported as an error instead of silently falling
  back to UTC.
• Generic webhook payloads use the same field names in every language; only the card
  text is translated. If you parsed the English field names that English-mode report
  webhooks sent in 2.0.12 ("Period", "AI calls" and so on), switch back to the fixed
  field names.
• License page: on a search head cluster member refused by the node limit, and on an
  offline license file without feature keys, features that cannot run on this host are
  shown as locked and are no longer counted as unlocked.
• License page: "expiring soon" now appears 7 days before expiry instead of 30.
• More license errors are shown in the interface language.
• Accepting the EULA right after a Splunk restart no longer fails while the KV store is
  still starting; the dialog asks you to retry.
• The EULA dialog can switch the agreement text between Chinese and English.
• License service rate limits (HTTP 429) are retried after 5–30 minutes, staggered per
  host, instead of waiting a day.

Download and install

File	Use it for
RST-Splunk-AI-Copilot-2.0.13-selfcontained.spl	Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-Splunk-AI-Copilot-2.0.13-fallback.spl	Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
*.spl.sha256	SHA-256 checksums
release-manifest.token	Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → Activation unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-Splunk-AI-Copilot-2.0.13-selfcontained.spl.sha256
tar xzf RST-Splunk-AI-Copilot-2.0.13-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot

v2.0.12

• In-product EULA acceptance: every user accepts the current EULA in the app before
  first use, and again after each EULA version change, in every edition including
  Community. Until then the app's REST requests are refused. The | copilot and
  | splexplain search commands, the MCP server and background tasks are not affected.
  Accounts used only for direct REST calls must open the app once and accept.
• EULA 1.4: acceptance wording for the in-app click-accept, more detail on the host
  fingerprint (including the locally generated host id), and the license service is
  hosted in the Hong Kong SAR.
• Hosts first activated on 2.0.10 or earlier move to the current fingerprint binding
  about 5 minutes after the upgrade, without using an extra node. Offline licenses are
  not affected.
• A host refused because the license's node limit is used up (for example an extra
  search head cluster member) now shows "License node limit reached" instead of
  "license server unreachable", and the License page warns as soon as the host is
  refused, before paid features stop at the end of the grace period.
• Search head cluster licensing is no longer Beta. See INSTALL.md §4.1.
• Scheduled report push now delivers: each report is pushed once per period to the
  notification targets bound to that period (before, it was never sent). Failed pushes
  are retried. Requires the reports entitlement.
• New setting "Scheduled report language" (Settings > Reports); scheduled reports and
  their push cards follow it.
• Switching the UI language re-renders the open report in the new language (preset
  periods; a custom range offers to regenerate).
• License error reasons such as a clock rollback are shown in the UI language, and pages
  show the real error instead of a generic "Request failed".
• English error messages from the search commands use English feature names.
• INSTALL: Docker containers without a machine-id activate via a persisted host id
  (2.0.11 and later); a rolling restart may be needed after apply shcluster-bundle.

Download and install

File	Use it for
RST-Splunk-AI-Copilot-2.0.12-selfcontained.spl	Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-Splunk-AI-Copilot-2.0.12-fallback.spl	Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
*.spl.sha256	SHA-256 checksums
release-manifest.token	Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → Activation unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-Splunk-AI-Copilot-2.0.12-selfcontained.spl.sha256
tar xzf RST-Splunk-AI-Copilot-2.0.12-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot

v2.0.11

• Operations reports can now be in English: a report you generate follows the UI
  language, and scheduled reports use copilot.conf [reports] language (zh or en,
  default zh). Reports archived from 2.0.11 on open in the viewer's UI language; older
  archives show as before. Fixed duplicated section numbers in the Chinese report.
• Search head clusters (Beta): each member keeps its own license state and activates as
  its own node; offline licenses are stored per member, and the License page shows
  whether the installed offline license belongs to this member. Online cluster members
  beyond the license's max_nodes now lock after upgrading (before, all members counted
  as one node): check max_nodes or move to Enterprise first. See INSTALL.md §4.1.
• Host fingerprint recipe v2 (same as the license server SDK). Hosts already bound by
  the old fingerprint keep working with no re-activation: offline licenses, online
  sessions and sealed-feature keyrings all still accept it, and upgrading uses no extra
  node. Containers with no machine-id and no MAC get a persisted host id instead of
  failing.
• An offline-activated license no longer contacts the license service at all (it used
  to download the revocation list once a day).
• The license check no longer rewrites stored state on almost every request.
• EULA 1.3: company-level terms aligned across the RST product family (liability cap,
  Chinese version prevails, subscription-term warranty, IP indemnity for paid editions,
  audit, export control, 30-day data export after termination, privacy and cross-border
  terms); the data-disclosure section now matches what the app actually sends.
• Product name shown as "RST AI Copilot for Splunk" throughout the app, notifications
  and reports.

Download and install

File	Use it for
RST-Splunk-AI-Copilot-2.0.11-selfcontained.spl	Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-Splunk-AI-Copilot-2.0.11-fallback.spl	Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
*.spl.sha256	SHA-256 checksums
release-manifest.token	Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → Activation unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-Splunk-AI-Copilot-2.0.11-selfcontained.spl.sha256
tar xzf RST-Splunk-AI-Copilot-2.0.11-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot

v2.0.10

• License page: the .lic file from the license server can now be uploaded or pasted
  as-is. Uploaded files show as a card with the license ID and expiry, the token is not
  shown on screen, and a .lic for another product or in the wrong format gets a
  specific error instead of a generic signature failure.
• Enterprise Security: the alert list now shows each notable's current ES status
  (including custom statuses) and its current Incident Review urgency, and the detail
  drawer shows status, owner and disposition. Batch triage ranks ES notables by their
  current urgency.
• Enterprise Security write-back offers the statuses actually configured in ES,
  including custom ones such as "Awaiting Customer", and falls back to the five ES
  defaults when the list cannot be read.
• AI settings: the embeddings max input length ([embeddings] max_input_chars) can be
  viewed and changed on the settings page.
• The | copilot and | splexplain search commands report errors in English when the
  command's lang= argument, the Copilot UI language, the Splunk user language or
  copilot.conf response_language is English.
• Licensing: a /etc/machine-id file in a non-UTF-8 encoding no longer crashes host
  fingerprinting.
• Installation guide: new section on running Splunk in Docker, including how to keep the
  license fingerprint stable across container restarts and re-creation.

Download and install

File	Use it for
RST-Splunk-AI-Copilot-2.0.10-selfcontained.spl	Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-Splunk-AI-Copilot-2.0.10-fallback.spl	Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
*.spl.sha256	SHA-256 checksums
release-manifest.token	Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → Activation unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-Splunk-AI-Copilot-2.0.10-selfcontained.spl.sha256
tar xzf RST-Splunk-AI-Copilot-2.0.10-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot

v2.0.9

• Fallback package (Windows / ARM search heads): the | copilot and | splexplain
  search commands now work. Before, they failed to load.
• | splexplain shows the real error, for example an AI model that is not configured
  yet, instead of "External search command exited unexpectedly".

Download and install

File	Use it for
RST-Splunk-AI-Copilot-2.0.9-selfcontained.spl	Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-Splunk-AI-Copilot-2.0.9-fallback.spl	Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
*.spl.sha256	SHA-256 checksums
release-manifest.token	Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → Activation unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-Splunk-AI-Copilot-2.0.9-selfcontained.spl.sha256
tar xzf RST-Splunk-AI-Copilot-2.0.9-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot

v2.0.8

• Enterprise Security 8: write-back from investigations and triage now works. Notable IDs
  are computed the way ES 8 computes them, a rejected or partial update is reported as an
  error with the reason ES gives instead of as a success, and "False positive" also sets
  the ES disposition.
• ES Incident Review write-back and audit forwarding (syslog / webhook) are out of Beta.
• Audit events record the provider and model that actually answered after LLM failover,
  and usage cost is priced by that model.
• Embeddings usage is no longer priced at the default LLM token price.
• Knowledge base re-indexing no longer stalls on embeddings rate limits or server errors,
  and re-indexes automatically when the embeddings model or endpoint changes.
• A revoked license heartbeat reply is no longer counted as a successful contact with
  the license server.
• EULA 1.2: when a paid license expires or is revoked, you may keep using the app as the
  Community Edition; only the paid features stop.

Download and install

File	Use it for
RST-Splunk-AI-Copilot-2.0.8-selfcontained.spl	Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-Splunk-AI-Copilot-2.0.8-fallback.spl	Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
*.spl.sha256	SHA-256 checksums
release-manifest.token	Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → Activation unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-Splunk-AI-Copilot-2.0.8-selfcontained.spl.sha256
tar xzf RST-Splunk-AI-Copilot-2.0.8-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot