v2.0.17

• Alert investigation shows its retrieval trace: each search the agent ran, with its
  SPL, hit count and duration. Searches the read-only or index guard blocked are marked
  refused, separately from searches that failed. The trace is saved with the analysis
  record and shows again when the record is reopened.
• When the agentic investigation does not finish, the simplified analysis that takes
  over reuses the evidence the agent already gathered instead of seeing only the alert,
  and the result carries a notice saying so. The context count on an investigation is
  now the number of events and rows it was built from.
• Claims in an investigation report that the retrieved evidence does not back (an IP,
  user, host, hash or time that no search returned) are marked unverified in the
  dialog, the exported report, tickets and notification cards.
• Cloud and private masking now replace values with placeholders that are reversible
  for the current request only. The agent's searches run on the real values, so
  entity-based follow-up searches find events again, while the LLM still never sees
  them. Reports and generated SPL show the real values. IPv6 addresses are masked like
  IPv4, and a sample pasted into data onboarding or a generated query sent back to be
  explained is masked before it reaches the LLM.
• Masking protects what is sent to the LLM. Incident reports, tickets and notification
  cards sent to your own channels carry the real values; the documentation now says so.
• The chat page's result table shows real values; masking applies only when those rows
  are sent to the LLM (explain, triage, investigate). Previously cloud mode showed lossy
  masks such as j***n, which also merged different users into one triage cluster.
• The chat answer header now counts events or statistics rows, in Splunk's own terms;
  streamstats / eventstats searches count as events.
• PowerShell -enc / -EncodedCommand payloads are decoded by the app instead of being
  left for the model to guess, and in cloud and private mode the raw encoded payload is
  no longer sent to the LLM.
• AI answers (investigation, triage, explain, NL→SPL explanations, detection rules,
  platform and onboarding readouts) follow the language selected in the Copilot UI
  instead of the Splunk URL locale. Incident reports, tickets and notification cards are
  fully localized.
• Triage: index-mode triage on a non-ES alert index now clusters on its search-time
  fields (signature, source, user) instead of folding all alerts into one cluster.
  Clusters the model left unrated are shown as not rated, without a placeholder
  severity, rank or attack intent, and are no longer counted as scored. Rated clusters
  get unique ranks.
• Agent searches: ISO-8601 timestamps in earliest= / latest= now work instead of
  matching nothing. The default cap is 12 tool calls per turn (was 8), and NL→SPL and
  detection get a 150 s budget (was 120 s). Changes to [agentic] settings and the
  agent index whitelist apply without a restart, and if copilot.conf cannot be read the
  agent index whitelist allows no index instead of every index.
• Triage samples keep the user, source, destination and rule fields; Splunk's
  date_* / punct fields no longer push them out, so the model sees who an alert
  is about. A masked name the model writes without its number is no longer guessed:
  it is shown marked [unresolved] / [未还原].
• Triage: a cluster grouped by a username (or another value masked by field name)
  no longer sends that value to the LLM in clear; it gets the same placeholder as
  the alert samples. The agent no longer runs a search on a real name with a
  placeholder number attached (j.chen#1), or on a masked name or IP it altered or
  made up (x.***n for j.***n#1, 10.9.x.x), or on a numbered placeholder it was
  never given, which could have searched other users' data or matched nothing; it is
  told to copy the placeholder exactly.
• Masked IPs the model abbreviates (10.10.20.x#1/x#2) are restored to both
  addresses in what the analyst sees in interactive triage, investigation, readouts,
  chat and reports. An agent search that still contains such a fragment is refused
  instead of running with the second address silently dropped.
• History lists and "latest" views now really show newest first: analysis records,
  reports, conversations, favorites, notification deliveries, baseline results and
  triage runs. The app's sort requests were in a form the Splunk KV store ignores, so
  these came back in storage order.
• Investigations (and event explanations) keep their searches on the alert's own time.
  The alert time is now recognized in every form Splunk shows it (with a zone name such
  as GMT, as an epoch, or as m/d/Y), and a search window relative to "now" is refused with
  the absolute window to use instead. The agent is also given the alert time as a
  search bound, so it no longer mistakes the end of the suggested window for the alert.
• SPL in AI answers (recommended actions, triage recommendations, explanations, generated
  and optimized SPL) now runs as written: ISO-8601 earliest= / latest= time bounds are
  converted to forms Splunk matches (they used to match nothing), including inline SPL
  outside code spans, and a trailing | is removed. A | written before a leading
  search term (| index=… sourcetype=…, which Splunk rejects as an unknown command) is
  dropped too.
• SPL suggested in triage recommendations, investigation recommended actions and
  explanation next steps is checked with Splunk's own parser (parsed only, never run). A
  snippet Splunk would reject is marked "Syntax error" / 「语法错误」 next to its item,
  with the parser's message. A snippet that names an index you can't see is marked
  "Index not found or not permitted" / 「无此索引或无权限」, and one that names an
  index with no events "Index has no data" / 「索引无数据」. Index marks are given on
  standalone search heads only, not on search heads with distributed search peers.
• | copilot "<question>" accepts questions that contain = (for example
  | copilot "show events where user=admin"), which used to fail with "Unrecognized
  option". A mistyped option such as rn=f is reported with the option it resembles.
• Date-only time bounds in suggested and generated SPL (earliest=10/01/2026, or an
  ISO date) are completed to midnight (10/01/2026:00:00:00), so they run on Splunk
  instead of failing with "Invalid value".
• The agent's searches are refused, with the form to use instead, when their time
  bounds would be rejected or silently mishandled by Splunk: an invalid time format, a
  bound inside an OR branch or NOT group, the same modifier written twice, or an empty
  window where earliest is at or after latest, absolute or relative (equal bounds such
  as earliest=@d latest=@d used to return nothing without an error).
• Prompts ask the model for full timestamps with four-digit years, each time modifier
  once, latest after earliest (a window around an alert's time, not the same value
  twice), and no write commands (collect, outputlookup, sendalert, …) in SPL
  suggested to analysts.
• SPL the AI writes for analysts (triage, investigation, explanations, NL→SPL,
  | copilot, platform readouts) is asked to use only index, sourcetype, field and
  lookup names from the question, the alert, the schema or its own search results; to
  use the index the question names, else the alert's, rather than assuming
  index=main; and not to invent lookups or command options.
• When an agent search names no index and finds nothing, the agent is told that only
  the default indexes were searched and to list the indexes first, so it stops
  repeating empty searches before finding where the data is.
• The chat result table's row selector reads "First [50] rows" instead of
  "SIZE [50] rows".
• Investigation recommended actions no longer show double numbering. The English UI
  shows English alert-type and attack-phase labels and incident-report titles. Long
  record titles are cut at a word boundary with "…", and long indicator chips wrap
  instead of overflowing.

Download and install

File	Use it for
RST-AI-Copilot-for-Splunk-2.0.17-selfcontained.spl	Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-AI-Copilot-for-Splunk-2.0.17-fallback.spl	Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
RST-AI-Copilot-for-Splunk-2.0.17-splunkbase.spl	The fallback package as listed on Splunkbase: in-app update off, Splunk offers new versions under Manage Apps
*.spl.sha256	SHA-256 checksums
release-manifest.token	Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → License unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-AI-Copilot-for-Splunk-2.0.17-selfcontained.spl.sha256
tar xzf RST-AI-Copilot-for-Splunk-2.0.17-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot