v2.0.8

• Enterprise Security 8: write-back from investigations and triage now works. Notable IDs
  are computed the way ES 8 computes them, a rejected or partial update is reported as an
  error with the reason ES gives instead of as a success, and "False positive" also sets
  the ES disposition.
• ES Incident Review write-back and audit forwarding (syslog / webhook) are out of Beta.
• Audit events record the provider and model that actually answered after LLM failover,
  and usage cost is priced by that model.
• Embeddings usage is no longer priced at the default LLM token price.
• Knowledge base re-indexing no longer stalls on embeddings rate limits or server errors,
  and re-indexes automatically when the embeddings model or endpoint changes.
• A revoked license heartbeat reply is no longer counted as a successful contact with
  the license server.
• EULA 1.2: when a paid license expires or is revoked, you may keep using the app as the
  Community Edition; only the paid features stop.

Download and install

File	Use it for
RST-Splunk-AI-Copilot-2.0.8-selfcontained.spl	Splunk Enterprise on your own servers (recommended); includes the agentic engine
RST-Splunk-AI-Copilot-2.0.8-fallback.spl	Splunk Enterprise where compiled components are not allowed (Splunk Cloud is not supported yet)
*.spl.sha256	SHA-256 checksums
release-manifest.token	Signed manifest read by the in-app online update (Settings → Version)

One package for every edition: without a licence it runs as the free Community Edition, and importing a licence under Settings → Activation unlocks Professional or Enterprise in place. Install in Splunk Web (Apps → Manage Apps → Install app from file) and restart, or on the search head:

sha256sum -c RST-Splunk-AI-Copilot-2.0.8-selfcontained.spl.sha256
tar xzf RST-Splunk-AI-Copilot-2.0.8-selfcontained.spl -C $SPLUNK_HOME/etc/apps/
$SPLUNK_HOME/bin/splunk restart

Documentation: https://reallysec.com/en/docs/splunk-ai-copilot · 中文文档：https://reallysec.com/docs/splunk-ai-copilot