Release 1.0.1

BunkerWeb add-on for Splunk 1.0.1

Changes

• [BUGFIX] Enable the update checks required for Splunkbase-hosted packages so Splunk can notify administrators of new versions.
• [MISC] Reject releases that disable Splunkbase update checks before publication.

Installation

Download TA-bunkerweb-1.0.1.tgz, check it against SHA256SUMS and install it as described in the
README.

Release 1.0.0

BunkerWeb add-on for Splunk 1.0.0

Changes

• [FEATURE] Add the bunkerweb:access, bunkerweb:error and bunkerweb:modsec_audit sourcetypes with timestamps, line breaking and search-time field extraction.
• [FEATURE] Map access and audit events to the CIM Web and Intrusion Detection data models, with the web, ids and attack tags.
• [FEATURE] Add a live test that installs the package on a pinned Splunk Enterprise container, ingests samples/ and asserts the extracted and CIM fields.
• [BUGFIX] Wait for container bootstrap and the authenticated management API before installing the app or continuing after a restart in the live test.
• [MISC] Check pull requests with pre-commit, Splunk AppInspect and the Plumber CI/CD gate; analyze them with CodeQL.
• [MISC] Publish tagged releases from a protected environment, with a SHA256SUMS file, a CycloneDX SBOM and signed build provenance.

Installation

Download TA-bunkerweb-1.0.0.tgz, check it against SHA256SUMS and install it as described in the
README.