v1.0.0 - Initial Release

WithSecure Elements Add-on for Splunk — v1.0.0

First public release.

Install

Apps → Manage Apps → Install app from file → select ta-withsecure-elements-1.0.0.spl

What's included

• EPP Security Events modular input (sourcetype=withsecure:epp:security_event)
• BCD Incidents modular input (sourcetype=withsecure:epp:bcd_incident)
• On-demand detection fetching via | fetchdetections incident_id="..." SPL command
• "Get BCD Details" workflow action button on BCD incident events
• CIM field mappings: Endpoint, Malware, Intrusion Detection
• Apache 2.0 license