Splunkbase App Watcher

Alcatel 0 Splunkbase apps · 1 SC4S source

No dedicated Splunkbase app or Technical Add-On exists for Alcatel — confirmed via a live Splunkbase search. However, Alcatel switches are a recognised source in Splunk Connect for Syslog (SC4S), which routes their logs directly without needing an installed app.

#	Ingestion Path	Type	Support Owner	Data Source Type Collected	Sourcetype / Config	Reference Link	Notes — Usage
1	Alcatel Switch (via Splunk Connect for Syslog)	SC4S Syslog Routing (No App)	Splunk Connect for Syslog (Community)	Alcatel switch syslogs — legacy BSD format, default port 514, MSG-format based filter	sourcetype `alcatel:switch` → index `netops`	SC4S docs	No Splunkbase Add-on required — SC4S's built-in filter recognises Alcatel switch syslog and assigns `alcatel:switch` automatically. If a dedicated parsing TA is ever published on Splunkbase, add it here as a normal row.

AWS 7 apps

#	Splunkbase App	Type	Support Owner	Data Source Type Collected	Latest Version	Release Date	Splunkbase Link	Notes — Usage
1	Splunk Add-on for Amazon Web Services (AWS)	Technical Add-On	Splunk Supported	AWS Config, EC2/EBS metadata, Inspector, CloudTrail, CloudWatch (logs/metrics/billing), S3/CloudFront/ELB access logs, generic S3/Kinesis/SQS, Amazon Security Lake	8.3.0	11 Sep 2026	app/1876	CURRENT STANDARD. Modular-input TA, CIM 5.x compatible. From v7.0.0 it has absorbed the Splunk Add-on for Amazon Security Lake (uninstall that add-on before upgrading to avoid duplication). Splunk Cloud users should also evaluate the newer Splunk Data Inputs (formerly Data Manager) onboarding flow, which co-exists with this TA.
2	Splunk App for AWS Security Dashboards	App	Splunk Supported	Consumes data ingested by TA #1	1.3.0	7 Feb 2026	app/6311	Visualization layer: pre-built security dashboards on top of TA #1. Search-head tier; requires TA #1.
3	Splunk Add-on for AWS Security Hub	Technical Add-On	Splunk Supported	AWS Security Hub — real-time findings	1.1.1	11 Jun 2026	app/8642	PREMIUM. Requires a subscription via "AWS Security Hub Extended." Converts real-time Security Hub events into findings/intermediate findings for Splunk Enterprise Security — separate from the general-purpose TA #1.
4	AWS Service Connectors (SOAR)	SOAR Connector	Splunk Supported	AWS service management APIs — containment & investigative playbook actions	2.x	Jul–Aug 2026	See notes	For Splunk SOAR (response, not parsing). Splunk publishes this as 13 separate per-service connector apps, consolidated here for brevity: EC2 · GuardDuty · S3 · CloudTrail · IAM · Security Token Service · Athena · Systems Manager · Security Hub · Lambda · WAF V2 · Inspector · DynamoDB
5	CCX Add-on for AWS Products	Technical Add-On (extension)	3rd party — CyberCX	Enriches sourcetypes already ingested by TA #1 (Network Firewall, WAF, S3 VPC Flow, Macie, API Gateway Access Logs, Security Hub Custom)	1.2.9	4 Aug 2026	app/6542	Search-head-only extension adding field extraction & CIM compliance (Alert, Change, Network Traffic, Web) on top of TA #1 — does not replace it. Ingest via SQS-based S3 custom data type or syslog.
6	AWS Web Application Firewall Add-on	Technical Add-On	3rd-party dev (Hurricane Labs)	AWS WAF logs via Kinesis Firehose (JSON)	1.0.6	16 Dec 2025	app/4714	CIM 4.0+ compliant, Enterprise Security-ready. Includes a guide for routing AWS WAF logs to Splunk via Kinesis Firehose.
7	AWS Trusted Advisor Aggregator	App	3rd-party dev (community, built on Hurricane Labs foundations)	AWS Trusted Advisor recommendations across one or more accounts (cost, performance, security)	1.2.1	27 Dec 2024	app/4207	Pre-built multi-account dashboard; supports AWS Access/Secret keys, instance-profile credentials, or AssumeRole for cross-account data collection.

Note: AWS is not a recognised vendor in Splunk Connect for Syslog (SC4S) — verified against the SC4S "Known Vendors" list. AWS data sources are API/HEC-based (CloudTrail, CloudWatch, Kinesis, S3, etc.), not syslog, so SC4S provides no alternative GDI path here. Filtered out of the 25 raw Splunkbase search results: ITSI-specific content packs, a standalone DFD visualizer tool, and several low-adoption/duplicate community add-ons (0 reviews, overlapping scope with #6).

Check Point 4 Splunkbase apps · 3 SC4S sources

#	Splunkbase App	Type	Support Owner	Data Source Type Collected	Latest Version	Release Date	Splunkbase Link	Notes — Usage
1	Check Point Firewall	SOAR Connector	Splunk Supported	Check Point Firewall management API — endpoint & network containment actions	4.0.0	4 Aug 2026	app/5777	For Splunk SOAR (response, not parsing): block/unblock IP, add/remove host from group, and other containment playbook actions against Check Point firewalls. FIPS compliant.
2	Check Point App for Splunk	Technical Add-On	Check Point (Not Supported)	Firewall, endpoint, mobile & cloud logs via Check Point Log Exporter (all Check Point technologies/platforms)	1.1.6	6 Jul 2026	app/4293	CURRENT STANDARD. Primary parsing TA: CIM-compatible, integrates with Enterprise Security & SmartEvent dashboards (General Overview, Threat Prevention, Cyber Attack View), MITRE ATT&CK analytics for SandBlast malware findings. Uses Log Exporter (syslog) — see Check Point sk122323.
3	Check Point Exposure Management (Cyberint)	Technical Add-On	3rd-party dev (bensa bensa)	Cyberint / Argos Edge threat intelligence — alerts, attack tools, phishing & fraud detections	1.2.0	4 Aug 2026	app/7117	Fetches enriched, intelligence-driven threat data with automatic incident-status sync; ships pre-built dashboards for investigation.
4	Splunk Add-on for Check Point Log Exporter	Technical Add-On	Splunk LLC (Archived)	Check Point Log Exporter over syslog (RFC5424)	1.2.0	15 Feb 2024	app/5478	ARCHIVED. Splunk-built TA specifically for Log Exporter syslog ingestion (sourcetype `cp_log:syslog`); Splunkbase lists it as an archived add-on. Use #2 (app/4293) for parsing instead — see the SC4S GDI option below for the Log Exporter transport layer.

Check Point — Additional GDI Option: Splunk Connect for Syslog (SC4S)

Check Point is a recognised vendor in Splunk Connect for Syslog (SC4S), a community syslog-routing layer that's an alternative (or complement) to HEC/modular-input based GDI. SC4S auto-assigns sourcetypes and routes events to an index — it still needs a parsing TA installed on the search head for CIM/dashboards unless noted otherwise.

#	Ingestion Path	Type	Support Owner	Data Source Type Collected	Sourcetype / Config	Reference Link	Notes — Usage
1	Firewall OS (direct syslog)	SC4S Syslog Routing (No App)	Splunk Connect for Syslog (Community)	Native/raw firewall syslog output (no Log Exporter involved)	sourcetype `cp_log:fw:syslog` → index `netops`	SC4S docs	No Splunkbase Add-on required — for devices sending direct syslog without Check Point's Log Exporter.
2	Log Exporter (Syslog / RFC5424)	SC4S Syslog Routing (pairs with TA)	Splunk Connect for Syslog (Community)	Log Exporter output over IETF RFC5424 syslog, port 514/TCP	sourcetype `cp_log:syslog` → index `netops`	SC4S docs	SC4S references the now-ARCHIVED #4 (app/5478); pair with #2 (app/4293) for parsing instead. SC4S notes Check Point's own Log Exporter config template was defective as of 2/1/2022 — use SC4S's corrected config.
3	Log Exporter (Splunk legacy format)	SC4S Syslog Routing (pairs with TA)	Splunk Connect for Syslog (Community)	Legacy "Splunk format" Log Exporter output (non-RFC3164 conformant)	sourcetype `cp_log`	SC4S docs	LEGACY — avoid for new deployments. SC4S docs explicitly recommend Log Exporter (Syslog) above instead. Pairs with #2 (app/4293).

Cisco 23 active · 7 deprecated/archived · 12 SC4S sources

#	Splunkbase App	Type	Support Owner	Data Source Type Collected	Latest Version	Release Date	Splunkbase Link	Notes — Usage
1	Cisco Security Cloud	Technical Add-On	Cisco Supported	Cisco security portfolio via one add-on: Duo, Secure Firewall (FTD / eStreamer / ASA), Secure Endpoint, XDR, Secure Malware Analytics, Secure Network Analytics, Multicloud Defense, Email Threat Defense, Secure Workload, Isovalent, AI Defense, Identity Intelligence, NVM, Vulnerability Intelligence	4.1.2	17 Sep 2026	app/7404	CURRENT STANDARD. Cisco's unified security add-on: modular UX inputs, built-in health checks, CIM mappings for ES. Replaces the archived eStreamer client, Secure Firewall app, Secure Endpoint app and the deprecated Duo connector (see #24–#26).
2	Splunk Add-on for Cisco ASA	Technical Add-On	Splunk Supported	Cisco ASA (and FTD in ASA-compatible format) firewall syslog	6.1.2	29 Jul 2026	app/1620	CURRENT STANDARD for ASA syslog parsing. CIM 5.x, used by ES & PCI. #1 also lists ASA under its Secure Firewall inputs — pick one ingestion path per device so you don't get duplicate events. See SC4S #1 below.
3	Splunk Add-on for Cisco Identity Services (ISE)	Technical Add-On	Splunk Supported	Cisco ISE syslog — authentication, authorisation, posture, profiling	5.0.0	21 Nov 2024	app/1915	CIM-compatible ISE parsing for ES. #8 also collects ISE via API/syslog for networking use cases. CyberCX extension #22 adds more CIM coverage.
4	Splunk Add-on for Cisco ESA	Technical Add-On	Splunk Supported	Cisco Secure Email (ESA) — textmail, HTTP, consolidated event, AMP, delivery, bounce & authentication logs	1.7.1	30 Jun 2026	app/1761	CIM-compatible email data for ES. See SC4S #4 for syslog ingestion.
5	Splunk Add-on for Cisco WSA	Technical Add-On	Splunk Supported	Cisco Secure Web (WSA) — access logs & L4 Traffic Monitor (L4TM) logs	5.0.0	13 Dec 2024	app/1747	CIM Web / Network Traffic mapping for proxy data. Pairs with SC4S #5.
6	Splunk Add-on for Cisco UCS	Technical Add-On	Splunk Supported	Cisco UCS Manager — faults, inventory & performance via the UCS API	4.3.3	10 Sep 2026	app/2731	For UCS Manager domains. For Intersight-managed UCS / HyperFlex, use #15 instead.
7	Cisco Talos Intelligence for Enterprise Security Cloud	App	Splunk Supported	Cisco Talos threat intelligence — enriches ES findings	1.0.3	18 Jun 2026	app/7557	SPLUNK CLOUD ONLY. Supported only on Splunk Enterprise Security Cloud (AWS, GCP or Azure) running ES 7.3.2+. Not available for on-prem ES.
8	Cisco Enterprise Networking Add-on for Splunk (Cisco Catalyst Add-on)	Technical Add-On	Cisco Supported	Catalyst Center (formerly DNA Center), Catalyst SD-WAN / SD-WAN Manager (vManage), ISE, Cyber Vision — API, syslog & NetFlow	4.0.35	8 Sep 2026	app/7538	CURRENT STANDARD for Cisco enterprise networking. Replaces the archived Cisco Network Data, DNA Center and Catalyst SD-WAN add-ons (#28, #29). SC4S's Cisco IOS page now references this add-on.
9	Cisco Enterprise Networking App for Splunk	App	Cisco Supported	Uses data from #8 (plus Meraki, ThousandEyes, network-device syslog, NetFlow)	4.0.10	4 Sep 2026	app/7539	Visualisation layer: dashboards and data models for Catalyst Center, SD-WAN, ISE, Cyber Vision, Meraki & ThousandEyes. Search-head tier; install #8 first (its built-in user guide covers both).
10	Cisco Enterprise Networking NetFlow Add-on for Splunk	Technical Add-On (extension)	Cisco Supported	Cisco enterprise IPFIX & High-Speed Logging (HSL) fields in NetFlow from Catalyst SD-WAN	4.0.0	26 Aug 2026	app/6872	Maps NetFlow collected through Splunk Stream, so Stream is required. Optional extension to #8.
11	Cisco Meraki Add-on for Splunk	Technical Add-On	Cisco Supported	Meraki organisations via REST API polling & real-time webhooks — network, security & device-health events	3.4.0	14 Aug 2026	app/5580	CIM-compatible, includes sample dashboards. Built for API/webhook data only — Meraki syslog goes through SC4S #6 below.
12	Cisco Secure Access Add-on for Splunk	Technical Add-On	Cisco Supported	Cisco Secure Access (SSE) and Cisco Umbrella logs	1.0.55	10 Sep 2026	app/7569	CURRENT STANDARD for Umbrella / Secure Access. Replaces the archived Umbrella add-ons (#27).
13	Cisco Secure Access App for Splunk	App	Cisco Supported	Cloud Security APIs (Secure Access & Umbrella), Investigate API, Cloudlock CASB incidents	1.0.57	13 Jul 2026	app/5558	Dashboards on top of #12, plus Investigate lookups, destination blocking via API, app-usage visibility and Cloudlock incident management.
14	Cisco DC Networking	App	Cisco Supported	Nexus 9000 switches, ACI (APIC) & Nexus Dashboard — via APIs	1.2.2	24 Jul 2026	app/7777	All-in-one app (UCC inputs and dashboards) using a single index. Replaces the archived ACI, Nexus 9k and Nexus Dashboard Insights add-ons/apps (#30).
15	Cisco Intersight Add-on for Splunk	Technical Add-On	Cisco Supported	Cisco Intersight — alarms, audit logs, inventory & metrics	3.2.2	23 Sep 2026	app/7828	Includes pre-built dashboards. An older Intersight add-on (app/6482) is archived — use this one.
16	Cisco ThousandEyes App for Splunk	App	Cisco Supported	ThousandEyes Cloud & Enterprise Agent and Endpoint test results, events & activity logs	0.9.0	24 Aug 2026	app/7719	PRE-1.0 RELEASE. Network / digital-experience monitoring with pre-built dashboards. Also feeds #9.
17	Cisco Splunk Add-on for AppDynamics	Technical Add-On	Splunk Works (Developer Supported)	Splunk AppDynamics REST APIs — application, business-transaction & infrastructure performance, health-rule violations	3.2.1	1 May 2026	app/3471	Correlates APM data with logs/infrastructure data in Splunk; includes add-on health dashboards.
18	Cisco Service Connectors (SOAR)	SOAR Connector	Splunk Supported	Cisco product APIs — containment, investigation & enrichment playbook actions	1.x–4.x	Sep 2025 – Sep 2026	See notes	For Splunk SOAR (response, not parsing). Splunk publishes 13 separate Cisco connector apps, grouped here to keep the table short: ISE · Secure Firewall · Firepower · Umbrella · Umbrella v2 · Umbrella Investigate · Secure Access · ESA · Secure Email & Web Manager · Secure Malware Analytics · Talos Intelligence · Meraki · Webex
19	Cisco Cyber Vision Splunk Add On	Technical Add-On	Cisco Cyber Vision team (Developer Supported)	Cisco Cyber Vision OT/ICS — devices, sensors, vulnerabilities, activities, flows & events (REST API)	2.2.2	31 Aug 2026	app/5748	Pairs with the Cyber Vision Splunk App (v2.2.0, 10 Feb 2026) for dashboards; also formats data for the Splunk OT Security add-on. #8 can collect Cyber Vision too.
20	Cisco Endpoint Security Analytics (CESA) Add-On	Technical Add-On	Cisco (Not Supported)	AnyConnect Network Visibility Module (NVM) endpoint & user flow telemetry	4.0.7	25 Jun 2025	app/4221	LICENSED. Needs a CESA endpoint licence for more than 50 AnyConnect clients (free 90-day trial). Dashboards in the CESA App (v4.0.8). New deployments should look at the NVM input in #1.
21	Cisco CDR Reporting and Analytics	App	Sideview (Partner)	Cisco Unified Communications Manager (CUCM) call detail & call management records	8.4.5	6 Aug 2026	app/669	COMMERCIAL. 60-day trial. Call quality, volume, failed calls, huntgroups, concurrency and compliance reporting. Companion TA: app/4434.
22	CCX Unified Add-on for Cisco Firepower	Technical Add-On (extension)	3rd party — CyberCX	Firepower / FTD syslog and eStreamer events — improved field extraction	1.1.3	24 Aug 2025	app/5543	Search-head extension that aims for maximum CIM coverage of Firepower data. Check it against #1's built-in mappings before you add it.
23	CCX Add-on for Cisco Identity Services (ISE)	Technical Add-On (extension)	3rd party — CyberCX	Enriches ISE sourcetypes already ingested by #3	1.0.4	24 Aug 2025	app/6460	Search-head-only extension that improves CIM compliance on top of #3. Does not replace #3.
24	Duo Splunk Connector	App	Duo Security	Duo activity, administrator, authentication, telephony, endpoint & Trust Monitor logs	2.1.0	2 Dec 2024	app/3504	DEPRECATED — END-OF-LIFE 31 May 2026. Duo's own listing says to move to Cisco Security Cloud (#1).
25	Cisco Secure eStreamer Client Add-On / Cisco Secure Firewall App	Technical Add-On	Cisco Security (Archived)	Firepower / FTD eStreamer events (intrusion, connection, file, malware)	5.2.9 / 1.9.1	10 Oct 2023 / 20 Feb 2024	app/3662 · app/4388	ARCHIVED. eStreamer collection now lives in Cisco Security Cloud (#1).
26	Cisco Secure Endpoint App / CIM Add-On (formerly AMP for Endpoints)	Technical Add-On	Cisco Security (Archived)	Secure Endpoint (AMP) events	3.0.0 / 2.1.2	7 Feb 2023 / 19 Apr 2024	app/3670 · app/3686	ARCHIVED. Use the Secure Endpoint input in #1.
27	Cisco Umbrella Add-On / Cisco Cloud Security Umbrella Add-on	Technical Add-On	Hurricane Labs / Cisco (Archived)	Cisco Umbrella logs	1.0.7 / 1.0.33	10 Dec 2021 / 16 Nov 2023	app/3926 · app/5557	ARCHIVED. Replaced by the Cisco Secure Access Add-on (#12).
28	DEPRECATED Add-on / App for Cisco Network Data	Technical Add-On	Community — Mikael Bjerkeland (Archived)	Cisco IOS, IOS-XE, IOS-XR, NX-OS network-device syslog	2.8.2 / 2.8.1	6 Feb 2026 / 8 Oct 2024	app/1467 · app/1352	ARCHIVED. Once the most-downloaded Cisco networking TA (130k+ downloads). Move to #8 plus SC4S #2 (sourcetype `cisco:ios`).
29	DEPRECATED Cisco DNA Center / Catalyst SD-WAN Add-ons & Apps	Technical Add-On	Cisco Systems (Archived)	Catalyst Center (DNAC) & Catalyst SD-WAN (vManage) API data	1.0.7 / 3.1.1	28 Apr 2025 / 17 Jun 2025	DNAC TA · DNAC App · SD-WAN TA · SD-WAN App	ARCHIVED. Merged into the Cisco Enterprise Networking Add-on & App (#8, #9).
30	Cisco ACI / Nexus 9k / Nexus Dashboard Insights Add-ons & Apps (deprecated)	Technical Add-On	Cisco Systems (Archived)	ACI (APIC), Nexus 9000 and Nexus Dashboard Insights data	5.1.0 / 3.0.0 / 1.1.0	May – Nov 2024	ACI TA · ACI App · N9k TA · N9k App · NDI TA · NDI App	ARCHIVED. Merged into Cisco DC Networking (#14).

Cisco — Categorised by Data Source

Secure Firewall (ASA / FTD)

#1 eStreamer / FTD / ASA · #2 ASA syslog parsing · #22 CyberCX extension · #25 archived

Security Cloud (Duo, XDR, Endpoint, SNA…)

#1 current standard · #7 Talos for ES Cloud · #24 / #26 legacy, migrate off

Identity — ISE

#3 syslog parsing · #23 CyberCX extension · #8 API collection · #18 SOAR actions

Email & Web

#4 ESA · #5 WSA · #12 / #13 Secure Access & Umbrella · #27 archived Umbrella

Enterprise Networking

#8 / #9 / #10 Catalyst Center, SD-WAN, NetFlow · SC4S #2 IOS/NX-OS syslog · #28 / #29 archived

Meraki

#11 API & webhooks · SC4S #6 syslog · #18 SOAR actions

Data Center & Compute

#14 Nexus / ACI / Nexus Dashboard · #6 UCS Manager · #15 Intersight · #30 archived

Observability, Collaboration & OT

#16 ThousandEyes · #17 AppDynamics · #21 CUCM CDR · #19 Cyber Vision (OT)

Key notes: Cisco now owns and supports most of its own Splunk integrations (Cisco Supported). Many older standalone add-ons have been merged into a few current ones: Cisco Security Cloud (#1) for security products, Cisco Enterprise Networking (#8/#9) for Catalyst, and Cisco DC Networking (#14) for Nexus/ACI. Splunk's free Splunk Cisco App Navigator (SCAN) (app/8566) lists 50+ Cisco integrations and checks whether data is flowing — useful for checking this list against your own environment. Left out of the 65 live and 63 archived raw Splunkbase results: apps that only mention Cisco (e.g. VulDB, Cyences, generic CDR tools for other vendors), ITSI content packs, low-adoption community tools, and a custom alert action for ISE.

Cisco — Additional GDI Option: Splunk Connect for Syslog (SC4S)

Cisco is a recognised vendor in Splunk Connect for Syslog (SC4S), a community syslog-routing layer that's an alternative (or complement) to HEC/modular-input based GDI. SC4S auto-assigns sourcetypes and routes events to an index — it still needs a parsing TA installed on the search head for CIM/dashboards unless noted otherwise.

#	Ingestion Path	Type	Support Owner	Data Source Type Collected	Sourcetype / Config	Reference Link	Notes — Usage
1	ASA / FTD (Firepower)	SC4S Syslog Routing (pairs with TA)	Splunk Connect for Syslog (Community)	ASA, FTD, legacy FWSM & PIX syslog — legacy BSD format, default port 514, MSG-format based filter	sourcetypes `cisco:asa`, `cisco:ftd`, `cisco:firepower:syslog` → index `netfw` (`netids` for Firepower)	SC4S docs	Pairs with #2 (app/1620) for parsing. FWSM and PIX are no longer supported by that add-on.
2	Cisco Networking (IOS, IOS-XE, IOS-XR, NX-OS, FX-OS, AireOS WLC, APIC/ACI)	SC4S Syslog Routing (pairs with TA)	Splunk Connect for Syslog (Community)	Network-device syslog — legacy BSD format, default port 514	sourcetypes `cisco:ios`, `cisco:xr` → index `netops`	SC4S docs	SC4S points to #8 (app/7538). IOS is detected from the message itself; WLC and ACI must be identified by host/IP (update filter `f_cisco_ios`).
3	Identity Services Engine (ISE)	SC4S Syslog Routing (pairs with TA)	Splunk Connect for Syslog (Community)	ISE syslog — legacy BSD format, default port 514	sourcetype `cisco:ise:syslog` → index `netauth`	SC4S docs	Pairs with #3 (app/1915).
4	Email Security Appliance (ESA)	SC4S Syslog Routing (pairs with TA)	Splunk Connect for Syslog (Community)	ESA syslog — legacy BSD format, default port 514	sourcetypes `cisco:esa:*` (http, textmail, amp, authentication, cef, error_logs, antispam, system_logs…) → index `email`	SC4S docs	Pairs with #4 (app/1761). Needs vendor/product-by-source configuration (host or port).
5	Web Security Appliance (WSA)	SC4S Syslog Routing (pairs with TA)	Splunk Connect for Syslog (Community)	WSA access logs over syslog — legacy BSD format, default port 514	sourcetypes `cisco:wsa:squid`, `cisco:wsa:squid:new` → index `netproxy`	SC4S docs	Pairs with #5 (app/1747). Needs vendor/product-by-source configuration; make sure host and timestamp are in the log.
6	Meraki (MR / MX / MS)	SC4S Syslog Routing (No App)	Splunk Connect for Syslog (Community)	Meraki access point, security appliance & switch syslog	sourcetypes `meraki:accesspoints`, `meraki:securityappliances`, `meraki:switches`, `meraki` → index `netfw`	SC4S docs	Meraki messages can't be told apart by content, so set known Meraki hosts or unique ports in SC4S. SC4S notes the Meraki add-on (#11) does not parse syslog.
7	Catalyst Center (DNA Center)	SC4S Syslog Routing (No App)	Splunk Connect for Syslog (Community)	Catalyst Center syslog — RFC5424, port 514	sourcetype `cisco:dna` → index `netops`	SC4S docs	No add-on listed by SC4S. For API data and dashboards, use #8 / #9.
8	Viptela (Catalyst SD-WAN)	SC4S Syslog Routing (No App)	Splunk Connect for Syslog (Community)	SD-WAN device syslog — MSG-format based filter	sourcetype `cisco:viptela` → index `netops`	SC4S docs	No add-on listed by SC4S. For SD-WAN Manager API data and dashboards, use #8 / #9.
9	Unified Communications Manager (UCM)	SC4S Syslog Routing (No App)	Splunk Connect for Syslog (Community)	CUCM syslog — legacy BSD format, default port 514	sourcetype `cisco:ucm` → index `ucm`	SC4S docs	Syslog only. For CDR/CMR call analytics, see #21.
10	UCS / HyperFlex & Integrated Management Controller (IMC)	SC4S Syslog Routing (No App)	Splunk Connect for Syslog (Community)	UCS and CIMC syslog — legacy BSD format, default port 514	sourcetypes `cisco:ucs` (UCS), `cisco:infraops` (CIMC) → index `infraops`	SC4S docs	Complements API-based #6 / #15. IMC reference: SC4S IMC docs.
11	Collaboration — Meeting Management, Meeting Server, TelePresence VCS	SC4S Syslog Routing (No App)	Splunk Connect for Syslog (Community)	Collaboration infrastructure syslog	sourcetypes `cisco:mm:audit`, `cisco:ms` → `netops`; `cisco:tvcs` → `main`	SC4S docs	Meeting Management and Meeting Server need vendor/product-by-source configuration. Other pages: MM · TVCS.
12	Legacy — ACS & ACE	SC4S Syslog Routing (No App)	Splunk Connect for Syslog (Community)	Access Control System and Application Control Engine syslog	sourcetypes `cisco:acs` → `netauth`; `cisco:ace` → `netops`	SC4S docs	LEGACY PRODUCTS. The ACS add-on SC4S refers to (app/1811) is archived; ISE (#3) replaced ACS. ACE: SC4S docs.

F5 6 active · 4 archived (1 row) · 1 SC4S source

#	Splunkbase App	Type	Support Owner	Data Source Type Collected	Latest Version	Release Date	Splunkbase Link	Notes — Usage
1	Splunk Add-on for F5 BIG-IP	Technical Add-On	Splunk Supported	BIG-IP LTM, GTM/DNS, ASM (Advanced WAF) & APM — traffic data, system logs, settings, performance metrics & traffic statistics via syslog, iRules (HSL) and the iControl API	7.0.1	2 Sep 2026	app/2680	CURRENT STANDARD. The only actively maintained, Splunk-supported F5 parsing add-on. CIM-compatible for ES, PCI and ITSI. Pairs with SC4S #1 below for syslog transport.
2	F5 BIG-IP LTM	SOAR Connector	Splunk Supported	BIG-IP LTM iControl API — pool & node management	2.1.5	4 Aug 2026	app/5948	For Splunk SOAR (response, not parsing): investigate and manage BIG-IP LTM pools and nodes as playbook actions.
3	Splunk Add-on for NGINX	Technical Add-On	Splunk Supported	NGINX (an F5 product) web server access & error logs and performance metrics — file monitoring & API inputs	3.3.2	10 Sep 2026	app/3258	Listed here because F5 owns NGINX. CIM-compatible for ES, PCI and ITSI.
4	F5 XC Add-on	Technical Add-On	3rd-party dev (Waleed Abosree)	F5 Distributed Cloud (XC) HTTP access, WAF, Bot Defense & L7 service-policy logs via HEC (sourcetype `f5:xc`)	1.2.0	29 Jul 2026	app/9322	NEW / LOW ADOPTION. The only F5 Distributed Cloud parser on Splunkbase. Maps to CIM Web and Intrusion Detection. Splunkbase lists it as type "app", but it works as a TA.
5	F5 XC Monitoring	App	3rd-party dev (Waleed Abosree)	Uses data from #4	2.0.0	29 Jul 2026	app/9321	Dashboards only: WAF attack analytics, Bot Defense, L7 policy enforcement, threat geomap and HTTP performance. Requires #4.
6	F5 WAF Security	App	3rd-party dev (Nexinto) — Not Supported	F5 ASM (Advanced WAF) attack events	—	—	app/2873	NO DOWNLOADABLE VERSION LISTED on Splunkbase as of compile date. GeoIP, attack-type and violation dashboards for ASM data. Use #1 for ASM parsing instead.
7	F5 Networks - LTM / F5 Security / F5 Access Visibility / F5 Analytics (iApp)	App	F5 Networks & community (Archived)	Legacy LTM, ASM and APM dashboards	2.0 / 1.0.0	Apr – Dec 2016	LTM · Security · Access · Analytics	ARCHIVED — 2016. F5's own Splunk apps have been unmaintained since 2016. Use #1 for data; there is no supported F5 dashboard app to replace them.

Key notes: F5 has a small Splunkbase footprint. Almost all BIG-IP use cases (LTM, DNS/GTM, Advanced WAF/ASM, APM) come down to one Splunk-supported add-on (#1). F5 publishes no supported dashboard app of its own. Left out of the raw search results: an Atlas ITSI content pack for BIG-IP (app/7418) and an archived 2015 query tool.

F5 — Additional GDI Option: Splunk Connect for Syslog (SC4S)

F5 is a recognised vendor in Splunk Connect for Syslog (SC4S), a community syslog-routing layer that's an alternative (or complement) to HEC/modular-input based GDI. SC4S auto-assigns sourcetypes and routes events to an index — it still needs a parsing TA installed on the search head for CIM/dashboards unless noted otherwise.

#	Ingestion Path	Type	Support Owner	Data Source Type Collected	Sourcetype / Config	Reference Link	Notes — Usage
1	BIG-IP (LTM / GTM / ASM / APM)	SC4S Syslog Routing (pairs with TA)	Splunk Connect for Syslog (Community)	BIG-IP syslog and iRule-generated events — legacy BSD format, default port 514	sourcetypes `f5:bigip:syslog`, `f5:bigip:irule`, `f5:bigip:ltm:http:irule`, `f5:bigip:gtm:dns:request:irule`, `f5:bigip:asm:syslog`, `f5:bigip:apm:syslog`, `f5:bigip:ltm:access_json` → index `netops` (`netwaf` for ASM)	SC4S docs	Pairs with #1 (app/2680). Needs vendor/product-by-source configuration, and the host must be in the syslog header. Without the `f_f5_bigip` filter, OS-level events fall back to `nix:syslog` → `osnix`.

Linux 8 active · 6 deprecated/archived

#	Splunkbase App	Type	Support Owner	Data Source Type Collected	Latest Version	Release Date	Splunkbase Link	Notes — Usage
1	Splunk Add-on for Unix and Linux	Technical Add-On	Splunk Supported	Unix/Linux OS logs, performance metrics, process/service info, package inventory, cron, hardware, network config	10.3.4	1 Sep 2026	app/833	CURRENT STANDARD. UF-based scripted/modular inputs providing rapid operational visibility across large-scale Unix/Linux fleets; pairs with the (now-archived) Splunk App for Unix and Linux dashboards. CIM 6.x compatible. v6.0 introduced default index/.conf changes — test upgrades in non-production first.
2	Splunk Add-on for Linux	Technical Add-On	Splunk Supported	Linux performance metrics via HEC/TCP (CPU, memory, swap, disk, network, load, process, TCP connections, thermal, uptime)	2.1.1	30 Mar 2026	app/3412	Lighter-weight, metrics-only alternative to TA #1 — pushes data via HTTP Event Collector/TCP instead of UF scripted inputs. CIM 5.x compatible. Choose based on whether you need full log collection (#1) or just metrics (#2).
3	Splunk Asset and Risk Intelligence Technical Add-on For Linux	Technical Add-On	Splunk Supported	Real-time Linux IT asset discovery & attribution (Splunk Asset and Risk Intelligence / SARI Edge Discovery)	1.2.0	17 Sep 2025	app/7416	Feeds Splunk's Asset and Risk Intelligence product — distinct from general log ingestion in TA #1/#2; focused on asset inventory/attribution.
4	Splunk Exposure Analytics Add-on for Linux	Technical Add-On	Splunk Supported	Enriched asset & user data from Splunk forwarder endpoints (system, user, network, full-disk-encryption info)	1.0.0	29 Apr 2026	app/8692	Optional entity-discovery source for Splunk Exposure Analytics; deploy to forwarders to enhance endpoint-derived enrichment alongside other discovery sources.
5	BeyondTrust Privilege Management for Unix and Linux	App	BeyondTrust Corporation	BeyondTrust Privilege Management — privileged command activity, recorded sessions, system-level control data	1.0.8	6 Jul 2026	app/7398	Vendor-published example app demonstrating centralized visibility into privileged access activity on Unix/Linux; provided free as a base for custom implementations.
6	Sandfly Agentless Security for Linux	App	Sandfly Security	Sandfly agentless Linux endpoint security findings (drift detection, rootkit/intrusion checks)	4.7.0	12 Feb 2026	app/5016	Vendor-published dashboards/inputs for Sandfly's agentless Linux security scanning product. CIM 6.x compatible.
7	OCSF TA for Linux	Technical Add-On (extension)	3rd-party dev (Arkitech Security)	Auditd events mapped to OCSF-compliant fields (on top of TA #1's Auditd collection)	2.3.3	18 Jul 2026	app/7432	Search-head extension adding OCSF and CIM 8.x field mapping for Auditd — ties STIG/CIS compliance data to security use cases.
8	Monitoring Linux - Metrics and Logs Forwarding	Technical Add-On	3rd-party dev (Outcold Solutions)	Linux metrics & logs via a proprietary lightweight forwarder (alternative to UF)	5.21.411	18 Nov 2024	app/4768	Commercial alternative collection agent for environments that prefer not to deploy a full Universal Forwarder.
9	Splunk App for Unix and Linux	App	Splunk LLC (Archived)	Consumes data ingested by TA #1	6.0.2	11 Jun 2021	app/273	ARCHIVED / EOL. Splunk officially end-of-sold this app 30 Apr 2021 and end-of-lifed it 13 Mar 2022, refocusing on IT Essentials Work and IT Service Intelligence (ITSI) instead — the same fate as the Windows Infrastructure companion app.
10	Splunk Add-on for Sysmon for Linux	Technical Add-On	Splunk LLC (Archived)	Sysmon for Linux events	1.0.0	24 Oct 2022	app/6652	ARCHIVED. No confirmed modern replacement identified on Splunkbase for dedicated Sysmon-for-Linux parsing.
11	NMON Performance Monitor for Unix and Linux Systems	App	3rd-party dev (Guilhem Marchand)	NMON performance metrics (CPU, memory, disk, network) for Unix/Linux	1.9.21	30 Nov 2019	app/1753	ARCHIVED. Long-popular community performance app (49 reviews); evaluate TA #1/#2's native performance metrics as the modern equivalent.
12	Linux Auditd	App	3rd-party dev (Doug Brown)	Linux Auditd security events	3.1.0	18 Oct 2019	app/2642	ARCHIVED. Pair OCSF TA for Linux (#7) with TA #1's Auditd input for a modern equivalent.
13	Linux Secure Technology Add-On	Technical Add-On	3rd-party dev (Doug Brown)	Linux `/var/log/secure` authentication & authorization events	1.0.1	29 Nov 2021	app/3476	ARCHIVED. No confirmed modern replacement identified on Splunkbase specific to /var/log/secure parsing.
14	Linux Netfilter (iptables) Technology Add-On	Technical Add-On	3rd-party dev (Doug Brown)	Linux Netfilter/iptables firewall logs	1.0.0	2 Jul 2019	app/3089	ARCHIVED. Consider the SC4S "Generic *NIX" path below for appliance-style iptables/syslog forwarding, or TA #1 for host-based collection.

Note on SC4S: Linux/Unix is a recognised source in Splunk Connect for Syslog (SC4S) via the "Generic *NIX" base source (sourcetype nix:syslog → index osnix), pairing with TA #1 (app/833). SC4S's own documentation is explicit that this path is intended for appliances built on Linux/BSD that log via syslog — it is NOT a replacement for the Universal Forwarder on general-purpose Linux servers, which offers far more comprehensive event/metric collection for both security and operations use cases. Reference: SC4S Generic *NIX docs. Filtered out of the raw Splunkbase search results: platform-suffixed packages that aren't actually Linux data sources (e.g. "CyberArk Audit for Splunk (for Linux 64-bit)" is a CyberArk data source, not a Linux one), Python runtime packages, UF-upgrade utilities, ITSI content packs, an internal Splunk self-monitoring add-on (S.o.S), and several low-adoption/unclear community listings.

Microsoft Cloud Azure · Entra ID · Microsoft 365 · Defender — 13 active · 4 archived · 1 SC4S source

#	Splunkbase App	Type	Support Owner	Data Source Type Collected	Latest Version	Release Date	Splunkbase Link	Notes — Usage
1	Splunk Add-on for Microsoft Cloud Services	Technical Add-On	Splunk Supported	Azure — Event Hubs (diagnostic, Entra ID & resource logs streamed to Event Hub), activity/audit logs, resource data, service status, Storage Table & Blob	6.3.3	10 Sep 2026	app/3110	CURRENT STANDARD for Azure. CIM-compatible for ES, PCI and ITSI. Most inputs from the Splunk Works Azure add-on (#7) have moved here — see the migration guide.
2	Splunk Add-on for Microsoft Security	Technical Add-On	Splunk Supported	Microsoft Defender XDR (365 Defender) incidents & alerts, Defender for Endpoint alerts, Defender Advanced Hunting events	4.0.0	21 Jul 2026	app/6207	CURRENT STANDARD for Defender. Replaces the archived Microsoft 365 Defender add-on and Defender Advanced Hunting add-on (#14, #15). Dashboards are in #5.
3	Splunk Add-on for Microsoft Office 365	Technical Add-On	Splunk Supported	Office 365 Management Activity API — audit logs for Entra ID, SharePoint Online, Exchange Online & DLP; service status and messages; message trace	6.1.0	30 Jul 2026	app/4055	CURRENT STANDARD for Microsoft 365. Took over message trace from the archived Reporting Web Service add-on (#16).
4	Microsoft Azure App for Splunk	App	Splunk Works (Not Supported)	Uses data from #1, #2 & #7	2.1.1	11 Dec 2024	app/4882	Dashboards for subscriptions, resources, VMs, metrics, storage, security monitoring and billing (beta), plus onboarding guides for app registrations. Search-head tier.
5	Microsoft 365 App for Splunk	App	Splunk Works (Not Supported)	Uses data from #2, #3 & #6	3.3.2	13 Apr 2026	app/3786	Dashboards for Entra ID, Defender XDR, Defender for Endpoint, Exchange, SharePoint, OneDrive, Teams and Power BI, with a step-by-step onboarding guide. Search-head tier.
6	Microsoft Teams Add-on for Splunk	Technical Add-On	Splunk Works (Not Supported)	Teams call records, sessions & segments (call quality — jitter, packet loss, RTT) via Microsoft Graph	2.0.1	16 Jul 2026	app/4994	Feeds the Teams dashboards in #5.
7	Splunk Add on for Microsoft Azure	Technical Add-On	Splunk Works (Not Supported)	Entra ID users, sign-ins, directory audits, devices, groups & risk detections; Defender for Cloud (Security Center) alerts; Resource Graph	4.2.0	15 Nov 2024	app/3757	LEGACY — INPUTS MIGRATED. Its own listing says the inputs have moved to Splunk-supported add-ons (mainly #1). Plan to migrate. Still includes useful alert actions (stop VM, add user to group).
8	Microsoft O365 Email Add-on for Splunk	Technical Add-On	Splunk Works (Not Supported)	M365 email from a dedicated compliance mailbox via Microsoft Graph — attachments, IOCs, SPF/DKIM/DMARC, phishing risk scoring	2.4.18	24 Apr 2026	app/5365	Security-focused mailbox ingestion with hashing, ZIP/macro inspection and header parsing. Separate from the audit logs in #3.
9	Microsoft Cloud Service Connectors (SOAR)	SOAR Connector	Splunk Supported	Microsoft Graph, Entra ID, Defender, Azure & M365 APIs — containment & investigative playbook actions	1.x–4.x	Sep 2025 – Sep 2026	See notes	For Splunk SOAR (response, not parsing). Splunk publishes 15 separate Microsoft cloud connector apps, grouped here to keep the table short: MS Graph for Active Directory · Azure AD Graph · MS Graph for Office 365 · MS Graph for O365 – Federal · Microsoft 365 · Microsoft 365 Defender · Defender for Endpoint · Azure Compute · Azure SQL · Azure DevOps · Teams · OneDrive · MS Graph for SharePoint · EWS for Office 365 · Intune (SOAR Community)
10	Splunk Alerts for Microsoft Teams	App (Alert Action)	Splunk Supported	Outbound only — posts Splunk alerts to Teams channels	1.1.11	27 Apr 2026	app/4855	Not a data source. Sends alert notifications to Teams (message cards, actions, retry through KV store).
11	Microsoft Graph Security Score Add-on	Technical Add-On	3rd-party dev (Crossrealms)	Microsoft Secure Score via the Graph Security API	1.3.0	15 Sep 2026	app/5693	Lightweight scripted input for tracking Secure Score over time.
12	Microsoft 365 Defender Threat Vulnerability Add-on for Splunk	Technical Add-On	3rd-party dev (Thomas Hillesøy)	Defender Vulnerability Management (TVM) — device vulnerabilities & exposure	2.0.2	17 Aug 2026	app/6470	CIM Vulnerabilities data model, plus reports that build ES asset lookups. Fills a gap: #2 does not collect TVM data.
13	MS Defender Advanced Hunting	Technical Add-On (search command)	3rd-party dev (Masaki Yoshikawa)	Ad-hoc KQL Advanced Hunting queries against Defender for Endpoint, Defender XDR or Graph APIs	0.2.6	8 Aug 2026	app/6456	Search-time custom command, not scheduled ingestion. Useful for pivoting from Splunk into Defender during investigations.
14	Microsoft Defender Advanced Hunting Add-on for Splunk	Technical Add-On	Splunk Works (Archived)	Defender Advanced Hunting events (CIM Endpoint)	1.4.2	9 Jan 2026	app/5518	ARCHIVED — FINAL VERSION. Moved into #2.
15	Microsoft 365 Defender Add-on for Splunk	Technical Add-On	Splunk Works (Archived)	365 Defender incidents, Defender for Endpoint alerts	1.3.0	21 May 2021	app/4959	ARCHIVED. Data collection moved to #2 and dashboards to #5.
16	Splunk Add-on for Microsoft Office 365 Reporting Web Service	Technical Add-On	Splunk Works (Archived)	Office 365 message trace	2.0.1	21 Sep 2022	app/3720	ARCHIVED. Moved into #3.
17	Microsoft Graph Security API Add-On / Microsoft Sentinel Add-On	Technical Add-On	Microsoft Corporation (Archived)	Graph Security API alerts (inbound) / Splunk → Sentinel log forwarding (outbound)	1.2.6 / 1.0.6	7 Jun 2023 / 7 Mar 2022	app/4564 · app/5312	ARCHIVED. Microsoft-published add-ons that are no longer maintained. Use #2 for Defender alerts and #1 for Azure/Entra data.

Microsoft Cloud — Categorised by Data Source

Azure (subscriptions, resources, Event Hub)

#1 current standard · #4 dashboards · #7 legacy, migrate off · #9 SOAR (Compute, SQL, DevOps)

Entra ID (Azure AD)

#3 audit via Management API · #1 sign-in/audit via Event Hub · #9 SOAR (MS Graph for AD)

Microsoft 365 (Exchange Online, SharePoint, Teams)

#3 audit & DLP · #6 Teams call quality · #8 mailbox content · #5 dashboards

Defender XDR / Endpoint

#2 incidents, alerts & hunting · #12 vulnerabilities · #13 ad-hoc KQL · #11 Secure Score

Scope: this tab covers Microsoft's cloud services only. On-prem Windows, Active Directory, DNS and DHCP are on the Windows tab. On-prem server products — Exchange Server, SQL Server, IIS, SCOM, SCCM, Hyper-V — were left out; they have their own Splunk-supported add-ons (e.g. Exchange, IIS, SCOM) and could get their own tab later. Also left out: on-prem SOAR connectors (Exchange EWS on-prem, SCCM, SCOM, SQL Server), low-adoption community lookups (Entra group/tenant/mailbox lookups), and the archived "Blue team app for Office 365 and Azure" (app/4667).

Microsoft Cloud — Additional GDI Option: Splunk Connect for Syslog (SC4S)

Microsoft's cloud services are API-based (Graph, Management Activity API, Event Hubs), not syslog, so SC4S plays a very small part here. The SC4S "Microsoft" vendor entry covers only one product:

#	Ingestion Path	Type	Support Owner	Data Source Type Collected	Sourcetype / Config	Reference Link	Notes — Usage
1	Defender for Cloud Apps (formerly Cloud App Security / MCAS)	SC4S Syslog Routing (No App)	Splunk Connect for Syslog (Community)	MCAS SIEM agent output as CEF — legacy BSD format, default port 514	sourcetype `cef`, source `microsoft:cas` → index `main`	SC4S docs	The only Microsoft source in SC4S. Parsed by the generic Splunk Add-on for CEF (GitHub, not Splunkbase). Check Microsoft's current SIEM-integration guidance first — the API-based add-ons above are the main path for Microsoft cloud data.

Palo Alto Networks 10 Splunkbase apps · 4 SC4S sources

#	Splunkbase App	Type	Support Owner	Data Source Type Collected	Latest Version	Release Date	Splunkbase Link	Notes — Usage
1	Splunk Add-on for Palo Alto Networks	Technical Add-On	Splunk Supported	Cortex XDR, IoT Security, Firewalls (NGFW), Panorama, Strata Logging Service	4.0.0	14 Aug 2026	app/7523	CURRENT STANDARD. Official parsing TA: modular inputs for IoT Security & Cortex XDR, CIM 5.x normalisation, health-check monitoring dashboard, latest PAN-OS support. Deploy on indexers / heavy forwarders.
2	Splunk App for Palo Alto Networks	App	Splunk LLC (Supported)	Consumes data ingested by TA #1 (firewall, Panorama, XDR, IoT, SLS)	1.0.1	14 Nov 2024	app/7505	Visualization layer: security reporting & analysis dashboards correlating app/user activity across network & security infrastructure. Search-head tier; requires TA #1.
3	Palo Alto API Inputs Add On	Technical Add-On	3rd-party dev (Edlyn Liew)	Logs & telemetry from PAN devices via API (alternative to syslog/HEC)	1.0.16	4 Dec 2025	app/8283	Use where syslog forwarding isn't feasible (firewalls behind NAT / restricted networks) or extra API metadata is needed; supports custom API endpoint scripts.
4	CCX Palo Alto Cortex XDR (CEF)	Technical Add-On	3rd party — CyberCX	Cortex XDR syslog (CEF) forwarded from Cortex Data Lake via syslog server	1.0.2	29 Aug 2025	app/6326	Field-extraction bundle mapping XDR CEF logs to CIM datamodels: Network Traffic, Change, Malware, Alerts, IDS. Not Splunk supported.
5	Palo Alto Cortex XDR	SOAR Connector	SOAR Community	Cortex XDR API — incidents, endpoints	1.2.1	28 Apr 2025	app/6046	For Splunk SOAR (response, not parsing): on-poll ingest, list endpoints, block/allow hash, quarantine / unquarantine device, get incident details.
6	Prisma Cloud Audit Input	Technical Add-On (input)	3rd-party dev (Brett Adams)	Prisma Cloud audit logs (API pull)	1.0.4	3 Aug 2026	app/6379	Pulls the Prisma Cloud audit trail into Splunk for admin / compliance visibility.
7	Add-on for Prisma Cloud Audit	Technical Add-On (input)	3rd-party dev (Rotimi Akinbobola)	Audit events from Prisma Cloud	2.0.1	20 Sep 2026	app/7700	Alternative Prisma Cloud audit fetcher — compare features against #6 before selecting.
8	Palo Alto Networks Add-on for Splunk (Splunk_TA_paloalto)	Technical Add-On	Palo Alto Networks	NGFW, Panorama, Traps ESM; also Aperture / SaaS Security, Cortex XDR, MineMeld / AutoFocus	8.1.3	24 May 2024	app/2757	DEPRECATED / ARCHIVED. Legacy PAN-owned TA. Migrate to #1 (Splunk-supported); note revised CIM mapping, macros, and input config changes during migration.
9	Palo Alto Networks App for Splunk (SplunkforPaloAltoNetworks)	App	Palo Alto Networks	Consumes legacy TA #8 data (firewall, GlobalProtect, WildFire, Traps, Aperture)	8.1.3	24 May 2024	app/491	DEPRECATED / ARCHIVED. Legacy dashboards: adversary attacks, incidents, SaaS usage, system health, config audit, malware, GlobalProtect VPN. Migrate to #2.
10	CCX Add-on for Palo Alto Networks (PAN IOT)	Technical Add-On	3rd party — CyberCX	IoT Security API — alert events, detections, vulnerabilities	1.0.0	27 Feb 2024	app/7250	ARCHIVED. CIM-compliant extractions (Alert, Endpoint, Network Traffic, IDS, Vulnerabilities). Superseded by the native IoT input in TA #1.

Palo Alto Networks — Categorised by Data Source

NGFW / Panorama (Syslog)

#1 current standard · #8 / #9 legacy, migrate off · #3 API-based alternative

Strata Logging Service / Cortex Data Lake

#1 native SLS input · #4 CEF-via-syslog extraction

Cortex XDR

#1 API modular input · #4 CEF syslog parsing · #5 SOAR response actions

IoT Security

#1 native input · #10 archived CyberCX alternative

Prisma Cloud

#6 / #7 audit logs. Prisma Cloud Compute (Twistlock) App — app/4555 by Palo Alto Networks — covers incidents & forensics via the Compute API (verify latest version on the listing).

Key notes: the Palo Alto App + Add-on pair (#1 + #2) is now officially Splunk Supported — all updates and support are managed by Splunk. Legacy #8 / #9 are deprecated; #10 is archived — all three are listed last in the table below. Splunkbase Classic will be deactivated on 18 Feb 2026 — update any bookmarked classic links.

Palo Alto Networks — Additional GDI Option: Splunk Connect for Syslog (SC4S)

Palo Alto Networks is a recognised vendor in Splunk Connect for Syslog (SC4S), a community syslog-routing layer that's an alternative (or complement) to HEC/modular-input based GDI. SC4S auto-assigns sourcetypes and routes events to an index — it still needs a parsing TA installed on the search head for CIM/dashboards unless noted otherwise.

#	Ingestion Path	Type	Support Owner	Data Source Type Collected	Sourcetype / Config	Reference Link	Notes — Usage
1	PAN-OS (NGFW / Panorama / Cortex Data Lake)	SC4S Syslog Routing (pairs with TA)	Splunk Connect for Syslog (Community)	NGFW/Panorama/CDL syslog — legacy BSD default port 514, or IETF Framed on port 601	sourcetypes `pan:log`, `pan:globalprotect`, `pan:traffic`, `pan:threat`, `pan:system`, `pan:config`, `pan:hipmatch`, `pan:correlation`, `pan:userid`	SC4S docs	Alternative transport/routing layer to the direct syslog input already built into #1 (app/7523); still requires that TA on search heads for CIM parsing/dashboards. Useful if you already run SC4S for centralized syslog routing across many vendors.
2	Cortex XDR	SC4S Syslog Routing (pairs with TA)	Splunk Connect for Syslog (Community)	Cortex XDR / Cortex Data Lake syslog — requires TLS, IETF Framed, port 5425	sourcetypes `pan:*`, `pan:xsoar`	SC4S docs	SC4S docs still reference the deprecated #8 (app/2757) — pair with current-standard #1 (app/7523) instead for parsing.
3	Traps	SC4S Syslog Routing (pairs with TA)	Splunk Connect for Syslog (Community)	Traps ESM syslog — legacy BSD format, default port 514	sourcetype `pan:traps4`	SC4S docs	Pairs with #1 (app/7523) for parsing.
4	Prisma SD-WAN ION	SC4S Syslog Routing (No App)	Splunk Connect for Syslog (Community)	Prisma SD-WAN ION flow, authentication & event syslogs (MSG format)	sourcetypes `prisma:sd-wan:flow`, `prisma:sd-wan:authentication`, `prisma:sd-wan:event`	SC4S docs	No Splunkbase Add-on required. Distinct data source from Prisma Cloud (#6/#7, API-based audit logs) — Prisma SD-WAN ION is a separate networking product ingested purely via syslog.

Salesforce 6 apps

#	Splunkbase App	Type	Support Owner	Data Source Type Collected	Latest Version	Release Date	Splunkbase Link	Notes — Usage
1	Splunk Add-on for Salesforce	Technical Add-On	Splunk Supported	Salesforce REST API — Event Log File data & SOQL object query output	7.0.1	3 Sep 2026	app/3549	CURRENT STANDARD. CIM-compatible inputs for use with Enterprise Security, PCI Compliance app, ITSI. v2.0.0 introduced breaking changes — always test upgrades in non-production before deploying.
2	Salesforce	SOAR Connector	Splunk Supported	Salesforce object management API	3.0.1	21 Jul 2026	app/5930	For Splunk SOAR (response, not parsing): create/update/manage Salesforce objects as part of automated playbooks. FIPS compliant.
3	Splunk Add-on for Salesforce Streaming API	Technical Add-On	Splunk Works (Not Supported)	Salesforce Streaming API — PushTopic, generic, platform & Change Data Capture (CDC) events	2.1.0	24 Jul 2026	app/5689	Near real-time push-based ingestion, complementary to #1's polled REST API collection. Not officially Splunk supported despite Splunk Works authorship.
4	CCX Extensions for Salesforce	Technical Add-On (extension)	3rd party — CyberCX	Enriches sourcetypes already ingested by #1 / #3 (login history, setup audit trail, log file, streaming login/report/security events)	1.0.6	24 Aug 2025	app/7174	Search-head-only extension adding field extraction & CIM compliance (Alerts, Authentication, Change, Data Access, IDS) on top of #1 and #3 — does not replace either add-on.
5	Salesforce Commerce Cloud Connector for CX Monitoring	App	3rd-party dev (AIOPS Group Monitoring Team)	Salesforce Commerce Cloud (SFCC) — logs, orders, products, pricebooks, inventory, eCDN, customer data	6.15.0	21 Sep 2026	app/6570	Broader CX-monitoring solution (not Salesforce CRM-specific): 360° monitoring with self-healing, 110+ real-time alerts, 200+ KPIs across the SFCC storefront stack.
6	Salesforce Monitoring App for Splunk	App	3rd-party dev (Rojo Consultancy BV)	Salesforce transactional & operational data (login history, platform/object stats, REST API usage)	1.0.0	24 Sep 2024	app/6579	NO DOWNLOADABLE VERSION LISTED on Splunkbase as of compile date — listing shows "This app has no available versions." Out-of-the-box dashboards for login trends, org limits, and API insights once available.

Note: Salesforce is not a recognised vendor in Splunk Connect for Syslog (SC4S) — its data sources (REST/Streaming APIs) are not syslog-based, so SC4S provides no alternative GDI path here. All ingestion options above use API/HEC-based inputs instead.

Windows 10 active · 5 deprecated/archived

#	Splunkbase App	Type	Support Owner	Data Source Type Collected	Latest Version	Release Date	Splunkbase Link	Notes — Usage
1	Splunk Add-on for Microsoft Windows	Technical Add-On	Splunk Supported	Windows Event Logs (Security/System/Application/etc.), performance counters, WMI, registry, Active Directory, DNS, DHCP, file system changes	11.0.2	17 Aug 2026	app/742	CURRENT STANDARD. Since v6.0.0 this TA has absorbed the standalone Splunk Add-on for Windows DNS and Splunk Add-on for Microsoft Active Directory — do not run those alongside v6.0.0+. CIM 5.x compatible. v5.0.0 introduced breaking changes — test upgrades in non-production first.
2	Splunk Asset and Risk Intelligence Technical Add-on For Windows	Technical Add-On	Splunk Supported	Real-time Windows IT asset discovery & attribution (Splunk Asset and Risk Intelligence / SARI Edge Discovery)	1.2.0	17 Sep 2025	app/7214	Feeds Splunk's Asset and Risk Intelligence product — distinct from general log ingestion in TA #1; focused on asset inventory/attribution.
3	Windows Remote Management	SOAR Connector	Splunk Supported	Windows Remote Management (WinRM) — remote command & script execution	3.0.1	21 Sep 2026	app/5875	For Splunk SOAR (response, not parsing): run commands/scripts on remote Windows hosts via WinRM as part of automated playbooks.
4	TA-winfw Technology Addon for Windows Firewall	Technical Add-On	3rd-party dev (Andreas Roth)	Windows Firewall event logs	1.0.1	21 Aug 2024	app/3300	ARCHIVED on Splunkbase (detected 23 Sep 2026). Dedicated parsing for Windows Firewall with Advanced Security logs, complementary to TA #1's general Windows Event Log coverage.
5	CCX Microsoft Windows Extensions (Defender for Endpoint and Sysmon)	Technical Add-On (extension)	3rd party — CyberCX	Enriches sourcetypes already ingested by TA #1 (Microsoft Defender for Endpoint & Sysmon events)	1.0.8	25 Sep 2025	app/6313	Search-head-only extension adding field extraction & CIM compliance on top of TA #1 — does not replace it.
6	Microsoft Windows Firewall Observability	Technical Add-On	3rd-party dev (Amara Mohamed Traore)	Windows host firewall traffic & configuration-change activity	4.0.0	25 Aug 2026	app/7790	CIM 6.x compliant; collects, parses and visualizes workstation/server firewall traffic and config changes with dedicated dashboards.
7	Windows Certificate Store Add-on for Splunk	Technical Add-On	3rd-party dev (Crossrealms)	Windows certificate store contents/metadata	1.0.2	22 Sep 2025	app/7013	Inventories certificates on Windows hosts for expiry tracking and compliance visibility.
8	Windows Security Operations Center	App	3rd-party dev (Bojan Zdrnja)	Consumes data ingested by TA #1	2.0.1	19 Sep 2025	app/647	Long-running community SOC dashboard app on top of TA #1 — correlation views for endpoint/security-relevant Windows events.
9	Add-On for Windows DNS Analytical Logging	Technical Add-On	3rd-party dev (Hugh Kelley)	Windows DNS Server analytical/diagnostic event logs	—	9 Jul 2023	app/4300	NO DOWNLOADABLE VERSION LISTED on Splunkbase as of compile date. Last updated 2023 — evaluate TA #1's built-in DNS input first.
10	Windows Lateral Movement Detection	Technical Add-On	3rd-party dev (community)	Windows-based forensic inputs for lateral-movement threat hunting (built on SANS' 2018 "Hunt Evil" poster)	—	17 Sep 2025	app/4581	NO DOWNLOADABLE VERSION LISTED on Splunkbase as of compile date — listing shows "This app has no available versions."
11	Splunk App for Windows Infrastructure	App	Splunk LLC (Archived)	Consumed data from the legacy Windows TAs (superseded)	2.0.4	30 Aug 2021	app/1680	ARCHIVED / EOL. Splunk officially end-of-sold this app 31 Jul 2021 and end-of-lifed it 21 Oct 2021, refocusing on IT Essentials Work and IT Service Intelligence (ITSI) instead.
12	Splunk Add-on for Microsoft Windows DNS	Technical Add-On	Splunk LLC (Archived)	Windows DNS Server logs	1.0.1	11 Oct 2016	app/3208	DEPRECATED / ARCHIVED. Fully absorbed into TA #1 as of v6.0.0 — do not install alongside TA #1 v6.0.0+.
13	TA for Microsoft Windows Defender	Technical Add-On	3rd-party dev (Patrick O'Connell)	Windows Defender antivirus/antimalware events	1.0.8	9 Dec 2021	app/3734	ARCHIVED. Consider CCX Microsoft Windows Extensions (#5) or TA #1's native Defender coverage instead.
14	Microsoft Windows DHCP addon for Splunk	Technical Add-On	3rd-party dev (Nick Hills)	Windows DHCP Server logs	1.2.0	17 Feb 2020	app/4359	ARCHIVED. No modern replacement identified on Splunkbase; evaluate custom inputs or generic file monitoring for DHCP server logs.
15	Splunk 5.x App for Microsoft Windows	App	Splunk Works (Archived)	Legacy Windows infrastructure dashboards	5.0.2	12 Oct 2013	app/272	ARCHIVED — very old (2013). Long superseded by #11 and now by TA #1 + #8. Kept for historical reference only.

Note on SC4S: the SC4S "Microsoft" vendor entry covers only Cloud App Security (MCAS) — Microsoft's cloud-app CASB product, ingested as generic CEF via the Splunk Add-on for CEF, not Windows OS Event Logs. There is also an "Arcsight Microsoft Windows (CEF)" page filed under the Microfocus/ArcSight vendor category (generic CEF passthrough, no Windows-specific TA). Core Windows Event Log collection (Security/System/Application, Sysmon, etc.) is fundamentally agent-based — via Universal Forwarder + TA #1 — not syslog, since Windows has no native syslog daemon. Third-party tools (e.g. NXLog, Snare) can convert Windows Event Log to syslog for SC4S ingestion, but that is a host-side agent choice rather than a built-in SC4S "Windows" source.