pyth0n1c · github-actions · Jun 18, 2026 · Jun 18, 2026 · Jun 18, 2026 · Jun 24, 2026
diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml
@@ -1,8 +1,8 @@
 name: ASL AWS CloudTrail
 id: 1dcf9cfb-0e91-44c6-81b3-61b2574ec898
-version: 3
+version: 6
 creation_date: '2025-01-14'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Represents AWS API dataset data collection from Amazon Security Lake.
 mitre_components:
@@ -24,7 +24,7 @@ separator: api.operation
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 output_fields:
     - dest
     - user

diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml
@@ -1,8 +1,8 @@
 name: AWS Cloudfront
 id: 780086dc-2384-45b6-ade7-56cb00105464
-version: 3
+version: 6
 creation_date: '2024-07-16'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs requests made to AWS CloudFront distributions, including details on client access, response data, and performance metrics.
 mitre_components:
@@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action

diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail
 id: e8ace6db-1dbd-4c72-a1fb-334684619a38
-version: 2
+version: 5
 creation_date: '2024-07-16'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: All AWS CloudTrail events
 source: aws_cloudtrail
@@ -11,4 +11,4 @@ separator: eventName
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail AssumeRoleWithSAML
 id: 1e28f2a6-2db9-405f-b298-18734a293f77
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs attempts to assume roles via SAML authentication in AWS, including details of identity provider and role mapping.
 mitre_components:
@@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action

diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail ConsoleLogin
 id: b68b3f26-bd21-4fa8-b593-616fe75ac0ae
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs attempts to sign in to the AWS Management Console, including successful and failed login events.
 mitre_components:
@@ -18,7 +18,7 @@ separator_value: ConsoleLogin
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action

diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail CopyObject
 id: 965083f4-64a8-403f-99cc-252e1a6bd3b6
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs operations that copy objects within or between AWS S3 buckets, including details of source and destination.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: CopyObject
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - additionalEventData.AuthenticationMethod

diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail CreateAccessKey
 id: 0460f7da-3254-4d90-b8c0-2ca657d0cea0
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs the creation of new AWS access keys, including details of the associated user and permissions.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: CreateAccessKey
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action

diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail CreateKey
 id: fcfc1593-b6b5-4a0f-91c5-3c395116a8b9
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs the creation of new AWS KMS keys, including details of key properties and associated metadata.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: CreateKey
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - app

diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail CreateLoginProfile
 id: 0024fdb1-0d62-4449-970a-746952cf80b6
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs the creation of login profiles for IAM users, including associated metadata and authentication settings.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: CreateLoginProfile
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action

diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail CreateNetworkAclEntry
 id: 45934028-10ec-4ab5-a7b1-a6349b833e67
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs the creation of new entries in a network ACL, including rules to allow or deny specific network traffic.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action

diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail CreatePolicyVersion
 id: f9f0f3da-37ec-4164-9ea0-0ae46645a86b
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs the creation of new versions of IAM policies, including changes to permissions and attached roles or resources.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action

diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail CreateSnapshot
 id: 514135a2-f4b2-4d32-8f31-d87824887f9f
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs the creation of a new snapshot of a cloud resource, such as an Amazon EBS volume, including details about the snapshot ID and resource type.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: CreateSnapshot
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - app

diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail CreateTask
 id: 6501e4fe-05b2-45f1-bd51-9e06a94fa7d9
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs the creation of a new task in AWS services, such as ECS, including details about the task definition and resource allocation.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: CreateTask
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - app

diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail CreateVirtualMFADevice
 id: 13e6e952-0dad-4190-865c-fb5911725f7a
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs the creation of a new virtual multi-factor authentication (MFA) device, including details about the associated user and configuration.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action

diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail DeactivateMFADevice
 id: 7397a10b-1150-4de9-8062-a96454ae53b2
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs the deactivation of a multi-factor authentication (MFA) device, including details about the associated user and the device.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action

diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail DeleteAccountPasswordPolicy
 id: b0730ac8-0992-4de8-b000-2c7d0fc7a67f
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs the deletion of an account-level password policy in AWS, including details about the account and policy being removed.
 mitre_components:
@@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action

diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail DeleteAlarms
 id: b0730ac8-0992-4de8-b000-2c7d0fc7a61f
-version: 3
+version: 6
 creation_date: '2024-08-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Bhavin Patel, Splunk
 description: Logs the deletion of CloudWatch alarms, including details about the alarm names and associated monitoring configurations.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: DeleteAlarms
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action

diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail DeleteDetector
 id: 5d8bd475-c8bc-4447-b27f-efa508728b90
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs the deletion of an Amazon GuardDuty detector, including details about the detector ID and associated configurations.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: DeleteDetector
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - app

diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail DeleteGroup
 id: c95308a4-a943-42ca-b112-f90a05c21bd3
-version: 3
+version: 6
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Patrick Bareiss, Splunk
 description: Logs the deletion of an IAM group in AWS, including details about the group name and its associated policies or members.
 mitre_components:
@@ -17,7 +17,7 @@ separator_value: DeleteGroup
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action

diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml
@@ -1,8 +1,8 @@
 name: AWS CloudTrail DeleteGuardrail
 id: 2f6e9d7a-1c53-48b1-be57-33a91e0f8c42
-version: 2
+version: 5
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-07-30'
 author: Bhavin Patel, Splunk
 description: Logs an event when a guardrail is deleted within the AWS CloudTrail.
 mitre_components:
@@ -14,7 +14,7 @@ separator_value: DeleteGuardrail
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
-      version: 8.1.2
+      version: 8.2.1
 fields:
     - _time
     - action