Splunk Add-on for Amazon Kinesis Firehose

Overview

Details

Important Update: With the next release of Splunk Add-on for Amazon Web Services (aws) v6.0.0, we are merging all the capabilities of the Splunk Add-on for Amazon Kinesis Firehose into the Splunk Add-on for AWS. This means with the Splunk add-on for AWS v6.0.0, customers will be able to use a single Add-on across all AWS data sources for ingesting AWS data into Splunk. If you are using the Splunk Add-on for Kinesis Firehose as well as the Add-on for AWS with your Splunk instance, then you must uninstall the Kinesis Firehose Add-on before upgrading the Add-on for AWS to version 6.0.0 to avoid any data duplicacy and discrepancy issues. We encourage all customers who have a use case for Kinesis Firehose to adopt the Splunk Add-on for AWS v6.0.0 as soon as it is available as the Splunk Add-on for Kinesis Firehose will be discontinued in the future.
__________________________________________________________________________________________________________

The Splunk Add-on for Amazon Kinesis Firehose allows a Splunk software administrator to collect AWS CloudTrail, VPC Flow Logs, CloudWatch events, and raw or JSON data from Amazon Kinesis Firehose. This add-on provides CIM-compatible knowledge for data collected via the HTTP event collector. After the Splunk platform indexes the events, you can analyze the data directly or using other Splunk apps, such as the Splunk App for AWS and Splunk Enterprise Security. If you want to collect data from other AWS sources, see Splunk Add-on for Amazon Web Services.

*** The Splunk Add-on for Amazon Kinesis Firehose is not compatible with the AWS GuardDuty Add-on

Documentation for this add-on may be found at http://docs.splunk.com/Documentation/AddOns/latest/Firehose/About

Release Notes

Version 1.3.2

Oct. 7, 2021

Version 1.3.2 of the Splunk Add-on for Amazon Kinesis Firehose contains the following new features:
- Common Information Model (CIM) version 4.20 compatibility and enhanced CIM mapping
- Enhanced CIM mapping for several sourcetypes
- Merging of Public Release and Internal Mustang Release to support Enterprise Security (ES) Cloud Security Dashboards content
See release documentation for more information: http://docs.splunk.com/Documentation/AddOns/latest/Firehose/About

Version 1.3.1r7d1d093

Nov. 30, 2020

Version 1.3.1 of the Splunk Add-on for Amazon Kinesis Firehose contains the following new features:
Increased Alerts CIM data model compatibility.
Increased Change CIM data model compatibility.
*Support for ingestion of AWS Security Hub findings events.

Version 1.2.1

April 28, 2020

This release for Splunk Add-on for Amazon Kinesis Firehose adds:
* Improved Support for the Authentication CIM Model.

Version 1.1.1

Jan. 10, 2018

For the Release Notes, What's New, and Getting Started documentation for this release see: http://docs.splunk.com/Documentation/AddOns/latest/Firehose/About

49,298

Downloads

Share Subscribe

Version

Built by

Splunk LLC

Support

Splunk Supported Questions on Splunk Answers File a case Flag as inappropriate

Technologies: AWS

Compatibility

This version of the app (1.3.1r7d1d093) is not available for Splunk Cloud. However, version 1.3.2 of this app is available for Splunk Cloud.

This version of the app (1.2.1) is not available for Splunk Cloud. However, version 1.3.2 of this app is available for Splunk Cloud.

This version of the app (1.1.1) is not available for Splunk Cloud. However, version 1.3.2 of this app is available for Splunk Cloud.

Products: Splunk Enterprise, Splunk Cloud

Products: Splunk Enterprise

Splunk Versions: 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0, 7.3, 7.2

Platform: Platform Independent

CIM Versions: 4.x

FedRAMP Validated: No

Splunk Versions: 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0, 7.3, 7.2, 7.1

Platform: Platform Independent

CIM Versions: 4.x

FedRAMP Validated: Yes

Splunk Versions: 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0, 7.3, 7.2, 7.1, 7.0

Platform: Platform Independent

CIM Versions: 4.x

FedRAMP Validated: Yes

Splunk Versions: 7.0

Platform: Platform Independent

CIM Versions: 4.x

FedRAMP Validated: No

Licensing

Splunk General Terms

Category & Contents

Categories: IT Operations, Security, Fraud & Compliance

App Type: Add-on

Subscribe Share

My Account

Support & Services