Innovations in Splunk Security Expands Unified TDIR Experience to On-Premises and FedRamp Moderate Environments

At RSAC™ 2025 Conference we announced new innovations to Splunk Security. Today, we are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only vendor to bring truly unified threat detection, investigation, and response (TDIR) workflows fueled by automation to both customer managed deployments and FedRAMP Moderate environments. Splunk empowers security operations centers (SOCs) to strengthen their digital resilience with increased visibility, more accurate detections, and tightly integrated,automated workflows delivered through a unified SecOps platform that increases efficiency by 50%.¹

SecOps, Your Way: The Only Unified SecOps Platform That Meets Your SOC’s Deployment Requirements

In our revolutionary release of Splunk Enterprise Security 8.0, we introduced for cloud-users the direct integration of Splunk SOAR playbooks and actions with the case management and investigation features of Splunk Enterprise Security and Mission Control. Now, Splunk SOAR on-premises customers can seamlessly integrate with Splunk Enterprise Security. This enables enhanced deployment options so that both on-premises and cloud customers have a completely integrated workflow experience for case management, alert triage, incident investigation, and incident response use cases. No matter your deployment requirements, Splunk is there to provide a truly modern work surface to detect, investigate, and respond to threats.

That’s not all. Splunk Enterprise Security administrators are now able to pair Splunk Enterprise Security and Splunk SOAR in secure FedRAMP environments. The pairing process enables a unified Splunk Enterprise Security and Splunk SOAR integration and runs playbooks and actions from Findings and Investigations.

To better support TDIR workflows, in Splunk SOAR 6.4 we introduced: 

• Tightly integrated playbook execution from within Splunk Enterprise Security, removing swivel-chair fatigue and accelerating SOC incident investigations.
• Streamlined asset management and enhanced API integrations to simplify deployment — at scale so that customers can onboard and operationalize faster without lengthy configuration steps.
• Improved case management and event timeline views, giving analysts faster, richer context at every step of their investigations.
   

Walk through a unified TDIR workflow

Informed, Timely, and Actionable Intelligence Across the SOC Ecosystem

Embedding threat intelligence into the operational framework of the SOC’s detection, investigation and response workflows reduces mean time to detect (MTTD) and mean time to respond (MTTR), allowing analysts to manage events from a single console. At no additional cost, as a feature of Splunk Enterprise Security, Threat Intelligence Management is now available for use by on-premise customers.² Analysts can fully investigate security events by accessing relevant and normalized intelligence to better understand threat context and accelerate time to triage. They can manage security events and leverage threat intelligence feeds directly within Splunk Enterprise Security without pivoting to other tools, ultimately reducing time to investigate. 
 

See Threat Intelligence Management in action

Prioritize Threats, Investigate Security Incidents, and Make Decisions, Faster

To reduce alert fatigue and time spent on investigations, with Finding-based Detections,³ related security events are automatically grouped so that analysts have a complete view into priority incidents, with the context they need to take action. Teams can now leverage standardized annotations with pre-populated industry frameworks, including NIST, CIS, and Kill-Chain, ensuring consistent documentation across the organization. Analysts can effortlessly test Finding-based detection configurations before deployment with improved validation tools, eliminating guesswork and reducing configuration errors. The enhanced Similar Findings logic in Splunk Enterprise Security 8.1 unifies related detections into a single Finding Group, allowing analysts to investigate related security events as a single, comprehensive alert.

Interested in seeing Splunk Enterprise Security 8.1 in action? Join us for Splunk Enterprise Security 8.1 Demo Day. Register here!

To see how organizations are leveraging the market-leading SIEM, download the PeerPaper™ Report: Security Visibility, Contextual Detection, and SecOps Efficiency.

We’re always listening! Have ideas and requests? Share them with us through Splunk Ideas.

To learn more about Splunk Security, visit our website. Happy Splunking!

¹ IDC Business Value Snapshot, sponsored by Splunk, The Business Value of Splunk Security: A Unified TDIR Platform, #US53392325, May 2025

²Starting in Q1, for on-premise customers who have upgraded to Splunk Enterprise Security 8.1, please reach out to your account team to request access to Threat Intelligence Management.

³Feature in preview with Splunk Enterprise Security 8.1