Splunk ESCU 6.5.0 adds 13 behavioral analytics and two stories
ESCU 6.5.0 was released on 2026-08-27 with 13 new behavioral analytics and two analytic stories, on malicious Python package installation and on Vidar Stealer. The RoguePlanet story was also expanded (Splunk release notes, read 2026-11-03).
Two stories in one release show how Splunk packages content: detections grouped by threat into Analytic Stories mapped to MITRE ATT&CK, per the security_content README. A team that runs ESCU gets the story as a unit.
Source: help.splunk.com read 2026-11-04
What it changes for a buyer
If your pipeline builds content with contentctl, the 6.5.0 and 6.6.0 releases are the next two diffs to review.
All notes are in the changelog. Spotted something wrong? See corrections.