Newest detection on research.splunk.com is dated 2026-10-28
The detections library on research.splunk.com listed its newest entry with a date of 2026-10-28 when we read it on 2026-11-03. The first 100,000 characters of the page did not state a total count of detections, analytic stories or hunting analytics. The home page reports 2,207 detections, 367 analytic stories and 86 playbooks, undated.
Splunk Enterprise Security ships this content as ESCU releases built with contentctl. The entry date shows content is still being added. It does not tell you which ESCU release carries the detection, and the version numbers on Splunk's pages were not reconciled: research.splunk.com shows v6.9.2 while the ES release notes we read run to 6.6.0.
Source: research.splunk.com read 2026-11-04
What it changes for a buyer
A Splunk team can treat the library as live, but should match a new detection to an ESCU release before assuming it is in its own instance.
Where this stands on the rubric
Current rubric standing of the platforms this note names.
| Platform | Total, of 10 | Matrix, of 33 | Rule health, of 5 |
|---|---|---|---|
| Splunk Enterprise Security (Cisco) | 6.21 | 13.5 | 1.5 |
All notes are in the changelog. Spotted something wrong? See corrections.