Release notes history

The latest release of Splunk Add-on for CyberArk EPM is version 5.0.1. For information, see Release notes for the Splunk Add-on for CyberArk EPM.

Version 5.0.0

Splunk Add-on for CyberArk EPM version 5.0.0 was released on .

Compatibility

Version 5.0.0 of the Splunk Add-on for CyberArk EPM is compatible with the following software, CIM versions, and platforms.

Component	Description
Splunk platform versions	9.x, 10.0.x
CIM	6.1.0
Platforms	Platform independent
Vendor Products	CyberArk Endpoint Privilege Manager v24.12.1, v25.6.1, v26.4

Breaking changes

• Removed deprecated inputs: Application Events, Policy Audit, and Threat Detection.

  The underlying CyberArk EPM API endpoints (GET /EPM/API/{version}/Sets/{setId}/Events/{category}) were deprecated by CyberArk in EPM v24.11.1 and removed from the product in EPM v24.12.x. As a result, the following inputs no longer function against current EPM versions and were removed from this add-on:

  Removed input	Removed sourcetype	Replacement input	Replacement sourcetype
  Application Events	cyberark:epm:application:events	Inbox Events (API type: Aggregated Events)	cyberark:epm:aggregated:events
  Threat Detection	cyberark:epm:threat:detection	Inbox Events (API type: Aggregated Events)	cyberark:epm:aggregated:events
  Policy Audit	cyberark:epm:policy:audit	Policy Audit Events (API type: Aggregated Events)	cyberark:epm:aggregated:policy:audit

  Migration steps:

  1. Create a new Inbox Events input with API Type set to Aggregated Events to replace any existing Application Events or Threat Detection inputs.
  2. Create a new Policy Audit Events input with API Type set to Aggregated Events to replace any existing Policy Audit inputs.
  3. Delete the old Application Events, Policy Audit, and Threat Detection inputs.

  Note

  The new inputs provide richer event schemas and support cursor-based pagination. The sourcetypes are different from the removed ones. Update any saved searches, dashboards, or alerts that reference cyberark:epm:application:events, cyberark:epm:policy:audit, or cyberark:epm:threat:detection.

• cyberark:epm:computers sourcetype: status field values changed.

  The Policies and Computers input uses the new EPM Endpoints API. The CIM status field is sourced from connectionStatus instead of Status, and its values changed:

  Old value (Status)	New value (connectionStatus)
  Alive	Connected
  Disconnected	Disconnected
  (not present)	NeverConnected

  Migration: Update any saved searches, dashboards, or alerts that filter on status="Alive" to use status="Connected" instead. The NeverConnected value has no equivalent in previous versions.

• Minimum supported CyberArk EPM version is v24.12.1.

  EPM versions prior to v24.12.1 (v21.10, v23.3.0, and v24.5.0) are not supported because the API endpoints used by this add-on require EPM v24.12.1 or later.

• Python 3.7 and 3.8 are no longer supported. Minimum required Python version is 3.9.

  Splunk Enterprise 9.0 and later ships with Python 3.9 or later, so most deployments are unaffected.

New features

• Added Python 3.13 support. The supported Python range is 3.9-3.13.
• Added the x-cybr-telemetry HTTP header to all CyberArk EPM API requests. The header identifies the integration to CyberArk and includes the add-on name, version, Splunk platform version, and operating system. No configuration is required.
• Account configuration fields now display as required in the UI. All credential fields are marked as mandatory with the standard required field indicator.

Fixed issues

Version 5.0.0 of the Splunk Add-on for CyberArk EPM has the following fixed issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 5.0.0 of the Splunk Add-on for CyberArk EPM has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 4.0.0

Splunk Add-on for CyberArk EPM version 4.0.0 was released on .

Compatibility

Version 4.0.0 of the Splunk Add-on for CyberArk EPM is compatible with the following software, CIM versions, and platforms.

Component	Description
Splunk platform versions	9.x, 10.0.x
CIM	6.1.0
Platforms	Platform independent
Vendor Products	CyberArk Endpoint Privilege Manager v21.10, v23.3.0, v24.5.0, v24.12.1, v25.6.1, v26.4

New features

• Added support for OAuth2 authentication using the client_credentials grant flow. You can now configure accounts using the OAuth2 (Client Credentials) authentication type, which obtains a JWT access token from CyberArk Identity and caches it for the duration of its validity (up to 12 hours).

  The following new fields are available when OAuth2 (Client Credentials) authentication is selected:

  Field	Description
  Client ID	The OAuth2 client ID registered in CyberArk Identity.
  Client Secret	The OAuth2 client secret for the registered application.
  Identity Tenant URL	The base URL of your CyberArk Identity tenant, for example https://<tenant>.id.cyberark.cloud.
  OAuth2 App Alias	The application alias configured in CyberArk Identity for the OAuth2 application.

• Added support for CyberArk EPM v26.4.

Fixed issues

Version 4.0.0 of the Splunk Add-on for CyberArk EPM has the following fixed issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 4.0.0 of the Splunk Add-on for CyberArk EPM has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 3.1.0

Splunk Add-on for CyberArk EPM version 3.1.0 was released on July 24, 2025.

Compatibility

Version 3.1.0 of the Splunk Add-on for CyberArk EPM is compatible with the following software, CIM versions, and platforms.

Component	Description
Splunk platform versions	9.x, 10.0.x
CIM	6.1.0
Platforms	Platform independent
Vendor Products	CyberArk EPM v21.10, v23.3.0, v24.5.0, v25.6.1

New features

• Added support for SetID Filter in the input configuration. A new SetID filter option was added to the following inputs:

  • Admin Audit Logs
  • Inbox Events
  • Policy Audit Events

  • Policies and Computers

    This enhancement introduces a dropdown menu in the input configuration, allowing you to filter event data based on specific SetIDs and collect events specific to the selected SetID.

  Note

  The SetID value will now appear in the raw events for the inputs listed in this section.

• The Common Information Model (CIM) was upgraded from version 5.3.2 to 6.1.0 to maintain compatibility with the latest data models and Splunk best practices.

• Added support of CyberArk EPM API v25.6.1.

Fixed issues

Version 3.1.0 of the Splunk Add-on for CyberArk EPM has the following fixed issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 3.1.0 of the Splunk Add-on for CyberArk EPM has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 3.0.0

Splunk Add-on for CyberArk EPM version 3.0.0 was released on January 30, 2025.

Compatibility

Version 3.0.0 of the Splunk Add-on for CyberArk EPM is compatible with the following software, CIM versions, and platforms.

Component	Description
Splunk platform versions	9.0.x 9.1.x, 9.2.x, 9.3.x, 9.4.x
CIM	5.3.2
Platforms	Platform independent
Vendor Products	CyberArk EPM v21.10, v23.3.0, v24.5.0

New features

• Introduced new input to collect Account Admin Audit Logs for improved tracking of account admin activities.
  • Added CIM support of the Change data model to the Account Admin Audit Logs collected using the modular input.
• Added support for the UCC Monitoring Dashboard.
  • This dashboard enables users to visualize data volume metrics based on source, index, sourcetype, event trendlines etc, and also visualize errors in the Splunk add-on for CyberArk EPM.
• Added validation for the URLs that do not use basic authentication when you provide a EPM Dispatcher Server URL value during account configuration.

Fixed issues

Version 3.0.0 of the Splunk Add-on for CyberArk EPM has no reported fixed issues.

Known issues

Version 3.0.0 of the Splunk Add-on for CyberArk EPM has no reported known issues.

Version 2.1.0

Splunk Add-on for CyberArk EPM version 2.1.0 was released on July 22, 2024.

Compatibility

Version 2.1.0 of the Splunk Add-on for CyberArk EPM is compatible with the following software, CIM versions, and platforms.

Component	Description
Splunk platform versions	9.0.x 9.1.x, 9.2.x
CIM	5.3.2
Platforms	Platform independent
Vendor Products	CyberArk EPM v21.10, v23.3.0, v24.5.0

New features

• Support for CyberArk EPM APIs v24.5.0.
• Introduced new input for fetching Admin Audit Logs.
  • Added CIM support of the Change data model to the Admin Audit Logs collected using the modular input.
• IPv6 support - the Splunk Add-on for CyberArk EPM is now compatible with Splunk running on the IPv6 environment.
• Support of Python 3.9.

Fixed issues

Version 2.1.0 of the Splunk Add-on for CyberArk EPM has no reported fixed issues.

Known issues

Version 2.1.0 of the Splunk Add-on for CyberArk EPM has no reported known issues.

Version 2.0.1

Splunk Add-on for CyberArk EPM version 2.0.1 was released on December 12, 2023.

Compatibility

Version 2.0.1 of the Splunk Add-on for CyberArk EPM is compatible with the following software, CIM versions, and platforms.

Component	Description
Splunk platform versions	9.0.x 9.1.x
CIM	5.1.0
Platforms	Platform independent
Vendor Products	CyberArk EPM v21.10, v23.3.0

New features

Fixed the security vulnerabilities found in the certifi and urllib3 libraries by upgrading their versions from 2022.12.7 to 2023.11.17 and 1.26.9 to 1.26.18 respectively.

Fixed issues

Version 2.0.1 of the Splunk Add-on for CyberArk EPM has no reported fixed issues.

Known issues

Version 2.0.1 of the Splunk Add-on for CyberArk EPM has no reported known issues.

Version 2.0.0

Splunk Add-on for CyberArk EPM version 2.0.0 was released on March 27, 2023.

Compatibility

Version 2.0.0 of the Splunk Add-on for CyberArk EPM is compatible with the following software, CIM versions, and platforms.

Component	Description
Splunk platform versions	8.1, 8.2, 9.0.x
CIM	5.1.0
Platforms	Platform independent
Vendor Products	CyberArk EPM v21.10, v23.3.0

New features

Version 2.0.0 of the Splunk Add-on for CyberArk EPM provides the following improvement:

• Support for CyberArk EPM APIs v23.3.0
• Support for Raw Events along with Aggregated Events
• Introduced 2 new inputs which collects data using both the API types - Inbox Events and Policy Audit Events
• Introduced 4 new sourcetypes. 2 each for both the inputs -
  • cyberark:epm:raw:events - Collects Inbox Events from raw API endpoint
  • cyberark:epm:aggregated:events - Collects Inbox Events from aggregated API endpoint
  • cyberark:epm:raw:policy:audit - Collects Policy Audit Events from raw API endpoint
  • cyberark:epm:aggregated:policy:audit - Collects Policy Audit Events from aggregated API endpoint
• Added functionality of “Start Date” to start the data collection as and when needed, for the 2 new inputs
• Provided support of CIM version 5.1.0
• Upgraded certifi library to version 2022.12.7 to fix a security vulnerability

Application Events, Policy Audit, and Threat Detection are marked as deprecated inputs in the UI. When configuring these inputs, a warning message appears that suggests using the newly introduced input to utilize the enhanced APIs introduced by CyberArk. The deprecated inputs will be removed in a future release.

Fixed issues

Version 2.0.0 of the Splunk Add-on for CyberArk EPM has no reported fixed issues.

Known issues

Version 2.0.0 of the Splunk Add-on for CyberArk EPM has no reported known issues.

Version 1.2.0

Splunk Add-on for CyberArk EPM version 1.2.0 was released on December 2, 2021.

Compatibility

Version 1.2.0 of the Splunk Add-on for CyberArk EPM is compatible with the following software, CIM versions, and platforms.

Component	Description
Splunk platform versions	8.0, 8.1, 8.2
CIM	4.20.2
Platforms	Platform independent
Vendor Products	CyberArk EPM v11.6, v21.10

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 1.2.0 of the Splunk Add-on for CyberArk EPM provides the following improvement:

• Support for CyberArk EPM v21.10 Enhanced CIM mapping and compatibility with CIM v4.20.2
• For cyberark:epm:computers sourcetype added Inventory Data Model mappings.
• For cyberark:epm:threat:detection sourcetype ThreatDetectionAction=Detected Data Model has been changed from Change DM to Intrusion Detection DM.
• Due to DM changes the following changes have been made for these events: dest field has been removed from these events. action field value has been changed from read to allowed.

Known issues

Version 1.2.0 of the Splunk Add-on for CyberArk EPM has no reported known issues.

Version 1.1.0

Splunk Add-on for CyberArk EPM version 1.1.0 was released on July 14, 2021.

Compatibility

Version 1.1.0 of the Splunk Add-on for CyberArk EPM is compatible with the following software, CIM versions, and platforms.

Component	Description
Splunk platform versions	8.0, 8.1, 8.2
CIM	4.16
Platforms	Platform independent
Vendor Products	CyberArk EPM v11.6

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 1.1.0 of the Splunk Add-on for CyberArk EPM provides the following improvement:

• Support for the latest UCC Framework 5.4.3.
• Restarts on search heads are no longer required.

Known issues

Version 1.1.0 of the Splunk Add-on for CyberArk EPM has no reported known issues.

Version 1.0.0

Compatibility

Version 1.0.0 of the Splunk Add-on for CyberArk EPM is compatible with the following software, CIM versions, and platforms.

Component	Description
Splunk platform versions	8.0
CIM	4.16
Platforms	Platform independent
Vendor Products	CyberArk EPM v11.6

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 1.0.0 of the Splunk Add-on for CyberArk EPM provides the following features:

• Let a Splunk software administrator pull aggregated events of Application Events, Policy Audit, and Threat Detection categories using the cloud administration APIs of CyberArk EPM.
• Collects logs related to Policies, Computers, and Computer Groups.
• Supported the following Data Models (CIM v4.16):
  • Change
  • Intrusion Detection
  • Endpoint

Known issues

Version 1.0.0 of the Splunk Add-on for CyberArk EPM has no reported known issues.