Release notes for the Splunk Add-on for Sysmon

Version 5.0.1 of the Splunk Add-on for Sysmon was released on July 6, 2026.

Compatibility

Version 5.0.1 of the Splunk Add-on for Sysmon is compatible with the following software, CIM versions, and platforms:

Splunk platform versions	9.2 and later
CIM	6.0
Supported OS for data collection	Platform independent
Vendor products	Microsoft Sysmon version 15.0

New features

Version 5.0.1 fixes known issues, see the Known Issues section of this topic for more information.

This release normalizes Sysmon XmlWinEventLog data to the XmlWinEventLog sourcetype. Customers with local props.conf customizations targeting [xmlwineventlog] might need to mirror them under [XmlWinEventLog].

Because the Splunk Add-on for Windows includes a generic [XmlWinEventLog] stanza with common WinEventLog XML parsing settings, normalized Sysmon events can inherit those settings after upgrade. Customers who customize the Windows TA [XmlWinEventLog] stanza should sanity-check for unexpected field collisions. Customers who co-deploy the Splunk Add-on for Windows should also review Sysmon events for process_name, signature, and service field conflicts from Windows TA [XmlWinEventLog] knowledge after upgrade.

Most searches using sourcetype=xmlwineventlog continue to work because Splunk search is case-insensitive by default. Searches using CASE(xmlwineventlog), external tooling that compares the sourcetype field exactly, or dashboard token logic that depends on exact casing should be updated to XmlWinEventLog.

The uri_path field for EventCode 15 events now returns the full URL path, for example /files/Sysmon.zip, rather than only the filename.

Fixed issues

Version 5.0.1 of the Splunk Add-on for Sysmon fixes the following issues:

Known issues

Version 5.0.1 of the Splunk Add-on for Sysmon contains the following known issues:

Third-party software attributions

Version 5.0.1 of the Splunk Add-on for Sysmon does not incorporate any third-party software or libraries.