Updated TAs

patel-bhavin · github-actions[bot] · commit 9572eb185376 · 2025-08-11T07:02:06.000Z
diff --git a/contentctl.yml b/contentctl.yml
@@ -155,15 +155,15 @@ apps:
 - uid: 5556
   title: Splunk Add-on for Google Workspace
   appid: SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE
-  version: 3.0.4
+  version: 3.1.0
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-workspace_304.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-workspace_310.tgz
 - uid: 3110
   title: Splunk Add-on for Microsoft Cloud Services
   appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES
-  version: 5.5.0
+  version: 5.6.0
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_550.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_560.tgz
 - uid: 4055
   title: Splunk Add-on for Microsoft Office 365
   appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365
diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 output_fields:
 - dest
 - user
diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml
@@ -18,7 +18,7 @@ separator_value: Add app role assignment to service principal
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml
@@ -18,7 +18,7 @@ separator_value: Add member to role
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml
@@ -18,7 +18,7 @@ separator_value: Add owner to application
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml
@@ -18,7 +18,7 @@ separator_value: Add service principal
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml
@@ -17,7 +17,7 @@ separator_value: Add unverified domain
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml
@@ -18,7 +18,7 @@ separator_value: Consent to application
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml
@@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml
@@ -15,7 +15,7 @@ separator_value: Enable account
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml
@@ -16,7 +16,7 @@ separator_value: Invite external user
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM",
diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml
@@ -10,7 +10,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - action
 - additional_details
diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml
@@ -16,7 +16,7 @@ separator_value: Reset password (by admin)
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml
@@ -16,7 +16,7 @@ separator_value: Set domain authentication
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml
@@ -16,7 +16,7 @@ separator_value: Sign-in activity
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml
@@ -16,7 +16,7 @@ separator_value: Update application
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml
@@ -16,7 +16,7 @@ separator_value: Update authorization policy
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml
@@ -14,7 +14,7 @@ separator_value: Update user
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml
@@ -15,7 +15,7 @@ separator_value: User registered security info
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - Level
diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml
@@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation account
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - authorization.action
diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml
@@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - authorization.action
diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml
@@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation webhook
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - _time
 - authorization.action
diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml
@@ -13,7 +13,7 @@ separator: operationName
 supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
-  version: 5.5.0
+  version: 5.6.0
 fields:
 - column
 - action
diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml
@@ -16,7 +16,7 @@ sourcetype: gsuite:drive:json
 supported_TA:
 - name: Splunk Add-on for Google Workspace
   url: https://splunkbase.splunk.com/app/5556
-  version: 3.0.4
+  version: 3.1.0
 fields:
 - _time
 - email
diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml
@@ -15,7 +15,7 @@ sourcetype: gsuite:gmail:bigquery
 supported_TA:
 - name: Splunk Add-on for Google Workspace
   url: https://splunkbase.splunk.com/app/5556
-  version: 3.0.4
+  version: 3.1.0
 fields:
 - _time
 - action_type
diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml
@@ -9,7 +9,7 @@ sourcetype: gws:reports:login
 supported_TA:
 - name: Splunk Add-on for Google Workspace
   url: https://splunkbase.splunk.com/app/5556
-  version: 3.0.4
+  version: 3.1.0
 fields:
 - action
 - actor.callerType
diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml
@@ -17,7 +17,7 @@ separator_value: login_failure
 supported_TA:
 - name: Splunk Add-on for Google Workspace
   url: https://splunkbase.splunk.com/app/5556
-  version: 3.0.4
+  version: 3.1.0
 fields:
 - _time
 - actor.email
diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml
@@ -17,7 +17,7 @@ separator_value: login_success
 supported_TA:
 - name: Splunk Add-on for Google Workspace
   url: https://splunkbase.splunk.com/app/5556
-  version: 3.0.4
+  version: 3.1.0
 fields:
 - _time
 - actor.email
diff --git a/data_sources/vmware_esxi_syslog.yml b/data_sources/vmware_esxi_syslog.yml
@@ -9,24 +9,24 @@ sourcetype: vmw-syslog
 supported_TA:
 - name: Add-on for VMware ESXi Logs
   url: https://splunkbase.splunk.com/app/5603
-  version: 4.2.1
+  version: 4.2.2
 fields:
 - _time
 - host
 - Message
 example_log: '{"preview":false,"lastrow":true,"result":{"Application":"May","Message":
   "54:23 192.168.8.233 2025-05-08T17:52:34.409Z localhost.lan Hostd[263196]: [Originator@6876
-  sub=Vimsvc.ha-eventmgr opID=esxui-6983-6230 sid=52eb1a76] Event 854 : User root@192.168.196.95 
-  logged in as Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like 
-  Gecko) Chrome/135.0.0.0 Safari/537.36","_raw":"May  8 17:54:23 192.168.8.233 2025-05-08T17:52:34.409Z 
-  localhost.lan Hostd[263196]: [Originator@6876 sub=Vimsvc.ha-eventmgr opID=esxui-6983-6230 
-  sid=52eb1a76] Event 854 : User root@192.168.196.95 logged in as Mozilla/5.0 (Macintosh; Intel 
-  Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","_time":
-  "2025-05-08T17:52:34.409+0000","date_hour":"17","date_mday":"8","date_minute":"52","date_month":
+  sub=Vimsvc.ha-eventmgr opID=esxui-6983-6230 sid=52eb1a76] Event 854 : User root@192.168.196.95
+  logged in as Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
+  (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","_raw":"May  8 17:54:23 192.168.8.233
+  2025-05-08T17:52:34.409Z localhost.lan Hostd[263196]: [Originator@6876 sub=Vimsvc.ha-eventmgr
+  opID=esxui-6983-6230 sid=52eb1a76] Event 854 : User root@192.168.196.95 logged in
+  as Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like
+  Gecko) Chrome/135.0.0.0 Safari/537.36","_time": "2025-05-08T17:52:34.409+0000","date_hour":"17","date_mday":"8","date_minute":"52","date_month":
   "may","date_second":"34","date_wday":"thursday","date_year":"2025","date_zone":"0","host":
   "192.168.8.233","index":"vmware-esxilog","linecount":"1","opID":"esxui-6983-6230","punct":
   "___::_..._--::._._[]:_[@_=.-_=--_=]___:__@...____/","sid":"52eb1a76","source":
   "vmware:esxlog:source::udp:514","sourcetype":"vmw-syslog","splunk_server":"splunk",
   "sub":"Vimsvc.ha-eventmgr","timeendpos":"54","timestartpos":"30"}}'
 output_fields:
-- dest
+- dest
