Share data usage in Splunk Enterprise Security

When Splunk Enterprise Security is deployed on Splunk Enterprise, the Splunk platform sends anonymized usage data to Splunk Inc. ("Splunk") to help improve Splunk Enterprise Security in future releases. For information about how to opt in or out, and how the data is collected, stored, and governed, see Share data in Splunk Enterprise.

How data is collected

Splunk Enterprise Security uses saved searches to collect anonymous usage data. These searches run in the background regardless of whether or not you opt-in to send usage data to Splunk, and do not have any significant impact on performance.

Splunk Enterprise Security also uses FullStory to collect experiential user journey information with the user personally identifiable information redacted.

Splunk collects usage data to improve the design, usability, and experience of the product. Customers may opt-out of sharing AI data including, but not limited to, chats, responses, context, and feedback. To opt out of sharing this AI data, see Opt out of data sharing for the AI Assistant in Splunk Enterprise Security.

What data is collected

Splunk Enterprise Security version 8.5 collects the following basic usage information. This page includes new telemetry components introduced in version 8.5. Splunk Enterprise Security still collects components introduced in earlier versions. Use the version selector to see data collection documentation from earlier versions.

For more information on telemetry information collected by Splunk SOAR, see Share data from Splunk SOAR (Cloud).

Component Description Example
teamQueue Indicates that a team queue status is updated by de-activating and re-activating the queue and reports the total number of active and inactive queues.
JSON 
{
    "appName": "enterprise-security",
    "component": "team-queue",
    "data": {
        "section": "team-queue-status-updated",
        "action": {
            "title": "queue1",
            "queueId": "84518723-248a-4f92-8341-588ef211ea24",
            "activeCount": 1,
            "inactiveCount": 1
        }
    }
}
team-queue-check-empty Verifies whether the queue is empty or not prior to deleting a queue.
JSON 
{
    "appName": "enterprise-security",
    "component": "team-queue",
    "data": {
        "section": "team-queue-check-empty",
        "action": {
            "title": "queue1",
            "queueId": "84518723-248a-4f92-8341-588ef211ea24",
            "isEmpty": true
        }
    }
}
team-queue-delete Indicates that a team queue is deleted and reports the total number of queues that are active and inactive.
JSON 
{
    "appName": "enterprise-security",
    "component": "team-queue",
    "data": {
        "section": "team-queue-delete",
        "action": {
            "title": "queue1",
            "queueId": "84518723-248a-4f92-8341-588ef211ea24",
            "totalQueues": 1
        }
    }
}
get-detection-state-executed Measures tool execution and tracking errors.
JSON 
{
  action: get-detection-state-executed,
  detection_type: event-based-detection,
  success: true,
}
scroll-to-section-executed Measures tool adoption and tracks errors.
JSON 
{
  action: scroll-to-section-executed,
  detection_type: event-based-detection,
  success: true,
  section_name: "DETECTION_SEARCH"
}
update-detection-fields-executed Measures tool adoption and tracks errors.
JSON 
{
  action: update-detection-fields-executed,
  detection_type: event-based-detection,
  success: true,
  field_names: "name, status,d escription"
}
session-summary Measures feature adoption.
JSON 
{
  action: session-summary,
  durationMs: 10000,
  wasDetectionSaved: true,
  wasDetectionNew: false,
  fieldIterations: {
    name: 1,
    search: 3,
    annotations: 1,
  }
}
rbac-team-queue-permission-type-updated Indicates that a team queue role type is switched between fullAccess and customAccess and reports the total number of queues with fullAccess and customAccess selected.
JSON 
{
    "appName": "enterprise-security",
    "component": "rbac-team-queue",
    "data": {
        "section": "rbac-team-queue-permission-type-updated",
        "action": {
            "title": "queue2",
            "queueId": "ea1ef8cd-408a-47e5-baed-a7bbee05fcd4",
            "isWildcardSelected": false,
            "fullAccessCount": 1,
            "customAccessCount": 1
        }
    }
}
MissionControl.splunkOwnedResponseTemplateCloned ; SplunkOwnedResponseTemplateRetrieval ; SplunkOwnedResponseTemplateDownload Collects which Splunk owned response templates are downloaded, cloned, or retrieved.
JSON 
data: { [-]
     name: SplunkOwnedResponseTemplateRetrieval
     template_name: Network Indicator Enrichment
     template_version: 2
   }
JSON 
data: { [-]
     app: SplunkEnterpriseSecuritySuite
     appName: MissionControl
     component: MissionControl.splunkOwnedResponseTemplateCloned
     name: splunkOwnedResponseTemplateCloned
     optInRequired: 3
     origin_id: 8b1df498-d692-4212-a4fd-6b99b99e9027
     origin_name: Network Indicator Enrichment
     origin_version: 2
     page: ess_configuration/
     pathname: /en-US/app/SplunkEnterpriseSecuritySuite/ess_configuration/
     sessionID: 2fe55e2f-a335-40a6-a38a-a32b93226afd
     type: event
   }
JSON 
component: app.MissionControl.SplunkOwnedResponseTemplateDownload
   data: { [-]
     name: SplunkOwnedResponseTemplateDownload
     template_name: Generic Incident Response
     template_version: 3
   }
ResponseTemplateSoftLimitExceeded Tracks when the user exceeds the soft imposed limits for response templates.
JSON 
{
     called_by_ai: false
     max_tasks_in_phase: 31
     name: ResponseTemplateSoftLimitExceeded
     operation: update
     payload_size_bytes: 43322
     payload_size_limit_bytes: 1048576
     payload_size_limit_exceeded: false
     phase_count: 22
     phase_count_limit: 20
     phase_count_limit_exceeded: true
     task_count_limit: 100
     task_count_limit_exceeded: false
     total_task_count: 103
}
app.session.MissionControl.responseTemplateCreated Collects data from the response plan importer AI capability and measures which response plans are generated by AI, cloned, or human generated
CODE 
ai_generated: true/false
cloned: true/false
responseTemplateUpdated Measures which response plans are generated by AI, cloned, or human generated
CODE 
ai_generated: true/false
ResponsePlanAiImportSubmitted Tracks when a user started a new AI response plan generation.
JSON 
{
     files_count: 1
     name: ResponsePlanAiImportSubmitted
}
ResponsePlanAiImportFinished Tracks when the system finished generating anAI response plan.
JSON 
{
     name: ResponsePlanAiImportFinished
     status: success
}
ResponsePlanAiGeneratedApplied Tracks when an AI generated response plan was applied to an investigation.
JSON 
{
     applied_count: 1
     name: ResponsePlanAiGeneratedApplied
}
aiAnalysisFeedbackSubmitted Measures the usefulness or the quality of AI Analysis responses by incident and logic breakdown.
JSON 
{
  "appName": "TELEMETRY_PREFIX",
  "component": "AI_ANALYSIS_FEEDBACK_SUBMITTED",
  "data": {
    "feedbackType": "THUMBS_DOWN",
    "feedbackReason": "Incorrect",
    "incidentId": "INC-12345"
    "langsmithRunId": "langsmithRunId",
    "langsmithTraceId": "langsmithTraceId",
  },
  "description": "AI Analysis feedback submitted: THUMBS_DOWN"
}
aiAnalysisCopied Measures how often the users copy AI analysis.
JSON 
{
  "appName": "TELEMETRY_PREFIX", 
  "component": "AI_ANALYSIS_COPIED", 
  "data": {
  "incidentId": "INC-123", 
  "analysisId": "a-456"
  }, 
  "description": "AI Analysis copied"
}
aiAnalysisCopyFailed Tracks the copy failure rate.
JSON 
{
  "appName":"TELEMETRY_PREFIX",
  "component":"AI_ANALYSIS_COPY_FAILED",
  "data":{
    "incidentId":"INC-123",
    "analysisId":"a-456",
    "errorMessage":"NotAllowedError"},
  "description":"AI Analysis copy failed"
}
aiAnalysisDownloaded Measures how often the users download AI analysis as PDF.
JSON 
{
  "appName":"TELEMETRY_PREFIX",
  "component":"AI_ANALYSIS_DOWNLOADED",
  "data":{
    "incidentId":"INC-123",
    "analysisId":"a-456"},
  "description":"AI Analysis downloaded"
}
aiAnalysisDownloadFailed Tracks the download failure.
JSON 
{
  "appName":"TELEMETRY_PREFIX",
  "component":"AI_ANALYSIS_DOWNLOAD_FAILED",
  "data":{
    "incidentId":"INC-123",
    "analysisId":"a-456",
    "errorMessage":"PDF generation failed"},
  "description":"AI Analysis download failed"
}
aiAnalysisSavedAsNote Measures how often the users save AI analysis to notes.
JSON 
{
  "appName":"TELEMETRY_PREFIX",
  "component":"AI_ANALYSIS_SAVED_AS_NOTE",
  "data":{
    "incidentId":"INC-123",
    "analysisId":"a-456"},
  "description":"AI Analysis saved as note"
}
aiAnalysisSaveAsNoteFailed Tracks the note save failure rate.
JSON 
{
  "appName":"TELEMETRY_PREFIX",
  "component":"AI_ANALYSIS_SAVE_AS_NOTE_FAILED",
  "data":{
    "incidentId":"INC-123",
    "analysisId":"a-456",
    "errorMessage":"Unable to create note"},
  "description":"AI Analysis save as note failed"
}
connectorsSearchPerformed Measures the connector search usage and result quality.
JSON 
{
  "appName":"TELEMETRY_PREFIX",
  "component":"CONNECTORS_SEARCH_PERFORMED",
  "data":{
    "search":"splunk",
    "aiUsageStatusFilter":"true",
    "resultCount":5,
    "source":"connectors"},
  "description":"Connectors search performed"
}
connectorsLoadError Tracks the connector load failure rate and conditions.
JSON 
{
  "appName":"TELEMETRY_PREFIX",
  "component":"CONNECTORS_LOAD_ERROR",
  "data":{
    "source":"connectors",
    "errorMessage":"Not Found",
    "statusCode":404,
    "filters":{"search":"splunk","aiUsageStatusFilter":"true"}},
  "description":"Connectors load error"
}
aiTriageConnectorActionToggled Tracks the action-level AI triage adoption.
JSON 
{
  "appName":"TELEMETRY_PREFIX",
  "component":"AI_TRIAGE_CONNECTOR_ACTION_TOGGLED",
  "data":{
    "source":"connectors",
    "connectorId":"c-123",
    "connectorName":"Splunk Enterprise Security",
    "actionId":"run_playbook",
    "actionName":"run_playbook",
    "action":"enabled"},
  "description":"AI Triage connector action enabled"
  }
aiTriageConnectorActionToggleFailed empty Tracks the action toggle failure rate.
JSON 
{
  "appName":"TELEMETRY_PREFIX",
  "component":"AI_TRIAGE_CONNECTOR_ACTION_TOGGLE_FAILED",
  "data":{
    "source":"connectors",
    "connectorId":"c-123",
    "connectorName":"Splunk Enterprise Security",
    "actionId":"run_playbook",
    "actionName":"run_playbook",
    "action":"enabled",
    "errorMessage":"Server Error"},
  "description":"AI Triage connector action toggle failed"
}
activityLogCsvDownloaded Tracks the user clicks on the download button forthe Activity Log in Response History.
JSON 
{
  "appName": "TELEMETRY_PREFIX",
  "component": "ACTIVITY_LOG_CSV_DOWNLOADED",
  "data": {
    "action": "clicked"
  },
}
activityLogRefreshed Tracks the user clicks on refresh to re-fetch the activity log.
JSON 
{
  "appName": "TELEMETRY_PREFIX",
  "component": "ACTIVITY_LOG_REFRESHED",
  "data": {
    "action": "clicked"
  },
}
activityLogSorted Tracks the user clicks on sort or filters within the activity log table.
JSON 
{
  "appName": "TELEMETRY_PREFIX",
  "component": "ACTIVITY_LOG_SORTED",
  "data": {
    "action": "clicked"
  },
}
activityLogPageChanged Tracks the user changes to the activity log page.
JSON 
{
  "appName": "TELEMETRY_PREFIX",
  "component": "ACTIVITY_LOG_PAGE_CHANGED",
  "data": {
    "action": "clicked"
  },
}
DrilldownDashboardList and DrilldownSearchList Tracks the clicks when a user adds or removes a drill-down dashboard or drill-down search. Currently these components are being used in the ES Ingest Settings UI. These events measure usage of drilldown features for users of the ES Phishing flow.
JSON 
{
  "section": "add-drilldown-btn",
  "action": "click",
  "appName": "securityUI",
  "pathname": "/en-US/app/SplunkEnterpriseSecuritySuite/ess_configuration/",
  "type": "event",
  "component": "securityUI.drilldown-search-list",
  "optInRequired": 3,
  "sessionID": "d8fc66d6-9b82-4cff-aadb-3da8d1b9c10e",
  "name": "drilldown-search-list",
  "app": "SplunkEnterpriseSecuritySuite",
  "page": "ess_configuration/"
}
app.exposure-analytics.details Track the number of custom enrichment entries that are added for each type. Also, track custom enrichment usage statistics.
JSON 
{
  "ea_default_accounts_custom": 3
  "ea_geolocation_custom": 1
  "ea_legacy_os_custom": 1
}

app.session.phantom.*

app.session.soar.*

automation.*

orchestration.*

automation.summary.*

 A mapping between customer and data with restricted access for those with permissions to view the mapping table.
JSON 
{
  "data": {
     ...

---- net new below ----

  "licenseNumber": "0ffff-ffff-fff-fff-ffffff",
  "licenseIssueDate": "2024-12-22",
  "licenseExpirationDate": "2024-12-22",
  "licenseInstance": "12304",
------------------------
  },
  "timestamp": 1684779074013,
  "component": "app.session.soar.systemSettings",
  "deploymentID": "soar-c48ed12b-262f-47e1-99b0-d2ba5b2af6dc",
  "stackID": "f3f5d1d9aba493153151e468915ca995a3355692da5ddc823e42044333a9deff",
  "eventID": "a74fd484-8d28-c0e8-c5bf-0b9ebf130665",
  "experienceID": "0b64f885-637b-9d67-289a-b4d4925e17fe",
}

app.session.soar.license

app.session.phantom.license

 Track the percentage of our customers, who are paid users. Also, track the license status of current customers.
JSON 
{

  'type': 'standard',

  'issueDate': 1616371200.0,

  'expirationDate': 4769971200.0,

  'companyName':

  'limits': {

    'actions': 'unlimited', (NEW)

    'apps': 'unlimited',

    'assets': 'unlimited', (NEW)

    'events': 'unlimited',

    'users': 'unlimited',

    'tenants': 1,

    'seats': 'unlimited'

  },

  'productVersion': '10155.0.0.124976',

  'usage': {

    'recentAppRunCount': 0,

    'recentPlaybookRunCount': 0,

    'recentDebugRunCount': 0,

    'seatCount': 1,

    'activeUsersCount': 2,

  }

}
automation.summary.playbook_names Getting a deeper understanding of the playbooks that are created by customers.
JSON 
{

  'type': 'aggregate',

  'component': 'automation.summary.playbook_names',

  'data': {

    'community': [

      'AD_LDAP_Entity_Attribute_Lookup',

      'wannacry_prevent',

      'wannacry_remediate',

      'zscaler_hunt_and_block_url',

      'zscaler_malicious_file_response',

      'zscaler_patient_0_parse_email'

    ],

    'community_count': 136,

    'custom': [

      'testa1'

    ],

    'custom_count': 1,

    'phantomDeploymentID': 'phantom-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9',

    'license': 'community',

    'productVersion': '6.1.0.58',

    'missionControlDeploymentID': None

  },

  'deploymentID': 'phantom-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9',

  'optInRequired': 3,

  'version': None,

  'timestamp': 1685658250000,

  'visibility': [

    'anonymous'

  ],

  'indexData': True,

  'begin': 1685491200000,

  'end': 1685577599000

}

app.session.phantom.*

app.session.soar.*

automation.*

orchestration.*

 A mapping between customer and data with restricted access for those with permissions to view the mapping table.
JSON 
{

  "data": {

     ...

  },

  "timestamp": 1684779074013,

  "component": "app.session.soar.systemSettings",

  "deploymentID": "soar-c48ed12b-262f-47e1-99b0-d2ba5b2af6dc",

  "companyID": "f3f5d1d9aba493153151e468915ca995a3355692da5ddc823e42044333a9deff",

  "eventID": "a74fd484-8d28-c0e8-c5bf-0b9ebf130665",

  "experienceID": "0b64f885-637b-9d67-289a-b4d4925e17fe"

}

app.session.soar.license

app.session.phantom.license

 Track the percentage of customers that are paid users. Also, track the license status of current customers.
JSON 
{

  'type': 'standard',

  'issueDate': 1616371200.0,

  'expirationDate': 4769971200.0,

  'companyName':

  'limits': {

    'actions': 'unlimited',

    'events': 'unlimited',

    'users': 'unlimited',

    'tenants': 1,

    'seats': 'unlimited'

  },

  'productVersion': '10155.0.0.124976',

  'usage': {

    'recentAppRunCount': 0,

    'recentPlaybookRunCount': 0,

    'recentDebugRunCount': 0,

    'seatCount': 1,

    'activeUsersCount': 2,

  }

}
app.session.soar.license Track the percentage of our customers that are paid users and the license status of current customers.
JSON 
component: app.session.soar.license
data: {
   app: soar
   expirationDate: 1576800000000
   issueDate: 1575504000000
   limits: {
      actions: 50
      events: 75
      tenants: 250
      users: 5
   }
   page: UNKNOWN_PAGE
   type: standard
   usage: {
      recentAppRunCount: 5
      recentDebugRunCount: 5
      recentPlaybookRunCount: 1
   }
   soarDeploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca
soarUserID: 5d900c28b8d1555745c09908ef386860

}
deploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca
eventID: 5854bede-18d9-5a88-d023-e698dab1afaf
experienceID: 31a418cc-1371-c58a-a0b8-dc87638b126f
optInRequired: 3
timestamp: 1575656115189
visibility: anonymous
app.session.phantom.license Track the percentage of our customers that are paid users. Also, track the license status of the current customers.
JSON 
component: app.session.phantom.license
data: {
   app: phantom
   expirationDate: 1576800000000
   issueDate: 1575504000000
   limits: {
      actions: 50
      events: 75
      tenants: 250
      users: 5
   }
   page: UNKNOWN_PAGE
   type: standard
   usage: {
      recentAppRunCount: 5
      recentDebugRunCount: 5
      recentPlaybookRunCount: 1
   }
   phantomDeploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca
phantomUserID: 5d900c28b8d1555745c09908ef386860

}
deploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca
eventID: 5854bede-18d9-5a88-d023-e698dab1afaf
experienceID: 31a418cc-1371-c58a-a0b8-dc87638b126f
optInRequired: 3
timestamp: 1575656115189
visibility: anonymous
app.session.soar.pageview Track the most popular pages in Splunk SOAR.
JSON 
component: app.session.soar.pageview
data: {
   app: soar
   page: admin.company_settings.info
   soarDeploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca
soarUserID: 5d900c28b8d1555745c09908ef386860
}
deploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca
eventID: 0db11144-7c14-88f7-b3e9-3a999102bfc6
experienceID: 20d4d671-7d18-f74a-c72f-9811b5bee20d
optInRequired: 3
timestamp: 1574210581565
visibility: anonymous
app.session.phantom.pageview Track the most popular pages in Phantom.
JSON 
component: app.session.phantom.pageview
data: {
   app: phantom
   page: admin.company_settings.info
   phantomDeploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca
phantomUserID: 5d900c28b8d1555745c09908ef386860
}
deploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca
eventID: 0db11144-7c14-88f7-b3e9-3a999102bfc6
experienceID: 20d4d671-7d18-f74a-c72f-9811b5bee20d
optInRequired: 3
timestamp: 1574210581565
visibility: anonymous
app.session.soar.error Uncaught errors of front-end Phantom scripts.
JSON 
component: app.session.soar.error
data: {
   app: soar
   errorMsg: Uncaught ReferenceError: helloworld is not defined
   file: /inc/swa/swa_enabled.js
   page: admin.product_settings.telemetry
   position: 74:1
   soarDeploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca
soarUserID: 5d900c28b8d1555745c09908ef386860
}
deploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca
eventID: 94efce66-ab89-33ae-f894-1cceb8f68f78
experienceID: 239facf6-261d-dd96-be08-33870c7d3750
optInRequired: 3
timestamp: 1574294947704
visibility: anonymous
app.session.soar.error Uncaught errors of front-end Phantom scripts.
JSON 
component: app.session.phantom.error
data: {
   app: phantom
   errorMsg: Uncaught ReferenceError: helloworld is not defined
   file: /inc/swa/swa_enabled.js
   page: admin.product_settings.telemetry
   position: 74:1
   phantomDeploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca
phantomUserID: 5d900c28b8d1555745c09908ef386860
}
deploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca
eventID: 94efce66-ab89-33ae-f894-1cceb8f68f78
experienceID: 239facf6-261d-dd96-be08-33870c7d3750
optInRequired: 3
timestamp: 1574294947704
visibility: anonymous
app.session.soar.apiTime Track the efficiency of our API requests. Also, track if there are any noticeable errors coming back to the client side.
JSON 
component: app.session.soar.apiTime
data: {
    app: soar
    endpoint: /rest/ph_user/3/permissions
    method: get
    page: UNKNOWN_PAGE
    status: 200
    time: 150
    soarDeploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca
soarUserID: 5d900c28b8d1555745c09908ef386860
}
deploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca
eventID: 551e5c46-4f71-d92a-51ba-30cf97ae3a97
experienceID: 6c2c534b-e750-e1a0-95fd-fcada1a50be0
optInRequired: 3
timestamp: 1574213030362
visibility: anonymous
app.session.phantom.apiTime Track the efficiency of our API requests? Also, track if there are any noticeable errors coming back to the client side.
JSON 
component: app.session.phantom.apiTime
data: {
    app: phantom
    endpoint: /rest/ph_user/3/permissions
    method: get
    page: UNKNOWN_PAGE
    status: 200
    time: 150
    phantomDeploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca
phantomUserID: 5d900c28b8d1555745c09908ef386860
}
deploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca
eventID: 551e5c46-4f71-d92a-51ba-30cf97ae3a97
experienceID: 6c2c534b-e750-e1a0-95fd-fcada1a50be0
optInRequired: 3
timestamp: 1574213030362
visibility: anonymous
app.session.phantom.vpe Track the vpe that a customer is using such as Classic or Modern. Also, track the number of blocks an average playbook has and the average count of each block type. Also, track how the playbooks grow over time.
JSON 
component: app.session.phantom.vpe

data: {
   app: phantom
   jsonSchemaVersion:"5.0.3"
   page: UNKNOWN_PAGE
   blocks: {
     totalCount: 14
     blockTypes: {
action: 2
 playbook: 1
 code: 1
utility: 1
filter: 1
decision: 1
format: 6
prompt: 1
 }
customCodeBlockCount: 3
 customCodeBlockTypeCounts: {
start: 0
end: 1
 action: 2
 playbook: 0
code: 0
 utility: 0
 filter: 0
 decision: 0
 format: 0
 prompt: 0
}
 actions: ["geolocate ip", "whois domain"]
   }
hotkeys: {
     totalCount: 14
     interactions: {
addMiniMenu: 7
 addActionBlock: 6
 addPlaybookBlock: 0
addCodeBlock: 0
addUtilityBlock: 0
addFilterBlock: 0
addDecisionBlock: 0
addFormatBlock: 1
addPromptBlock: 0
autoArrange: 1
zoomToFit: 1
zoomIn: 0
zoomOut: 0
savePlaybook: 1
deleteNode: 0
toggleEditor: 1
toggleDebugger: 1
toggleSettings: 1
showShortcutModal: 1
 }
   }
features: {
     customConditionLabel: 3
     customDatapaths: 2
 playbookInputs: {
count: 0
dataTypes: {
"domain": 0
 "file id": 0
 "file name": 0
 "file path": 0
 "hash": 0
 "host name": 0
 "ip": 0
 "mac address": 0
 "port": 0
 "process name": 0
 "url": 0
 "user name": 0
}
}
 playbookOutputs: {
count: 1
dataTypes: {
 "domain": 1
 "file id": 0
 "file name": 0
 "file path": 0
 "hash": 0
 "host name": 0
 "ip": 0
 "mac address": 0
 "port": 0
 "process name": 0
 "url": 0
 "user name": 0
}
dedupeCount: 0
 }
   }
playbookType: automation
playbookName: 5d900c28b8d1555745c09908ef133337
 phantomDeploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca
 phantomUserID: 5d900c28b8d1555745c09908ef386860
}
deploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca

eventID: d4b331e7-3ce3-91b6-7724-bc4d7235bca9

experienceID: 21febb16-c3f6-cbd5-ffac-905f1466c830

optInRequired: 3

timestamp: 1576695256840

visibility: anonymous
app.session.soar.vpe Track the vpe that a customer using such as Classic or Modern. Also track the number of blocks an average playbook has and the average count of each block type. Also, track how the playbooks grow over time.
JSON 
component: app.session.soar.vpe

data: {
   app: soar
   jsonSchemaVersion:"5.0.3"
   page: UNKNOWN_PAGE
   blocks: {
     totalCount: 14
     blockTypes: {
action: 2
       playbook: 1
code: 1
utility: 1
filter: 1
decision: 1
format: 6
prompt: 1
     }
customCodeBlockCount: 3
     customCodeBlockTypeCounts: {
start: 0
end: 1
       action: 2
       playbook: 0
code: 0
       utility: 0
       filter: 0
       decision: 0
       format: 0
       prompt: 0
     }
actions: ["geolocate ip", "whois domain"]
   }
hotkeys: {
     totalCount: 14
     interactions: {
addMiniMenu: 7
       addActionBlock: 6
addPlaybookBlock: 0
addCodeBlock: 0
addUtilityBlock: 0
addFilterBlock: 0
addDecisionBlock: 0
addFormatBlock: 1
addPromptBlock: 0
autoArrange: 1
zoomToFit: 1
zoomIn: 0
zoomOut: 0
savePlaybook: 1
deleteNode: 0
toggleEditor: 1
toggleDebugger: 1
toggleSettings: 1
showShortcutModal: 1
     }
   }
features: {
     customConditionLabel: 3
     customDatapaths: 2
playbookInputs: {
count: 0
dataTypes: {
"domain": 0
         "file id": 0
         "file name": 0
         "file path": 0
         "hash": 0
         "host name": 0
         "ip": 0
         "mac address": 0
         "port": 0
         "process name": 0
         "url": 0
         "user name": 0
       }
     }
playbookOutputs: {
count: 1
dataTypes: {
         "domain": 1
         "file id": 0
         "file name": 0
         "file path": 0
         "hash": 0
         "host name": 0
         "ip": 0
         "mac address": 0
         "port": 0
         "process name": 0
         "url": 0
         "user name": 0
       }
dedupeCount: 0
     }
   }
playbookType: automation
playbookName: 5d900c28b8d1555745c09908ef133337
   soarDeploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca
soarUserID: 5d900c28b8d1555745c09908ef386860
}
deploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca

eventID: d4b331e7-3ce3-91b6-7724-bc4d7235bca9

experienceID: 21febb16-c3f6-cbd5-ffac-905f1466c830

optInRequired: 3

timestamp: 1576695256840

visibility: anonymous
app.session.phantom.vpeTime Track the average page load time for the vpe.
JSON 
component: app.session.phantom.vpeTime

data: {
   app: phantom
   pageLoadTime: 10298
}
deploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca

eventID: d4b331e7-3ce3-91b6-7724-bc4d7235bca9

experienceID: 21febb16-c3f6-cbd5-ffac-905f1466c830

optInRequired: 3

timestamp: 1576695256840

visibility: anonymous
app.session.soar.vpeTime Track the average page load time for the vpe.
JSON 
component: app.session.soar.vpeTime

data: {
   app: soar
   pageLoadTime: 10298
}
deploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca

eventID: d4b331e7-3ce3-91b6-7724-bc4d7235bca9

experienceID: 21febb16-c3f6-cbd5-ffac-905f1466c830

optInRequired: 3

timestamp: 1576695256840

visibility: anonymous

app.session.soar.systemSettings

app.session.phantom.systemSettings

 Reack which features are being turned on by the customers.
JSON 
{

  "optInRequired": 3,

  "original_timestamp": 1684779074013,

  "visibility": "anonymous",

  "data": {

    "cloudWorksEnvironment": "stg",

    "isClusteringEnabled": false,

    "numOfClusterNodes": 0,

    "isMultiTenantEnabled": false,

    "nodeGUID": "057f9e04-d54c-4ccc-9ffb-4aa82551b4d6",

    "page": "UNKNOWN_PAGE",

    "isElasticSearchEnabled": false,

    "credential_manager": "hashicorp",

    "splunkConfig": {

      "searchLocation": "local",

      "searchType": "standalone"

    },

    "app": "soar",

    "missionControlDeploymentID": null,

    "soarDeploymentID": "soar-c48ed12b-262f-47e1-99b0-d2ba5b2af6dc",

    "license": "standard",

    "soarUserID": "5ebe9df18591550e99cd82079e8448a1c14582f0c04cfd84eaa3a254cae8675cc1eb2097c47dcc99c184481d89949492c4b700918c1e20f909f1bc5f4ea400c6",

    "productVersion": "10155.0.0.124976"

  },

  "timestamp": 1684779074013,

  "component": "app.session.soar.systemSettings",

  "deploymentID": "soar-c48ed12b-262f-47e1-99b0-d2ba5b2af6dc",

  "eventID": "a74fd484-8d28-c0e8-c5bf-0b9ebf130665",

  "experienceID": "0b64f885-637b-9d67-289a-b4d4925e17fe"

}
app.session.soar.systemSettings Feature turned on or turned off settings and product version.
JSON 
component: app.session.soar.systemSettings

data: {
   app: soar
   isClusteringEnabled: false
   isMultiTenantEnabled: false
   numOfClusterNodes: 0
   page: UNKNOWN_PAGE
   productVersion: 10900.0.5
 nodeGUID: dca36837-3e10-4cbd-bf14-b49097b84347
 isElasticSearchEnabled: false
   splunkConfig: {
     searchLocation: local
     searchType: standalone
   }
 soarDeploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca
 soarUserID: 5d900c28b8d1555745c09908ef386860
}
deploymentID: soar-a2a983de-38ec-42d7-a179-30087b0ca8ca

eventID: d4b331e7-3ce3-91b6-7724-bc4d7235bca9

experienceID: 21febb16-c3f6-cbd5-ffac-905f1466c830

optInRequired: 3

timestamp: 1576695256840

visibility: anonymous
app.session.phantom.systemSettings Feature turned on or turned off settings and product version.
JSON 
component: app.session.phantom.systemSettings

data: {
   app: phantom
   isClusteringEnabled: false
   isMultiTenantEnabled: false
   numOfClusterNodes: 0
   page: UNKNOWN_PAGE
   productVersion: 10900.0.5
nodeGUID: dca36837-3e10-4cbd-bf14-b49097b84347
   isElasticSearchEnabled: false
   splunkConfig: {
     searchLocation: local
     searchType: standalone
   }
   phantomDeploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca
phantomUserID: 5d900c28b8d1555745c09908ef386860
}
deploymentID: phantom-a2a983de-38ec-42d7-a179-30087b0ca8ca

eventID: d4b331e7-3ce3-91b6-7724-bc4d7235bca9

experienceID: 21febb16-c3f6-cbd5-ffac-905f1466c830

optInRequired: 3

timestamp: 1576695256840

visibility: anonymous
automation.summary.ingestion_status Track how many apps are currently installed for a given deploymentID. Also, track how many times a given app is launched and what is the distribution of apps installed for all deployment Ingestion status and events ingested per SOAR stackIDs.
JSON 
{

  'type': 'aggregate',

  'component': 'automation.summary.ingestion_status',

  'data': {

    'adhoc': None,

    'automated': None,

    'all': {

      'total': 1,

      'success': 1,

      'failed': 0,

      'running': 0

    },

    'event_ingested_count': 1,

    'soarDeploymentID': 'soar-c48ed12b-262f-47e1-99b0-d2ba5b2af6dc',

    'license': 'standard',

    'productVersion': '10155.0.0.124976',

    'missionControlDeploymentID': None,

    'cloudWorksEnvironment': 'stg'

  },

  'deploymentID': 'soar-c48ed12b-262f-47e1-99b0-d2ba5b2af6dc',

  'optInRequired': 3,

  'version': None,

  'timestamp': 1684358758000,

  'visibility': [

    'anonymous'

  ],

  'indexData': True,

  'begin': 1684281600000,

  'end': 1684367999000

}
automation.summary.publish_telemetry_time_taken Time taken for publish_telemetry job to run to examine the performance of the queries.
JSON 
{

  'type': 'event',

  'component': 'automation.summary.publish_telemetry_time_taken',

  'data': {

    'start_time': 28244.781,

    'end_time': 28244.812,

    'total_time': 0.031,

    'soarDeploymentID': 'soar-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9',

    'license': 'community',

    'productVersion': '6.1.0.58',

    'missionControlDeploymentID': None,

    'cloudWorksEnvironment': 'dev'

  },

  'deploymentID': 'soar-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9',

  'optInRequired': 3,

  'version': None,

  'timestamp': 1685128654000,

  'visibility': [

    'anonymous'

  ],

  'indexData': True,

  'begin': None,

  'end': None

}
automation.summary.app_summary Get a deeper understanding of the apps customers are using from a summary of apps that are installed on the system.
JSON 
{

  'type': 'event',

  'component': 'automation.summary.app_summary',

  'data': {

    'app_name': 'MaxMind',

    'description': 'This app provides IP geolocation with the included MaxMind database',

    'version': '2.2.5',

    'product_name': 'GeoIP2',

    'product_vendor': 'MaxMind',

    'soarDeploymentID': 'soar-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9',

    'license': 'community',

    'productVersion': '6.1.0.58',

    'missionControlDeploymentID': None,

    'cloudWorksEnvironment': 'dev'

  },

  'deploymentID': 'soar-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9',

  'optInRequired': 3,

  'version': None,

  'timestamp': 1685128654000,

  'visibility': [

    'anonymous'

  ]

}
automation.summary.playbook_runs.by_trigger Track the number of SOAR playbooks run by Mission Control customers and track the count of playbook runs by trigger, i.e. adhoc or automated, aggregated over a given day. Emitted once per day at 12:00 AM UTC.
JSON 
{ [-]
   begin: 1663891200000
   component: automation.summary.playbook_runs.by_trigger
   data: { [-]
     adhoc: { [-]
       failed: 0
       running: 0
       success: 2
       total: 2
     }
     all: { [-]
       failed: 0
       running: 0
       success: 2
       total: 2
     }
     automated: { [-]
       failed: 0
       running: 0
       success: 0
       total: 0
     }
     cloudWorksEnvironment: dev
     missionControlDeploymentID: 917660C8-50E1-407B-86C5-D5061176245C
     soarDeploymentID: soar-cd07b53e-125e-4d27-adf7-2dba77b9fa81

     productVersion: 10155.0.0.98349
     license: standard
   }
   deploymentID: soar-cd07b53e-125e-4d27-adf7-2dba77b9fa81
   end: 1663977599000
   indexData: true
   optInRequired: 3
   timestamp: 1663977609000
   type: aggregate
   visibility: [ [+]
   ]

}
automation.summary.case_summary A summary of opened or closed cases.
JSON 
{
  'type': 'aggregate',
  'component': 'automation.summary.case_summary',
  'data': {
    'opened': 120,
    'closed': 87,
    'promoted': 12,
    'phantomDeploymentID': 'phantom-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9',
    'license': 'community',
    'productVersion': '6.1.0.58',
    'missionControlDeploymentID': None
  },
  'deploymentID': 'phantom-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9',
  'optInRequired': 3,
  'version': None,
  'timestamp': 1685658250000,
  'visibility': [
    'anonymous'
  ],
  'indexData': True,
  'begin': 1685491200000,
  'end': 1685577599000
}
automation.summary.workbook_summary A summary of opened or closed workbooks.
JSON 
{
  'type': 'aggregate',
  'component': 'automation.summary.case_summary',
  'data': {
    'opened': {
        'unique_containers': 3,
        'total_tasks': 15,
        'total_phases': 45, 
    },
    'started': {
        'unique_containers': 2,
        'total_tasks': 2,
        'total_phases': 4, 
    },
    'closed': {
        'unique_containers': 2,
        'total_tasks': 4,
        'total_phases': 12, 
    },
    'phantomDeploymentID': 'phantom-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9',
    'license': 'community',
    'productVersion': '6.1.0.58',
    'missionControlDeploymentID': None
  },
  'deploymentID': 'phantom-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9',
  'optInRequired': 3,
  'version': None,
  'timestamp': 1685658250000,
  'visibility': [
    'anonymous'
  ],
  'indexData': True,
  'begin': 1685491200000,
  'end': 1685577599000
}
orchestration.summary.action_runs.by_trigger Identify what fraction of action runs are executing on broker groups versus local versus legacy brokers, and track RPC broker adoption in terms of actual workload, not just registration.
JSON 
"by_target_type": {"rpc_broker": {"success": 120, "failed": 3, "running": 0, "pending": 0, "total": 123}, "local": {"success": 400, "failed": 10, "running": 2, "pending": 1, 
    "total": 413}}
automation_broker.summary.broker_adoption Track RPC broker adoption over time, alert when inactive_rpc_broker_count spikes, and understand version spread across the fleet.
JSON 
{"legacy_broker_count": 5, "rpc_broker_count": 3, "active_rpc_broker_count": 2, "inactive_rpc_broker_count": 1, "has_internal_broker": true, "rpc_broker_version_buckets":
    {"8.6.x": 2, "8.5.x": 1}}
automation_broker.summary.group_adoption Identify degraded or empty groups that need attention, understand HA posture (i.e. how many groups are truly active versus just registered, and track group adoption depth.
JSON 
{"broker_group_count": 4, "active_group_count": 2, "degraded_group_count": 1, "inactive_group_count": 0, "empty_group_count": 1, "max_group_size_bucket": "4-7",
    "groups_by_size_bucket": {"2-3": 2, "4-7": 1, "0": 1}, "groups_with_assets_count": 3}
automation_broker.summary.asset_assignment Measure ABHA adoption depth, understand the share of assets that are protected by HA groups versus a single broker versus local execution. Track app-level RPC/group usage.
JSON 
{"asset_count": 200, "local_asset_count": 80, "legacy_broker_asset_count": 60, "internal_broker_asset_count": 5, "rpc_broker_asset_count": 30, "broker_group_asset_count": 25,
    "apps_with_rpc_assets_count": 8, "apps_with_group_assets_count": 5}
automation_broker.summary.registration Detect registration churn (many re-registrations may indicate instability); validate credential rotation is happening on schedule; compare against fleet size for coverage.
JSON 
{"legacy_broker_registration_success_count": 2, "rpc_broker_registration_success_count": 5, "legacy_broker_credential_rotation_success_count": 3}
automation_broker.summary.group_management Track group lifecycle activity, identify customers actively managing HA topology, flag unexpected removal spikes as potential mis-configurations.
JSON 
{"group_create_count": 1, "group_update_count": 2, "broker_added_count": 3, "broker_removed_count": 1}
automation_broker.summary.group_dispatch Measure actual broker group workload, track failure rates for group-dispatched actions, and identify under-utilized or overloaded groups.
JSON 
{"group_action_count": 47, "group_action_status_counts": {"success": 43, "failed": 2, "running": 1, "pending": 1}}
automation_broker.summary.group_dispatch Understand the mix of websocket vs RPC connectivity among legacy brokers. Also, track the upgrade progress across the fleet and inform deprecation planning for older broker versions.
JSON 
{"legacy_broker_runtime_type_counts": {"websocket": 4, "rpc": 1}, "legacy_broker_version_buckets": {"8.5.x": 3, "8.6.x": 2}, "rpc_broker_version_buckets": {"8.6.x": 3}}
app.session.DA-ESS-TIM.dashboardLoaded Track how frequently users access the TIM dashboard. Also, track the adoption rate of the TIM app and when a user loads the TIM dashboard page.
JSON 
component: app.session.DA-ESS-TIM.dashboardLoadeddata: {
  action: timDashboard.loaded timestamp: 1755640541000
}
app.session.DA-ESS-TIM.filterApplied Track the frequency with which users use filtering capabilities and the number of filters users typically apply at the same time.
JSON 
component: app.session.DA-ESS-TIM.filterApplieddata: {
  action: filters.applied filterCount: 3
}
app.session.DA-ESS-TIM.openInSearch Track how frequently users drill down into the raw search from the TIM dashboard. Also, track whether users find the dashboard panels informative enough or if they need to investigate further.
JSON 
component: app.session.DA-ESS-TIM.openInSearchdata: {
  action: openInSearch.click
}
app.DA-ESS-TIM.TIMSearch Track the time taken by dashboard queries to run. For long-running queries, track the number of results and identify any performance bottlenecks in specific panels.
JSON 
component: app.DA-ESS-TIM.TIMSearch, data: {
  label: ds_active_ioc,
  resultCount: 42,
  runDuration: 1.502,
  searchEarliestTime: 1755550745,
  searchLatestTime: 1755554345
}
app.DA-ESS-TIM.TIMPerformanceMetadata Track how long the TIM dashboard takes to load and render. Also, track the dashboard complexity and performance regressions between versions.
JSON 
component: app.DA-ESS-TIM.TIMPerformanceMetadata, data: {
  id: DashboardCore.mountToRender,
  totalDuration: 2845.30,
  definitionInfo: { numDataSources: 14, numViz: 10, numInputs: 7 }
}
chatFeedbackSubmitted Measure SecA assistant response quality and usefulness by tenant, user feedback direction, reason, screen/surface, and product context. Use negative feedback patterns and comments to identify response-quality issues and prioritize improvements.
PYTHON 
[
  {
    "tenant": "customer-tenant",
    "type": "feedback",
    "request_id": "req-123",
    "thread_id": "thread-abc",
    "run_id": "run-001",
    "thumb": "down",
    "thumb_status": "Negative",
    "feedback_reasons": ["incorrect", "not_helpful"],
    "feedback_comment": "This missed the detection context.",
    "user_message": "Summarize this finding.",
    "message_content": "I cannot determine that from the provided information.",
    "message_id": "run-001:thread-abc",
    "message_role": "assistant",
    "user": "analyst@example.com",
    "screen_id": "es-assistant",
    "context": {
      "feature": "triage",
      "entityType": "finding",
      "entityId": "finding-123"
    }
  }
]
chatMessageCaptured Measure SecA usage volume, conversation length, message role mix, and assistant response flow.
JSON 
{
  "type": "message",
  "tenant": "tenant-1",
  "user": "analyst@example.com",
  "request_id": "req-123",
  "content": "Summarize this finding",
  "message_id": "msg-001",
  "thread_id": "thread-abc",
  "role": "user",
  "index": "1"
}
contextSubmitted Understand which context types are used, detect oversized context, prioritize context handling improvements.
JSON 
{
  "type": "context",
  "tenant": "tenant-1",
  "context_cls": "finding_context",
  "context_size": 18422,
  "request_id": "req-123",
  "thread_id": "thread-abc",
  "user": "analyst@example.com"
}
skillOrchestrationCompleted Measure skill selection quality, understand feature usage, and debug wrong tool/skill routing.
JSON 
{
  "type": "orchestration",
  "tenant": "tenant-1",
  "user": "analyst@example.com",
  "request_id": "req-123",
  "api_version": "v0.1.0",
  "query": "write SPL for failed logins",
  "thread_id": "thread-abc",
  "outputs": [
    {
      "selected_skill": "spl_writer",
      "arguments": {
        "intent": "write SPL for failed logins"
      }
    }
  ]
}
splFewshotSearchPerformed Measure retrieval relevance, detect RAG gaps, and improve SPL example corpus.
JSON 
{
  "type": "search",
  "tenant": "tenant-1",
  "request_id": "req-123",
  "input": "failed login SPL",
  "results": [
    {
      "spl": "index=auth action=failure"
    },  
  ],
  "distances": [0.12, 0.18, 0.31]
}
modelGenerationCompleted Evaluate model quality, debug poor generations, and compare behavior by model.
JSON 
{
  "type": "generate",
  "tenant": "tenant-1",
  "user": "analyst@example.com",
  "request_id": "req-abc123",
  "model_id": "gpt-4o",
  "prompt": "You are a security analyst assistant. Given the following finding...",
  "output": "Based on the finding details, the most likely cause is..."
}
ragPromptFetchNoMatches Identify RAG corpus coverage gaps and queries with no useful retrieval hits.
JSON 
{
  "metric_name": "rag_prompt_fetch_no_matches",
  "operation": "inc",
  "tenant": "tenant-1",
  "request_id": "req-123",
  "retrieval_source": "spl_fewshots"
}
ai-analysis-feedback-submitted Measure usefulness/quality of AI Analysis responses by incident and reason breakdown
JSON 
{
  "component": "AI_ANALYSIS_FEEDBACK_SUBMITTED",
  "data": {
    "feedbackType": "THUMBS_DOWN",
    "feedbackReason": "Incorrect",
    "incidentId": "INC-12345"
  }
}
ai-analysis-nested-section-toggled Understand which sections users engage with most; which tools are surfaced/used
JSON 
{
  "component": "AI_ANALYSIS_NESTED_SECTION_TOGGLED",
  "data": {
    "sectionId": "tools",
    "action": "OPENED",
    "incidentId": "INC-12345",
    "tools": [
      {"app_id": "risk", "app_name": "Risk Analysis"}
    ]
  }
}
ai-analysis-section-toggled Track overall engagement with AI Analysis section visibility
JSON 
{
  "component": "AI_ANALYSIS_SECTION_TOGGLED",
  "data": {
    "action": "COLLAPSED",
    "incidentId": "INC-12345"
  }
}
ai-analysis-view-details-clicked Track deeper investigation intent and feature usage
JSON 
{
  "component": "AI_ANALYSIS_VIEW_DETAILS_CLICKED",
  "data": {
    "incidentId": "INC-12345"
  }
}
ai-suggested-disposition-match Measures AI suggestion adoption / trust signal (how often users accept AI's suggested disposition)
JSON 
{
  "component": "aiSuggestedDispositionMatch",
  "data": {
    "incidentId": "INC-12345",
    "aiSuggestedDisposition": "True Positive",
    "selectedDisposition": "True Positive",
    "dispositionMatches": true
  }
}
detection-status-filter-changed Understand how users filter detections (which states are most used) and UX effectiveness of filtering
JSON 
{
  "component": "detectionStatusFilterChanged",
  "data": {
    "filterValue": "on",
    "previousValue": "off",
    "source": "detections"
  }
}
ai-triage-status-filter-changed Understand how users filter detections by AI triage status and UX effectiveness of filtering
JSON 
{
  "component": "aiTriageStatusFilterChanged",
  "data": {
    "filterValue": "on",
    "previousValue": "off",
    "source": "detections"
  }
}
detections-search-performed Understand search adoption and effectiveness (zero-result searches, common filters paired with searches)
JSON 
{
  "component": "detectionsSearchPerformed",
  "data": {
    "searchQuery": "ransomware",
    "resultCount": 12,
    "detectionStatusFilter": "all",
    "aiTriageStatusFilter": "all",
    "source": "detections"
  }
}
detections-load-error Track reliability issues and identify failing filter combinations / backend problems
JSON 
{
  "component": "detectionsLoadError",
  "data": {
    "errorMessage": "Request failed with status 500",
    "statusCode": 500,
    "filters": {
      "detectionStatus": "All",
      "aiTriageStatus": "All",
      "search": "ransomware"
    },
    "source": "detections"
  }
}
ai-triage-bulk-turned-on Adoption and usage patterns of bulk AI triage; size of bulk operations and which detections are targeted
JSON 
{
  "component": "aiTriageBulkTurnedOn",
  "data": {
    "detectionCount": 3,
    "detections": [...],
    "source": "detections"
  }
}
ai-triage-bulk-turned-off Adoption and usage patterns of bulk AI triage; size of bulk operations and which detections are targeted
JSON 
{
  "component": "aiTriageBulkTurnedOff",
  "data": {
    "detectionCount": 3,
    "detections": [...],
    "source": "detections"
  }
}
rbac-team-queue (permissions-updated) Capture role counts for each permission in a queue when save is hit; tracks usage of granular permission settings
JSON 
{
  "component": "rbac-team-queue",
  "data": {
    "section": "rbac-team-queue-permissions-updated",
    "action": {
      "queueId": "some-random-queue-id",
      "teamQueuePermissionCount": {
        "create": 10, "edit": 12,
        "read": 15, "delete": 8, "execute": 2
      }
    }
  }
}
rbac-team-queue (retention-period-configured) Captures the difference between queue-specific and global investigation retention period in days; only fires when global policy is enabled and queue retention is updated
JSON 
{
  "component": "rbac-team-queue",
  "data": {
    "section": "create_queue",
    "action": "rbac-team-queue-retention-period-configured",
    "retentionPeriodDifference": 35
  }
}
live-test-mode (status-change-attempt) Measure Live Test adoption rates, aggregate by detection types, track errors during status transition
JSON 
{
  "component": "live-test-mode",
  "data": {
    "action": "status-change-attempt",
    "detection_id": "some-detection-id",
    "app_name": "SplunkEnterpriseSecuritySuite",
    "version": "2.1",
    "detection_type": "ebd",
    "from_state": "off",
    "to_state": "live_test",
    "is_successful": true,
    "error_message": ""
  }
}
live-test-mode (inventory-snapshot) Measure how many detections and versions are being tested in Live Test mode at once
JSON 
{
  "component": "live-test-mode",
  "data": {
    "action": "inventory-snapshot",
    "live-test-mode-detections-count": 2,
    "live-test-mode-versions-count": 3
  }
}
sint-local-source (create) Measure how many local sources are created
JSON 
{
  "component": "SINT_LOCAL_SOURCE",
  "data": {
    "action": "create",
    "name": "my source",
    "sourceType": "lineOriented"
  }
}
sint-local-source (update) Measure how many local sources are updated
JSON 
{
  "component": "SINT_LOCAL_SOURCE",
  "data": {
    "action": "update",
    "name": "my source",
    "sourceType": "lineOriented"
  }
}
sint-local-source (delete) Measure how many local sources are deleted
JSON 
{
  "component": "SINT_LOCAL_SOURCE",
  "data": {
    "action": "delete",
    "name": "my source"
  }
}
sint-local-source (activate) Measure how many local sources are activated
JSON 
{
  "component": "SINT_LOCAL_SOURCE",
  "data": {
    "action": "activate",
    "name": "my source"
  }
}
sint-local-source (deactivate) Measure how many local sources are deactivated
JSON 
{
  "component": "SINT_LOCAL_SOURCE",
  "data": {
    "action": "deactivate",
    "name": "my source"
  }
}
sint-cloud-source (subscribe) Measure how many cloud sources are subscribed
JSON 
{
  "component": "SINT_CLOUD_SOURCE",
  "data": {
    "action": "subscribe",
    "name": "cloud source"
  }
}
sint-cloud-source (unsubscribe) Measure how many cloud sources are unsubscribed
JSON 
{
  "component": "SINT_CLOUD_SOURCE",
  "data": {
    "action": "unsubscribe",
    "name": "cloud source"
  }
}
sint-threatlist (create) Measure how many threatlists are created
JSON 
{
  "component": "SINT_THREATLIST",
  "data": {
    "action": "create",
    "name": "my threatlist"
  }
}
sint-threatlist (update) Measure how many threatlists are updated
JSON 
{
  "component": "SINT_THREATLIST",
  "data": {
    "action": "update",
    "name": "my threatlist"
  }
}
sint-threatlist (delete) Measure how many threatlists are deleted
JSON 
{
  "component": "SINT_THREATLIST",
  "data": {
    "action": "delete",
    "name": "my threatlist"
  }
}
sint-threatlist (activate) Measure how many threatlists are activated
JSON 
{
  "component": "SINT_THREATLIST",
  "data": {
    "action": "activate",
    "name": "my threatlist"
  }
}
sint-safelist (create) Measure how many safelists are created
JSON 
{
  "component": "SINT_SAFELIST",
  "data": {
    "action": "create",
    "name": "my safelist"
  }
}
sint-safelist (delete) Measure how many safelists are deleted
JSON 
{
  "component": "SINT_SAFELIST",
  "data": {
    "action": "delete",
    "name": "my safelist"
  }
}
sint-safelist-entry (update) Measure how many safelist entries are updated
JSON 
{
  "component": "SINT_SAFELIST_ENTRY",
  "data": {
    "action": "update",
    "name": "my safelist entry"
  }
}
sint-safelist-entry (delete) Measure how many safelist entries are deleted
JSON 
{
  "component": "SINT_SAFELIST_ENTRY",
  "data": {
    "action": "delete",
    "safelistId": "my safelistId",
    "termID": "termId"
  }
}
detection-in-editor-testing (diet-test-launch) Tracks how many detection tests are being run
JSON 
{
  "component": "detection-in-editor-testing",
  "data": {
    "action": "diet-test-launch",
    "mode": "findings",
    "time_preset": "24h"
  }
}
detection-in-editor-testing (diet-test-cancel) Tracks how many times results loading is canceled
JSON 
{
  "component": "detection-in-editor-testing",
  "data": {
    "action": "diet-test-cancel",
    "mode": "findings",
    "time_preset": "24h"
  }
}
detection-in-editor-testing (diet-versioning-test-launch) Tracks how many version comparison tests are being run
JSON 
{
  "component": "detection-in-editor-testing",
  "data": {
    "action": "diet-versioning-test-launch",
    "mode": "findings",
    "time_preset": "24h"
  }
}
detection-in-editor-testing (diet-test-versioning-cancel) Tracks how many times results loading for version comparison is canceled
JSON 
{
  "component": "detection-in-editor-testing",
  "data": {
    "action": "diet-test-versioning-cancel",
    "mode": "findings",
    "time_preset": "24h"
  }
}
detection-in-editor-testing (diet-results / success) Tracks how many times results fetch was successful for user
JSON 
{
  "component": "detection-in-editor-testing",
  "data": {
    "action": "diet-results",
    "result": "success",
    "precision": "count",
    "mode": "findings"
  }
}
detection-in-editor-testing (diet-warning / partial) Tracks how many times results shown were partial
JSON 
{
  "component": "detection-in-editor-testing",
  "data": {
    "action": "diet-warning",
    "type": "partialResults",
    "precision": "count",
    "mode": "findings"
  }
}
detection-in-editor-testing (diet-error) Tracks how many times results fetch was not successful and the reason for it
JSON 
{
  "component": "detection-in-editor-testing",
  "data": {
    "action": "diet-error",
    "type": "activeDetection",
    "message": "Something went wrong"
  }
}
aqSidePanelLayoutChanged Determines whether users are leveraging the new streamlined two-column redesign experience in the AQ side panel
JSON 
{
  "appName": "MissionControl",
  "component": "aqSidePanelLayoutChange",
  "data": {
    "columns": 2
  }
}
collapsibleSectionToggled Determines what information sections in the AQ sidepanel and investigation overview users persist for daily usage
JSON 
{
  "appName": "MissionControl",
  "component": "collapsibleSectionToggled",
  "data": {
    "sectionId": "sidepanel_response_history",
    "isOpen": true
  }
}
fieldGroupSelectionChanged Determines what field groups the analyst deems important for investigation/triage
JSON 
{
  "appName": "MissionControl",
  "component": "fieldGroupSelectionChanged",
  "data": {
    "selectedGroups": "metadata, mitre_attack, pinned",
    "source": "mc.details-section-groups.sidepanel"
  }
}
viewCompleteAnalysis Determines how often the analyst uses the new Threat analysis tab in the investigation page to view full job details
JSON 
{
  "appName": "MissionControl",
  "component": "viewCompleteAnalysis",
  "data": undefined
}
saa-invocation Track SAA API reliability and adoption — success/failure rates per endpoint, identify unreliable endpoints, measure overall SAA feature usage volume
JSON 
{
  "component": "saa-invocation",
  "metadata": {
    "endpoint": "submit_url_job",
    "job_id": "abc-123",
    "success": true,
    "status_code": 200
  }
}

Share threat data in Splunk Enterprise Security

Sharing of telemetry usage data is different from sharing threat data. If you are a Splunk Enterprise Security Hosted Service Offering (cloud) customer with a standard terms contract renewed or created after January 10, 2025, you can refer to Share threat data in Splunk Enterprise Security for details on enhanced data sharing to support improved detection capabilities, update threat intelligence, and operations of our security content offerings.