Skip to content

pin windows ta version in updater #4203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nasbench merged 2 commits into from
Aug 5, 2026
Merged

pin windows ta version in updater #4203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2f9065a
pin windows ta version in updater
pyth0n1c Aug 5, 2026
2b6d541
Revert all windows ta versions.
pyth0n1c Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/workflows/datasource-dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,11 @@ jobs:
run: |
echo "Updating data source supported_TA and repo install.yml app versions"
contentctl-ng update-data-source-tas --content-dirs .

# TODO: Remove this when we are fully compatible with the latest version of the Windows TA
# Temporarily roll back any automated updates to the Windows TA because we intentionally
# want to pin to the current version.
git checkout -- $(grep -rl "https://splunkbase.splunk.com/app/742" data_sources/)
echo "Changed data source and install.yml files:"
git status --short -- data_sources install.yml

Expand Down
2 changes: 1 addition & 1 deletion data_sources/ntlm_operational_8004.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/ntlm_operational_8005.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/ntlm_operational_8006.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/powershell_script_block_logging_4104.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ separator_value: '4104'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ActivityID
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_active_directory_admon.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- Guid
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_application_15457.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_application_17135.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_application_2282.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_application_3000.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ separator_value: '3000'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_application_8128.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_appxdeployment_server_400.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_appxdeployment_server_854.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_appxdeployment_server_855.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_appxpackaging_171.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- CategoryString
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_capi2_70.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ separator_value: '70'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_capi2_81.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ separator_value: '81'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_certificateservicesclient_1007.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ separator_value: '1007'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ActivityID
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_defender_1121.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: '1121'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ActivityID
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_defender_1122.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: '1122'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ActivityID
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_defender_1125.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1122</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-26T23:43:08.7101401Z'/><EventRecordID>3701</EventRecordID><Correlation ActivityID='{b68511a1-ec5f-4bc7-a9bb-2bd601338de2}'/><Execution ProcessID='3512' ThreadID='5936'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>E6DB77E5-3DF2-4CF1-B95A-636979351E5B</Data><Data Name='Detection Time'>2023-11-26T23:43:08.709Z</Data><Data Name='User'>(unknown user)</Data><Data Name='Path'></Data><Data Name='Process Name'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Security intelligence Version'>1.401.1247.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'></Data><Data Name='Parent Commandline'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Involved File'></Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event>
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_defender_1126.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ActivityID
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_defender_1129.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: '1129'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ComputerName
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_defender_1131.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- ActivityID
- CategoryString
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_defender_1132.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- ActivityID
- CategoryString
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_defender_1133.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- ActivityID
- CategoryString
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_defender_1134.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- ActivityID
- CategoryString
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_defender_5007.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_printservice_316.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: '316'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ComputerName
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_printservice_4909.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
example_log: ''
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_printservice_808.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: '808'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ComputerName
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_remoteconnectionmanager_1149.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: '1149'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ActivityID
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_security_1100.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: '1100'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- Channel
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_security_1102.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: '1102'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- Caller_User_Name
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_security_4624.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: '4624'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ActivityID
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_security_4625.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: '4625'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ActivityID
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_security_4627.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ separator_value: '4627'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ActivityID
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_security_4648.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: '4648'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ActivityID
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_security_4662.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: '4662'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- AccessList
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_security_4663.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: '4663'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- AccessList
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_security_4672.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: '4672'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- ActivityID
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_security_4688.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- Caller_Domain
- Caller_User_Name
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_security_4698.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: '4698'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- Account_Domain
Expand Down
2 changes: 1 addition & 1 deletion data_sources/windows_event_log_security_4699.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ separator_value: '4699'
supported_TA:
- name: Splunk Add-on for Microsoft Windows
url: https://splunkbase.splunk.com/app/742
version: 11.0.0
version: 10.0.1
fields:
- _time
- Account_Domain
Expand Down
Loading