v6.9.0

Issues

• [BUG] AWS CreateAccessKey: unquoted field names make the cross-user filter a no-op (fires on self-key creation)

  bug
  splunk/security_content#4292 · Filter by author vshcherbakov opened on Sep 25, 2026 · v6.9.0
  1

  

• Add AWS CloudTrail behavioral detections

  Detections
  Unread
  splunk/security_content#4297·themaryjo opened Sep 29, 2026 · Updated Oct 9, 2026·Draft
  12

• Add detection for repeated CloudWatch Logs read operations

  Detections
  Unread
  splunk/security_content#4288·themaryjo opened Sep 24, 2026 · Updated Oct 13, 2026·Draft
  5

• Add AWS EC2 Instance Connect key upload detection

  Detections
  Unread
  splunk/security_content#4312·themaryjo opened Oct 2, 2026 · Updated Oct 13, 2026
  11

• Revamp Cisco FTD and its Dependent Detections

  Detections
  Unread
  splunk/security_content#4328·onurmerdogan opened Oct 8, 2026 · Updated Oct 14, 2026·Draft
  1

• Add Braodo Stealer Coverage For 2026 Variant

  DetectionsStories
  Unread
  splunk/security_content#4320·tccontre opened Oct 6, 2026 · Updated Oct 13, 2026
  18