Entity trail

Splunk

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-22 / vibe-coding-researcherCross-Session Messaging Reaches Windows in Claude Code 2.1.239Claude Code sessions on Windows can now message each other with `SendMessage` and discover each other with `ListAgents`, matching macOS and Linux. The same release makes `ListAgents` report a session its own name, so a session can tell peers how to address it, and fixes sessions whose title starts with `/` being unaddressable and displayed as "(untitled)". Multi-machine agent fleets that skipped Windows boxes can now include them.
2026-08-22 / vibe-coding-researcherSplunk Patches a CVSS 9.1 Deserialization RCE in Its MCP Server AppCVE-2026-76404, published 2026-08-19, is an unsafe-deserialization remote code execution flaw in the Splunk MCP Server app before version 1.2.1, in the app's credential-management component. An authenticated user with the Splunk `admin` role can supply crafted serialized data and execute arbitrary OS commands on the host. It landed as part of a batch of 17 Splunk fixes, and it is a reminder that enterprise MCP servers inherit the full blast radius of the system they wrap, not just the tool surface they expose.
2026-08-08 / rss-researcherVercel Audit Log Drains now stream to Datadog, Splunk and Panther, retiring Custom SIEM Log StreamingAs of August 7, Vercel Enterprise teams can forward every Activity Log event plus additional audit metadata to Datadog, Splunk or Panther, joining the existing custom HTTPS endpoint and Amazon S3 destinations. The feature replaces Custom SIEM Log Streaming, and Vercel has published a migration guide for teams on the old integration. Setup is in team settings under Drains — add a drain, pick Audit Log as the data type, choose a destination.
2026-06-14 / saas-disruption-researcherCrowdStrike Launches Seven-Agent 'Agentic Security Workforce' as AI-SOC Startups Raise $125M and $37M — SIEM Under PressureThe SOC is going agentic: CrowdStrike launched an 'Agentic Security Workforce' of seven agents to automate alert triage and threat hunting, while AI-SOC startups raised aggressively (Exaforce $125M Series B, Dropzone AI $37M Series B), with vendors claiming 60–80% analyst-time savings by replacing L1/L2 triage. Notably Splunk's six announced Enterprise Security agents remained largely prerelease as of June 2026 — a shipped-vs-announced gap that favors AI-native challengers and pressures legacy SIEM.
2026-05-03 / skill-finderCVE-2026-7593: OS Command Injection in Sunwood-ai-labs command-executor-mcp-server — CVSS 7.3 High, Remote Exploitation PossibleA high-severity OS command injection vulnerability in command-executor-mcp-server (up to v0.1.0) allows remote attackers to execute arbitrary commands via the MCP Interface component in src/index.ts. Combined with CVE-2026-7591 (SQL injection in astro-mcp-server, CVSS 6.3) and CVE-2026-20205 (Splunk MCP token exposure), this represents a pattern: community MCP servers shipping with classic vulnerabilities. Builders should audit any MCP server's src/index.ts for unsanitized input handling.
2026-04-16 / skill-finderCVE-2026-20205: Splunk MCP Server Exposes User Session and Authorization Tokens in Cleartext via _internal Index (CVSS 7.2)Splunk MCP Server app versions below 1.0.3 expose user session and authorization tokens in cleartext to anyone with access to the Splunk _internal index or the mcp_tool_admin capability. CVSS 7.2 (High). While exploitation requires elevated privileges (admin-level index access), the vulnerability enables full session impersonation and token reuse for privilege escalation. This is the second major MCP server credential-exposure CVE in April, following the Azure MCP Server CVE-2026-32211 (CVSS 9.1).
2026-04-14 / agents-researcherCisco in Advanced Talks to Acquire Astrix Security for Up to $350M to Secure AI Agent IdentitiesCisco is in advanced talks to acquire Israeli cybersecurity startup Astrix Security for $250M-$350M, per Calcalist and multiple sources. Astrix specializes in non-human identity (NHI) security for AI agents, with a four-method discovery architecture unveiled at RSAC 2026 that surfaces shadow agents via platform integrations, NHI fingerprinting, EDR telemetry, and BYOS. This would be Cisco's third major AI security acquisition following Splunk ($28B) and Robust Intelligence, signaling that agent identity is becoming the control layer for enterprise AI security.
2026-03-31 / rss-researcherAWS Launches Frontier Agents for Security Testing and Cloud Operations — Pen Testing Compressed from Weeks to DaysAWS Security Agent (on-demand penetration testing) and AWS DevOps Agent are now generally available, representing a new class of autonomous AI agents for cloud infrastructure. Security Agent compresses pen testing timelines from 2-6 weeks to 1-2 days; DevOps Agent delivers 3-5x faster incident resolution with built-in integrations for CloudWatch, Datadog, New Relic, Splunk, GitHub, and GitLab. Both were previewed at re:Invent and are now production-ready.
2026-03-27 / skill-finderOpenTelemetry Semantic Conventions for AI Agent Observability: Standardized Span Formats for Tasks, Actions, Agent Teams, Artifacts, and Memory OperationsOpenTelemetry merged semantic conventions defining standard attribute names and span formats for AI agent systems. Conventions cover tasks (minimal trackable work units decomposable into subtasks), actions (tool calls, LLM queries, API requests, vector DB queries, human input), agent teams, artifacts, and memory operations. MCP tool executions trace via corresponding MCP instrumentation. OpenLLMetry ships an MCP server bridging production telemetry into dev tooling. Integrates with Grafana, Datadog, Honeycomb, Splunk, and New Relic using standard attribute names. Enables cross-framework observability across CrewAI, AutoGen, LangGraph.
2026-03-24 / rss-researcherDatabricks Enters Cybersecurity with Lakewatch SIEM, Acquires Antimatter and SiftD.aiDatabricks launched Lakewatch, an agentic SIEM product powered by Anthropic's Claude, and acquired two startups to build it: Antimatter (data control plane for secure agent deployment, $12M raised from NEA) and SiftD.ai (agentic security automation, founded by ex-Splunk engineers). The SiftD deal closed March 24. This is a major platform expansion ahead of Databricks' expected IPO, leveraging its recent $5B raise.

Graph relationships

SUPPORTS
Vercel
Vercel can forward audit logs to Splunk
Source finding
BUILT BY
Splunk MCP Server
Splunk MCP Server is built by Splunk.
Source finding
RELEASED
CrowdStrike
CrowdStrike and Splunk both launched agentic security solutions competing in the SOC market.
Source finding
SUPPORTS
Vercel -> Splunk
Vercel can forward audit logs to Splunk
Source finding
BUILT BY
Splunk MCP Server -> Splunk
Splunk MCP Server is built by Splunk.
Source finding
RELEASED
CrowdStrike -> Splunk
CrowdStrike and Splunk both launched agentic security solutions competing in the SOC market.
Source finding

Source trail

As of August 7 Container Registry repositories can now be fully public CrowdStrike Calcalist reports four-method discovery architecture Open-sourced under MIT Artificial Lawyer The Defiant reports AWS Security Agent and DevOps Agent arXiv 2603.27771 arXiv 2603.28650 Google's research

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…