No, Splunk does not currently bundle the Adobe Flash Player in Splunk Enterprise and has not knowingly for at least several years. If it was ever was bundled, it might have been in versions pre-4.x. There are no Adobe Flash requirements from Splunk Enterprise Core since Splunk Enterprise 4.3. However, there may be dependencies based on older apps and dashboards. Some flash objects (.swf files) are still shipped in Splunk Enterprise up until 7.3.x, and have been removed in Splunk 8.x, below are the details: Flash Objects:   Splunk stopped using Flash for objects with Splunk Enterprise 5.0 and switched to JScharts. Thus from this point, Splunk Enterprise core has not been using Flash.   However, it is still an option to use FlashChart if using "Advanced XML". Apps and dashboards that use Advanced XML could still use Flash objects.   There may be apps and add-ons, including older Splunk created ones, that could still be using Advanced XML and possibly some Flash objects in their dashboards.   Splunk Enterprise Core Visualizations:   Splunk Enterprise has not used Adobe Flash since version 5.0, visualizations were changed further in versions 6.0 and 6.3. All Splunk created apps at that point should have stopped using Flash objects also.   Advanced XML:   Third-party apps may use "Advanced XML" to call and use Flash objects up until Splunk Enterprise 7.3.x.   Splunk 8.x drops support for Advanced XML.   Advanced XML deprecation in Splunk Enterprise v6.3:   https://docs.splunk.com/Documentation/Splunk/6.3.0/ReleaseNotes/Deprecatedfeatures#Feature_support   As of Splunk 6.3, Advanced XML was marked as Deprecated. At this point, all Splunk created apps should be transiting completely from using Flash objects. Third-party apps could still use Flash objects as Advanced XML is supported.   Advanced XML Support for Dashboards:   Supported through 7.3.x   Advanced XML is supported through 7.3.x. This would be for third-party apps and code and the reason .swf files may be found packaged with Splunk Enterprise.   https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/Whatsinthismanual#Advanced_XML_Deprecation   Unsupported starting in Splunk 8.0   Advanced XML support is removed from Splunk 8.x.   https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/Deprecatedfeatures#Removed_features_in_version_8.0   Thank you to @ddaniel  for helping with the answer.   ... View more

As of version 7.1.3 of Splunk Stream, Splunk Stream does not support credentials for file-servers/mounts. There is an open Enhancement Request, STREAM-4140, to add support for this feaure. If you'd like to add yourself to the list in support of this feature (and for status updates), please file a case with Splunk Support requesting to be added to STREAM-4140 and follow up with your Splunk Account Team for status updates of STREAM-4140. ... View more

All sign-in data comes from Microsoft Azure AD, but there are a few main types (with respect to entry points/schema): 1.) Azure Application Data 2.) Azure User Account Sign-Ins (this is separate from the Audit data) 3.) Office 365 Management – Sign-Ins What Splunk currently officially supports is number 3, O365 Management Sign-Ins, which was part of the Splunk MSCS Add-On until it was separated into the separate Splunk O365 Add-On (https://splunkbase.splunk.com/app/4055/). So technically, at one point, MSCS was supporting "Sign-In" data, but it pertained to O365, not Azure. Splunk plans to officially support the other sign-in data sources at a later date (active work in progress), but as of now, it is not supported. An enhancement request was created, ADDON-21972. If you'd like to follow this, please contact Splunk Support with a message stating you wish to be added to the Enhancement Request ADDON-21972 and reach out to your Splunk account team for status updates. In the mean time, there are unsupported ways to get that data into Splunk explained below. The Azure Audit sign-in data sources for 1 and 2 above (currently not supported by the Splunk MSCS Add-On) can be obtained using apps created by Splunk Works/the community. There are two ways to get that sign-in data using those published Add-Ons: a.) Using the Azure AD reporting add-on -> https://splunkbase.splunk.com/app/3757/ b.) Sending the Azure AD logs to an Event Hub and using the Azure monitor add-on -> https://splunkbase.splunk.com/app/3534/ https://www.splunk.com/blog/2018/04/20/splunking-microsoft-azure-monitor-data-part-1-azure-setup.html https://www.splunk.com/blog/2018/05/07/splunking-microsoft-azure-monitor-data-part-2-splunk-setup.html https://splunkbase.splunk.com/app/4343/#/details Separately, it may be possible to just download the data directly with a script and ingest it into Splunk as a log appropriately. An example of a download script can be found here: https://gallery.technet.microsoft.com/scriptcenter/Pull-Azure-AD-Sign-In-3fead683 ... View more