---
updatedAt: 2026-09-28T17:55:22.000Z
agentTools:
  projectIndex: https://docs.greynoise.io/llms.txt
---

# SIEM Integration: Splunk Release Notes

<br />

## RELEASE NOTES (VERSION 3.1.0)

* Added the Executive Dashboard for firewall and VPN traffic analysis
* Added Callback IP Feed configuration for scheduled ingest of Callback IPs into `greynoise_callback_indicators`
* Added the Callback IP Lookup dashboard and the `gncallback` and `gncallbackfeed` commands
* Added a Callback IP workflow action on CIM IP fields
* Added the Include Community Dataset option on Feed Configuration
* Indicator records now store `spoofable` and `source_workspaces`
* Added the `gnrecall` command for Recall timeseries and stats lookups
* Added the `gnippsychic` command for Psychic IP lookups
* Added the `gnfeed` command to populate `greynoise_indicators` without storing a `_raw` payload for each IP
* Rebuilt the Overview dashboard in Dashboard Studio
* Updated the GreyNoise SDK to v3.1.0
* Migrated the configuration UI to UCC 6.6.0
* Added compatibility with Splunk Enterprise 10.2.x
* Custom commands now require Python 3.13
* Updated `splunklib` to v2.1.1

## RELEASE NOTES (VERSION 3.0.2)

* Fixed connection failures on RHEL systems caused by IPv6 resolution issues
* Fixed Live Investigation Dashboard

## RELEASE NOTES (VERSION 3.0.1)

* Fixed Python file formatting

## RELEASE NOTES (VERSION 3.0.0)

* Implemented CIM (Common Information Model) mapping for better data normalization and integration with Splunk ES
* Introduced support to update the Risk Score in Splunk Enterprise Security (ES) based on classification
* Added capability to ingest GreyNoise feed data into a Splunk index
* Added support for Splunk ES - Threat Intelligence
* Updated the IP Timeline Lookup dashboard with new filters
* Updated GreyNoise SDK to use v3.0.1
* Migrated the app to the latest version of Splunk Add-on Builder v4.5.0
* Removed the commands `gnipsimilar` and `gnriot`
* Removed the Similar IP Lookup dashboard

## RELEASE NOTES (VERSION 2.2.1)

* Updated to support Splunk Cloud requirements

## RELEASE NOTES (Version 2.2.0)

* Added new FEED component to create lookuptable based on GreyNoise indicators
* Added new command gnipsimilar and new Similar IP Lookup dashboard
* Added new command gniptimeline and new IP Timeline Lookup dashboard
* Updated gnenrich command to use batch lookups
* Updated gnquery command with new parameters page\_size and exclude\_raw
* Updated GreyNoise SDK to v2.0.1

## RELEASE NOTES (Version 2.1.5)

* Fix bug with gnenrich, gnriot, and gnfilter where proxy wasn't being used for API key validation
* Fix credentials.py to deal with null API keys on fresh install

## RELEASE NOTES (Version 2.1.4)

* Add support for configuring proxy information in conf file
* Add support for IP Destination Geo feature fields
* Fix bug in `gnriot` when IPv6 address is sent for lookup
* Update to use GreyNoise SDK 1.3.0
* Update to use splunktaucclib 6.0.6

## RELEASE NOTES (Version 2.1.2)

* Fixed issue where API key could not be entered on new installs
* IMPORTANT: GreyNoise API Key *must* be re-entered if upgrading from a previous version

## RELEASE NOTES (Version 2.1.1)

* Fixed JQuery 3.5.0 compatibility issue identified via Upgrade Readiness
* Fixed Python3 compatibility issue identified via Upgrade Readiness
* Fixed missing explict definition for cache\_maintenance script to use py3
* Update to use GreyNoise SDK 1.2.0
* Updated splunklib to version 1.6.18

## RELEASE NOTES (Version 2.1.0)

* Python2 and Splunk7.x support is dropped starting from this release, GreyNoise now only supports Splunk 8.x and Python3
* Updated to latest GreyNoise SDK 1.1.0
* Added gnriot custom command for the RIOT endpoint
* Improves error messages for non-routable and invalid IP address
* Updated splunklib to version 1.6.16
* Updated the time in gnoverview saved search to 6 hours
* Added 2 new codes to the csv file
* Updated the custom commands, saved searches, and dashboards to handle the RIOT key
* Fixed an issue to handle Splunk fields with unallowed characters
* Added Caching feature for all the custom commands and saved searches.

<br />

## UPGRADING FROM VERSION 2.0.1

Follow the below steps to upgrade the app to the latest version:

* Disable all the saved searches which uses alert actions and custom commands of GreyNoise.
* Backup your current app/configurations outside of the Splunk install path.
* To upgrade the app from the UI, follow the steps in the INSTALLATION section below. Ensure that `Upgrade app.` checkbox is selected before clicking on the Upload button.
* Follow the steps mentioned in CONFIGURATION section to reconfigure the app.
* If SCAN DEPLOYMENT feature was already configured before app upgradation then go to SCAN DEPLOYMENT tab inside the Configuration tab and Click on Save button to re-configure the scan deployment saved search in the backend.

*Note: Upgrade is only supported from UI and not supported from the backend.*