Upgrading Splunk Enterprise Security (ES) 7.x to ES 8.x Terminology and Taxonomy Changes

Applicability

Description

When upgrading from ES 7.x to ES 8.x, previously familiar terms are replaced or consolidated under a new standardized taxonomy. This structural change affects how searches, notable events, risk objects, investigations, and other components are referenced across the product. The core shift centers on grouping detection logic and its resulting output into two clearly defined categories:

•  Detections: Represents the logic used to identify threats. Detections are classified as Event-based, Finding-based, or Threat Match.
• Findings: Represents the output or evidence generated by those detections. Findings may be standard, threat-related, or intermediate in nature. 

Investigation

In ES 8.x, the investigation workflow has been streamlined to provide a more cohesive experience. Key changes include:

• Consolidation of Terms: Legacy terms such as "MC Incident" and "ES Investigation" have been unified under the single term "Investigation."
• Mission Control Analyst Queue: The legacy "Incident Review" dashboard has been replaced by the Mission Control Analyst Queue. This serves as the primary interface for viewing findings and managing investigation workflows.
• Integrated Workflows: Investigations are now managed directly within the Analyst Queue. Mission Control capabilities—previously a separate product—are now fully integrated into the ES core, providing users with automated response plans and AI-driven investigation tools.
• Investigation Details Page: The interface for viewing specific incident data has been standardized as the "Investigation Details Page" (formerly the "MC Incident Details Page").

Resolution

Key Terminology Mapping 

Most Asked Questions

Q: What happened to "Comments"?
A: In ES 8.0, we have enhanced and renamed "Comments" to "Notes." This change reflects the broader utility of these entries within the new Investigation and Finding workflows.

Action Items for Migration

Update all internal references, runbooks, and documentation to reflect the new terminology. Prioritize these high-impact changes:

1. Detections: Replace "Correlation Search," "Correlation Rule," and "Risk Rule" with "Detection (Event-based)."
2. Findings: Replace "Notable Event" and "Risk Notable" with "Finding."
3. Investigations: Update "MC Incident" and "ES Investigation" to "Investigation."
4. Interface: Replace "Incident Review" with "Mission Control Analyst Queue" and "MC Incident Details Page" with "Investigation Details Page."
5. Response: Update "Response Template" to "Response Plan."
6. Entities: Replace "Risk Object" with "Entity (in a Finding)."
7. Artifacts: Replace "Threat Artifact" with "Indicator" and "Evidence" with "Artifact."

Detailed Changes & New Concepts

• Event-Based Detections (EBD): Analyzes raw events to generate findings.
• Finding-Based Detections (FBD): Builds on existing findings to produce more refined, high-fidelity findings.
• Mission Control Analyst Queue: A unified view for managing findings and investigation workflows.
• Risk Annotations: Used to enrich detection results with context (e.g., MITRE ATT&CK techniques) for enhanced threat hunting.

Preserved Concepts (no change in definition)

• Risk Score
• Response Plan
• Adaptive Response Action
• Task, Observable
• Indicator
• Next Steps
• Assets and Identities Framework
• Assets
• Identities
• Confidence
• Impact

Deep Dive Resources

For detailed definitions of the new ES 8.x components and workflows, refer to the official documentation:

• Download: Get Started with Splunk Enterprise Security (PDF)
• Online: Splunk ES 8.x User Guide

Related Links

• Get started with Splunk Enterprise Security (Taxonomy Page)
• Splunk Enterprise Security 8.x User Guide
• Tech Talk: Splunk Enterprise Security 8.x (PDF Deck)
• How risk annotations provide additional context