When comparing the Windows 5.x TA and the Windows 8.x TA we’ve come a long way. Visually you’ll notice differences in how your data is presented but on the backend there’s much more.
Changes
There’s a laundry list of adjustments and improvements between the major version changes. Without listing everything here’s a small list of items worth noting.
- Switching from non-xml format to xml format.
- Joining the AD, and DNS add-ons into a single manageable input that can be broken out for job segregation later.
- Better supporting functionality for data models. (The items that help field ES).
- Supporting Python 3.0.
| Version 5.0 | Version 8.0 |
What does this mean?
In terms of manageability we have a few more benefits then before. We now have a single add-on that we can trouble shoot (and a single add-on that splunk can manage), modify, etc.. as needed. Rather then going through the back end and accessing 3 different add-ons.
Data models are largely useful for many reasons premium apps, search queries, etc… A single data source can have upwards of thousands of events. Not all common and some very unique. With each version of the Windows TA comes better definitions that supports greater functionality which in turn improves our analytical work.
Python three is a much larger change that’s worth noting. On January 1st, of 2020 python version 2 is officially deprecated. In efforts to foresee 3rd parties switching their own development to python 3. So has come the request support that same change within TAs. The effort is largely based to support the different/newer version of Python as time passes and the old ways exit life.
Conclusion
With each change comes a small push back. There’s a new processes we’re not willing to learn, more knowledge we’ll have to comprehend, and more. At the same time it’s worth noting that technology is also ever changing, growing, improving. As with the TA versions. Upgrading/modifying existing applications to-date might break some processes but ultimately it’s for improvement.
