Remove SplunkHecMetrics destination schema and change hist signals endpoint to POST
BreakingBreaking change
This is a breaking change — integrations that rely on the affected behaviour will need updates before the change rolls out.
What changed
Two breaking changes in this diff:
- The
ObservabilityPipelineSplunkHecMetricsDestinationschema (and its sub-schemasObservabilityPipelineSplunkHecMetricsDestinationCompressionandObservabilityPipelineSplunkHecMetricsDestinationType) have been entirely removed from the spec, and the$refto this schema has been removed from theObservabilityPipelineConfigDestinationunion. Any client configuring asplunk_hec_metricspipeline destination will no longer have a valid schema definition. - The
/api/v2/siem-historical-detections/histsignals/searchendpoint has changed fromGETtoPOST. Clients calling this endpoint withGETwill receive an error.