Add README screenshots and fix Splunkbase validation

.github/workflows/splunkbase-validate.yml

@@ -31,6 +31,12 @@ jobs:
       - name: Package aviatrix-security
         run: slim package aviatrix-security -r .slim-repo
 
+      - name: Validate TA-aviatrix manifest
+        run: slim validate TA-aviatrix
+
+      - name: Validate aviatrix-security manifest
+        run: slim validate aviatrix-security
+
       - name: AppInspect TA-aviatrix
         run: splunk-appinspect inspect TA-aviatrix-*.tar.gz --mode precert --included-tags cloud
 

README.md

@@ -2,6 +2,14 @@
 
 Security visibility and analytics for **Aviatrix Distributed Cloud Firewall** in Splunk. Provides CIM-compliant field extractions and pre-built dashboards for SIEM/SOC teams.
 
+## Screenshots
+
+![Security Overview](screenshots/01_overview.png)
+
+![Traffic Analysis](screenshots/02_traffic_analysis.png)
+
+![Threat Detection](screenshots/03_threat_detection.png)
+
 ## Apps
 
 This repository contains two Splunk apps, designed to be installed together:
@@ -37,10 +45,14 @@ Pre-built dashboards for monitoring Aviatrix Cloud Firewall activity.
 - **Gateway Health** -- CPU, memory, disk, network throughput per gateway
 - **Audit Trail** -- Controller API changes, user activity, success/failure tracking
 
+## Log Ingestion
+
+These apps are designed to work with the [Aviatrix SIEM Connector](https://github.com/AviatrixSystems/aviatrix-siem-connector), which parses Aviatrix Syslog messages and posts them to Splunk via HEC (HTTP Event Collector).
+
 ## Requirements
 
 - Splunk Enterprise 8.0+ or Splunk Cloud
-- Aviatrix Controller with logging configured to send via HEC
+- [Aviatrix SIEM Connector](https://github.com/AviatrixSystems/aviatrix-siem-connector) for log ingestion
 - CIM Add-on 4.0+ (for data model acceleration)
 
 ## Installation

TA-aviatrix/app.manifest

@@ -48,7 +48,7 @@
   "incompatibleApps": null,
   "platformRequirements": {
     "splunk": {
-      "Enterprise": ">=8.0"
+      "Enterprise": ">=9.0"
     }
   },
   "supportedDeployments": [

TA-aviatrix/default/app.conf

@@ -18,4 +18,4 @@ version = 2.0.0
 
 [package]
 id = TA-aviatrix
-check_for_updates = 0
+check_for_updates = 1

aviatrix-security/app.manifest

@@ -38,19 +38,13 @@
       "uri": null
     }
   },
-  "dependencies": {
-    "TA-aviatrix": {
-      "version": ">=2.0.0",
-      "package": "TA-aviatrix",
-      "optional": false
-    }
-  },
+  "dependencies": null,
   "tasks": null,
   "inputGroups": null,
   "incompatibleApps": null,
   "platformRequirements": {
     "splunk": {
-      "Enterprise": ">=8.0"
+      "Enterprise": ">=9.0"
     }
   },
   "supportedDeployments": [

aviatrix-security/default/app.conf

@@ -19,4 +19,4 @@ version = 2.0.0
 
 [package]
 id = aviatrix-security
-check_for_updates = 0
+check_for_updates = 1