This message was deleted.

No experience with Splunk, but I see no reason why it couldn't go into an App layer. As for LAPS, I'd probably put that in the Platform layer myself.

You should always start with an App Layer and only use the OS or Platform layer if it wont work assuming its not something that is part of the OS. I have not personally done LAPS but normally we recommend adding Microsoft infrastructure components to the OS layer. But I am not sure what the implications would be for the packaging machines which are non domain joined. Also i don't know if the machine you install it on has to be domain joined. From several blogs it looks like you might be OK with packaging machines and that you would need a script to change the passwords on non persistent VDAs. This is what I was reviewing https://www.davidmaiolo.com/portfolio-item/integrating-laps-with-citrix-vdi/ and https://mybrokencomputer.net/t/citrix-machine-creation-services-mcs-and-laps-local-admin-password-solution/43

We have Splunk and LAPS installed in 2 different App Layers, no issues as far as I know. Both are included in the image and not deployed as elastic layers.

Fantastic, thank you all!

Laps and Splunk go in an app layer. If you want you can combine tools like this into a single layer.