splunk
ZeroFox Data Connector
Splunk Cloud
Overview
Details
The ZeroFox Data Connector Add-on should be installed on your IDM or Heavy Forwarder as a way to ingest ZeroFOX alert data.
The ZeroFox Data Collector application periodically pulls data from the ZeroFox API and creates alerts within Splunk.
Release Notes
Version 3.7.2
Aug. 12, 2025
Updated the CTI botnet compromised credentials query to search against the "impacted_domain" field of the ZeroFox API
Version 3.7.1
Sept. 30, 2024
- updated splunk-sdk-python
- updated props.conf
Version 3.6.5
Aug. 8, 2024
- increased initial compromised credential poll history to 30 days
Version 3.6.0
July 8, 2024
- patch to gather older alert updates
- change timestamp field to last_modified date for ZeroFox Alerts data input
Version 3.5.4
Dec. 13, 2023
- fixed an issue with the CTI vulnerability feed not properly updating
Version 3.5.2
Oct. 5, 2023
- fix to address some CTI data inputs not pulling new data
Version 3.5.1
Sept. 22, 2023
- add back /readme/inputs.conf.spec per email from devinfo@splunk.com for Splunk Cloud compatibility
Version 3.5.0
Aug. 24, 2023
- updated initial historical alert poll
- enhanced takedown timestamp metrics
Version 3.1.0
June 27, 2023
- Deprecated the legacy "ZeroFox Threat Feed"
- updated proxy settings
Version 3.0.3
April 4, 2022
Version 3.0.0 adds support for ZeroFox Cyber Threat Intelligence Feeds.
- 3.0.3 addresses an issue with evaluating takedown log timestamps.
Version 2.4.1
Feb. 16, 2021
Data optimizations to update previous events for alert changes subsequent to initial event creation.
Version 2.3.1
Nov. 16, 2020
Data optimizations to update previous events for alert changes subsequent to initial event creation.