soar
MalwareBazaar
Splunk SOAR Cloud
Splunk Built
Overview
This app integrates with MalwareBazaar from abuse.ch to provide investigative actions
Supported Actions Version 1.0.6
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- get file info: Query the MalwareBazaar API for the corresponding hash
- get file: Fetch malware sample from MalwareBazaar and store in vault
Supported Actions Version 1.0.5
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- get file info: Query the MalwareBazaar API for the corresponding hash
- get file: Fetch malware sample from MalwareBazaar and store in vault
Supported Actions Version 1.0.4
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- get file info: Query the MalwareBazaar API for the corresponding hash
- get file: Fetch malware sample from MalwareBazaar and store in vault
Supported Actions Version 1.0.3
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- get file info: Query the MalwareBazaar API for the corresponding hash
- get file: Fetch malware sample from MalwareBazaar and store in vault
Supported Actions Version 1.0.1
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- get file info: Query the MalwareBazaar API for the corresponding hash
- get file: Fetch malware sample from MalwareBazaar and store in vault
Release Notes
Version 1.0.6
April 11, 2025
- Update Python dependencies for vulnerabilities, package updates, and platform built-in removals
- Update Python dependencies for Python 3.13 support
- Update NOTICE file with updated dependencies
- Apply pre-commit fixes
Version 1.0.5
Feb. 2, 2024
- Updated requests and certifi dependencies in order to use platform packages [PAPP-30822, PAPP-31096]
Version 1.0.4
Dec. 5, 2023
- Use the Vault API to retrieve the temp directory path, instead of assuming a constant value [PAPP-32438]
- Update
min_phantom_versionto 6.1.1 - Remove the
requestslibrary, instead using the one built into the SOAR platform
Version 1.0.3
April 7, 2022
- Certified this app under Splunk [PAPP-25202]
Version 1.0.1
Sept. 21, 2021
MalwareBazaar Release Notes - Published by Splunk Community April 19, 2021
Version 1.0.1 - Released April 19, 2021
- Initial Release with Python 3 support