icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading SpyCloud Application for Splunk
SHA256 checksum (spycloud-application-for-splunk_161.tgz) 99dfd701edf4e682a063e422550a2a94e875cba789bb2fa566d92cc661614d51 SHA256 checksum (spycloud-application-for-splunk_160.tgz) 440d5421bf5a1a1a1770806440a80dacf4ebdeb4a077a43da519aed0176a0930 SHA256 checksum (spycloud-application-for-splunk_150.tgz) a28ddebb3208e47f72b151177d3927a7204cfefdfe6493354a344d9bc7be6aa1
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

splunk

SpyCloud Application for Splunk

Splunk Cloud
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
SpyCloud is the market leader in protecting enterprises and their customers from online fraud, account takeover, and follow-on attacks like ransomware. We provide an early warning of compromised credentials and malware-infected users, so you can take action before the criminals do.

This application provides visualizations that allow the end user to view the SpyCloud data that is loaded by the SpyCloud Add-On for Splunk . Visualizations include a high level dashboard, a breakdown of breach records by the customer’s watchlist assets (domain, email and IP addresses,) and a summary of infected user data, including the ability to drill down into a specific machine infection to see all details for a given malware infection including sites visited, along with credential information.

Note: This Application can display information loaded by the SpyCloud Add-On for Splunk found here: https://splunkbase.splunk.com/app/6373/

The SpyCloud App for Splunk provides visualizations and alerts based on data provided by TA-SpyCloud.

Support:

  • Splunk 8.0, 8.1, 8.2

Installation:

  1. When opening the app, you will be redirected to the "Setup" view. If this doesn't happen, click Setup on the app's navigation bar.
  2. If you want e-mail alerts, enable and configure them as well. More info on that in the "Saved searches" section.
  3. Click submit and wait for setup to complete.

Setup Page:

  • Be sure to set the index to the same index used during configuration of TA-SpyCloud. If there is no data in the index you set, dashboards will not display anything.
  • The alerts "SpyCloud - Compromised Active User Alert" and "SpyCloud - Compromised Active User Alert - Admin"
    are disabled by default. If you do not have LDAP data to query against leave them disabled.
    as the alerts will never fire without the additional LDAP data. A notification in the UI is also provided.
  • If this app is installed on Splunk Cloud, a separate notification will display on the set up page informing
    the user that LDAP queries will not work on a Cloud Environment.

Features:

  • Breached Asset Types
  • Breach Exposure Timeline
  • Breach Catalog
  • Email Watchlist Assets
  • Domain Watchlist Assets

Pre-built Panels available:

The following pre-built panels are available to use on your own dashboards. By default the searches run over the last
30 days, but you can override this:
- active_employees_in_breach_data
- breach_catalog
- breach_exposure_timeline
- domain_watchlist_assets
- email_watchlist_assets
- your_breached_asset_types

Saved searches:

  • SpyCloud Breach Catalog Lookup Populator
    This search automatically maintains a lookup filled with breach catalog data.
    It is used by the app's dashboard panels.
  • SpyCloud Active User Lookup Populator
    This search maintains a lookup of active LDAP users. Does not function if LDAP is not configured
    (see the "Pulling in LDAP Data" section).
  • SpyCloud - Compromised Active User Alert
    In the case of an active user becoming compromised, this will alert that user by e-mail.
  • SpyCloud - Compromised Active User Alert - Admin
    In the case of an active user becoming compromised, this will alert the configured administrator by e-mail.

Prerequisites:

 If using the LDAP functionality of this app, Splunk Supporting Add-on for Active Directory is needed.
 Otherwise this app has no additional dependencies. This app does use the open source "requests" library,
 though it ships with Splunk so no configuration needs to be done by the end user.

Release Notes:

v. 1.5.0
- Initial release, split off of previously all-in-one app "SpyCloud"

Support:

  • Support for this app is provided through e-mail during weekday business hours (US, Central Time).
  • Please send your questions/concerns to support@spycloud.com.

Third-party software attributions/credits:

requirejs/text.js 2.0.15

(https://github.com/requirejs/text) - MIT License

Copyright jQuery Foundation and other contributors, https://jquery.org/

This software consists of voluntary contributions made by many
individuals. For exact contribution history, see the revision history
available at https://github.com/requirejs/text

The following license applies to all parts of this software except as
documented below:

====

Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:

The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Release Notes

Version 1.6.1
April 23, 2025
  • Maintenance update
Version 1.6.0
Dec. 17, 2024

Version 1.6 - December 17, 2024

v1.6
- Added UI element for "Sightings" which shows users how many times SpyCloud has seen a credential pair.
- Removed legacy setup page and workflow that is not compatible with latest versions of Splunk

Version 1.5.0
April 27, 2022

Versions 1.5.0 - April 27, 2022

v 1.5.0
Split previous standalone application into an Add-On and Application to provide for more flexible deployment models
Updated Watchlist View to include all Watchlist Items
Added Visualizations for Infected Users


Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk LLC in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.