soar
Splunk Attack Analyzer Connector for Splunk SOAR
Splunk SOAR Cloud
Splunk Built
Overview
This connector integrates with the Splunk Attack Analyzer platform to reduce the friction of repetitive manual tasks typically associated with investigating threats
Supported Actions Version 1.2.0
- get job screenshots: Get screenshots for the specified job and store them in the vault
- get pdf report: Get the PDF report for a completed job
- get job forensics: Get the consolidated forensics for a completed job
- get job summary: Get a job summary for a submitted job
- list recent jobs: Get a list of recent jobs
- detonate file: Submit File for Scanning
- detonate url: Submit New URL for Scanning
- on poll: Callback action for the on_poll ingest functionality
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
Supported Actions Version 1.1.0
- get job screenshots: Get screenshots for the specified job and store them in the vault
- get pdf report: Get the PDF report for a completed job
- get job forensics: Get the consolidated forensics for a completed job
- get job summary: Get a job summary for a submitted job
- list recent jobs: Get a list of recent jobs
- detonate file: Submit File for Scanning
- detonate url: Submit New URL for Scanning
- on poll: Callback action for the on_poll ingest functionality
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
Supported Actions Version 1.0.2
- get job screenshots: Get screenshots for the specified job and store them in the vault
- get pdf report: Get the PDF report for a completed job
- get job forensics: Get the consolidated forensics for a completed job
- get job summary: Get a job summary for a submitted job
- list recent jobs: Get a list of recent jobs
- detonate file: Submit File for Scanning
- detonate url: Submit New URL for Scanning
- on poll: Callback action for the on_poll ingest functionality
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
Supported Actions Version 1.0.1
- get job screenshots: Get screenshots for the specified job and store them in the vault
- get pdf report: Get the PDF report for a completed job
- get job forensics: Get the consolidated forensics for a completed job
- get job summary: Get a job summary for a submitted job
- list recent jobs: Get a list of recent jobs
- detonate file: Submit File for Scanning
- detonate url: Submit New URL for Scanning
- on poll: Callback action for the on_poll ingest functionality
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
Release Notes
Version 1.2.0
March 1, 2024
- Added support for customizable 'app url' asset configuration parameter
- Added support for 'profile' parameter in 'detonate url' and 'detonate file' actions
Version 1.1.0
Dec. 5, 2023
- Added 'user-agent', 'custom user-agent', 'internet region', and 'archive password' parameters in 'detonate file', 'detonate url' actions.
Version 1.0.2
July 14, 2023
- Update app name [PAPP-31260]
Version 1.0.1
Feb. 28, 2023
- Initial release with python3 support [PAPP-28715]
- Note: This app is replacement of TwinWave app