soar
Intezer
Splunk SOAR Cloud
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Intezer connector for Splunk SOAR enables security teams to automate the analysis, detection, and response of threats by integrating Intezer's technology into their Splunk workflows
Supported Actions Version 1.1.1
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- detonate file: Analyze a file from Splunk vault with Intezer
- detonate hash: Analyze a file hash (SHA1, SHA256, or MD5) with Intezer
- get file report: Get a file analysis report based on an analysis ID or a file hash
- detonate url: Analyze a suspicious URL with Intezer
- get url report: Get a URL analysis report based on a URL analysis ID
- get alert: Get an ingested alert triage and response information using alert ID
- submit alert: Submit a new alert, including the raw alert information, to Intezer for processing
- submit suspicious email: Submit a suspicious phishing email in a raw format (.MSG or .EML) to Intezer for processing
- index file: Index the file's genes into the organizational database
- unset index file: Unset file's indexing
Supported Actions Version 1.1.0
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- detonate file: Analyze a file from Splunk vault with Intezer
- detonate hash: Analyze a file hash (SHA1, SHA256, or MD5) with Intezer
- get file report: Get a file analysis report based on an analysis ID or a file hash
- detonate url: Analyze a suspicious URL with Intezer
- get url report: Get a URL analysis report based on a URL analysis ID
- get alert: Get an ingested alert triage and response information using alert ID
- submit alert: Submit a new alert, including the raw alert information, to Intezer for processing
- submit suspicious email: Submit a suspicious phishing email in a raw format (.MSG or .EML) to Intezer for processing
- index file: Index the file's genes into the organizational database
- unset index file: Unset file's indexing
Supported Actions Version 1.0.1
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- detonate file: Analyze a file from Splunk vault with Intezer
- detonate hash: Analyze a file hash (SHA1, SHA256, or MD5) with Intezer
- get file report: Get a file analysis report based on an analysis ID or a file hash
- detonate url: Analyze a suspicious URL with Intezer
- get url report: Get a URL analysis report based on a URL analysis ID
- get alert: Get an ingested alert triage and response information using alert ID
- index file: Index the file's genes into the organizational database
- unset index file: Unset file's indexing
Release Notes
Version 1.1.1
April 28, 2025
- Update Python dependencies for vulnerabilities, package updates, and platform built-in removals
- Update Python dependencies for Python 3.13 support
- Update NOTICE file with updated dependencies
- Apply pre-commit fixes
Version 1.1.0
Aug. 14, 2023
- Added support for the below actions:
- submit alert
- submit suspicious email
- Option to connect between file to alert id in 'detonate file' action
Version 1.0.1
Aug. 10, 2023
- Initial release of app with the support of the below actions:
- test connectivity
- detonate file
- detonate hash
- get file report
- detonate url
- get url report
- get alert
- index file
- unset index file