Default Version 1.3.0
October 15, 2026
PT Sandbox
Official Positive Technologies add-on for parsing, normalizing, searching, and visualizing PT Sandbox RFC 5424 JSON syslog events in Splunk Enterprise.Built by Sina Mohebi
Compatibility
Splunk Enterprise, Splunk Cloud
Platform Version: 10.6, 10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0
CIM Version: 8.x
Rating
0(0)
Log in to rate this app
Support
Developer Supported
The PT Sandbox Technology Add-on for Splunk ingests and parses RFC 5424 JSON syslog events generated by Positive Technologies PT Sandbox. It converts raw sandbox notifications into searchable security telemetry by extracting nested JSON fields, normalizing security attributes, and providing a dynamic dashboard for malware verdicts, analyzed objects, detections, scan activity, URLs, files, and administrative events. The app also includes a search macro for parsing previously indexed historical events.
Categories
Sandbox
Created by
Sina Mohebi
Type
app
Splunk Answers
Resources
Log in to report this app listing.