VMRay Analyzer Add-On

WARNING: This Add-on is deprecated and will not be updated anymore. Please switch to the new "Add-on for VMRay Platform" which can be found at https://splunkbase.splunk.com/app/5563/ VMRay Analyzer is a network sandbox, incorporating VMRay’s market-leading, dynamic analysis engine, a built-in rapid reputation service, and high-quality static analysis The VMRay Analyzer add-on for Splunk enables users to import valuable security information from VMRay Analyzer into Splunk. This includes automatically importing severity scores, file hashes and YARA rule matches. In addition, it also allows users to automatically blacklist files with high severity scores via Splunk Enterprise Security. VMRay’s Adaptive Response action allows for end-users to submit URLs from Splunk to VMRay Analyzer. VMRay will dynamically analyze the file or website connected to the URL. Analysis results are ingested back into Splunk, allowing end-users to aggregate threat intelligence associated with the URL including: IOCs, threat indicators, a high-level severity, and additional analysis information.