Skip to main content
Network Behavior Analytics for Splunk app icon

Network Behavior Analytics for Splunk

Hundreds of security teams use this app to process CIM compliant DNS, IP, HTTP, TLS, and DHCP events within Splunk and flag compromised hosts. Use Network Behavior Analytics for Splunk to instantly uncover DNS and ICMP tunnels, DGA traffic, C2 callbacks and implant beaconing, data exfiltration, Tor and I2P anonymizing circuit activity, cryptomining, and threats without known signatures or indicators.Built by AlphaSOC, Inc.
splunk product badge
Default Version 2.5.3

May 8, 2026

Compatibility

Splunk Enterprise, Splunk Cloud

Platform Version: 10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0

CIM Version: 8.x, 6.x, 5.x, 4.x, 3.x

Rating
5
(5)

Log in to rate this app

Support
Developer Supported

Hundreds of security teams use this app to process CIM compliant DNS, IP, HTTP, TLS, and DHCP events within Splunk and flag compromised hosts. Use Network Behavior Analytics for Splunk to instantly uncover DNS and ICMP tunnels, DGA traffic, C2 callbacks and implant beaconing, data exfiltration, Tor and I2P anonymizing circuit activity, cryptomining, and threats without known signatures or indicators.