ProActive File Analysis Connector

Enrich the SHA-1 file hashes already in your Splunk environment with NetClean’s verified risk intelligence on human insider risk, a specialized area within insider risk. Each hash is analyzed through the ProActive File Analysis API and returns a match or no match. A match is a verified, high-confidence insider risk signal that calls for investigation.Built by Kim Andersson

Default Version 1.0.3

October 19, 2026

Compatibility

Splunk Enterprise, Splunk Cloud

Platform Version: 10.6, 10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0

Rating

(0)

Support

Developer Supported

The ProActive File Analysis Connector for Splunk enriches the SHA-1 file hashes already in your Splunk environment with NetClean’s verified risk intelligence on human insider risk, a specialized area within insider risk. The connector submits the hashes to the ProActive File Analysis API and stores the result in Splunk together with contextual metadata, ready to use in your searches, alerts, dashboards and response workflows. A match means that a file corresponds to a risk indicator verified by trusted sources. It is a verified event, not a heuristic alert, and gives your insider risk program a high-confidence insider risk signal that calls for investigation. A match describes the content, not the person, so an investigation is always needed to understand the situation. A built-in alert and dashboard are included, and the connector works with the data and tools you already run.