PolySwarm Malware Threat Intelligence App

The PolySwarm App integrates crowd-sourced malware threat intelligence into Splunk by enriching indicators of compromise, or IOCs, with verdicts derived from multiple detection engines. It is a file reputation and hash lookup source for the SOC: the app processes MD5, SHA-1 and SHA-256 hashes, URLs, domains and IP addresses found in Splunk events, annotating them with threat scores, verdict classifications, and detection counts sourced from the PolySwarm platform. It extracts and refangs indicators from raw text fields within the search head environment, at no cost and with no API key, and submits artifacts to a cloud-based sandbox for behavioral analysis. Search results are augmented with metadata including malware family attribution, file type classification, and aggregated security vendor assessments. The app operates entirely on the search head tier and relies on a key-value store to cache verdict data, track sandbox task state, and maintain modular input checkpoints. Enrichment occurs through five specialized search commands that query the PolySwarm API: the indicators being looked up are sent to PolySwarm, and nothing else from the deployment is transmitted. A local verdict cache means a repeated indicator costs nothing, and every metered request carries an explicit ceiling. Deployments whose search heads reach the internet through a proxy can route this traffic through it, with credentials held in encrypted storage and certificate verification always enforced. Events tagged with the polyswarm:artifact source type represent threat intel pulled from the PolySwarm feed and from sandbox task results, and each one carries the artifact's MD5, SHA-1 and SHA-256 so it can be matched against events however your own sources log a digest. A saved search ships with the app, disabled by default, that correlates those indicators against your events and carries the verdict, score, family attribution and report link through to the alert, so an analyst sees why a match matters rather than only that one occurred. It reads indexed events only and consumes no PolySwarm quota. Three dashboards cover enrichment activity and entitlement, sandbox detonations, and per-indicator triage, and opening any of them is free because no panel calls PolySwarm. Four workflow actions give an analyst one-click enrichment from a search result's field menu, enrichment with attribution, direct navigation to the PolySwarm portal, and the triage page opened on that indicator.