PolySwarm Malware Reputation and Sandbox

PolySwarm Malware Reputation and Sandbox integrates crowd-sourced malware threat intelligence into Splunk by enriching indicators of compromise, or IOCs, with verdicts derived from multiple detection engines. It is a file reputation and hash lookup source for the SOC: the app processes MD5, SHA-1 and SHA-256 hashes, URLs, domains and IP addresses found in Splunk events, annotating them with verdicts, detection counts and malware family attribution sourced from the PolySwarm platform. It extracts and refangs indicators from raw text fields within the search head environment, at no cost and with no API key, and submits URLs to a cloud-based sandbox for behavioral analysis. The app operates entirely on the search head tier and relies on a key-value store to cache verdict data, track sandbox task state, and maintain modular input checkpoints. Enrichment occurs through five specialized search commands that query the PolySwarm API: the indicators being looked up are sent to PolySwarm, and nothing else from the deployment is transmitted. A local verdict cache means a repeated indicator costs nothing, and every metered request carries an explicit ceiling. Search heads that reach the internet through a proxy can route this traffic through it, with credentials held in encrypted storage and certificate verification on the PolySwarm connection always enforced. Events tagged with the polyswarm:artifact source type represent threat intel pulled from the PolySwarm feed and from sandbox task results, and each one carries the artifact's MD5, SHA-1 and SHA-256 so it can be matched against events however your own sources log a digest. Four saved searches ship and all four ship disabled. PolySwarm Indicator Match correlates the indexed feed against your own events and carries the verdict, detection counts, family attribution and report link through to the alert, so an analyst sees why a match matters rather than only that one occurred; it reads indexed events only and spends no PolySwarm quota. The other three are for an AI agent reaching Splunk through an MCP server: PolySwarm Indicator Lookup answers for one indicator, the same search with Attribution adds family and actor, and PolySwarm Quota Remaining reports what is left without spending indicator quota. Two of those three spend a metered request per run, which is why enabling them is a deliberate administrative act. Every answer carries a status field reading answered, not_found, refused or error, so an automated caller never has to read English to learn whether a lookup failed or the platform holds no record. Three dashboards cover enrichment activity and entitlement, sandbox detonations, and per-indicator triage. Opening any of them spends nothing. Four workflow actions give an analyst one-click enrichment from a search result's field menu, enrichment with attribution, navigation to the PolySwarm portal, and the triage page opened on that indicator.