PolySwarm Inside Microsoft Sentinel
Multi-engine verdicts, sandbox detonation and threat intelligence in Microsoft Sentinel, without hand-building Logic Apps against the PolySwarm API. Coming soon to the Microsoft Sentinel Content Hub.
What the Solution Does
Incident Enrichment
Playbooks look up a file hash, URL, IP address or domain and post the verdict, PolyScore, agreeing engines, malware family and, where available, sandbox and MITRE ATT&CK detail on the incident.
Native Threat Intelligence
Two data connectors bring PolySwarm indicators into Sentinel's own ThreatIntelIndicators table: your hunting results, and the PolySwarm curated feed. Microsoft's built-in matching rules run against them automatically.
Sandbox Detonation
Detonate a URL, an email attachment, a file in Azure Storage, or a file pulled from an endpoint through Defender for Endpoint, and get the verdict, family and ATT&CK techniques back on the incident.
Analytics Rules
Three rules correlate PolySwarm indicators with your own logs and raise an incident when a sandbox detonation comes back malicious.
Hunting Queries
Four saved queries join PolySwarm indicators against your log tables, by hash, IP, URL and domain.
Status Workbook
See what has arrived from each connector and rule. The workbook reads only your own workspace, never calls PolySwarm, and needs no credential.
See It in Sentinel
Screens from a live Microsoft Sentinel workspace running the solution. Select any image to see it full size.
How Teams Use It
Enrich Every Incident
Attach the enrichment playbooks to an automation rule so every new incident arrives with PolySwarm verdicts already in the comments.
Detonate From the Endpoint
Pull a suspicious file straight from a Defender for Endpoint device and detonate it, without an analyst touching the sample.
Match Against Fresh Intel
Let the curated feed and your own hunts populate threat intelligence, and let Microsoft's matching rules find them in your logs.
Getting Started
Install
Install PolySwarm from the Microsoft Sentinel Content Hub, once Microsoft publishes it
Connect
Store your PolySwarm API key in Key Vault and connect the data connectors
Automate
Turn on the analytics rules and attach the playbooks to automation rules
Want It Before It Ships?
Coming soon to the Content Hub. Talk to us about early access in your own workspace.