PolySwarm Inside Sekoia
Look up, scan and detonate indicators from Sekoia Defend playbooks, start a playbook when a detonation finishes, and bring PolySwarm results into a Sekoia intake. Coming soon to Sekoia's integration catalog.
What the Integration Does
Search
Search Hash, Search Multiple Hashes, Search URL, Search IP Address, Search IOC and Search Metadata read what PolySwarm already holds, and spend no scanning quota.
Scan
Scan File, Scan URL, Scan Domain and Scan IP Address submit to the engines and return a fresh multi-engine verdict.
Detonate
Detonate File, Detonate URL and Detonate IP Address send artifacts to the sandbox, and Get Sandbox Report fetches what it found.
Extract IOCs
Pull indicators out of free text, ready to feed into the other actions.
Detonation Trigger
The Sandbox detonation completed trigger starts a playbook the moment a detonation finishes, so nothing waits on polling.
Intel Feed Connector
The PolySwarm Intel Feed connector ingests new PolySwarm results into a Sekoia intake on a schedule.
See It in Sekoia
Screens from a Sekoia community running the integration. Select any image to see it full size.
How Teams Use It
Alert Enrichment
Search the hashes and URLs on a Sekoia alert and branch the playbook on whether PolySwarm's engines detected them.
Detonate and Respond
Detonate an unknown file or URL, and let the detonation trigger carry the result into the next playbook step.
Continuous Intelligence
Ingest the PolySwarm intel feed into an intake so new malware results are already in Sekoia when your rules need them.
Getting Started
Install
Add PolySwarm from Sekoia's integrations, once Sekoia publishes it
Add Your Key
Create an account with your PolySwarm API key
Build Playbooks
Drag PolySwarm actions and the trigger into your playbooks
Want It Before It Ships?
Coming soon to Sekoia's catalog. Talk to us about early access in your own Sekoia community.