Splunk Integration

PolySwarm Inside Splunk

Enrich the indicators already in your Splunk data with multi-engine verdicts, detonate URLs in a cloud sandbox, and read it all from three dashboards. For Splunk Enterprise and Splunk Cloud.

What the App Does

Enrichment

polyswarmsearch adds a PolyScore, a banded verdict, a detection count and a permalink to your events. Answers are cached, so enriching the same indicator again costs no API quota.

Extraction

polyswarmextract finds indicators in any text field, refangs and types them. It runs entirely inside Splunk, with no API key and no network request.

Attribution

Optionally adds the malware families on file, PolySwarm's tags and the actor they name, so a verdict comes with context.

Sandbox Detonation

polyswarmdetonate sends a URL to the sandbox and the app writes the findings back. The Detonate alert action does the same from a scheduled or correlation search.

Three Dashboards

Overview for the account and cache, Triage for the engine-by-engine detail behind one verdict, and Sandbox Tasks for every detonation. Opening them spends no API quota.

Ready for AI Agents

Saved searches an AI agent can run through Splunk's MCP server, so an agent can ask PolySwarm the same questions an analyst does.

See It in Splunk

Screens from the PolySwarm app. Select any image to see it full size.

The PolySwarm Overview dashboard in Splunk, showing the verdict mix, the engines that answered and the API allowance — Overview: what the swarm has already told you, at no cost to your quota

A Splunk search enriching five file hashes with PolySwarm verdicts, PolyScores and detection counts — Enrich any field in any search with a verdict, PolyScore and detection count

The PolySwarm Sandbox Tasks dashboard in Splunk, showing detonation states and findings — Every URL detonation and what the sandbox found

How Teams Use It

Alert Triage

Enrich the hashes and URLs in a notable event and put confirmed malware at the top of the queue.

Phishing Investigation

Extract the defanged links from a reported email, enrich them, and detonate the unknown ones without leaving Splunk.

Automated Detonation

Attach the Detonate alert action to a correlation search so suspicious URLs are sandboxed as they arrive, under a hard cap.

Get Started in Minutes

Install

Install PolySwarm from Splunkbase, or from Apps in Splunk Cloud

Add Your Key

Paste your PolySwarm API key on the app's setup page

Enrich

Run polyswarmsearch on any field, or open the dashboards

Bring PolySwarm Into Splunk

Free on Splunkbase. Use it with your existing PolySwarm API key, or talk to us about a plan.

Get It on Splunkbase Talk to Our Team