splunk
VMRay Analyzer Add-On
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
WARNING: This Add-on is deprecated and will not be updated anymore. Please switch to the new "Add-on for VMRay Platform" which can be found at https://splunkbase.splunk.com/app/5563/
VMRay Analyzer is a network sandbox, incorporating VMRay’s market-leading, dynamic analysis engine, a built-in rapid reputation service, and high-quality static analysis The VMRay Analyzer add-on for Splunk enables users to import valuable security information from VMRay Analyzer into Splunk. This includes automatically importing severity scores, file hashes and YARA rule matches. In addition, it also allows users to automatically blacklist files with high severity scores via Splunk Enterprise Security.
VMRay’s Adaptive Response action allows for end-users to submit URLs from Splunk to VMRay Analyzer. VMRay will dynamically analyze the file or website connected to the URL. Analysis results are ingested back into Splunk, allowing end-users to aggregate threat intelligence associated with the URL including: IOCs, threat indicators, a high-level severity, and additional analysis information.
VMRay Analyzer is a network sandbox, incorporating VMRay’s market-leading, dynamic analysis engine, a built-in rapid reputation service, and high-quality static analysis The VMRay Analyzer add-on for Splunk enables users to import valuable security information from VMRay Analyzer into Splunk. This includes automatically importing severity scores, file hashes and YARA rule matches. In addition, it also allows users to automatically blacklist files with high severity scores via Splunk Enterprise Security.
VMRay’s Adaptive Response action allows for end-users to submit URLs from Splunk to VMRay Analyzer. VMRay will dynamically analyze the file or website connected to the URL. Analysis results are ingested back into Splunk, allowing end-users to aggregate threat intelligence associated with the URL including: IOCs, threat indicators, a high-level severity, and additional analysis information.
Release Notes
Version 1.2.4
Feb. 2, 2021
- Improved Setup pages to achieve compatibility with Splunk Cloud
(For VMRay Platform versions: 3.2, 3.3, 4.0)
=== Announcements ===
This will be the last version of the "VMRay Analyzer Addon". In the future, it will be replaced by two completely new Splunk apps:
- Splunk Add-on for VMRay Platform
- Splunk App for VMRay Platform
The release of the new apps is currently planned for Q2/2021. The current app will stay available for backwards compatibility but no new features will be added.
Version 1.2.3
Nov. 18, 2020
- Updated Splunklib to version 1.6.14
- Migration to Python 3 (dual-compatible with Python 2 and 3)
- Bugfixes
(For VMRay Platform Versions: 3.2, 3.3, 4.0)
Version 1.2.2
Dec. 9, 2019
- New extended import options for the new features of Analyzer 3.2
- Static analysis data
- Extracted functions strings
- Minor bugfixes
(For VMRay Analyzer Versions: 3.0, 3.1, 3.2,
and VMRay Platform Version 3.3)
Version 1.2.1
July 29, 2019
Extended import options to include new features in VMRay Analyzer 3.1
- MITRE ATT&CK (TM) techniques mapped in the analysis
- Reputation lookups for artifacts
- WHOIS lookups for artifacts
- Network activity metadata
Version 1.2.0
March 8, 2019
- New adaptive response functionality (Submit URL, Query hash)
- Extended import options
- Minor bugfixes
Version 1.1.8
Sept. 12, 2017
- Updated Splunklib to version 1.6.2
- Minor bugfixes
Version 1.1.7
Sept. 4, 2017
Added summary.json as import option.
Version 1.1.6
April 20, 2017