SPLUNK PHANTOM

Apps & Integrations

LADS

This app supports containment actions like 'block ip' or 'unblock ip' using the A10 Lightning Application Delivery System (LADS).

AbuseIPDB

This app integrates with AbuseIPDB to perform investigative actions

Aella Data Starlight

This app integrates with an Aella Data installation to implement ingestion and investigative actions

Alexa

Connects to Alexa Web Information Services for lookup url.

ThreatStream

Integrates a variety of reputation and lookup actions from the Anomali ThreatStream threat intelligence platform.

Kafka

This app implements ingesting and sending data on the Apache Kafka messaging system

Arbor Networks APS

This app integrates with Arbor Networks APS to execute containment and corrective actions

HipChat

This app integrates with HipChat to support different generic and investigative actions

Jira

This app supports a variety of ticket management actions on JIRA

AlertFind

Integrate with AlertFind to enable notification actions

AWS Athena

This app supports investigative actions on AWS Athena

AWS Community App

App Review - AWS App by GE

AWS Community App 2

AWS Community App - BAH

AWS IAM

This app integrates with Amazon Web Services Identity Access Management (AWS IAM) to support various containment, corrective and investigate actions

AWS Lambda

This app integrates with AWS Lambda to perform lambda functions

AWS S3

This app integrates with AWS S3 to perform investigative actions

Axonius

This app integrates with the Axonius Cybersecurity Asset Management Platform to enrich asset data for investigations

Cyber Triage

Initiates a remote endpoint collection to support an investigation using Cyber Triage

Risk Fabric

This app supports retrieving entity risk scores from Risk Fabric

Request Tracker

This app allows ticket management on Request Tracker by implementing investigative and manipulative actions on the tickets

RemedyForce

This app allows ticket management on RemedyForce by implementing actions like create ticket and update ticket.

Remedy

This app supports ticket management functions on incidents in BMC Remedy.

CB Defense

This app integrates with an instance of Carbon Black defense to run investigative actions

CB Response

This app supports executing various endpoint-based investigative and containment actions on Carbon Black Response

CB Protection

This app supports various investigative and containment actions on Carbon Black Enterprise Protection (formerly Bit9)

Censys

This app implements investigative actions to get information from the censys search engine

Certly

Implements url reputation action by querying the Certly web API

Firewall

This app supports a variety of endpoint and network based containment actions on Check Point Firewall

Cherwell

This app implements various ticketing actions on Cherwell

Cisco ASA

This app supports containment actions like 'block ip' in addition to investigative actions like 'get config' and 'get version' on a Cisco ASA device.

Cisco Catalyst

This app supports containment actions like 'set system vlan' in addition to investigative actions like 'get config' and 'get version' on a Cisco Catalyst switch.

Cisco ESA

This app supports investigation on the Cisco Email Security Appliance (ESA) device.

Cisco FireAMP

This app allows users to connect to FireAMP with actions such as list endpoints, hunt url, and hunt ip.

Cisco Firepower

This app interfaces with Cisco Firepower devices to add or remove IPs or networks to a Firepower Network Group Object, which is configured with an ACL

Cisco FireSIGHT

This app implements investigative actions on the FireSIGHT device

Cisco ISE

This app implements investigative and containment actions like 'quarantine device', 'terminate session' and 'list sessions' etc. on a Cisco ISE device.

Cisco Router BGP RTBH

This app interfaces with Cisco IOS-XE devices to create a blackhole for configured IPs or networks in Cisco BGP networks.

Cisco Spark

Integrate with Cisco Spark to implement investigative actions

Cisco Tetration

This app supports variety of investigative actions on Cisco Tetration Analytics

Cisco Umbrella

This app allows management of a domain list on the OpenDNS Umbrella Security platform by implementing actions like 'block domain', 'unblock domain' and 'list blocked domains'.

Duo Security

Use Duo Auth API to authenticate actions.

Meraki

This app interfaces with the Cisco Meraki cloud managed devices. The search string specified is used to match a value in the client MAC address or description field. The default dashboard URL is dashboard.meraki.com. The API Key is generated in your account profile. An account with read only privileges is acceptable.

PhishTank Phish Verification System

This app implements URL investigative capabilities utilizing PhishTank

ClickSend

This app integrates with ClickSend to send SMS messages

CloudPassage

This app supports a variety of investigative actions on CloudPassage Halo

Code42

This app integrates with Code42 to execute various containment, corrective and investigative actions

Cofense Intelligence

This App integrates with PhishMe Intelligence to provide various hunting and reporting actions in addition to threat ingestion

Critical Stack

This app integrates with the CriticalStack feed to implement investigative actions

CRITs

This App supports various investigative actions on CRITs

VirusTotal Threat Intelligence

This app integrates with the VirusTotal cloud to implement investigative and reputation actions

Crowdstrike Streaming

This app integrates with CrowdStrike security services to implement ingestion of endpoint security data

Crowdstrike Falcon Host

This app allows you to manage indicators of compromise (IOC) and investigate your endpoints on the Falcon Host API

Cuckoo

This app supports executing various investigative actions on the Cuckoo sandbox

EDR

This app integrates with Cybereason to perform investigative, contain and corrective actions

Cylance Protect

This app supports various investigative, containment, and corrective actions on CylancePROTECT

MazeRunner

MazeRunner App

Cyware

Implements event reporting on the Cyware platform

Digital Shadows

This app integrates with Digital Shadows SearchLight to ingest and investigate credentials found in data breaches

DomainTools

Use DomainTools to query various current and historical data regarding domain names, domain registration and IPs

DomainTools Iris

Use the DomainTools Iris Investigate API to profile domain names, get risk scores, and find connected domains that share the same Whois details, web hosting profiles, SSL certificates, and more

DShield

Implements lookup ip action by querying the DShield web API

EclecticIQ

TIP integration

Elasticsearch

This app integrates with an Elasticsearch installation to implement ingestion and investigative actions

Empire

This app supports a variety of actions to interact with the REST API of Empire - https://github.com/powershellempire/empire

Endace

App integrates with the Endace Packet Capture device to implement investigative actions

Endgame

This app integrates with Endgame to execute investigative and corrective actions

Cymon

Queries Cymon for IP, URL, domain, and blacklist information.

Extrahop

This app integrates with the ExtraHop platform to perform investigative actions based on real-time network data

BigIP

This app supports containment actions like 'block ip' or 'unblock ip' on an F5 BIG-IP appliance. There must be a firewall policy (Security››Network Firewall:Policies) configured on the BIG-IP and the name of the policy must be specified in the Action Parameters. The rule name can be the source IP address appended to a keyword string, e.g. 'Phantom' + ip

DNSDB

This app supports investigative DNS lookup actions on DNSDB

FireEye HX

FireEye HX Endpoint Security

FireEye CM

Leverage the FireEye Web Services API to download malware objects.

Floodlight

Implements command and control for the Floodlight SDN controller

Forcepoint Next Generation Firewall

This app integrates with Forcepoint Firewall

Forescout NAC

This app implements various network access control actions for ForeScout

Fortisiem

This app implements powerful security, performance, compliance, information and event management. It provides rapid detection and remediation of security events

FortiGate

This app supports a variety of containment and investigative actions on the FortiGate Firewall.

BerryIO

This app supports actions for APIs on the BerryIO project for the Raspberry Pi, such as GPIO status, get and set.

Timer

This app will generate an empty event which can be used to kick off a playbook at scheduled intervals

NetBios

This app implements various investigative actions using the NetBIOS protocol

RSS

Ingest IOCs from an RSS Feed

Whois RDAP

This App implements the investigative action 'whois ip' using RDAP.

Whois

This App implements investigative actions that query the whois database

SSH

This app supports executing various endpoint-based investigative and containment actions on an SSH endpoint

SMTP

This app provides the ability to send email using SMTP

REST Data Source

This app implements custom REST handlers for external implementations to push ingest data such as events and artifacts into Phantom

NMAP

This app integrates with NMAP in order to provide detailed network information

IMAP

This app supports email ingestion and various investigative actions over IMAP

HTTP

This App facilitates making HTTP requests as actions

Generator

This app generates ingested sample data

DNS

This app implements investigative actions that return DNS Records for the object queried

git

This app integrates with git and supports common git actions

GigaVUE FM

This app leverages APIs from GigaVUE-FM 5.1 and above to perform investigative and corrective actions

Big Query

This app allows running investigative actions against Google BigQuery

GSuite

This app allows various file manipulation actions to be performed on Google Drive

GRR Rapid Response

This app implements various actions from the GRR API

Safe Browsing

This app Integrate with Google Safe Browsing to execute reputation-based actions

GSuite for Gmail

Integrates with G Suite for various investigative and containment actions

Greynoise

This app implements investigate actions to fetch IP details using Greynoise API

HackerTarget

This app supports executing investigative actions like 'traceroute', 'ping', 'whois ip', and 'whois domain' to analyze a host.

TheHive

This app integrates with an instance of TheHive to perform ticketing actions

HoneyDB

Performs investigative actions on the HoneyDB service

ArcSight ESM

This app implements creating and updating cases on ArcSight

Watson

Leverage IBM Watson for language translation

XForce

This app implements various investigative actions on the IBM XForce device

QRadar

This app supports investigative actions like 'get events' and 'get flows' on an IBM QRadar device. It also supports ingesting Incidents and Events into Phantom containers and artifacts

BigFix

This app supports several investigative actions on IBM Big Fix

Maker Channel

IFTTT Maker Channel connector

SecureSphere WAF

This app implements containment actions by integrating with the SecureServer Device

InfluxDB

This app implements various investigative actions against an InfluxDB instance

DDI

This app supports various containment and investigative actions on Infoblox Grid Manager.

Interset

This app allows integration with the Interset analytics platform by implementing contain and investigate actions pertaining to importance and risk details respectively

Cyber Intelligence

This app integrates with Intsights Cyber Intelligence.

Intsights

This app integrates with Intsights Cyber Intelligence.

ipstack

Integrates with ipstack to implement investigative actions

ThreatScape

This app integrates with iSight Partners' ThreatScape product. It implements the ingest action to pull campaign reports and parse them into containers with all the IOCs represented as artifacts. Investigative actions like 'hunt domain', 'hunt ip' etc. are also supported.

isitPhishing

This app implements investigative actions on the isitPhishing service.

ITSM

This app integrates with Ivanti ITSM to provide ingestion and several ticketing actions

Jask

This app implements ingest action for fetching alerts on JASK ASOC Platform

Joe Sandbox

This app supports executing investigative actions to analyze files and URLs on Joe Sandbox

Juniper Networks SRX

This app implements various containment actions like 'block ip' and 'block application' in addition to investigative actions like 'list applications' on a Juniper SRX device. Uses port 830 by default if no port is set.

Juniper Networks Cyphort

This app supports executing investigative actions like 'detonate file' to analyze executables on the Cyphort sandbox.

Kenna Security

This app integrates with Kenna Security to implement various investigative actions

KnowThyCustomer

This app integrates with the KnowThyCustomer service to implement investigative actions

Koodous Collaborative Malware Research Platform

This app integrates with Koodous to analyze APK files

Lastline Detonator

This app supports executing investigative actions to analyze executables and URLs on the online Lastline sandbox

LogRhythym SIEM

This app supports ingestion and several investigative actions on LogRhythm SIEM

MAC Address Vendor API Lookup

This app interfaces with the Cisco Meraki cloud managed devices. The search string specified is used to match a value in the client MAC address or description field. The default dashboard URL is dashboard.meraki.com. The API Key is generated in your account profile. An account with read only privileges is acceptable.

MalShare Public Malware Repository

This app integrates with MalShare to provide several investigative actions

Malware Domain List

This app retrieves IOC reputation from Malware Domain List

MalwareBytes Cloud Endpoint Security

This app integrates with the Malwarebytes Cloud platform to perform prevention, detection, remediation, and forensics endpoint management tasks

Malwr Online Analysis and Research Platform

This app implements investigative actions on the Malwr cloud based sandbox.

Mattermost Chat Service

This app integrates with Mattermost to support various investigative actions

GeoIP2 IP Location Database

This app provides ip geolocation with the included MaxMind database.

TrustedSource

McAfee TrustedSource provides an online service that enables you to check website categorization and risk levels

Network Security Manager (NSM)

This app supports multiple containment actions on the McAfee NSM

Enteprise Security Manager (ESM)

This app ingests data from a McAfee ESM device. Each event is parsed into a container and various event characteristics like the Rule, Signature and actionName are ingested into the event artifact.

ePolicy Orchestrator (ePO)

This app implements various endpoint based investigative and containment actions by integrating with McAfee ePO

OpenDXL

Push Notfications over McAfee OpenDXL

Advanced Threat Defense (ATD)

This app supports executing investigative actions like 'detonate file' to analyze executables on the McAfee ATD appliance

Microsoft SQL Server

This app supports investigative actions against a Microsoft SQL Server

Windows Remote Management

This app integrates with the Windows Remote Management service to execute various actions

Microsoft Sharepoint

Provides various interactions with Microsoft SharePoint sites

Office 365

This app ingests emails from a mailbox in addition to supporting various investigative and containment actions on an Office 365 service

Windows Server - WMI

This App uses the WMI WQL to implement investigative actions that are executed on a Windows endpoint

Windows Server - Agent

Windows Server - LDAP

This app implements various actions that can be carried out on an AD server

Office 365

Connects to Office 365 using the MS Graph API

Exchange Server

This app performs email ingestion, investigative and containment actions on an on-premise Exchange installation

System Center Operations Manager

This app integrates with Microsoft System Center Operations Manager (SCOM) to execute investigative actions

System Center Configuration Manager

This app integrates with Microsoft System Center Configuration Manager (SCCM) to execute investigative and generic actions

Malware Information Sharing Platform (MISP)

Take action with Malware Information Sharing Platform

PassiveDNS

This app integrates with the Mnemonic Passive DNS API to implement investigative actions

MobileIron

This app allows endpoint management on MobileIron by implementing actions such as 'list devices', 'lock devices' and 'unlock device'.

MongoDB

This app supports CRUD operations in a MongoDB database

MxToolBox

This app implements investigative actions on domains and IPs.

Myip.ms Whois IP Service

This app integrates with the Myip.ms service to implement investigative actions

Soltra Edge Cyber Threat Communications Platform

This App acts as a STIX client and implements the ingest action to pull data from a Soltra Edge device to create containers and artifacts.

Netskope Cloud Access Security Broker

This app integrates with the Netskope to execute various investigative and polling actions

Neutrino API Developer Power Tools

Detect potentially malicious or dangerous IP addresses by integrating with Neutrino API

Okta Identity and Access Management

This app supports various identity management actions on Okta

OpenStack Software Platform

This app interfaces with OpenStack to take an IP, and suspend the associated instance. It is intended to be coupled in a playbook with a ticketing system to log why the instance was suspended

Metadefender Advanced Threat Prevention

App that connects to OPSWAT Metadefender for actions like ip reputation and file reputation.

MySQL Database Server

This app supports investigative actions against a MySQL database

OSXCollector Forensics and Analysis

Runs OSXCollector on an endpoint running OS X

PagerDuty

This app integrates with PagerDuty to implement investigative and ticketing actions

WildFire Malware Analysis

This app supports file detonation for forensic file analysis on the Palo Alto Networks WildFire sandbox

AutoFocus Threat Intelligence

This app implements hunting and reporting actions on the AutoFocus threat intelligence service.

Panorama Network Security Management

This app integrates with the Palo Alto Networks Panorama product to support several containment and investigative actions.

Next-Generation Firewall

This app integrates with the Palo Alto Networks Firewall to support containment actions like 'block url', 'block application' and 'block ip' in addition to investigative actions like 'list applications'.

Falcon Sandbox

This app integrates with Falcon Sandbox Services to provide investigative actions

Message Parser

Integrate with Slack to post messages and attachments to channels

Phantom App for Kafka

Integrate with Slack to post messages and attachments to channels

Phantom API

This App exposes various Phantom APIs as actions

PhishLabs Casetracker Portal

This app implements investigative actions on the PhishLabs Casetracker Portal

TiFRONT Cloud Security Switch

This app supports containment actions like 'block ip' and 'unblock ip' on a TiFRONT device.

Pipl People Search

This app integrates with Pipl to perform an investigative action

PostgreSQL Database Server

This app supports investigative actions against a PostgreSQL database

Targeted Attack Protection (TAP)

This App integrates with Proofpoint to implement ingestion and investigative actions

Network Detection and Response (NDR)

This app integrates with the ProtectWise cloud platform to implement ingestion and investigative actions

SSL Labs Assessment API

This app supports executing investigative actions to analyze a host

InsightVM Vulnerability Management

This app integrates with Rapid7 InsightVM (formerly Nexpose) to ingest scan data

Recorded Future Threat Intelligence

Recorded Future

Ansible Tower

This app launches a job template on Ansible Tower 3.0. The job template can be specified by its name or numeric value. Ansible extra vars can be specified to the playbook. After a successful launch, the app waits for the job to complete to return the job status, up to the specified dead interval iterations. With Ansible Tower 3.0 if extra variables need be passed, the job template must have 'Prompt on launch' checked.

RedLock

This app integrates with RedLock and ingests new alerts

TitaniumCloud File Reputation

This app implements investigative actions on the ReversingLabs reputation service

A1000 Malware Analysis

This app integrates with the ReversingLabs A1000 Advanced Malware Analysis Appliance to implement investigative actions

TitaniumScale Malware Analysis

This app integrates with ReversingLabs TiScale Enterprise Scale File Visibility platform to automate analysis and investigative actions for file samples

RIPE Abuse Intelligence

This app integrates with RIPE to support investigative actions

Security Analytics

This App supports ingestion and investigative actions on RSA Security Analytics

Archer

This app implements ticket management actions on RSA Archer GRC.

NetWitness Logs and Packets

This app supports investigative actions to collect log and packet captures from RSA NetWitness Logs and Packets.

NetWitness Endpoint

This app supports executing various endpoint-based investigative and containment actions on RSA NetWitness Endpoint

PassiveTotal

This app implements investigative actions by integrating with the PassiveTotal cloud reputation service

Screenshot Machine

This app integrates with the Screenshot Machine service

Security Onion

This app integrates with the ELSA service included in the Security Onion security distribution

SentinelOne

This app integrates with the SentinelOne platform to perform prevention, detection, remediation, and forensic endpoint management tasks

ServiceNow Platform

This app provides ServiceNow integration for tickets and records

SocialNet Social Media Forensics and Investigations

This app supports investigative actions on the SocialNet cloud investigation API

Shodan Search Engine

This app implements investigative actions like query ip and query domain to get information from the shodan search engine.

Slack Collaboration Platform

Integrate with Slack to post messages and attachments to channels

Infotrace Mark II Endpoint Detection and Response

This app supports containment actions on Soliton Mark II Server

Firewall

Manipulate SonicWALL firewall via ECLI

SQLite Database Server

This app supports investigative actions against a local SQLite database

Sumo Logic Log Management and Analytics

This app integrates with the Sumo Logic cloud platform to implement investigative actions

Symantec Messaging Gateway

This app integrates with an instance of Symantec Messaging Gateway to perform containment and corrective actions

Symantec Endpoint Protection 14

Integrate with Symantec Endpoint Protection 14 to execute investigative, containment and corrective actions

Symantec Data Loss Prevention (DLP)

This app ingests data from a Symantec Data Loss Prevention installation

Symantec Content Analysis Software (CAS)

This app supports file investigation on the Symantec Content Analysis System

Malware Analysis Service

Integrate with Malware Analysis Service (MAS) to execute actions like detonate file and get report

DeepSight

This app supports hunting and a variety of investigative actions, in addition to report ingestion, from the Symantec DeepSight Intelligence cyber security service.

Symantec Advanced Threat Protection (ATP)

This app integrates with a Symantec ATP (Advanced Threat Protection) device to implement ingestion, investigative and containment actions

Tala

This app implements various endpoint actions using Tala

Tanium Endpoint Security

This app supports investigative and containment actions on Tanium

Tenable.sc (SecurityCenter)

This app integrates with Tenable's SecurityCenter to provide endpoint-based investigative actions.

Nessus Vulnerability Assessment

This app integrates with Tenable's Nessus scanner to provide endpoint-based investigative actions

ThreatConnect Threat Intelligence Platform

This app integrates with the ThreatConnect platform to provide various hunting actions in addition to threat ingestion.

ThreatCrowd Threat Intelligence

This app provides free investigative actions such as file reputation, lookup domain, lookup ip, and lookup email.

ThreatMiner Threat Intelligence

This app integrates with the ThreatMiner API to provide investigation activities

ThreatQ Threat Intelligence Platform

Integrates a variety of ThreatQ services into Phantom.

Tor Network

This app implements investigative actions to query info about the Tor network

TruSTAR Intelligence Management Platform

This App integrates with TruSTAR to provide various hunting and reporting actions

SecureTrack Firewall Policy Managment

This app supports investigative actions on Tufin SecureTrack

Twilio Cloud Communications Platform

This app integrates with Twilio to send messages

unshorten.me URL Expansion Service

This app integrates with the unshorten.me service to expand shortened URLs

urlscan.io website scanner

This app supports investigative actions on urlscan.io

URLVoid Website Reputation Service

This app supports executing investigative and reputation actions on the URLVoid service

Vectra Active Enforcement

This app ingests data from the Vectra Active Enforcement device

Verodin Security Instrumentation Platform

Phantom app for Verodin

VictorOps DevOps Incident Management and IT Alerting

This app implements various investigative actions using VictorOps

VMRay Malware Analysis Tool

Connector for VMRay Analyzer

vSphere Virtualization Management Software

This app implements investigative, containment and VM management actions on VMware ESXi or vCenter server

NSX Network Virtualization and Security

This app implements investigative and management action on VMware NSX, Network Virtualization and Security Platform

Volatility Open Source Memory Forensics

This app implements a variety of investigative actions on the Volatility forensics analysis platform.

WiGLE Wireless Network Intelligence

This app integrates with the WiGLE service to implement investigative actions

xMatters IT Event Management

This app integrates with xMatters to retrieve information about events and users

Zendesk Customer Service Software

This App allows for ticket management on Zendesk

Zetalytics Passive DNS

This App implements investigative actions that query the ZETAlytics security feed and APIs

Zscaler Security System

This app implements containment and investigative actions on Zscaler