In short: Splunk Attack Analyzer is an automated malware and phishing analysis service from Splunk, a Cisco company. It detonates suspicious files and URLs in isolated environments, follows multi-stage attack chains, renders a verdict with forensic evidence, and integrates with Splunk SOAR and Splunk Enterprise Security, where it powers Automated Threat Analysis in the Premier edition.
What is Splunk Attack Analyzer?
Phishing and malware analysis is slow when done by hand. An analyst has to open a link in a safe browser, follow redirects, solve a fake CAPTCHA, download an archive, extract the file inside, run it in a sandbox and record what happened at each stage. Splunk Attack Analyzer automates that chain.
It came from TwinWave Security, a threat analysis start-up Splunk acquired in November 2022. Today it is a standalone Splunk product and the engine behind Automated Threat Analysis in Splunk Enterprise Security Premier.
How it works
- Follows the full attack chain: it clicks links, follows redirects, extracts attachments and embedded files, and opens archives, so multi-stage attacks are analysed end to end without manual steps
- Isolated, non-attributable environments: analysis runs away from your network and does not reveal your organisation to the attacker's infrastructure
- Credential phishing detection: it identifies pages built to harvest passwords, not just malware
- Verdicts and evidence: each submission gets a verdict, with a point-in-time archive of artefacts and technical detail an analyst can review
- AI-assisted summaries: an AI malware reversing agent summarises threat behaviour, recommends a disposition and breaks down malicious scripts step by step
- Talos intelligence: Cisco Talos data helps detect short-lived threats and infrastructure
- API: a full API lets you feed results into other platforms
Attack Analyzer with SOAR and Enterprise Security
| Route | What you get |
|---|---|
| Attack Analyzer with Splunk SOAR | Playbooks send files and URLs for analysis and act on the verdict automatically, without you building detonation logic yourself |
| ES 8.5 and later phishing investigations | Threat analysis inside ES: static analysis of email bodies and metadata, resource trees, screenshots and verdicts in the investigation view |
| Automated Threat Analysis in ES Premier | Native capability, powered by Attack Analyzer, built into the Premier edition where available |
| Standalone Attack Analyzer | Analyst-driven submissions and API use, with or without other Splunk products |
If you are buying ES Premier, check whether Automated Threat Analysis already covers your phishing use case before buying Attack Analyzer separately. If you use another SIEM, or want analyst-driven submissions and API access, the standalone product is the route.
Attack Analyzer vs Cisco Secure Malware Analytics
Cisco now owns two analysis engines, and they solve related but different problems:
| Splunk Attack Analyzer | Cisco Secure Malware Analytics | |
|---|---|---|
| Former name | TwinWave | Threat Grid |
| Focus | Automated, end-to-end phishing and malware chain analysis for SOC workflows | Dynamic file and URL sandboxing with behavioural indicators and threat scores |
| Where it is built in | Splunk SOAR and Splunk ES Premier (Automated Threat Analysis) | Secure Endpoint, Secure Email, Secure Firewall and Secure Access |
| Delivery | Cloud service | Cloud service or on-premises appliance |
| Best fit | Splunk-centred SOCs automating phishing triage | Cisco Secure estates wanting shared sandboxing across products |
Read more on Cisco Secure Malware Analytics.
A typical automated phishing workflow
- A user reports a suspicious email with the report button in their mail client, or a detection in Secure Email Threat Defense or another email tool raises an alert
- Splunk SOAR or Splunk ES picks up the report and extracts the links and attachments
- Attack Analyzer follows each link and opens each file in an isolated environment, recording redirects, downloads and any credential-harvesting page
- The verdict and evidence return to the case, enriched with Talos intelligence
- If the message is malicious, a playbook searches for other recipients, removes the message from their mailboxes and blocks the sender, domains and URLs, with analyst approval where you want it
- If it is clean, the case is closed and the reporter can be told quickly, which encourages people to keep reporting
The same pattern works for suspicious files raised by endpoint or web controls.
Who it suits
- SOC teams handling a steady stream of user-reported phishing, where manual detonation is a bottleneck
- Splunk SOAR users who want reliable analysis verdicts to drive automated response
- Splunk ES customers comparing Premier's Automated Threat Analysis with the standalone product
- Organisations that want to show users that reporting phishing is worthwhile, by closing reports quickly with evidence
Technology is half of phishing defence. Pair it with phishing awareness training so staff report suspicious messages in the first place.
How we help
We look at how your team handles phishing and malware alerts today, recommend whether ES Premier, standalone Attack Analyzer or Cisco Secure Malware Analytics fits best, and connect the result to your SOAR playbooks and mailbox reporting. Ask us for a quote. Contact us using the form.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Splunk Attack Analyzer?
It is an automated malware and phishing analysis service from Splunk. It detonates files and URLs in isolated environments, follows the full attack chain and returns a verdict with forensic evidence.
Is Splunk Attack Analyzer the same as TwinWave?
Yes. Splunk acquired TwinWave Security in November 2022 and its product became Splunk Attack Analyzer.
Is Attack Analyzer included in Splunk Enterprise Security?
Splunk ES Premier includes Automated Threat Analysis, powered by Splunk Attack Analyzer, where available. ES 8.5 and later also integrate Attack Analyzer threat analysis into phishing investigations. The standalone product is sold separately.
What is the difference between Splunk Attack Analyzer and Cisco Secure Malware Analytics?
Attack Analyzer focuses on automated, end-to-end analysis of phishing and malware chains for Splunk SOC workflows. Secure Malware Analytics, formerly Threat Grid, is a sandbox built into Cisco Secure products and is also available as an on-premises appliance.