Directory/Categories/Security/Splunk Attack Analyzer

Splunk Attack Analyzer

GoodBotVerifiedBOT

Splunk Attack Analyzer (formerly known as TwinWave), visits URLs submitted by customers using a headless Chrome browser. DOM (Document Object Model), HAR (HTTP Archive), and other relevant data from these visits are analyzed to determine if the page is hosting malicious content. Operated by Splunk.

Operator website ↗

GoodBot

Assessment

Security

What is Splunk Attack Analyzer?

Splunk Attack Analyzer is a web crawler operated by Splunk. Splunk Attack Analyzer (formerly known as TwinWave), visits URLs submitted by customers using a headless Chrome browser. DOM (Document Object Model), HAR (HTTP Archive), and other relevant data from these visits are analyzed to determine if the page is hosting malicious content.

Helpful — Verified, safe crawler. Respects robots.txt and provides operator documentation.

Identification

Bot name

Splunk Attack Analyzer

Operator

Splunk

How we rated this bot

Verified by Cloudflare, which confirms who runs it, with no widespread reports of abuse.

Names itself honestly

Yes

Verified by Cloudflare

Yes

Says it follows robots.txt and opt-outs

Not stated

Ignores site rules

None found

Disguises itself or evades blocks

None found

Overloads sites

None found

How widely people complain

No complaint about this bot in the evidence

Reddit discussion

There is no Reddit discussion of this bot in the evidence

What we read

Why it crawls your site

Splunk Attack Analyzer crawls websites to scan for security vulnerabilities and potential threats. It is operated by Splunk as part of their security infrastructure. If you see this bot in your server logs, it is a verified crawler and generally safe.

Block or allow Splunk Attack Analyzer

Block it

Add a Disallow rule for TwinWaveScanner in your robots.txt file. You can also block at the server level using your web server configuration or CDN firewall rules to filter requests matching the user-agent string.

# Block Splunk Attack Analyzer from crawling your entire site
User-agent: TwinWaveScanner
Disallow: /

# Allow Splunk Attack Analyzer full access
User-agent: TwinWaveScanner
Allow: /