Directory/Categories/Security/Splunk Attack Analyzer

Splunk Attack Analyzer

Name: Splunk Attack Analyzer
Author: Splunk

GoodBotVerifiedBOT

Splunk Attack Analyzer (formerly known as TwinWave), visits URLs submitted by customers using a headless Chrome browser. DOM (Document Object Model), HAR (HTTP Archive), and other relevant data from these visits are analyzed to determine if the page is hosting malicious content. Operated by Splunk.

Operator website ↗

GoodBot

Assessment

Security

What is Splunk Attack Analyzer?

Splunk Attack Analyzer is a web crawler operated by Splunk. Splunk Attack Analyzer (formerly known as TwinWave), visits URLs submitted by customers using a headless Chrome browser. DOM (Document Object Model), HAR (HTTP Archive), and other relevant data from these visits are analyzed to determine if the page is hosting malicious content.

Helpful — Verified, safe crawler. Respects robots.txt and provides operator documentation.

Identification

Bot name

Splunk Attack Analyzer

Operator

Splunk

Why it crawls your site

Splunk Attack Analyzer crawls websites to scan for security vulnerabilities and potential threats. It is operated by Splunk as part of their security infrastructure. If you see this bot in your server logs, it is a verified crawler and generally safe.

Block or allow Splunk Attack Analyzer

Block it

Add a Disallow rule for TwinWaveScanner in your robots.txt file. You can also block at the server level using your web server configuration or CDN firewall rules to filter requests matching the user-agent string.

# Block Splunk Attack Analyzer from crawling your entire site
User-agent: TwinWaveScanner
Disallow: /

# Allow Splunk Attack Analyzer full access
User-agent: TwinWaveScanner
Allow: /