Bot intelligence record
Splunk Attack Analyzer
Usually allowSplunk Attack Analyzer is an AI training crawler from Splunk used for AI model training, dataset discovery; it appears in server logs as `TwinWaveScanner`.
User-Agent Pattern
SplunkTwinWaveScanner
User-agent strings are identification signals, not proof of identity. Confirm important allow, block, or rate-limit decisions with logs, DNS or IP evidence, request behavior, or operator documentation when available.
Robots.txt Snippet
Click snippet to copyUser-agent: TwinWaveScanner
Disallow: /Click the snippet to copy it, or highlight the text manually.
Handling Guidance
NoThis bot is usually safe to allow when the request source is verified and the traffic matches your site policy.
Splunk Attack Analyzer is used for AI model training, dataset discovery, and collection of public web content for model-development pipelines.
Record Details
Structured data- Operator
- Splunk
- Family
- Splunk
- Type
- Feed
- Purpose
- Ai Training
- Identity type
- Verified Bot
- Confidence
- Medium
- Last verified
- 2026-04-01
- Last checked
- 2026-05-20
- Source type
- Documented
- Verification
- Verify Splunk Attack Analyzer by matching `TwinWaveScanner` to Splunk evidence, then checking reverse DNS, source-network ownership, signed request data, or published crawler documentation when available.
- Spoofing risk
- Splunk Attack Analyzer has medium spoofing risk because user-agent strings can be copied; pair the match with DNS, IP, behavior, or operator evidence.
Notes
- Splunk Attack Analyzer is an AI training crawler from Splunk used for AI model training, dataset discovery, and collection of public web content for model-development pipelines.
- Its primary user-agent pattern is
TwinWaveScanner. - Splunk Attack Analyzer is verified with Medium confidence. The identity type is Verified Bot, and the evidence basis is documented crawler-pattern evidence.
- Splunk Attack Analyzer does not have confirmed robots.txt behavior in the available public evidence.
- Splunk Attack Analyzer can usually be allowed after confirming the source and monitoring request volume.
Evidence and Source
- Verify Splunk Attack Analyzer by matching `TwinWaveScanner` to Splunk evidence, then checking reverse DNS, source-network ownership, signed request data, or published crawler documentation when available.
- Splunk Attack Analyzer traffic is primarily detected by the `TwinWaveScanner` user-agent pattern. Compare source IPs, reverse DNS, request paths, and crawl cadence with Splunk infrastructure before trusting the traffic.
- Splunk Attack Analyzer is used for AI model training, dataset discovery, and collection of public web content for model-development pipelines.
- Splunk Attack Analyzer has medium spoofing risk because user-agent strings can be copied; pair the match with DNS, IP, behavior, or operator evidence.
Monitor This Bot In Edge
Botcrawl EdgeUse Botcrawl Edge to see matching traffic, identify related datacenter activity, and create allow, block, rate-limit, or log rules across connected sites.