ANY.RUN Cloud Sandbox

ANY.RUN Sandbox is an online interactive sandbox for malware analysis, a tool for detection, monitoring, and research of cyber threats in real time.

Forensics & Malware Analysis · ANY.RUN

Details

ID	`ANY.RUN Cloud Sandbox`
Provider	AnyRun
Category	Forensics & Malware Analysis
From Version	6.0.0
Docker Image	`demisto/anyrun-sdk:1.0.0.10440656`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

ANY.RUN is a cloud-based sandbox with interactive access.

Use Cases

ANY.RUN Sandbox is an online interactive sandbox for malware analysis, a tool for detection, monitoring, and research of cyber threats in real time.

Submit a file, remote file, or URL to ANY.RUN for analysis using the following OS:
- Windows
- Ubuntu, Debian
- Android
Retrieve report details for a given analysis task ID in various formats:
- Json summary
- HTML
- IOCs
View history of analysis tasks.
View personal analysis limits.
Download file submission sample, analysis network traffic dumps

Requirements

Integration is officially supported from XSOAR 8.x

Generate API token

Follow ANY.RUN Sandbox
[1] Profile > [2] API and Limits > [3] Generate > [4] Copy

ANY.RUN Generate API KEY

Configure ANY.RUN Sandbox in Cortex

Navigate to Settings > Integrations > Servers & Services.
Search for ANY.RUN.
Click Add instance to create and configure a new integration instance.
Insert ANY.RUN API-KEY into the Password parameter.
Please use “ANY.RUN” as username.
Click Test to validate the URLs, token, and connection.

Parameter	Description	Required
Password	ANY.RUN API-KEY without prefix.	True
Root URL	Base domain for the ANY.RUN connection. By default, the domain is any.run.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

anyrun-detonate-file-windows

Perform File analysis using Windows VM.

Base Command

anyrun-detonate-file-windows

Input

Argument Name	Description	Required
file	XSOAR Incident file data.	Required
env_version	Version of OS. Possible values are: 7, 10, 11. Default is 10.	Optional
env_bitness	Bitness of Operation System. Possible values are: 32, 64. Default is 64.	Optional
env_type	Environment preset type. You can select development env for OS Windows 10 x64. For all other cases, complete env is required. Possible values are: development, complete. Default is complete.	Optional
env_locale	Operation system language. Use locale identifier or country name (Ex: “en-US” or “Brazil”). Case insensitive. Default is en-US.	Optional
opt_network_connect	Network connection state. Default is True.	Optional
opt_network_fakenet	FakeNet feature status. Default is False.	Optional
opt_network_tor	TOR using. Default is False.	Optional
opt_network_geo	Tor geo location option. Example: US, AU. Default is fastest.	Optional
opt_network_mitm	HTTPS MITM proxy option. Default is False.	Optional
opt_network_residential_proxy	Residential proxy using. Default is False.	Optional
opt_network_residential_proxy_geo	Residential proxy geo location option. Example: US, AU. Default is fastest.	Optional
opt_privacy_type	Privacy settings. Possible values are: public, bylink, owner, byteam. Default is bylink.	Optional
opt_timeout	Timeout option. Size range: 10-660. Default is 240.	Optional
obj_ext_startfolder	Start file analysis from the specified directory. Possible values are: desktop, home, downloads, appdata, temp, windows, root. Default is temp.	Optional
obj_ext_cmd	Optional command line.	Optional
obj_force_elevation	Forces the file to execute with elevated privileges and an elevated token (for PE32, PE32+, PE64 files only). Default is False.	Optional
obj_ext_extension	Change extension to valid. Default is True.	Optional

Context Output

Path	Type	Description
ANYRUN_DetonateFileWindows.TaskID	String	Task UUID.

anyrun-detonate-url-windows

Perform URL analysis using Windows VM.

Base Command

anyrun-detonate-url-windows

Input

Argument Name	Description	Required
obj_url	Target URL. Size range 5-512. Example: (http/https)://(your-link).	Required
env_version	Version of OS. Possible values are: 7, 10, 11. Default is 10.	Optional
env_bitness	Bitness of Operation System. Possible values are: 32, 64. Default is 64.	Optional
env_type	Environment preset type. You can select development env for OS Windows 10 x64. For all other cases, complete env is required. Possible values are: development, complete. Default is complete.	Optional
env_locale	Operation system language. Use locale identifier or country name (Ex: “en-US” or “Brazil”). Case insensitive. Default is en-US.	Optional
opt_network_connect	Network connection state. Default is True.	Optional
opt_network_fakenet	FakeNet feature status. Default is False.	Optional
opt_network_tor	TOR using. Default is False.	Optional
opt_network_geo	Tor geo location option. Example: US, AU. Default is fastest.	Optional
opt_network_mitm	HTTPS MITM proxy option. Default is False.	Optional
opt_network_residential_proxy	Residential proxy using. Default is False.	Optional
opt_network_residential_proxy_geo	Residential proxy geo location option. Example: US, AU. Default is fastest.	Optional
opt_privacy_type	Privacy settings. Possible values are: public, bylink, owner, byteam. Default is bylink.	Optional
opt_timeout	Timeout option. Size range: 10-660. Default is 240.	Optional
obj_ext_browser	Browser name. Possible values are: Google Chrome, Mozilla Firefox, Internet Explorer, Microsoft Edge. Default is Google Chrome.	Optional
obj_ext_extension	Change extension to valid. Default is True.	Optional

Context Output

Path	Type	Description
ANYRUN_DetonateUrlWindows.TaskID	String	Task UUID.

anyrun-detonate-file-linux

Perform File analysis using Linux VM.

Base Command

anyrun-detonate-file-linux

Input

Argument Name	Description	Required
file	XSOAR Incident file data.	Required
env_locale	Operation system language. Use locale identifier or country name (Ex: “en-US” or “Brazil”). Case insensitive. Default is en-US.	Optional
env_os	Operation system. Possible values are: ubuntu, debian. Default is ubuntu.	Optional
opt_network_connect	Network connection state. Default is True.	Optional
opt_network_fakenet	FakeNet feature status. Default is False.	Optional
opt_network_tor	TOR using. Default is False.	Optional
opt_network_geo	Tor geo location option. Example: US, AU. Default is fastest.	Optional
opt_network_mitm	HTTPS MITM proxy option. Default is False.	Optional
opt_network_residential_proxy	Residential proxy using. Default is False.	Optional
opt_network_residential_proxy_geo	Residential proxy geo location option. Example: US, AU. Default is fastest.	Optional
opt_privacy_type	Privacy settings. Possible values are: public, bylink, owner, byteam. Default is bylink.	Optional
opt_timeout	Timeout option. Size range: 10-660. Default is 240.	Optional
obj_ext_startfolder	Start file analysis from the specified directory. Possible values are: desktop, home, downloads, appdata, temp, windows, root. Default is temp.	Optional
obj_ext_cmd	Optional command line.	Optional
run_as_root	Run file with superuser privileges. Default is True.	Optional
obj_ext_extension	Change extension to valid. Default is True.	Optional

Context Output

Path	Type	Description
ANYRUN_DetonateFileLinux.TaskID	String	Task UUID.

anyrun-detonate-url-linux

Perform URL analysis using Linux VM.

Base Command

anyrun-detonate-url-linux

Input

Argument Name	Description	Required
obj_url	Target URL. Size range 5-512. Example: (http/https)://(your-link).	Required
env_locale	Operation system language. Use locale identifier or country name (Ex: “en-US” or “Brazil”). Case insensitive. Default is en-US.	Optional
env_os	Operation system. Possible values are: ubuntu, debian. Default is ubuntu.	Optional
opt_network_connect	Network connection state. Default is True.	Optional
opt_network_fakenet	FakeNet feature status. Default is False.	Optional
opt_network_tor	TOR using. Default is False.	Optional
opt_network_geo	Tor geo location option. Example: US, AU. Default is fastest.	Optional
opt_network_mitm	HTTPS MITM proxy option. Default is False.	Optional
opt_network_residential_proxy	Residential proxy using. Default is False.	Optional
opt_network_residential_proxy_geo	Residential proxy geo location option. Example: US, AU. Default is fastest.	Optional
opt_privacy_type	Privacy settings. Possible values are: public, bylink, owner, byteam. Default is bylink.	Optional
opt_timeout	Timeout option. Size range: 10-660. Default is 120.	Optional
obj_ext_browser	Browser name. Possible values are: Google Chrome, Mozilla Firefox. Default is Google Chrome.	Optional
obj_ext_extension	Change extension to valid. Default is True.	Optional

Context Output

Path	Type	Description
ANYRUN_DetonateUrlLinux.TaskID	String	Task UUID.

anyrun-detonate-file-android

Perform File analysis using Android VM.

Base Command

anyrun-detonate-file-android

Input

Argument Name	Description	Required
file	XSOAR Entry ID.	Required
env_locale	Operation system language. Use locale identifier or country name (Ex: “en-US” or “Brazil”). Case insensitive. Default is en-US.	Optional
opt_network_connect	Network connection state. Default is True.	Optional
opt_network_fakenet	FakeNet feature status. Default is False.	Optional
opt_network_tor	TOR using. Default is False.	Optional
opt_network_geo	Tor geo location option. Example: US, AU. Default is fastest.	Optional
opt_network_mitm	HTTPS MITM proxy option. Default is False.	Optional
opt_network_residential_proxy	Residential proxy using. Default is False.	Optional
opt_network_residential_proxy_geo	Residential proxy geo location option. Example: US, AU. Default is fastest.	Optional
opt_privacy_type	Privacy settings. Possible values are: public, bylink, owner, byteam. Default is bylink.	Optional
opt_timeout	Timeout option. Size range: 10-660. Default is 120.	Optional
obj_ext_cmd	Optional command line.	Optional

Context Output

Path	Type	Description
ANYRUN_DetonateFileAndroid.TaskID	String	Task UUID.

anyrun-detonate-url-android

Perform URL analysis using Android VM.

Base Command

anyrun-detonate-url-android

Input

Argument Name	Description	Required
obj_url	Target URL. Size range 5-512. Example: (http/https)://(your-link).	Required
env_locale	Operation system language. Use locale identifier or country name (Ex: “en-US” or “Brazil”). Case insensitive. Default is en-US.	Optional
opt_network_connect	Network connection state. Default is True.	Optional
opt_network_fakenet	FakeNet feature status. Default is False.	Optional
opt_network_tor	TOR using. Default is False.	Optional
opt_network_geo	Tor geo location option. Example: US, AU. Default is fastest.	Optional
opt_network_mitm	HTTPS MITM proxy option. Default is False.	Optional
opt_network_residential_proxy	Residential proxy using. Default is False.	Optional
opt_network_residential_proxy_geo	Residential proxy geo location option. Example: US, AU. Default is fastest.	Optional
opt_privacy_type	Privacy settings. Possible values are: public, bylink, owner, byteam. Default is bylink.	Optional
opt_timeout	Timeout option. Size range: 10-660. Default is 120.	Optional

Context Output

Path	Type	Description
ANYRUN_DetonateUrlAndroid.TaskID	String	Task UUID.

anyrun-get-user-limits

Get user available limits to perform the Sandbox analysis.

Base Command

anyrun-get-user-limits

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
ANYRUN.SandboxLimits.web.minute	String	Defines limits for interactive usage. Value of -1 indicates unlimited usage.
ANYRUN.SandboxLimits.web.hour	String	Defines limits for interactive usage. Value of -1 indicates unlimited usage.
ANYRUN.SandboxLimits.web.day	String	Defines limits for interactive usage. Value of -1 indicates unlimited usage.
ANYRUN.SandboxLimits.web.month	String	Defines limits for interactive usage. Value of -1 indicates unlimited usage.
ANYRUN.SandboxLimits.api.minute	String	Defines limits for API usage. Value of -1 indicates unlimited usage.
ANYRUN.SandboxLimits.api.hour	String	Defines limits for API usage. Value of -1 indicates unlimited usage.
ANYRUN.SandboxLimits.api.day	String	Defines limits for API usage. Value of -1 indicates unlimited usage.
ANYRUN.SandboxLimits.api.month	String	Defines limits for API usage. Value of -1 indicates unlimited usage.
ANYRUN.SandboxLimits.parallels.total	String	Defines limits for parallel runs.
ANYRUN.SandboxLimits.parallels.available	String	Defines limits for parallel runs.

anyrun-get-analysis-history

Get analysis history.

Base Command

anyrun-get-analysis-history

Input

Argument Name	Description	Required
team	Leave this field blank to get your history or specify to get team history. Default is False..	Optional
skip	Skip the specified number of tasks. Default is 0.	Optional
limit	Specify the number of tasks in the result set (not more than 100). Default is 25.	Optional

Context Output

Path	Type	Description
ANYRUN.SandboxHistory.tasks.uuid	String	Task UUID.
ANYRUN.SandboxHistory.tasks.verdict	String	ANY.RUN verdict for the submitted file status.
ANYRUN.SandboxHistory.tasks.name	String	Task name.
ANYRUN.SandboxHistory.tasks.related	String	ANY.RUN link to a related file.
ANYRUN.SandboxHistory.tasks.pcap	String	ANY.RUN link to the network traffic dump.
ANYRUN.SandboxHistory.tasks.file	String	ANY.RUN link to the file sample.
ANYRUN.SandboxHistory.tasks.json	String	ANY.RUN link to json summary.
ANYRUN.SandboxHistory.tasks.misp	String	ANY.RUN link to misp report.
ANYRUN.SandboxHistory.tasks.tags	String	ANY.RUN related tags array.
ANYRUN.SandboxHistory.tasks.date	Date	The date that the file was submitted for analysis.
ANYRUN.SandboxHistory.tasks.hashes.md5	String	MD5 hash of the submitted file.
ANYRUN.SandboxHistory.tasks.hashes.sha1	String	SHA1 hash of the submitted file.
ANYRUN.SandboxHistory.tasks.hashes.sha256	String	SHA256 hash of the submitted file.
ANYRUN.SandboxHistory.tasks.hashes.ssdeep	String	SSDeep hash of the submitted file.

anyrun-delete-task

Deletes analysis task according to specified task uuid.

Base Command

anyrun-delete-task

Input

Argument Name	Description	Required
task_uuid	Sandbox task uuid.	Required

Context Output

There is no context output for this command.

anyrun-get-analysis-report

Returns the analysis report summary.

Base Command

anyrun-get-analysis-report

Input

Argument Name	Description	Required
task_uuid	Sandbox task uuid.	Required
report_format	Report format. Possible values are: summary, html, ioc. Default is summary.	Optional

Context Output

Path	Type	Description
ANYRUN.IOCs	String	A comma-separated string of IOC values from the report.’
ANYRUN.SandboxAnalysis.mitre.name	String	MITRE Technic text description.
ANYRUN.SandboxAnalysis.mitre.phases	String	MITRE Technic phases.
ANYRUN.SandboxAnalysis.mitre.id	String	MITRE Technic identifier.
ANYRUN.SandboxAnalysis.debugStrings	Unknown	Analysis debug information.
ANYRUN.SandboxAnalysis.incidents.process	String	Analysis process.
ANYRUN.SandboxAnalysis.incidents.events.time	Date	Event time.
ANYRUN.SandboxAnalysis.incidents.events.cmdline	String	Event command line.
ANYRUN.SandboxAnalysis.incidents.events.image	String	Event image.
ANYRUN.SandboxAnalysis.incidents.mitre.v	String	MITRE version.
ANYRUN.SandboxAnalysis.incidents.mitre.sid	String	SID.
ANYRUN.SandboxAnalysis.incidents.mitre.tid	String	TID.
ANYRUN.SandboxAnalysis.incidents.count	String	Count of related incidents.
ANYRUN.SandboxAnalysis.incidents.firstSeen	Date	Incident first seen date.
ANYRUN.SandboxAnalysis.incidents.source	String	Incident source.
ANYRUN.SandboxAnalysis.incidents.desc	String	Incident description.
ANYRUN.SandboxAnalysis.incidents.title	String	Incident title.
ANYRUN.SandboxAnalysis.incidents.threatLevel	String	Incident threat level.
ANYRUN.SandboxAnalysis.incidents.events.typeValue	String	Event type value.
ANYRUN.SandboxAnalysis.incidents.events.key	String	Event key.
ANYRUN.SandboxAnalysis.incidents.events.value	String	Event value.
ANYRUN.SandboxAnalysis.incidents.events.name	String	Event name.
ANYRUN.SandboxAnalysis.incidents.events.operation	String	Event operation.
ANYRUN.SandboxAnalysis.incidents.events.cmdParent	String	Event parent cmd.
ANYRUN.SandboxAnalysis.incidents.events.cmdChild	String	Event child cmd.
ANYRUN.SandboxAnalysis.modified.registry.time	Date	Registry time.
ANYRUN.SandboxAnalysis.modified.registry.process	String	Registry process.
ANYRUN.SandboxAnalysis.modified.registry.operation	String	Registry operation.
ANYRUN.SandboxAnalysis.modified.registry.value	String	Registry value.
ANYRUN.SandboxAnalysis.modified.registry.name	String	Registry name.
ANYRUN.SandboxAnalysis.modified.registry.key	String	Registry key.
ANYRUN.SandboxAnalysis.modified.files.process	String	File process.
ANYRUN.SandboxAnalysis.modified.files.size	String	File size.
ANYRUN.SandboxAnalysis.modified.files.filename	String	Filename.
ANYRUN.SandboxAnalysis.modified.files.time	Date	File creating time.
ANYRUN.SandboxAnalysis.modified.files.info.mime	String	File MIME type.
ANYRUN.SandboxAnalysis.modified.files.info.file	String	File content.
ANYRUN.SandboxAnalysis.modified.files.permanentUrl	String	File url.
ANYRUN.SandboxAnalysis.modified.files.hashes.ssdeep	String	File SSDeep.
ANYRUN.SandboxAnalysis.modified.files.hashes.sha256	String	File sha256 hash.
ANYRUN.SandboxAnalysis.modified.files.hashes.sha1	String	File sha1 hash.
ANYRUN.SandboxAnalysis.modified.files.hashes.md5	String	File md5 hash.
ANYRUN.SandboxAnalysis.modified.files.threatLevel	String	File threat level.
ANYRUN.SandboxAnalysis.modified.files.type	String	File type.
ANYRUN.SandboxAnalysis.network.threats	Unknown	Analysis network threats.
ANYRUN.SandboxAnalysis.network.connections.reputation	String	Network connection reputation.
ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3SFullstring	String	Network connection ja3S.
ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3S	String	Network connection ja3S.
ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3Fullstring	String	Network connection ja3F.
ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3	String	Network connection ja3F.
ANYRUN.SandboxAnalysis.network.connections.time	Date	Network connection time.
ANYRUN.SandboxAnalysis.network.connections.asn	String	Network connection ASN.
ANYRUN.SandboxAnalysis.network.connections.country	String	Network connection country.
ANYRUN.SandboxAnalysis.network.connections.protocol	String	Network connection protocol.
ANYRUN.SandboxAnalysis.network.connections.port	String	Network connection port.
ANYRUN.SandboxAnalysis.network.connections.ip	String	Network connection ip.
ANYRUN.SandboxAnalysis.network.connections.process	String	Network connection processes.
ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.jarm	String	Network connection jarm.
ANYRUN.SandboxAnalysis.network.httpRequests.country	String	HTTP Request country.
ANYRUN.SandboxAnalysis.network.httpRequests.reputation	String	HTTP Request reputation.
ANYRUN.SandboxAnalysis.network.httpRequests.process	String	HTTP Request related process.
ANYRUN.SandboxAnalysis.network.httpRequests.httpCode	String	HTTP Request status code.
ANYRUN.SandboxAnalysis.network.httpRequests.status	String	HTTP Request status.
ANYRUN.SandboxAnalysis.network.httpRequests.user-agent	String	HTTP Request User-Agent header value.
ANYRUN.SandboxAnalysis.network.httpRequests.proxyDetected	String	HTTP Request is proxy detected.
ANYRUN.SandboxAnalysis.network.httpRequests.port	String	HTTP Request port.
ANYRUN.SandboxAnalysis.network.httpRequests.ip	String	HTTP Request ip.
ANYRUN.SandboxAnalysis.network.httpRequests.url	String	HTTP Request url.
ANYRUN.SandboxAnalysis.network.httpRequests.host	String	HTTP Request host.
ANYRUN.SandboxAnalysis.network.httpRequests.method	String	HTTP Request method.
ANYRUN.SandboxAnalysis.network.httpRequests.time	Date	HTTP Request time estimate.
ANYRUN.SandboxAnalysis.network.dnsRequests.reputationNumber	String	DNS Request reputation number.
ANYRUN.SandboxAnalysis.network.dnsRequests.reputation	String	DNS Request reputation.
ANYRUN.SandboxAnalysis.network.dnsRequests.ips	String	DNS Request IPs.
ANYRUN.SandboxAnalysis.network.dnsRequests.domain	String	DNS Request domain.
ANYRUN.SandboxAnalysis.network.dnsRequests.time	Date	DNS Request time estimate.
ANYRUN.SandboxAnalysis.malconf	Unknown	Analysis malconf.
ANYRUN.SandboxAnalysis.processes.synchronization	Unknown	Analysis processes synchronization.
ANYRUN.SandboxAnalysis.processes.modules	Unknown	Analysis processes modules.
ANYRUN.SandboxAnalysis.processes.hasMalwareConfig	String	Process has malware config.
ANYRUN.SandboxAnalysis.processes.parentUUID	String	Process parent UUID.
ANYRUN.SandboxAnalysis.processes.status	String	Process status.
ANYRUN.SandboxAnalysis.processes.scores.specs.malwareConfig	String	Process malware config.
ANYRUN.SandboxAnalysis.processes.scores.specs.privEscalation	String	Process priv escalation.
ANYRUN.SandboxAnalysis.processes.scores.specs.stealing	String	Process stealing.
ANYRUN.SandboxAnalysis.processes.scores.specs.networkLoader	String	Process network loader.
ANYRUN.SandboxAnalysis.processes.scores.specs.network	String	Process network.
ANYRUN.SandboxAnalysis.processes.scores.specs.lowAccess	String	Process low access.
ANYRUN.SandboxAnalysis.processes.scores.specs.knownThreat	String	Process known threat.
ANYRUN.SandboxAnalysis.processes.scores.specs.injects	String	Process inject.
ANYRUN.SandboxAnalysis.processes.scores.specs.exploitable	String	Process exploitable.
ANYRUN.SandboxAnalysis.processes.scores.specs.executableDropped	String	Process executable dropped.
ANYRUN.SandboxAnalysis.processes.scores.specs.debugOutput	String	Process debug output.
ANYRUN.SandboxAnalysis.processes.scores.specs.crashedApps	String	Process crashed apps.
ANYRUN.SandboxAnalysis.processes.scores.specs.autoStart	String	Process auto start.
ANYRUN.SandboxAnalysis.processes.scores.loadsSusp	String	Process loads susp.
ANYRUN.SandboxAnalysis.processes.scores.injected	String	Process injected.
ANYRUN.SandboxAnalysis.processes.scores.dropped	String	Process dropped.
ANYRUN.SandboxAnalysis.processes.scores.verdict.threatLevelText	String	Process threat level text.
ANYRUN.SandboxAnalysis.processes.scores.verdict.threatLevel	String	Process threat level.
ANYRUN.SandboxAnalysis.processes.scores.verdict.score	String	Process score.
ANYRUN.SandboxAnalysis.processes.context.userName	String	Process context username.
ANYRUN.SandboxAnalysis.processes.context.integrityLevel	String	Process context integrity level.
ANYRUN.SandboxAnalysis.processes.context.rebootNumber	String	Process context reboot number.
ANYRUN.SandboxAnalysis.processes.versionInfo.version	String	Process version.
ANYRUN.SandboxAnalysis.processes.versionInfo.description	String	Process description.
ANYRUN.SandboxAnalysis.processes.versionInfo.company	String	Process company.
ANYRUN.SandboxAnalysis.processes.mainProcess	String	Process main process.
ANYRUN.SandboxAnalysis.processes.fileType	String	Process file type.
ANYRUN.SandboxAnalysis.processes.fileName	String	Process filename.
ANYRUN.SandboxAnalysis.processes.commandLine	String	Process cmd.
ANYRUN.SandboxAnalysis.processes.image	String	Process image.
ANYRUN.SandboxAnalysis.processes.uuid	String	Process uuid.
ANYRUN.SandboxAnalysis.processes.ppid	String	Process PPID.
ANYRUN.SandboxAnalysis.processes.important	String	Process important.
ANYRUN.SandboxAnalysis.processes.pid	String	Process PID.
ANYRUN.SandboxAnalysis.processes.exitCode	String	Process exit code.
ANYRUN.SandboxAnalysis.processes.times.terminate	Date	Process time terminate.
ANYRUN.SandboxAnalysis.processes.times.start	Date	Process time start.
ANYRUN.SandboxAnalysis.processes.resolvedCOM.title	String	Process resolved COM title.
ANYRUN.SandboxAnalysis.processes.synchronization.operation	String	Process sync operation.
ANYRUN.SandboxAnalysis.processes.synchronization.type	String	Process sync type.
ANYRUN.SandboxAnalysis.processes.synchronization.name	String	Process sync name.
ANYRUN.SandboxAnalysis.processes.synchronization.time	Date	Process sync time.
ANYRUN.SandboxAnalysis.processes.modules.image	String	Process module image.
ANYRUN.SandboxAnalysis.processes.modules.time	Date	Process module time.
ANYRUN.SandboxAnalysis.processes.scores.monitoringReason	String	Process monitoring reason.
ANYRUN.SandboxAnalysis.processes.times.monitoringSince	Date	Process monitoring since.
ANYRUN.SandboxAnalysis.counters.synchronization.type.event	String	Process sync event.
ANYRUN.SandboxAnalysis.counters.synchronization.type.mutex	String	Process sync mutex.
ANYRUN.SandboxAnalysis.counters.synchronization.operation.create	String	Process sync operation create.
ANYRUN.SandboxAnalysis.counters.synchronization.operation.open	String	Process sync operation open.
ANYRUN.SandboxAnalysis.counters.synchronization.total	String	Process sync total.
ANYRUN.SandboxAnalysis.counters.registry.delete	String	Registry delete.
ANYRUN.SandboxAnalysis.counters.registry.write	String	Registry write.
ANYRUN.SandboxAnalysis.counters.registry.read	String	Registry read.
ANYRUN.SandboxAnalysis.counters.registry.total	String	Registry total.
ANYRUN.SandboxAnalysis.counters.files.malicious	String	File malicious count.
ANYRUN.SandboxAnalysis.counters.files.suspicious	String	File suspicious count.
ANYRUN.SandboxAnalysis.counters.files.text	String	File text.
ANYRUN.SandboxAnalysis.counters.files.unknown	String	File unknown count.
ANYRUN.SandboxAnalysis.counters.network.threats	String	Network threats count.
ANYRUN.SandboxAnalysis.counters.network.dns	String	Network dns count.
ANYRUN.SandboxAnalysis.counters.network.connections	String	Network connections count.
ANYRUN.SandboxAnalysis.counters.network.http	String	Network networks count.
ANYRUN.SandboxAnalysis.counters.processes.malicious	String	Malicious processes count.
ANYRUN.SandboxAnalysis.counters.processes.suspicious	String	Suspicious processes count.
ANYRUN.SandboxAnalysis.counters.processes.monitored	String	Monitored processes count.
ANYRUN.SandboxAnalysis.counters.processes.total	String	Total processes count.
ANYRUN.SandboxAnalysis.environments.hotfixes.title	String	Environment hotfixes title.
ANYRUN.SandboxAnalysis.environments.software.version	String	Environment software version.
ANYRUN.SandboxAnalysis.environments.software.title	String	Environment software title.
ANYRUN.SandboxAnalysis.environments.internetExplorer.kbnum	String	Environment Internet Explorer KBNUM.
ANYRUN.SandboxAnalysis.environments.internetExplorer.version	String	Environment Internet Explorer version.
ANYRUN.SandboxAnalysis.environments.os.bitness	String	Environment OS version.
ANYRUN.SandboxAnalysis.environments.os.softSet	String	Environment OS software set.
ANYRUN.SandboxAnalysis.environments.os.servicePack	String	Environment OS service pack.
ANYRUN.SandboxAnalysis.environments.os.major	String	Environment OS major version.
ANYRUN.SandboxAnalysis.environments.os.productType	String	Environment OS product type.
ANYRUN.SandboxAnalysis.environments.os.variant	String	Environment OS variant.
ANYRUN.SandboxAnalysis.environments.os.product	String	Environment OS product.
ANYRUN.SandboxAnalysis.environments.os.build	String	Environment OS build.
ANYRUN.SandboxAnalysis.environments.os.title	String	Environment OS title.
ANYRUN.SandboxAnalysis.analysis.content.dumps	Unknown	Content dumps.
ANYRUN.SandboxAnalysis.analysis.content.screenshots.thumbnailUrl	String	Screenshots thumbnail url.
ANYRUN.SandboxAnalysis.analysis.content.screenshots.permanentUrl	String	Screenshots permanent url.
ANYRUN.SandboxAnalysis.analysis.content.screenshots.time	String	Screenshots time.
ANYRUN.SandboxAnalysis.analysis.content.screenshots.uuid	String	Screenshots uuid.
ANYRUN.SandboxAnalysis.analysis.content.sslkeys.present	String	SSL keys present.
ANYRUN.SandboxAnalysis.analysis.content.pcap.permanentUrl	String	Pcap dump permanent url.
ANYRUN.SandboxAnalysis.analysis.content.pcap.present	String	Pcap present.
ANYRUN.SandboxAnalysis.analysis.content.video.permanentUrl	String	Video permanent url.
ANYRUN.SandboxAnalysis.analysis.content.video.present	String	Video present.
ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.ssdeep	String	Main object ssdeep.
ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.sha256	String	Main object sha256.
ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.sha1	String	Main object sha1.
ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.md5	String	Main object md5.
ANYRUN.SandboxAnalysis.analysis.content.mainObject.url	String	Main object url.
ANYRUN.SandboxAnalysis.analysis.content.mainObject.type	String	Main object type.
ANYRUN.SandboxAnalysis.analysis.scores.specs.knownThreat	String	Specs known threat.
ANYRUN.SandboxAnalysis.analysis.scores.specs.malwareConfig	String	Specs malware Config.
ANYRUN.SandboxAnalysis.analysis.scores.specs.notStarted	String	Specs not started.
ANYRUN.SandboxAnalysis.analysis.scores.specs.privEscalation	String	Specs priv escalation.
ANYRUN.SandboxAnalysis.analysis.scores.specs.torUsed	String	Specs TOR used.
ANYRUN.SandboxAnalysis.analysis.scores.specs.suspStruct	String	Specs susp structure.
ANYRUN.SandboxAnalysis.analysis.scores.specs.stealing	String	Specs stealing.
ANYRUN.SandboxAnalysis.analysis.scores.specs.staticDetections	String	Specs static detections.
ANYRUN.SandboxAnalysis.analysis.scores.specs.spam	String	Specs spam.
ANYRUN.SandboxAnalysis.analysis.scores.specs.serviceLauncher	String	Specs service launcher.
ANYRUN.SandboxAnalysis.analysis.scores.specs.rebooted	String	Specs rebooted.
ANYRUN.SandboxAnalysis.analysis.scores.specs.networkThreats	String	Specs network threats.
ANYRUN.SandboxAnalysis.analysis.scores.specs.networkLoader	String	Specs network loader.
ANYRUN.SandboxAnalysis.analysis.scores.specs.multiprocessing	String	Specs multiprocessing.
ANYRUN.SandboxAnalysis.analysis.scores.specs.memOverrun	String	Specs memory overrun.
ANYRUN.SandboxAnalysis.analysis.scores.specs.lowAccess	String	Specs low access.
ANYRUN.SandboxAnalysis.analysis.scores.specs.exploitable	String	Specs exploitable.
ANYRUN.SandboxAnalysis.analysis.scores.specs.executableDropped	String	Specs executable dropped.
ANYRUN.SandboxAnalysis.analysis.scores.specs.debugOutput	String	Specs debug output.
ANYRUN.SandboxAnalysis.analysis.scores.specs.crashedTask	String	Specs crashed task.
ANYRUN.SandboxAnalysis.analysis.scores.specs.crashedApps	String	Specs crashed apps.
ANYRUN.SandboxAnalysis.analysis.scores.specs.cpuOverrun	String	Specs CPU overrun.
ANYRUN.SandboxAnalysis.analysis.scores.specs.autoStart	String	Specs auto start.
ANYRUN.SandboxAnalysis.analysis.scores.specs.injects	String	Specs injects.
ANYRUN.SandboxAnalysis.analysis.scores.verdict.threatLevelText	String	Verdict threat level text.
ANYRUN.SandboxAnalysis.analysis.scores.verdict.threatLevel	String	Verdict threat level.
ANYRUN.SandboxAnalysis.analysis.scores.verdict.score	String	Verdict score.
ANYRUN.SandboxAnalysis.analysis.options.automatization.uac	String	Options automatization UAC.
ANYRUN.SandboxAnalysis.analysis.options.privateSample	String	Options private sample.
ANYRUN.SandboxAnalysis.analysis.options.privacy	String	Options privacy.
ANYRUN.SandboxAnalysis.analysis.options.network	String	Options network.
ANYRUN.SandboxAnalysis.analysis.options.hideSource	String	Options hide source.
ANYRUN.SandboxAnalysis.analysis.options.video	String	Options video.
ANYRUN.SandboxAnalysis.analysis.options.presentation	String	Options presentation.
ANYRUN.SandboxAnalysis.analysis.options.tor.used	String	Options tor used.
ANYRUN.SandboxAnalysis.analysis.options.mitm	String	Options MITM proxy.
ANYRUN.SandboxAnalysis.analysis.options.heavyEvasion	String	Options kernel heavy evasion.
ANYRUN.SandboxAnalysis.analysis.options.fakeNet	String	Options fake network.
ANYRUN.SandboxAnalysis.analysis.options.additionalTime	String	Options additional time.
ANYRUN.SandboxAnalysis.analysis.options.timeout	String	Options timeout.
ANYRUN.SandboxAnalysis.analysis.tags	Unknown	Analysis tags.
ANYRUN.SandboxAnalysis.analysis.stopExecText	Date	Analysis stopExecText.
ANYRUN.SandboxAnalysis.analysis.stopExec	Date	Analysis creation stopExec.
ANYRUN.SandboxAnalysis.analysis.creationText	Date	Analysis creation text.
ANYRUN.SandboxAnalysis.analysis.creation	Date	Analysis creation date.
ANYRUN.SandboxAnalysis.analysis.duration	String	Analysis duration.
ANYRUN.SandboxAnalysis.analysis.sandbox.plan.name	String	Analysis sandbox user plan name.
ANYRUN.SandboxAnalysis.analysis.sandbox.name	String	Analysis sandbox name.
ANYRUN.SandboxAnalysis.analysis.reports.graph	String	Analysis reports graph.
ANYRUN.SandboxAnalysis.analysis.reports.STIX	String	Analysis STIX report url.
ANYRUN.SandboxAnalysis.analysis.reports.HTML	String	Analysis HTML report url.
ANYRUN.SandboxAnalysis.analysis.reports.MISP	String	Analysis MISP report url.
ANYRUN.SandboxAnalysis.analysis.reports.IOC	String	Analysis IOC report url.
ANYRUN.SandboxAnalysis.analysis.permanentUrl	String	Analysis permanent url.
ANYRUN.SandboxAnalysis.analysis.uuid	String	Analysis uuid.
ANYRUN.SandboxAnalysis.status	String	Analysis status.

anyrun-download-analysis-pcap

Returns the analysis network traffic dump.

Base Command

anyrun-download-analysis-pcap

Input

Argument Name	Description	Required
task_uuid	Sandbox task uuid.	Required

Context Output

There is no context output for this command.

anyrun-download-analysis-sample

Returns the analysis file in zip archive. Archive password: infected.

Base Command

anyrun-download-analysis-sample

Input

Argument Name	Description	Required
task_uuid	Sandbox task uuid.	Required

Context Output

There is no context output for this command.

anyrun-get-analysis-verdict

Returns a threat level text. Possible values: No threats detected, Suspicious activity, Malicious activity.

Base Command

anyrun-get-analysis-verdict

Input

Argument Name	Description	Required
task_uuid	Sandbox task uuid.	Required

Context Output

Path	Type	Description
ANYRUN.SandboxAnalysisReportVerdict	String	The analysis verdict.

Configuration parameters

credentials — Username. (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
root_url — Root URL

Commands (13)

anyrun-delete-task
Deletes analysis task according to specified task uuid.
anyrun-detonate-file-android
Perform File analysis using Android VM.
anyrun-detonate-file-linux
Perform File analysis using Linux VM.
anyrun-detonate-file-windows
Perform File analysis using Windows VM.
anyrun-detonate-url-android
Perform URL analysis using Android VM.
anyrun-detonate-url-linux
Perform URL analysis using Linux VM.
anyrun-detonate-url-windows
Perform URL analysis using Windows VM.
anyrun-download-analysis-pcap
Returns the analysis network traffic dump.
anyrun-download-analysis-sample
Returns the analysis file in zip archive. Archive password: infected.
anyrun-get-analysis-history
Get analysis history.
anyrun-get-analysis-report
Returns the analysis report summary.
anyrun-get-analysis-verdict
Returns a threat level text. Possible values: No threats detected, Suspicious activity, Malicious activity.
anyrun-get-user-limits
Get user available limits to perform the Sandbox analysis.

Source

AnyRunSandbox.py AnyRunSandbox_test.py AnyRunSandbox.yml AnyRunSandbox_description.md

Download History Raw

category: Forensics & Malware Analysis
provider: AnyRun
sectionorder:
- Connect
commonfields:
  id: ANY.RUN Cloud Sandbox
  version: -1
configuration:
- display: Username.
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- display: Root URL
  name: root_url
  type: 0
  required: false
  section: Connect
  defaultvalue: any.run
  additionalinfo: Base domain for the ANY.RUN connection. Enter only the domain (e.g. any.run), without a scheme or trailing slash.
description: ANY.RUN Sandbox is an online interactive sandbox for malware analysis, a tool for detection, monitoring, and research of cyber threats in real time.
display: ANY.RUN Cloud Sandbox
name: ANY.RUN Cloud Sandbox
script:
  commands:
  - arguments:
    - description: 'XSOAR Incident file data.'
      name: file
      required: true
      type: Unknown
    - auto: PREDEFINED
      description: 'Version of OS.'
      name: env_version
      defaultValue: '10'
      required: false
      type: String
      predefined:
      - '7'
      - '10'
      - '11'
    - auto: PREDEFINED
      description: 'Bitness of Operation System.'
      name: env_bitness
      defaultValue: '64'
      required: false
      type: String
      predefined:
      - '32'
      - '64'
    - auto: PREDEFINED
      description: 'Environment preset type. You can select **development** env for OS Windows 10 x64. For all other cases, **complete** env is required.'
      name: env_type
      defaultValue: 'complete'
      required: false
      type: String
      predefined:
      - 'development'
      - 'complete'
    - description: 'Operation system language. Use locale identifier or country name (Ex: "en-US" or "Brazil"). Case insensitive.'
      name: env_locale
      defaultValue: 'en-US'
      required: false
      type: String
    - description: 'Network connection state.'
      name: opt_network_connect
      defaultValue: 'True'
      required: false
      type: String
    - description: 'FakeNet feature status.'
      name: opt_network_fakenet
      defaultValue: 'False'
      required: false
      type: String
    - description: 'TOR using.'
      name: opt_network_tor
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Tor geo location option. Example: US, AU.'
      name: opt_network_geo
      defaultValue: 'fastest'
      required: false
      type: String
    - description: 'HTTPS MITM proxy option.'
      name: opt_network_mitm
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Residential proxy using.'
      name: opt_network_residential_proxy
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Residential proxy geo location option. Example: US, AU.'
      name: opt_network_residential_proxy_geo
      defaultValue: 'fastest'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Privacy settings.'
      name: opt_privacy_type
      defaultValue: 'bylink'
      required: false
      type: String
      predefined:
      - 'public'
      - 'bylink'
      - 'owner'
      - 'byteam'
    - description: 'Timeout option. Size range: 10-660.'
      name: opt_timeout
      defaultValue: '240'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Start file analysis from the specified directory.'
      name: obj_ext_startfolder
      defaultValue: 'temp'
      required: false
      type: String
      predefined:
      - 'desktop'
      - 'home'
      - 'downloads'
      - 'appdata'
      - 'temp'
      - 'windows'
      - 'root'
    - description: 'Optional command line.'
      name: obj_ext_cmd
      required: false
      type: String
    - description: 'Forces the file to execute with elevated privileges and an elevated token (for PE32, PE32+, PE64 files only).'
      name: obj_force_elevation
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Change extension to valid.'
      name: obj_ext_extension
      defaultValue: 'True'
      required: false
      type: String
    name: anyrun-detonate-file-windows
    description: 'Perform File analysis using Windows VM.'
    outputs:
    - contextPath: ANYRUN_DetonateFileWindows.TaskID
      description: 'Task UUID.'
      type: String
  - arguments:
    - description: 'Target URL. Size range 5-512. Example: (http/https)://(your-link).'
      name: obj_url
      required: true
      type: String
    - auto: PREDEFINED
      description: 'Version of OS.'
      name: env_version
      defaultValue: '10'
      required: false
      type: String
      predefined:
      - '7'
      - '10'
      - '11'
    - auto: PREDEFINED
      description: 'Bitness of Operation System.'
      name: env_bitness
      defaultValue: '64'
      required: false
      type: String
      predefined:
      - '32'
      - '64'
    - auto: PREDEFINED
      description: 'Environment preset type. You can select **development** env for OS Windows 10 x64. For all other cases, **complete** env is required.'
      name: env_type
      defaultValue: 'complete'
      required: false
      type: String
      predefined:
      - 'development'
      - 'complete'
    - description: 'Operation system language. Use locale identifier or country name (Ex: "en-US" or "Brazil"). Case insensitive.'
      name: env_locale
      defaultValue: 'en-US'
      required: false
      type: String
    - description: 'Network connection state.'
      name: opt_network_connect
      defaultValue: 'True'
      required: false
      type: String
    - description: 'FakeNet feature status.'
      name: opt_network_fakenet
      defaultValue: 'False'
      required: false
      type: String
    - description: 'TOR using.'
      name: opt_network_tor
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Tor geo location option. Example: US, AU.'
      name: opt_network_geo
      defaultValue: 'fastest'
      required: false
      type: String
    - description: 'HTTPS MITM proxy option.'
      name: opt_network_mitm
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Residential proxy using.'
      name: opt_network_residential_proxy
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Residential proxy geo location option. Example: US, AU.'
      name: opt_network_residential_proxy_geo
      defaultValue: 'fastest'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Privacy settings.'
      name: opt_privacy_type
      defaultValue: 'bylink'
      required: false
      type: String
      predefined:
      - 'public'
      - 'bylink'
      - 'owner'
      - 'byteam'
    - description: 'Timeout option. Size range: 10-660.'
      name: opt_timeout
      defaultValue: '240'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Browser name.'
      name: obj_ext_browser
      defaultValue: 'Google Chrome'
      required: false
      type: String
      predefined:
      - 'Google Chrome'
      - 'Mozilla Firefox'
      - 'Internet Explorer'
      - 'Microsoft Edge'
    - description: 'Change extension to valid.'
      name: obj_ext_extension
      defaultValue: 'True'
      required: false
      type: String
    name: anyrun-detonate-url-windows
    description: 'Perform URL analysis using Windows VM.'
    outputs:
    - contextPath: ANYRUN_DetonateUrlWindows.TaskID
      description: 'Task UUID.'
      type: String
  - arguments:
    - description: 'XSOAR Incident file data.'
      name: file
      required: true
      type: Unknown
    - description: 'Operation system language. Use locale identifier or country name (Ex: "en-US" or "Brazil"). Case insensitive.'
      name: env_locale
      defaultValue: 'en-US'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Operation system. Possible values: ubuntu, debian.'
      name: env_os
      defaultValue: 'ubuntu'
      required: false
      type: String
      predefined:
        - 'ubuntu'
        - 'debian'
    - description: 'Network connection state.'
      name: opt_network_connect
      defaultValue: 'True'
      required: false
      type: String
    - description: 'FakeNet feature status.'
      name: opt_network_fakenet
      defaultValue: 'False'
      required: false
      type: String
    - description: 'TOR using.'
      name: opt_network_tor
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Tor geo location option. Example: US, AU.'
      name: opt_network_geo
      defaultValue: 'fastest'
      required: false
      type: String
    - description: 'HTTPS MITM proxy option.'
      name: opt_network_mitm
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Residential proxy using.'
      name: opt_network_residential_proxy
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Residential proxy geo location option. Example: US, AU.'
      name: opt_network_residential_proxy_geo
      defaultValue: 'fastest'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Privacy settings.'
      name: opt_privacy_type
      defaultValue: 'bylink'
      required: false
      type: String
      predefined:
      - 'public'
      - 'bylink'
      - 'owner'
      - 'byteam'
    - description: 'Timeout option. Size range: 10-660.'
      name: opt_timeout
      defaultValue: '240'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Start file analysis from the specified directory.'
      name: obj_ext_startfolder
      defaultValue: 'temp'
      required: false
      type: String
      predefined:
      - 'desktop'
      - 'home'
      - 'downloads'
      - 'appdata'
      - 'temp'
      - 'windows'
      - 'root'
    - description: 'Optional command line.'
      name: obj_ext_cmd
      required: false
      type: String
    - description: 'Run file with superuser privileges.'
      name: run_as_root
      defaultValue: 'True'
      required: false
      type: String
    - description: 'Change extension to valid.'
      name: obj_ext_extension
      defaultValue: 'True'
      required: false
      type: String
    name: anyrun-detonate-file-linux
    description: 'Perform File analysis using Linux VM.'
    outputs:
    - contextPath: ANYRUN_DetonateFileLinux.TaskID
      description: 'Task UUID.'
      type: String
  - arguments:
    - description: 'Target URL. Size range 5-512. Example: (http/https)://(your-link).'
      name: obj_url
      required: true
      type: String
    - description: 'Operation system language. Use locale identifier or country name (Ex: "en-US" or "Brazil"). Case insensitive.'
      name: env_locale
      defaultValue: 'en-US'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Operation system. Possible values: ubuntu, debian.'
      name: env_os
      defaultValue: 'ubuntu'
      required: false
      type: String
      predefined:
        - 'ubuntu'
        - 'debian'
    - description: 'Network connection state.'
      name: opt_network_connect
      defaultValue: 'True'
      required: false
      type: String
    - description: 'FakeNet feature status.'
      name: opt_network_fakenet
      defaultValue: 'False'
      required: false
      type: String
    - description: 'TOR using.'
      name: opt_network_tor
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Tor geo location option. Example: US, AU.'
      name: opt_network_geo
      defaultValue: 'fastest'
      required: false
      type: String
    - description: 'HTTPS MITM proxy option.'
      name: opt_network_mitm
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Residential proxy using.'
      name: opt_network_residential_proxy
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Residential proxy geo location option. Example: US, AU.'
      name: opt_network_residential_proxy_geo
      defaultValue: 'fastest'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Privacy settings.'
      name: opt_privacy_type
      defaultValue: 'bylink'
      required: false
      type: String
      predefined:
      - 'public'
      - 'bylink'
      - 'owner'
      - 'byteam'
    - description: 'Timeout option. Size range: 10-660.'
      name: opt_timeout
      defaultValue: '120'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Browser name.'
      name: obj_ext_browser
      defaultValue: 'Google Chrome'
      required: false
      type: String
      predefined:
      - 'Google Chrome'
      - 'Mozilla Firefox'
    - description: 'Change extension to valid.'
      name: obj_ext_extension
      defaultValue: 'True'
      required: false
      type: String
    name: anyrun-detonate-url-linux
    description: 'Perform URL analysis using Linux VM.'
    outputs:
    - contextPath: ANYRUN_DetonateUrlLinux.TaskID
      description: 'Task UUID.'
      type: String
  - arguments:
    - description: 'XSOAR Entry ID.'
      name: file
      required: true
      type: String
    - description: 'Operation system language. Use locale identifier or country name (Ex: "en-US" or "Brazil"). Case insensitive.'
      name: env_locale
      defaultValue: 'en-US'
      required: false
      type: String
    - description: 'Network connection state.'
      name: opt_network_connect
      defaultValue: 'True'
      required: false
      type: String
    - description: 'FakeNet feature status.'
      name: opt_network_fakenet
      defaultValue: 'False'
      required: false
      type: String
    - description: 'TOR using.'
      name: opt_network_tor
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Tor geo location option. Example: US, AU.'
      name: opt_network_geo
      defaultValue: 'fastest'
      required: false
      type: String
    - description: 'HTTPS MITM proxy option.'
      name: opt_network_mitm
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Residential proxy using.'
      name: opt_network_residential_proxy
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Residential proxy geo location option. Example: US, AU.'
      name: opt_network_residential_proxy_geo
      defaultValue: 'fastest'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Privacy settings.'
      name: opt_privacy_type
      defaultValue: 'bylink'
      required: false
      type: String
      predefined:
      - 'public'
      - 'bylink'
      - 'owner'
      - 'byteam'
    - description: 'Timeout option. Size range: 10-660.'
      name: opt_timeout
      defaultValue: '120'
      required: false
      type: String
    - description: 'Optional command line.'
      name: obj_ext_cmd
      required: false
      type: String
    name: anyrun-detonate-file-android
    description: 'Perform File analysis using Android VM.'
    outputs:
    - contextPath: ANYRUN_DetonateFileAndroid.TaskID
      description: 'Task UUID.'
      type: String
  - arguments:
    - description: 'Target URL. Size range 5-512. Example: (http/https)://(your-link).'
      name: obj_url
      required: true
      type: String
    - description: 'Operation system language. Use locale identifier or country name (Ex: "en-US" or "Brazil"). Case insensitive.'
      name: env_locale
      defaultValue: 'en-US'
      required: false
      type: String
    - description: 'Network connection state.'
      name: opt_network_connect
      defaultValue: 'True'
      required: false
      type: String
    - description: 'FakeNet feature status.'
      name: opt_network_fakenet
      defaultValue: 'False'
      required: false
      type: String
    - description: 'TOR using.'
      name: opt_network_tor
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Tor geo location option. Example: US, AU.'
      name: opt_network_geo
      defaultValue: 'fastest'
      required: false
      type: String
    - description: 'HTTPS MITM proxy option.'
      name: opt_network_mitm
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Residential proxy using.'
      name: opt_network_residential_proxy
      defaultValue: 'False'
      required: false
      type: String
    - description: 'Residential proxy geo location option. Example: US, AU.'
      name: opt_network_residential_proxy_geo
      defaultValue: 'fastest'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Privacy settings.'
      name: opt_privacy_type
      defaultValue: 'bylink'
      required: false
      type: String
      predefined:
      - 'public'
      - 'bylink'
      - 'owner'
      - 'byteam'
    - description: 'Timeout option. Size range: 10-660.'
      name: opt_timeout
      defaultValue: '120'
      required: false
      type: String
    - auto: PREDEFINED
      description: 'Browser name.'
      name: obj_ext_browser
      defaultValue: 'Google Chrome'
      required: false
      type: String
      hidden: true
      predefined:
      - 'Google Chrome'
      - 'Mozilla Firefox'
    name: anyrun-detonate-url-android
    description: 'Perform URL analysis using Android VM.'
    outputs:
    - contextPath: ANYRUN_DetonateUrlAndroid.TaskID
      description: 'Task UUID.'
      type: String
  - name: anyrun-get-user-limits
    description: 'Get user available limits to perform the Sandbox analysis.'
    outputs:
    - contextPath: ANYRUN.SandboxLimits.web.minute
      description: 'Defines limits for interactive usage. Value of -1 indicates unlimited usage.'
      type: String
    - contextPath: ANYRUN.SandboxLimits.web.hour
      description: 'Defines limits for interactive usage. Value of -1 indicates unlimited usage.'
      type: String
    - contextPath: ANYRUN.SandboxLimits.web.day
      description: 'Defines limits for interactive usage. Value of -1 indicates unlimited usage.'
      type: String
    - contextPath: ANYRUN.SandboxLimits.web.month
      description: 'Defines limits for interactive usage. Value of -1 indicates unlimited usage.'
      type: String
    - contextPath: ANYRUN.SandboxLimits.api.minute
      description: 'Defines limits for API usage. Value of -1 indicates unlimited usage.'
      type: String
    - contextPath: ANYRUN.SandboxLimits.api.hour
      description: 'Defines limits for API usage. Value of -1 indicates unlimited usage.'
      type: String
    - contextPath: ANYRUN.SandboxLimits.api.day
      description: 'Defines limits for API usage. Value of -1 indicates unlimited usage.'
      type: String
    - contextPath: ANYRUN.SandboxLimits.api.month
      description: 'Defines limits for API usage. Value of -1 indicates unlimited usage.'
      type: String
    - contextPath: ANYRUN.SandboxLimits.parallels.total
      description: 'Defines limits for parallel runs.'
      type: String
    - contextPath: ANYRUN.SandboxLimits.parallels.available
      description: 'Defines limits for parallel runs.'
      type: String
  - arguments:
    - description: 'Leave this field blank to get your history or specify to get team history.'
      name: team
      defaultValue: 'False.'
      required: false
      type: String
    - description: 'Skip the specified number of tasks.'
      name: skip
      defaultValue: '0'
      required: false
      type: String
    - description: 'Specify the number of tasks in the result set (not more than 100).'
      name: limit
      defaultValue: '25'
      required: false
      type: String
    name: anyrun-get-analysis-history
    description: 'Get analysis history.'
    outputs:
    - contextPath: ANYRUN.SandboxHistory.tasks.uuid
      description: 'Task UUID.'
      type: String
    - contextPath: ANYRUN.SandboxHistory.tasks.verdict
      description: 'ANY.RUN verdict for the submitted file status.'
      type: String
    - contextPath: ANYRUN.SandboxHistory.tasks.name
      description: 'Task name.'
      type: String
    - contextPath: ANYRUN.SandboxHistory.tasks.related
      description: 'ANY.RUN link to a related file.'
      type: String
    - contextPath: ANYRUN.SandboxHistory.tasks.pcap
      description: 'ANY.RUN link to the network traffic dump.'
      type: String
    - contextPath: ANYRUN.SandboxHistory.tasks.file
      description: 'ANY.RUN link to the file sample.'
      type: String
    - contextPath: ANYRUN.SandboxHistory.tasks.json
      description: 'ANY.RUN link to json summary.'
      type: String
    - contextPath: ANYRUN.SandboxHistory.tasks.misp
      description: 'ANY.RUN link to misp report.'
      type: String
    - contextPath: ANYRUN.SandboxHistory.tasks.tags
      description: 'ANY.RUN related tags array.'
      type: String
    - contextPath: ANYRUN.SandboxHistory.tasks.date
      description: 'The date that the file was submitted for analysis.'
      type: Date
    - contextPath: ANYRUN.SandboxHistory.tasks.hashes.md5
      description: 'MD5 hash of the submitted file.'
      type: String
    - contextPath: ANYRUN.SandboxHistory.tasks.hashes.sha1
      description: 'SHA1 hash of the submitted file.'
      type: String
    - contextPath: ANYRUN.SandboxHistory.tasks.hashes.sha256
      description: 'SHA256 hash of the submitted file.'
      type: String
    - contextPath: ANYRUN.SandboxHistory.tasks.hashes.ssdeep
      description: 'SSDeep hash of the submitted file.'
      type: String
  - arguments:
    - description: 'Sandbox task uuid.'
      name: task_uuid
      required: true
      type: String
    name: anyrun-delete-task
    description: 'Deletes analysis task according to specified task uuid.'
  - arguments:
    - description: 'Sandbox task uuid.'
      name: task_uuid
      required: true
      type: String
    - auto: PREDEFINED
      description: 'Report format.'
      name: report_format
      defaultValue: 'summary'
      required: false
      type: String
      predefined:
      - 'summary'
      - 'html'
      - 'ioc'
    name: anyrun-get-analysis-report
    description: 'Returns the analysis report summary.'
    outputs:
    - contextPath: ANYRUN.IOCs
      description: 'A comma-separated string of IOC values from the report.'
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.mitre.name
      description: 'MITRE Technic text description.'
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.mitre.phases
      description: "MITRE Technic phases."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.mitre.id
      description: "MITRE Technic identifier."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.debugStrings
      type: Unknown
      description: "Analysis debug information."
    - contextPath: ANYRUN.SandboxAnalysis.incidents.process
      description: "Analysis process."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.events.time
      type: Date
      description: "Event time."
    - contextPath: ANYRUN.SandboxAnalysis.incidents.events.cmdline
      description: "Event command line."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.events.image
      description: "Event image."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.mitre.v
      description: "MITRE version."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.mitre.sid
      description: "SID."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.mitre.tid
      description: "TID."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.count
      description: "Count of related incidents."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.firstSeen
      type: Date
      description: "Incident first seen date."
    - contextPath: ANYRUN.SandboxAnalysis.incidents.source
      description: "Incident source."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.desc
      description: "Incident description."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.title
      description: "Incident title."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.threatLevel
      description: "Incident threat level."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.events.typeValue
      description: "Event type value."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.events.key
      description: "Event key."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.events.value
      description: "Event value."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.events.name
      description: "Event name."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.events.operation
      description: "Even operation."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.events.cmdParent
      description: "Event parent cmd."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.incidents.events.cmdChild
      description: "Event child cmd."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.registry.time
      type: Date
      description: "Registry time."
    - contextPath: ANYRUN.SandboxAnalysis.modified.registry.process
      description: "Registry process."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.registry.operation
      description: "Registry operation."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.registry.value
      description: "Registry value."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.registry.name
      description: "Registry name."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.registry.key
      description: "Registry key."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.process
      description: "File process."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.size
      description: "File size."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.filename
      description: "Filename."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.time
      type: Date
      description: "File creating time."
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.info.mime
      description: "File MIME type."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.info.file
      description: "File content."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.permanentUrl
      description: "File url."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.hashes.ssdeep
      description: "File SSDeep."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.hashes.sha256
      description: "File sha256 hash."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.hashes.sha1
      description: "File sha1 hash."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.hashes.md5
      description: "File md5 hash."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.threatLevel
      description: "File threat level."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.modified.files.type
      description: "File type."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.threats
      type: Unknown
      description: "Analysis network threats."
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.reputation
      description: "Network connection reputation."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3SFullstring
      description: "Network connection ja3S."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3S
      description: "Network connection ja3S."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3Fullstring
      description: "Network connection ja3F."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3
      description: "Network connection ja3F."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.time
      type: Date
      description: "Network connection time."
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.asn
      description: "Network connection ASN."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.country
      description: "Network connection country."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.protocol
      description: "Network connection protocol."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.port
      description: "Network connection port."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.ip
      description: "Network connection ip."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.process
      description: "Network connection processes."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.jarm
      description: "Network connection jarm."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.country
      description: "HTTP Request country."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.reputation
      description: "HTTP Request reputation."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.process
      description: "HTTP Request related process."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.httpCode
      description: "HTTP Request status code."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.status
      description: "HTTP Request status."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.user-agent
      description: "HTTP Request User-Agent header value."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.proxyDetected
      description: "HTTP Request is proxy detected."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.port
      description: "HTTP Request port."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.ip
      description: "HTTP Request ip."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.url
      description: "HTTP Request url."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.host
      description: "HTTP Request host."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.method
      description: "HTTP Request method."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.httpRequests.time
      type: Date
      description: "HTTP Request time estimate."
    - contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.reputationNumber
      description: "DNS Request reputation number."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.reputation
      description: "DNS Request reputation."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.ips
      description: "DNS Request IPs."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.domain
      description: "DNS Request domain."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.network.dnsRequests.time
      type: Date
      description: "DNS Request time estimate."
    - contextPath: ANYRUN.SandboxAnalysis.malconf
      type: Unknown
      description: "Analysis malconf."
    - contextPath: ANYRUN.SandboxAnalysis.processes.synchronization
      type: Unknown
      description: "Analysis processes synchronization."
    - contextPath: ANYRUN.SandboxAnalysis.processes.modules
      type: Unknown
      description: "Analysis processes modules."
    - contextPath: ANYRUN.SandboxAnalysis.processes.hasMalwareConfig
      description: "Process has malware config."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.parentUUID
      description: "Process parent UUID."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.status
      description: "Process status."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.malwareConfig
      description: "Process malware config."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.privEscalation
      description: "Process priv escalation."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.stealing
      description: "Process stealing."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.networkLoader
      description: "Process network loader."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.network
      description: "Process network."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.lowAccess
      description: "Process low access."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.knownThreat
      description: "Process known threat."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.injects
      description: "Process inject."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.exploitable
      description: "Process exploitable."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.executableDropped
      description: "Process executable dropped."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.debugOutput
      description: "Process debug output."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.crashedApps
      description: "Process crashed apps."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.specs.autoStart
      description: "Process auto start."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.loadsSusp
      description: "Process loads susp."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.injected
      description: "Process injected."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.dropped
      description: "Process dropped."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.verdict.threatLevelText
      description: "Process threat level text."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.verdict.threatLevel
      description: "Process threat level."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.verdict.score
      description: "Process score."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.context.userName
      description: "Process context username."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.context.integrityLevel
      description: "Process context integrity level."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.context.rebootNumber
      description: "Process context reboot number."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.versionInfo.version
      description: "Process version."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.versionInfo.description
      description: "Process description."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.versionInfo.company
      description: "Process company."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.mainProcess
      description: "Process main process."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.fileType
      description: "Process file type."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.fileName
      description: "Process filename."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.commandLine
      description: "Process cmd."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.image
      description: "Process image."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.uuid
      description: "Process uuid."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.ppid
      description: "Process PPID."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.important
      description: "Process important."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.pid
      description: "Process PID."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.exitCode
      description: "Process exit code."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.times.terminate
      type: Date
      description: "Process time terminate."
    - contextPath: ANYRUN.SandboxAnalysis.processes.times.start
      type: Date
      description: "Process time start."
    - contextPath: ANYRUN.SandboxAnalysis.processes.resolvedCOM.title
      description: "Process resolved COM title."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.synchronization.operation
      description: "Process sync operation."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.synchronization.type
      description: "Process sync type."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.synchronization.name
      description: "Process sync name."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.synchronization.time
      type: Date
      description: "Process sync time."
    - contextPath: ANYRUN.SandboxAnalysis.processes.modules.image
      description: "Process module image."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.modules.time
      type: Date
      description: "Process module time."
    - contextPath: ANYRUN.SandboxAnalysis.processes.scores.monitoringReason
      description: "Process monitoring reason."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.processes.times.monitoringSince
      type: Date
      description: "Process monitoring since."
    - contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.type.event
      description: "Process sync event."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.type.mutex
      description: "Process sync mutex."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.operation.create
      description: "Process sync operation create."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.operation.open
      description: "Process sync operation open."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.synchronization.total
      description: "Process sync total."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.registry.delete
      description: "Registry delete."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.registry.write
      description: "Registry write."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.registry.read
      description: "Registry reed."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.registry.total
      description: "Registry total."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.files.malicious
      description: "File malicious count."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.files.suspicious
      description: "File suspicious count."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.files.text
      description: "File text."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.files.unknown
      description: "File unknown count."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.network.threats
      description: "Network threats count."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.network.dns
      description: "Network dns count."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.network.connections
      description: "Network connections count."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.network.http
      description: "Network HTTP count."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.processes.malicious
      description: "Malicious processes count."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.processes.suspicious
      description: "Suspicious processes count."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.processes.monitored
      description: "Monitored processes count."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.counters.processes.total
      description: "Total processes count."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.hotfixes.title
      description: "Environment hotfixes title."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.software.version
      description: "Environment software version."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.software.title
      description: "Environment software title."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.internetExplorer.kbnum
      description: "Environment Internet Explorer KBNUM."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.internetExplorer.version
      description: "Environment Internet Explorer version."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.os.bitness
      description: "Environment OS version."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.os.softSet
      description: "Environment OS software set."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.os.servicePack
      description: "Environment OS service pack."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.os.major
      description: "Environment OS major version."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.os.productType
      description: "Environment OS product type."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.os.variant
      description: "Environment OS variant."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.os.product
      description: "Environment OS product."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.os.build
      description: "Environment OS build."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.environments.os.title
      description: "Environment OS title."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.dumps
      type: Unknown
      description: "Content dumps."
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.screenshots.thumbnailUrl
      description: "Screenshots thumbnail url."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.screenshots.permanentUrl
      description: "Screenshots permanent url."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.screenshots.time
      description: "Screenshots time."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.screenshots.uuid
      description: "Screenshots uuid."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.sslkeys.present
      description: "SSL keys present."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.pcap.permanentUrl
      description: "Pcap dump permanent url."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.pcap.present
      description: "Pcap present."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.video.permanentUrl
      description: "Video permanent url."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.video.present
      description: "Video present."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.ssdeep
      description: "Main object ssdeep."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.sha256
      description: "Main object sha256."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.sha1
      description: "Main object sha1."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.md5
      description: "Main object md5."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.url
      description: "Main object url."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.content.mainObject.type
      description: "Main object type."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.knownThreat
      description: "Specs known threat."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.malwareConfig
      description: "Specs malware Config."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.notStarted
      description: "Specs not started."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.privEscalation
      description: "Specs priv escalation."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.torUsed
      description: "Specs TOR used."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.suspStruct
      description: "Specs susp structure."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.stealing
      description: "Specs stealing."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.staticDetections
      description: "Specs static detections."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.spam
      description: "Specs spam."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.serviceLauncher
      description: "Specs service launcher."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.rebooted
      description: "Specs rebooted."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.networkThreats
      description: "Specs network threats."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.networkLoader
      description: "Specs network loader."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.multiprocessing
      description: "Specs multiprocessing."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.memOverrun
      description: "Specs memory overrun."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.lowAccess
      description: "Specs low access."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.exploitable
      description: "Specs exploitable."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.executableDropped
      description: "Specs executable dropped."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.debugOutput
      description: "Specs debug output."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.crashedTask
      description: "Specs crashed task."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.crashedApps
      description: "Specs crashed apps."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.cpuOverrun
      description: "Specs CPU overrun."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.autoStart
      description: "Specs suto start."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.specs.injects
      description: "Specs injects."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.verdict.threatLevelText
      description: "Verdict threat level text."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.verdict.threatLevel
      description: "Verdict threat level."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.scores.verdict.score
      description: "Verdict score."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.automatization.uac
      description: "Options automatization UAC."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.privateSample
      description: "Options private sample."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.privacy
      description: "Options privacy."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.network
      description: "Options network."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.hideSource
      description: "Options hide source."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.video
      description: "Options video."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.presentation
      description: "Options presentation."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.tor.used
      description: "Options tor used."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.mitm
      description: "Options MITM proxy."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.heavyEvasion
      description: "Options kernel heavy evasion."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.fakeNet
      description: "Options fake network."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.additionalTime
      description: "Options additions time."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.options.timeout
      description: "Options timeout."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.tags
      type: Unknown
      description: "Analysis tags."
    - contextPath: ANYRUN.SandboxAnalysis.analysis.stopExecText
      type: Date
      description: "Analysis stopExecText."
    - contextPath: ANYRUN.SandboxAnalysis.analysis.stopExec
      type: Date
      description: "Analysis creation stopExec."
    - contextPath: ANYRUN.SandboxAnalysis.analysis.creationText
      type: Date
      description: "Analysis creation creation text."
    - contextPath: ANYRUN.SandboxAnalysis.analysis.creation
      type: Date
      description: "Analysis creation date."
    - contextPath: ANYRUN.SandboxAnalysis.analysis.duration
      description: "Analysis duration."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.sandbox.plan.name
      description: "Analysis sandbox user plan name."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.sandbox.name
      description: "Analysis sandbox name."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.reports.graph
      description: "Analysis reports graph."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.reports.STIX
      description: "Analysis STIX report url."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.reports.HTML
      description: "Analysis HTML report url."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.reports.MISP
      description: "Analysis MISP report url."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.reports.IOC
      description: "Analysis IOC report url."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.permanentUrl
      description: "Analysis permanent url."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.analysis.uuid
      description: "Analysis uuid."
      type: String
    - contextPath: ANYRUN.SandboxAnalysis.status
      description: "Analysis status."
      type: String
  - arguments:
    - description: "Sandbox task uuid."
      name: task_uuid
      required: true
      type: String
    name: anyrun-download-analysis-pcap
    description: "Returns the analysis network traffic dump."
  - arguments:
    - description: "Sandbox task uuid."
      name: task_uuid
      required: true
      type: String
    name: anyrun-download-analysis-sample
    description: "Returns the analysis file in zip archive. Archive password: infected."
  - arguments:
    - description: "Sandbox task uuid."
      name: task_uuid
      required: true
      type: String
    name: anyrun-get-analysis-verdict
    description: "Returns a threat level text. Possible values: No threats detected, Suspicious activity, Malicious activity."
    outputs:
    - contextPath: ANYRUN.SandboxAnalysisReportVerdict
      description: "The analysis verdict."
      type: String
  dockerimage: demisto/anyrun-sdk:1.0.0.10440656
  subtype: python3
  runonce: false
  script: '-'
  type: python
tests:
- No tests
fromversion: 6.0.0