CrowdStrike Falcon Sandbox V2
Fully automated malware analysis using Hybrid Analysis API.
Forensics & Malware Analysis · CrowdStrike Falcon Sandbox
Details
| ID | CrowdStrike Falcon Sandbox V2 |
|---|---|
| Provider | CrowdStrike |
| Category | Forensics & Malware Analysis |
| From Version | 6.2.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
README
CrowdStrike Falcon Sandbox v2
Use the CrowdStrike Falcon Sandbox integration to submit and analyze files and URLs.
This integration is backwards compatible with the CrowdStrike Falcon Sandbox integration.
Prerequisites
Make sure you have the API key for CrowdStrike Falcon Sandbox v2.
Each API key has an associated authorization level, which determines the available endpoints. By default, all free, non-vetted accounts can issue restricted keys. You can upgrade to full default keys, enabling file submissions and downloads.
Get an API Key
You must have an account with Hybrid-Analysis. If you do not have an account, you can sign up here.
Obtain an API key by:
- In your profile page, from the top right menu navigate to the API key tab.
- Click the Create API key button.
Configure CrowdStrike Falcon Sandbox v2 in Cortex
| Parameter | Description | Required | |
|---|---|---|---|
| Server URL | The Server URL of the CrowdStrike Falcon Sandbox instance. By default, https://www.hybrid-analysis.com |
True | |
| API Key | True | ||
| Source Reliability | Reliability of the source providing the intelligence data. | True | |
| Trust any certificate (not secure) | False | ||
| Use system proxy settings | False |
Supported File Types
- PE (.exe, .scr, .pif, .dll, .com, .cpl, and so on)
- Microsoft Word (.doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub)
- APK
- JAR executables
- Windows Script Component (.sct)
- Windows Shortcut (.lnk)
- Windows Help (.chm)
- HTML Application (.hta)
- Windows Script File (*.wsf)
- Javascript (.js)
- Visual Basic (.vbs,.vbe)
- Shockwave Flash (.swf)
- Perl (.pl)
- PowerShell (.ps1, .psd1, .psm1)
- Scalable Vector Graphics (.svg)
- Python scripts (.py)
- Perl scripts (.pl)
- Linux ELF executables
- MIME RFC 822 (*.eml)
- Outlook (*.msg files)
The maximum file upload size is 100 MB.
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
cs-falcon-sandbox-scan
Gets report summary information for a job_id or a sha256 hash.
Base Command
cs-falcon-sandbox-scan
Input
| Argument Name | Description | Required |
|---|---|---|
| file | A comma-separated list of file hashes (SHA256), followed by an environment ID, separated by colon (:). For example, SHA256_1:ENV_ID_1,SHA256_2:ENV_ID_2. Use this argument or the job_id argument. | Optional |
| environmentID | A comma-separated list of environment IDs. That list would be used with, and should be the same length, as the file argument. Available environment IDs: 310: “Linux (Ubuntu 20, 64-bit)”, 200: “Android Static Analysis”, 120: “Windows 7 64 bit”, 110: “Windows 7 32 bit (HWP Support)”, 100: “Windows 7 32 bit”. | Optional |
| polling | Whether to poll until there is at least one result. Possible values are: true, false. | Optional |
| JobID | A comma-separated list of JobIDs to check the state of when polling. Use this argument or the file argument. | Optional |
| hide_polling_output | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.Report.job_id | String | The report job ID. |
| CrowdStrike.Report.environment_id | Number | The report environment ID. |
| CrowdStrike.Report.environment_description | String | The environment description. |
| CrowdStrike.Report.size | Number | The file size. |
| CrowdStrike.Report.type | String | The file type. |
| CrowdStrike.Report.type_short | String | The short description of the file type. |
| CrowdStrike.Report.target_url | String | The target url. |
| CrowdStrike.Report.state | String | The report state. |
| CrowdStrike.Report.error_type | String | The error type. |
| CrowdStrike.Report.error_origin | String | The error origin. |
| CrowdStrike.Report.submit_name | String | The name of the file when submitted. |
| CrowdStrike.Report.md5 | String | The MD5 hash of the file. |
| CrowdStrike.Report.sha1 | String | The SHA1 hash of the file. |
| CrowdStrike.Report.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.sha512 | String | The SHA512 hash of the file. |
| CrowdStrike.Report.ssdeep | String | The SSDeep hash of the file. |
| CrowdStrike.Report.imphash | String | The imphash hash of the file. |
| CrowdStrike.Report.av_detect | Number | The AV Multiscan range, for example 50-70 (min 0, max 100). |
| CrowdStrike.Report.vx_family | String | The file malware family. |
| CrowdStrike.Report.url_analysis | Boolean | Whether this report is url analysis. |
| CrowdStrike.Report.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.Report.threat_score | Number | The file threat score. |
| CrowdStrike.Report.interesting | Boolean | Whether the file was found to be interesting. |
| CrowdStrike.Report.threat_level | Number | The file threat level. |
| CrowdStrike.Report.verdict | String | The file verdict. |
| CrowdStrike.Report.total_network_connections | Number | The total number of network connections. |
| CrowdStrike.Report.total_processes | Number | The total number of processes. |
| CrowdStrike.Report.total_signatures | Number | The total number of signatures. |
| CrowdStrike.Report.file_metadata | Object | The file metadata. |
| CrowdStrike.Report.submissions.submission_id | String | The submission ID. |
| CrowdStrike.Report.submissions.filename | String | The name of the file. |
| CrowdStrike.Report.submissions.url | String | The url. |
| CrowdStrike.Report.submissions.created_at | Date | When the submission was created. |
| CrowdStrike.Report.network_mode | String | The network mode. |
| File.SHA256 | string | The SHA256 hash of the file. |
| File.SHA1 | string | The SHA1 hash of the file. |
| File.MD5 | string | The MD5 hash of the file. |
| File.Name | string | The file submission name. |
| File.MalwareFamily | string | The file family classification. |
| File.Malicious.Vendor | string | The vendor that decided the file was malicious. |
| File.Malicious.Description | string | The reason the vendor decided the file was malicious. |
| DBotScore.Indicator | string | The tested indicator. |
| DBotScore.Type | string | The indicator type. |
| DBotScore.Vendor | string | The vendor used to calculate the score. |
| DBotScore.Score | number | The actual score. |
cs-falcon-sandbox-get-environments
Gets a list of all available environments.
Base Command
cs-falcon-sandbox-get-environments
Input
| Argument Name | Description | Required |
| — | — | — |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.Environment.ID | number | The environment ID. |
| CrowdStrike.Environment.description | string | The environment description. |
| CrowdStrike.Environment.architecture | string | The environment architecture. |
| CrowdStrike.Environment.VMs_total | number | The total number of virtual machines in the environment. |
| CrowdStrike.Environment.VMs_busy | number | The number of busy virtual machines in the environment. |
| CrowdStrike.Environment.analysisMode | string | The environment analysis mode. |
| CrowdStrike.Environment.groupicon | string | The environment icon. |
Command example
#### Context Example
```json
{
"CrowdStrike": {
"Environment": [
{
"ID": 100,
"VMs_busy": 9223372036854776000,
"VMs_total": 9223372036854776000,
"analysisMode": "KERNELMODE",
"architecture": "WINDOWS",
"description": "Windows 7 32 bit",
"groupicon": "windows",
"id": "100",
"invalid_virtual_machines": 0,
"virtual_machines": []
},
{
"ID": 110,
"VMs_busy": 9223372036854776000,
"VMs_total": 9223372036854776000,
"analysisMode": "KERNELMODE",
"architecture": "WINDOWS",
"description": "Windows 7 32 bit (HWP Support)",
"groupicon": "windows",
"id": "110",
"invalid_virtual_machines": 0,
"virtual_machines": []
},
{
"ID": 120,
"VMs_busy": 9223372036854776000,
"VMs_total": 9223372036854776000,
"analysisMode": "KERNELMODE",
"architecture": "WINDOWS",
"description": "Windows 7 64 bit",
"groupicon": "windows",
"id": "120",
"invalid_virtual_machines": 0,
"virtual_machines": []
},
{
"ID": 300,
"VMs_busy": 9223372036854776000,
"VMs_total": 9223372036854776000,
"analysisMode": "USERMODE",
"architecture": "LINUX",
"description": "Linux (Ubuntu 16.04, 64 bit)",
"groupicon": "linux",
"id": "300",
"invalid_virtual_machines": 0,
"virtual_machines": []
},
{
"ID": 200,
"VMs_busy": 9223372036854776000,
"VMs_total": 9223372036854776000,
"analysisMode": "USERMODE",
"architecture": "ANDROID",
"description": "Android Static Analysis",
"groupicon": "android",
"id": "200",
"invalid_virtual_machines": 0,
"virtual_machines": []
}
]
}
}
Human Readable Output
Execution Environments
_ID Description Architecture Total VMS Busy VMS Analysis mode Group icon 100 Windows 7 32 bit WINDOWS 9223372036854775807 9223372036854775807 KERNELMODE windows 110 Windows 7 32 bit (HWP Support) WINDOWS 9223372036854775807 9223372036854775807 KERNELMODE windows 120 Windows 7 64 bit WINDOWS 9223372036854775807 9223372036854775807 KERNELMODE windows 300 Linux (Ubuntu 16.04, 64 bit) LINUX 9223372036854775807 9223372036854775807 USERMODE linux 200 Android Static Analysis ANDROID 9223372036854775807 9223372036854775807 USERMODE android
cs-falcon-sandbox-submit-sample
Submits a file from the investigation to the analysis server.
Base Command
cs-falcon-sandbox-submit-sample
Input
| Argument Name | Description | Required |
|---|---|---|
| entryId | The War Room entry ID. | Required |
| environmentID | The environment ID. Available environment IDs: 310: “Linux (Ubuntu 20, 64-bit)”, 200: “Android Static Analysis”, 120: “Windows 7 64 bit”, 110: “Windows 7 32 bit (HWP Support)”, 100: “Windows 7 32 bit”. Possible values are: 100, 110, 120, 200, 310. Default is 100. | Required |
| polling | Whether the command should poll until the result is ready. Possible values are: true, false. | Optional |
| no_share_third_party | When set to ‘true’, the sample is never shared with any third party. Possible values are: true, false. | Optional |
| no_hash_lookup | When set to ‘true’, no hash lookup is done on the sample. Possible values are: true, false. | Optional |
| allow_community_access | When set to ‘true’, the sample is available for the community. Possible values are: true, false. | Optional |
| action_script | Optional custom runtime action script. Available runtime scripts: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie. Possible values are: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie. | Optional |
| hybrid_analysis | When set to ‘false’, no memory dump or memory dump analysis is done. Possible values are: true, false. | Optional |
| experimental_anti_evasion | When set to ‘true’, sets all Kernelmode Monitor experimental anti-evasion options. Possible values are: true, false. | Optional |
| script_logging | When set to ‘true’, sets the Kernelmode Monitor in-depth script logging engine. Possible values are: true, false. | Optional |
| input_sample_tampering | When set to ‘true’, allows Kernelmode Monitor experimental anti-evasion options that tamper with the input sample. Possible values are: true, false. | Optional |
| network_settings | Network settings. Available options: default: ‘Fully operating network’, tor: ‘Route network traffic via TOR’, simulated: ‘Simulate network traffic’. Possible values are: default, tor, simulated. | Optional |
| Optional email address that may be associated with the submission for notification. | Optional | |
| comment | Optional comment text that may be associated with the submission/sample (Note: you can use #tags). | Optional |
| custom_cmd_line | Optional command line that should be passed to the analysis file. | Optional |
| custom_run_time | Optional runtime duration (in seconds). | Optional |
| submit_name | Optional ‘submission name’ field that will be used for file type detection and analysis. Ignored unless url contains a file. | Optional |
| priority | Optional priority value between 1 (lowest) and 10 (highest). By default all samples run with highest priority. Possible values are: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10. | Optional |
| document_password | Optional document password used to fill in Adobe/Office password prompts. | Optional |
| environment_variable | Optional system environment value. The value is provided in the format name=value. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.Submit.job_id | String | The submitted report job ID. |
| CrowdStrike.Submit.submission_id | String | The report submission ID. |
| CrowdStrike.Submit.environment_id | Number | The report environment ID. |
| CrowdStrike.Submit.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.job_id | String | The report job ID. |
| CrowdStrike.Report.environment_id | Number | The report environment ID. |
| CrowdStrike.Report.environment_description | String | The environment description. |
| CrowdStrike.Report.size | Number | The file size. |
| CrowdStrike.Report.type | String | The file type. |
| CrowdStrike.Report.type_short | String | The short description of the file type. |
| CrowdStrike.Report.target_url | String | The target url. |
| CrowdStrike.Report.state | String | The report state. |
| CrowdStrike.Report.error_type | String | The error type. |
| CrowdStrike.Report.error_origin | String | The error origin. |
| CrowdStrike.Report.submit_name | String | The name of the file when submitted. |
| CrowdStrike.Report.md5 | String | The MD5 hash of the file. |
| CrowdStrike.Report.sha1 | String | The SHA1 hash of the file. |
| CrowdStrike.Report.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.sha512 | String | The SHA512 hash of the file. |
| CrowdStrike.Report.ssdeep | String | The SSDeep hash of the file. |
| CrowdStrike.Report.imphash | String | The imphash hash of the file. |
| CrowdStrike.Report.av_detect | Number | The AV Multiscan range, for example 50-70 (min 0, max 100). |
| CrowdStrike.Report.vx_family | String | The file malware family. |
| CrowdStrike.Report.url_analysis | Boolean | Whether this report is url analysis. |
| CrowdStrike.Report.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.Report.threat_score | Number | The file threat score. |
| CrowdStrike.Report.interesting | Boolean | Whether the file was found to be interesting. |
| CrowdStrike.Report.threat_level | Number | The file threat level. |
| CrowdStrike.Report.verdict | String | The file verdict. |
| CrowdStrike.Report.total_network_connections | Number | The total number of network connections. |
| CrowdStrike.Report.total_processes | Number | The total number of processes. |
| CrowdStrike.Report.total_signatures | Number | The total number of signatures. |
| CrowdStrike.Report.file_metadata | Object | The file metadata. |
| CrowdStrike.Report.submissions.submission_id | String | The submission ID |
| CrowdStrike.Report.submissions.filename | String | The name of the file. |
| CrowdStrike.Report.submissions.url | String | The url. |
| CrowdStrike.Report.submissions.created_at | Date | When the submission was created. |
| CrowdStrike.Report.network_mode | String | The network mode. |
| File.SHA256 | string | The SHA256 hash of the file. |
| File.SHA1 | string | The SHA1 hash of the file |
| File.MD5 | string | The MD5 hash of the file. |
| File.Name | string | The file submission name. |
| File.MalwareFamily | string | The file family classification. |
| File.Malicious.Vendor | string | The vendor that decided the file was malicious. |
| File.Malicious.Description | string | The reason the vendor decided the file was malicious. |
| DBotScore.Indicator | string | The tested indicator. |
| DBotScore.Type | string | The indicator type. |
| DBotScore.Vendor | string | The vendor used to calculate the score. |
| DBotScore.Score | number | The actual score. |
cs-falcon-sandbox-search
Searches the database using the Falcon Sandbox search syntax.
Base Command
cs-falcon-sandbox-search
Input
| Argument Name | Description | Required |
|---|---|---|
| query | The Falcon Sandbox query syntax, for example url:google,host:95.181.53.78. This argument integrates all other arguments into one and cannot be given along with the other arguments. | Optional |
| filename | The file name, for example invoice.exe. | Optional |
| filetype | The file type. Available options: 64bits, android, assembly, bat, cmd, com, csv, data, doc, docx, elf, empty, executable, flash, html, hwp, hwpx, img, iqy, java, javascript, library, lnk, macho, mshelp, msi, native, neexe, office, outlook, pdf, pedll, peexe, perl, ppt, pptx, ps, pub, python, rtf, script, sct, sh, svg, text, url, vbe, vbs, wsf, xls, xlsx. | Optional |
| filetype_desc | The file type description, for example PE32 executable. | Optional |
| env_id | The environment ID. | Optional |
| country | The country (3 digit ISO), for example swe. | Optional |
| verdict | The search result verdict. Available options: Whitelisted, NoVerdict, NoSpecificThreat, Suspicious, Malicious. Possible values are: Whitelisted, NoVerdict, NoSpecificThreat, Suspicious, Malicious. | Optional |
| av_detect | The AV Multiscan range, for example 50-70 (min 0, max 100). | Optional |
| vx_family | The AV Family Substring, for example nemucod. | Optional |
| limit | The max number of search results to return. Default is 10. | Optional |
| tag | The hashtag, for example ransomware. | Optional |
| date_from | The date from in format ‘YYYY-MM-DD HH:MM’, for example 2018-09-28 15:30. | Optional |
| date_to | The date to in format ‘YYYY-MM-DD HH:MM’, for example 2018-09-28 15:30. | Optional |
| port | The port, for example 8080. | Optional |
| host | The host, for example 192.168.0.1. | Optional |
| domain | The domain, for example checkip.dyndns.org. | Optional |
| url | The HTTP request substring, for example google. | Optional |
| similar_to | Similar samples, for example <sha256>. | Optional |
| context | Sample context, for example <sha256>. | Optional |
| imp_hash | The import hash. | Optional |
| ssdeep | The SSDeep hash. | Optional |
| authentihash | The file authentihash. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| File.SHA256 | string | The SHA256 hash of the file. |
| File.Name | string | The file submission name. |
| File.MalwareFamily | string | The file family classification. |
| File.Extension | string | The file extension. |
| File.MalwareFamily | String | The malware family associated with the file. |
| CrowdStrike.Search.search_terms.id | String | The id of the search term. |
| CrowdStrike.Search.search_terms.value | String | The value of the search term. |
| CrowdStrike.Search.count | Number | The number of results for this search. |
| CrowdStrike.Search.result.verdict | String | The file verdict. |
| CrowdStrike.Search.result.av_detect | String | The AV Multiscan range, for example 50-70 (min 0, max 100). |
| CrowdStrike.Search.result.threat_score | Number | The file threat score. |
| CrowdStrike.Search.result.vx_family | String | The file malware family. |
| CrowdStrike.Search.result.job_id | String | The JobID of the result. |
| CrowdStrike.Search.result.sha256 | String | The sha256 hash of the file. |
| CrowdStrike.Search.result.environment_id | Number | The environment ID. |
| CrowdStrike.Search.result.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.Search.result.submit_name | String | The name of the file. |
| CrowdStrike.Search.result.environment_description | String | The environment description. |
| CrowdStrike.Search.result.size | Number | The size of the file. |
| CrowdStrike.Search.result.type | String | The file type. |
| CrowdStrike.Search.result.type_short | String | The short description of the file type. |
Command example
!cs-falcon-sandbox-search filename=sample.pdf
Context Example
{
"CrowdStrike": {
"Search": [
{
"analysis_start_time": "2020-09-15T16:47:06+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "5f60f00aeac13102de2fce70",
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"size": 3028,
"submit_name": "file",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "whitelisted",
"vx_family": null
},
{
"analysis_start_time": "2021-11-30 03:00:10",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "61a593b82d8c3b27e521d683",
"sha256": "e4c0b73252211528f355e7db301da6369e69e079c6daad9e8fbb0134cc44ce27",
"size": 160626,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-11-05 17:02:53",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "618551a497ef941c2b423271",
"sha256": "2f0de9415b0e746b1189d939d84d0dd15ea93d457bd0a42ebec8b52475c2be63",
"size": 468452,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-08-09 07:15:50",
"av_detect": "25",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "6110d6214689581ac34e89ab",
"sha256": "98983e00b47bcbe9ebbaf5f28ea6cdbf619dd88c91f481b18fec7ffdb68ab741",
"size": 254635,
"submit_name": "Sample.pdf",
"threat_score": 100,
"type": null,
"type_short": "pdf",
"verdict": "malicious",
"vx_family": "RDN/Generic.cf"
},
{
"analysis_start_time": "2021-07-30 17:31:11",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "61043759e4ae00628e4757d9",
"sha256": "45d2de1252ebd402728b2cb810d8a9232a99e9887f75146d2e7d1d84d46fd360",
"size": 561412,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-06-24 02:53:57",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "60d3f3bb942da51feb3c77b5",
"sha256": "b33d6fa9eac776c1ad07c406bacef7c9af8ce052a181a5801a0bffa1f24ebf1d",
"size": 25138418,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-06-03 09:49:10",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "60b8a59139899b32c2459c98",
"sha256": "7207460b6cf6e4965b7ab20bfadca652ab1629240781e49f7e783de8a9c31900",
"size": 370299,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2020-08-04 18:46:31",
"av_detect": "2",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5f29acffc8af093b787e92de",
"sha256": "4af3aa3c6afd3db86a65f191bd69306650e12475fd5611ccaec5519543276d5a",
"size": 64532,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": "Unavailable"
},
{
"analysis_start_time": "2020-07-08 15:39:36",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5f05c7c22ada7e11701edcc2",
"sha256": "02b0fcf5406a4cd1c816ea21bc25f6f0bcb5ae36b8da9526d3af6f5aab89b6de",
"size": 394003,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2020-06-18 15:15:46",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5eeb85187ce0e079d35424e7",
"sha256": "3714ef17995d459f9c81d99b77bdef830b24dbe28d893b2b4f1952279ca91aa6",
"size": 5639308,
"submit_name": "sample.pdf",
"threat_score": 29,
"type": null,
"type_short": "pdf",
"verdict": "suspicious",
"vx_family": null
},
{
"analysis_start_time": "2020-06-05T07:35:10+00:00",
"av_detect": "42",
"environment_description": "Linux (Ubuntu 16.04, 64 bit)",
"environment_id": 300,
"job_id": "5ed9f5ae2466ef104967e5bb",
"sha256": "9d0bfa6a3c99f83bb6d9fb4822855c488dedd3a9a2fe19010e0e176437422b04",
"size": 5732088,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "64-bit elf",
"verdict": null,
"vx_family": "Unavailable"
},
{
"analysis_start_time": "2020-06-04 05:21:19",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5ed884ca8989f014bf0a2867",
"sha256": "91f5a577e0df35103c8bf6d5d5ea6690b97ed319570ba61688379d254fe9b1ed",
"size": 159219,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2020-05-10 06:06:38",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5eb799e4098ed957b177f7f1",
"sha256": "6822023d6f22b0f08f788c4528eed07c424603b1d68fc4fdb8ef8a9e6dfab3b6",
"size": 69992,
"submit_name": "Sample.pdf",
"threat_score": 56,
"type": null,
"type_short": "pdf",
"verdict": "suspicious",
"vx_family": null
},
{
"analysis_start_time": "2020-02-14 04:50:05",
"av_detect": null,
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5e4626f1428a7c6bd26e42e8",
"sha256": "a5963f78a27e384421e23ff54974094a34112b8eeec77615cd4235d7b82812c7",
"size": 35270,
"submit_name": "sample.pdf",
"threat_score": 35,
"type": null,
"type_short": "html",
"verdict": "suspicious",
"vx_family": null
},
{
"analysis_start_time": "2019-09-25 07:30:35",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5d8b17a8028838f13e7f6bf4",
"sha256": "7856688c84402d991250abf44d8bea30131837f11a69891fb9597816e8902f4e",
"size": 189630,
"submit_name": "sample.pdf",
"threat_score": 45,
"type": null,
"type_short": "pdf",
"verdict": "suspicious",
"vx_family": null
},
{
"analysis_start_time": "2019-09-25 07:04:24",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5d8b1180028838e40e7f6bc1",
"sha256": "ed511c548b99fe89836cbd9258e81a9f84df95bb8fc8cccc7958b2b5bd40a6e3",
"size": 186763,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": "Unavailable"
},
{
"analysis_start_time": "2019-09-09 09:07:09",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5d7616ef0388386b85511900",
"sha256": "6d056be8945a60bc2f68c6468bd4f6b68a37f99e69090478e0f8f078b9763176",
"size": 50790,
"submit_name": "sample.pdf",
"threat_score": 29,
"type": null,
"type_short": "pdf",
"verdict": "suspicious",
"vx_family": null
},
{
"analysis_start_time": "2019-09-01T10:31:54+00:00",
"av_detect": null,
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5d6b9e1a0288383930c48455",
"sha256": "8b46920adaa5a4d2d2912f68452dea622fa215d78e923a878647a5febe082a36",
"size": 58,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "text",
"verdict": null,
"vx_family": null
},
{
"analysis_start_time": "2019-09-01T10:00:10+00:00",
"av_detect": null,
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5d6b96660388389c397057c2",
"sha256": "84e0435537ceedd0819188759387f4eeb59c8bc63d243c9b4a3399a90e564715",
"size": 41,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "text",
"verdict": null,
"vx_family": null
},
{
"analysis_start_time": "2019-06-22 12:25:24",
"av_detect": "0",
"environment_description": "Windows 7 32 bit (HWP Support)",
"environment_id": 110,
"job_id": "5d0e1e790288380b0e2af5eb",
"sha256": "9fcb5ed2265c1aca54a8e4ebc847e0c9c19b7aa7984f3e7ca0794b314057505e",
"size": 2669339,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-04-22 06:41:37",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5cbd62160388381a4caf198e",
"sha256": "6042d499aca0c5700fb416a4970fdd9238272397732beda9b4065a21c0150e8e",
"size": 440654,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-03-29 04:41:26",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5c9da41c02883869997acd28",
"sha256": "c979e4b6a1850794609860fcc68bda58edc0f51989d57a199808d3f1a2564d7a",
"size": 95318,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-03-20T17:45:03+00:00",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5c927c1f038838b59636b712",
"sha256": "b26054c33e5f201a2a4cafb5047c576115c389451e5a74f3f75400e4f0504512",
"size": 95271,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": null,
"vx_family": null
},
{
"analysis_start_time": "2019-03-19 06:38:41",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5c909092028838fe55b4f755",
"sha256": "f8bf163014405cd4dc8f133fc563886e92a2b98862edd98d5f8656eba67db284",
"size": 496372,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-03-14 17:06:41",
"av_detect": null,
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5c8a8c39038838899a329921",
"sha256": "65ab8a0fd8920379c37d03ad3b5f7d62d5a8b00b902c5d72229269328aa2221f",
"size": 1317691,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-03-09 06:40:22",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5c8361e20388387f5d1006a4",
"sha256": "e28401b6fa6f8fafc7db5946c30a18ab2d306748b277609caec5ecf970506529",
"size": 696561,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-02-26 18:41:27",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5c758a5a038838514ca50f27",
"sha256": "a84b84b85911e68b421172a1d857da81706a7608eae6415e9a52bb9e59801e59",
"size": 1154729,
"submit_name": "sample.pdf",
"threat_score": 20,
"type": null,
"type_short": "pdf",
"verdict": "malicious",
"vx_family": null
},
{
"analysis_start_time": "2019-02-15 09:36:27",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5c6676c07ca3e17d121f3f11",
"sha256": "855e15b9e02ff992d81e2cf93fdec286b81e8374b5acad5a9009d1569ca86cf0",
"size": 324101,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-01-30T18:15:14-06:00",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5c5236d97ca3e107a93e8333",
"sha256": "33adb4f6630443600d5d1381350ac018f1676d8523084af814b5c01da3e7a609",
"size": 80468,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "raw data",
"verdict": null,
"vx_family": null
},
{
"analysis_start_time": "2018-10-17 08:14:46",
"av_detect": "67",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5bc6d34b7ca3e104a26ff5c3",
"sha256": "a927b3f2244e901e23e50f6b7a4929b837f0f0d1d8e0dc0a1957f5208b4e4e51",
"size": 11961,
"submit_name": "extract-1424750780.560286-HTTP-FTdiED2cMH3iOTs3c4.raw.pdf",
"threat_score": 100,
"type": null,
"type_short": "pdf",
"verdict": "malicious",
"vx_family": "PDF:Exploit.PDF"
},
{
"analysis_start_time": "2016-08-27 06:28:06",
"av_detect": "75",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "57c116c0aac2edfe59c7c2a0",
"sha256": "86a96ec03ba8242c1486456d67ee17f919128754846dbb3bdf5e836059091dba",
"size": 10866,
"submit_name": "pdf-doc-vba-eicar-dropper.pdf",
"threat_score": 100,
"type": null,
"type_short": "pdf",
"verdict": "malicious",
"vx_family": "Trojan.Eicartest"
},
{
"analysis_start_time": "2022-01-11T03:46:07+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "61dcfd7f797bea289de8eaff",
"sha256": "55c3b94ca033edb56010d8cfbbc17c900911e0f5bc938020debdc8d454a15313",
"size": 254738,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2022-01-05T12:02:39+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "61d588df797bea289d371b1d",
"sha256": "6332a96c88c486d1b396f9346e689d1ad15c06ae733539cd4e66a2bd8dbec9ff",
"size": 218816,
"submit_name": "SAMPLE.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-07-28T05:48:32+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "6100efb09a02dd8ce6bb695a",
"sha256": "177661da747aebe78fa66313ca239143a226be23d397a5327329c732c4d2670b",
"size": 727215,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": "Unavailable"
},
{
"analysis_start_time": "2021-03-17T06:15:46+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "60519e929a02dd8ce6f4090c",
"sha256": "111ee199588c1a167be496933b037fefaa69c45404f915054edc8e209a73fa4c",
"size": 215461,
"submit_name": "SAMPLE.PDF",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-01-11T08:18:07+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "5ffc09bf40fe1d5daa5ca658",
"sha256": "dc13bd74b9e78ea241bbb0736a8e660eb56afc53b2701b75964d89cb47f6edb0",
"size": 1285713,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-01-08T05:47:16+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "5ff7f1e440fe1d5daa17422b",
"sha256": "6486ef92ad7b591f6da0eacf04304840e8d293b591ca4e48c2eeca664bf0d120",
"size": 2037209,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2020-12-10T03:33:47+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "5fd1971b40fe1d5daa721221",
"sha256": "d60dee8111b0289e66e5858dd27f29855d1611f3602564f0cdfe06725790c144",
"size": 268886,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2020-11-25T13:16:42+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "5fbe593a40fe1d5daa57823e",
"sha256": "5ff12f55a1a8c198ccafff9e1920b9e2a5d5cde0f2f6cfe787264c43cbac808c",
"size": 381447,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
}
]
},
"File": [
{
"Extension": "pdf",
"JobID": "620587e270d21856e87f7164",
"MalwareFamily": "Trojan.PDF.Phishing",
"Name": "sample.pdf",
"SHA256": "9e8eb1889ec6b32a6074dd5b963c84fd27d7ba7f314ea997f3e3eb4a1ac70757",
"Size": 164833,
"av_detect": "61",
"environmentDescription": "Windows 7 32 bit",
"environmentId": 100,
"size": 164833,
"start_time": "2022-02-10 21:47:19",
"submitname": "sample.pdf",
"threatscore": 95,
"type": null,
"type_short": "pdf",
"verdict": "malicious",
"vx_family": "Trojan.PDF.Phishing"
},
{
"Extension": "pdf",
"JobID": "6204334534edcd3b4a77c57e",
"Name": "sample.pdf",
"SHA256": "05fd3790624f8eed569a244ea550231f173e9c697c85a8a762a1cdac156548c8",
"Size": 96456,
"av_detect": "0",
"environmentDescription": "Linux (Ubuntu 16.04, 64 bit)",
"environmentId": 300,
"size": 96456,
"start_time": "2022-02-09T21:33:57+00:00",
"submitname": "sample.pdf",
"threatscore": null,
"type": null,
"type_short": "pdf",
"verdict": null,
"vx_family": null
},
{
"Extension": "pdf",
"JobID": "620232a39f065a6af02c3ca3",
"Name": "sample.pdf",
"SHA256": "2834c221137f03516befdfb3fec545442bb77de3984f141212e4813da924e0c2",
"Size": 126204,
"av_detect": "0",
"environmentDescription": "Windows 7 32 bit",
"environmentId": 100,
"size": 126204,
"start_time": "2022-02-08 09:06:45",
"submitname": "sample.pdf",
"threatscore": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"Extension": "pdf",
"JobID": "6201302fba54b008a31228ef",
"Name": "sample.pdf",
"SHA256": "fb6dd79ebb7755eb5aeabf605e6a30e0de5090e4b3039c9b0337877f435c4d66",
"Size": 120719,
"av_detect": "0",
"environmentDescription": "Windows 7 32 bit",
"environmentId": 100,
"size": 120719,
"start_time": "2022-02-07 14:44:06",
"submitname": "sample.pdf",
"threatscore": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"Extension": "pdf",
"JobID": "61ae29f24e69ff77d566ab48",
"Name": "samplePdf.pdf",
"SHA256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"Size": 3506,
"av_detect": "0",
"environmentDescription": "Android Static Analysis",
"environmentId": 200,
"size": 3506,
"start_time": "2021-12-06 15:19:23",
"submitname": "samplePdf.pdf",
"threatscore": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"Extension": "pdf",
"JobID": "61a593b82d8c3b27e521d683",
"Name": "Sample.pdf",
"SHA256": "e4c0b73252211528f355e7db301da6369e69e079c6daad9e8fbb0134cc44ce27",
"Size": 160626,
"av_detect": "0",
"environmentDescription": "Windows 7 32 bit",
"environmentId": 100,
"size": 160626,
"start_time": "2021-11-30 03:00:10",
"submitname": "Sample.pdf",
"threatscore": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"Extension": "pdf",
"JobID": "618551a497ef941c2b423271",
"Name": "sample.pdf",
"SHA256": "2f0de9415b0e746b1189d939d84d0dd15ea93d457bd0a42ebec8b52475c2be63",
"Size": 468452,
"av_detect": "0",
"environmentDescription": "Windows 7 32 bit",
"environmentId": 100,
"size": 468452,
"start_time": "2021-11-05 17:02:53",
"submitname": "sample.pdf",
"threatscore": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"Extension": "pdf",
"JobID": "6110d6214689581ac34e89ab",
"MalwareFamily": "RDN/Generic.cf",
"Name": "Sample.pdf",
"SHA256": "98983e00b47bcbe9ebbaf5f28ea6cdbf619dd88c91f481b18fec7ffdb68ab741",
"Size": 254635,
"av_detect": "25",
"environmentDescription": "Windows 7 64 bit",
"environmentId": 120,
"size": 254635,
"start_time": "2021-08-09 07:15:50",
"submitname": "Sample.pdf",
"threatscore": 100,
"type": null,
"type_short": "pdf",
"verdict": "malicious",
"vx_family": "RDN/Generic.cf"
}
]
}
Human Readable Output
Search Results
Submit Name Verdict Vx Family Threat Score Sha 256 Size Environment Id Type Short Analysis Start Time sample.pdf 8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 3028 300 2022-01-10T08:33:11+00:00 sample.pdf 8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 3028 300 2022-01-10T07:38:29+00:00 samplePdf.pdf no specific threat 8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 3506 200 2021-12-06 15:19:23 Sample.pdf no specific threat e4c0b73252211528f355e7db301da6369e69e079c6daad9e8fbb0134cc44ce27 160626 100 2021-11-30 03:00:10 sample.pdf no specific threat 2f0de9415b0e746b1189d939d84d0dd15ea93d457bd0a42ebec8b52475c2be63 468452 100 2021-11-05 17:02:53 Sample.pdf malicious RDN/Generic.cf 100 98983e00b47bcbe9ebbaf5f28ea6cdbf619dd88c91f481b18fec7ffdb68ab741 254635 120 2021-08-09 07:15:50
cs-falcon-sandbox-result
Retrieves result data on a file. Note: This command returns a file.
Base Command
cs-falcon-sandbox-result
Input
| Argument Name | Description | Required |
|---|---|---|
| polling | Whether the command should poll until the result is ready. Possible values are: true, false. Default is True. | Optional |
| file | The file hash (MD5, SHA1, or SHA256). | Optional |
| environmentID | The environment ID. Available environment IDs: 310: “Linux (Ubuntu 20, 64-bit)”, 200: “Android Static Analysis”, 120: “Windows 7 64 bit”, 110: “Windows 7 32 bit (HWP Support)”, 100: “Windows 7 32 bit”. Possible values are: 100, 110, 120, 200, 310. Default is 100. | Required |
| JobID | The file job ID to generate a report for. | Optional |
| file-type | The file type. Possible values are: xml, json, html, pdf, maec, stix, misp, misp-json, openioc. Default is pdf. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.Report.job_id | String | The file job ID. |
| CrowdStrike.Report.environment_id | Number | The report environment ID. |
| CrowdStrike.Report.environment_description | String | The environment description. |
| CrowdStrike.Report.size | Number | The file size. |
| CrowdStrike.Report.type | String | The file type. |
| CrowdStrike.Report.type_short | String | The short description of the file type. |
| CrowdStrike.Report.target_url | String | The target url. |
| CrowdStrike.Report.state | String | The report state. |
| CrowdStrike.Report.error_type | String | The error type. |
| CrowdStrike.Report.error_origin | String | The error origin. |
| CrowdStrike.Report.submit_name | String | The file name when submitted. |
| CrowdStrike.Report.md5 | String | The MD5 hash of the file. |
| CrowdStrike.Report.sha1 | String | The SHA1 hash of the file. |
| CrowdStrike.Report.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.sha512 | String | The SHA512 hash of the file. |
| CrowdStrike.Report.ssdeep | String | The SSDeep hash of the file. |
| CrowdStrike.Report.imphash | String | The imphash hash of the file. |
| CrowdStrike.Report.av_detect | Number | The AV Multiscan range, for example 50-70 (min 0, max 100). |
| CrowdStrike.Report.vx_family | String | The file malware family. |
| CrowdStrike.Report.url_analysis | Boolean | Whether this report is url analysis. |
| CrowdStrike.Report.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.Report.threat_score | Number | The file threat score. |
| CrowdStrike.Report.interesting | Boolean | Whether the file was found to be interesting. |
| CrowdStrike.Report.threat_level | Number | The file threat level. |
| CrowdStrike.Report.verdict | String | The file verdict. |
| CrowdStrike.Report.total_network_connections | Number | The total number of network connections. |
| CrowdStrike.Report.total_processes | Number | The total number of processes. |
| CrowdStrike.Report.total_signatures | Number | The total number of signatures. |
| CrowdStrike.Report.file_metadata | Object | The file metadata. |
| CrowdStrike.Report.submissions.submission_id | String | The ID of the submission. |
| CrowdStrike.Report.submissions.filename | String | The name of the file. |
| CrowdStrike.Report.submissions.url | String | The url. |
| CrowdStrike.Report.submissions.created_at | Date | When the submission was created. |
| CrowdStrike.Report.network_mode | String | The network mode. |
| File.SHA256 | string | The SHA256 hash of the file. |
| File.SHA1 | string | The SHA1 hash of the file. |
| File.MD5 | string | The MD5 hash of the file. |
| File.Name | string | The file submission name. |
| File.MalwareFamily | string | The file family classification. |
| File.Malicious.Vendor | string | The vendor that decided the file was malicious. |
| File.Malicious.Description | string | The reason the vendor decided the file was malicious. |
| DBotScore.Indicator | string | The tested indicator. |
| DBotScore.Type | string | The indicator type. |
| DBotScore.Vendor | string | The vendor used to calculate the score. |
| DBotScore.Score | number | The actual score. |
| InfoFile.Name | string | The file name. |
| InfoFile.EntryID | string | The file entry ID. |
| InfoFile.Size | number | The file size. |
| InfoFile.Type | string | The file type, for example “PE”. |
| InfoFile.Info | string | Basic information about the file. |
| InfoFile.Extension | string | The file extension. |
cs-falcon-sandbox-submit-url
Submits a URL for analysis.
Base Command
cs-falcon-sandbox-submit-url
Input
| Argument Name | Description | Required |
|---|---|---|
| url | The URL for analysis or the URL of the file to submit. | Required |
| environmentID | The environment ID. Available environment IDs: 310: “Linux (Ubuntu 20, 64-bit)”, 200: “Android Static Analysis”, 120: “Windows 7 64 bit”, 110: “Windows 7 32 bit (HWP Support)”, 100: “Windows 7 32 bit”. Possible values are: 100, 110, 120, 200, 310. Default is 100. | Required |
| polling | Whether the command should poll until the result is ready. Possible values are: true, false. | Optional |
| no_share_third_party | When set to ‘true’, the sample is never shared with any third party. Possible values are: true, false. | Optional |
| no_hash_lookup | When set to ‘true’, no hash lookup is done on the sample. Possible values are: true, false. | Optional |
| allow_community_access | When set to ‘true’, the sample is available for the community. Possible values are: true, false. | Optional |
| action_script | Optional custom runtime action script. Available runtime scripts: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie. Possible values are: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie. | Optional |
| hybrid_analysis | When set to ‘false’, no memory dump or memory dump analysis is done. Possible values are: true, false. | Optional |
| experimental_anti_evasion | When set to ‘true’, sets all Kernelmode Monitor experimental anti-evasion options. Possible values are: true, false. | Optional |
| script_logging | When set to ‘true’, sets the Kernelmode Monitor in-depth script logging engine. Possible values are: true, false. | Optional |
| input_sample_tampering | When set to ‘true’, allows Kernelmode Monitor experimental anti-evasion options that tamper with the input sample. Possible values are: true, false. | Optional |
| network_settings | Network settings. Available options: default: ‘Fully operating network’, tor: ‘Route network traffic via TOR’, simulated: ‘Simulate network traffic’. Possible values are: default, tor, simulated. | Optional |
| Optional email address that may be associated with the submission for notification. | Optional | |
| comment | Optional comment text that may be associated with the submission/sample (Note: you can use #tags). | Optional |
| custom_cmd_line | Optional command line that should be passed to the analysis file. | Optional |
| custom_run_time | Optional runtime duration (in seconds). | Optional |
| submit_name | Optional ‘submission name’ field that will be used for file type detection and analysis. Ignored unless url contains a file. | Optional |
| priority | Optional priority value between 1 (lowest) and 10 (highest). By default all samples run with highest priority. Possible values are: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10. | Optional |
| document_password | Optional document password used to fill in Adobe/Office password prompts. | Optional |
| environment_variable | Optional system environment value. The value is provided in the format name=value. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.Submit.job_id | String | The The submitted report job ID. |
| CrowdStrike.Submit.submission_type | String | The type of the submission. |
| CrowdStrike.Submit.submission_id | String | The submission ID. |
| CrowdStrike.Submit.environment_id | Number | The submission environment ID. |
| CrowdStrike.Submit.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.job_id | String | The report job ID. |
| CrowdStrike.Report.environment_id | Number | The report environment ID. |
| CrowdStrike.Report.environment_description | String | The environment description. |
| CrowdStrike.Report.size | Number | The file size. |
| CrowdStrike.Report.type | String | The file type. |
| CrowdStrike.Report.type_short | String | The short description of the file type. |
| CrowdStrike.Report.target_url | String | The target url. |
| CrowdStrike.Report.state | String | The report state. |
| CrowdStrike.Report.error_type | String | The error type. |
| CrowdStrike.Report.error_origin | String | The error origin. |
| CrowdStrike.Report.submit_name | String | The file name when submitted. |
| CrowdStrike.Report.md5 | String | The MD5 hash of the file. |
| CrowdStrike.Report.sha1 | String | The SHA1 hash of the file. |
| CrowdStrike.Report.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.sha512 | String | The SHA512 hash of the file. |
| CrowdStrike.Report.ssdeep | String | The SSDeep hash of the file. |
| CrowdStrike.Report.imphash | String | The imphash hash of the file. |
| CrowdStrike.Report.av_detect | Number | The AV Multiscan range, for example 50-70 (min 0, max 100) |
| CrowdStrike.Report.vx_family | String | The file malware famil. |
| CrowdStrike.Report.url_analysis | Boolean | Whether this report is url analysis. |
| CrowdStrike.Report.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.Report.threat_score | Number | The file threat score. |
| CrowdStrike.Report.interesting | Boolean | Whether the file was found to be interesting. |
| CrowdStrike.Report.threat_level | Number | The file threat level. |
| CrowdStrike.Report.verdict | String | The file verdict. |
| CrowdStrike.Report.total_network_connections | Number | The total number of network connections. |
| CrowdStrike.Report.total_processes | Number | The total number of processes. |
| CrowdStrike.Report.total_signatures | Number | The total number of signatures. |
| CrowdStrike.Report.file_metadata | Object | The file metadata. |
| CrowdStrike.Report.submissions.submission_id | String | The submission ID. |
| CrowdStrike.Report.submissions.filename | String | The name of the file. |
| CrowdStrike.Report.submissions.url | String | The url. |
| CrowdStrike.Report.submissions.created_at | Date | When the submission was created. |
| CrowdStrike.Report.network_mode | String | The network mode. |
| File.SHA256 | string | The SHA256 hash of the file. |
| File.SHA1 | string | The SHA1 hash of the file. |
| File.MD5 | string | The MD5 hash of the file. |
| File.Name | string | The file submission name. |
| File.MalwareFamily | string | The file family classification. |
| File.Malicious.Vendor | string | The vendor that decided the file was malicious. |
| File.Malicious.Description | string | The reason the vendor decided the file was malicious. |
| DBotScore.Indicator | string | The tested indicator. |
| DBotScore.Type | string | The indicator type. |
| DBotScore.Vendor | string | The vendor used to calculate the score. |
| DBotScore.Score | number | The actual score. |
Command example
!cs-falcon-sandbox-submit-url url=example.com environmentID=300
Context Example
{
"CrowdStrike": {
"EnvironmentID": 300,
"JobID": "61f7a5f99741de6d6100bbc8",
"Report": [
{
"analysis_start_time": "2020-02-03T08:39:15+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environment_description": "Static Analysis",
"environment_id": null,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"file_metadata": null,
"hosts": [],
"imphash": null,
"interesting": false,
"job_id": null,
"machine_learning_models": [],
"md5": "be69708899323a1c8d5f88d9909d7b7a",
"mitre_attcks": [],
"network_mode": "default",
"processes": [],
"sha1": "017f143e0d7c33c65e4cb1a325e21c02c052c586",
"sha256": "0b1d27c7ef8651eac6933608d4cb0a4b9fd74c45b883d5a4da1eeaa540f6cc5c",
"sha512": "891aa9b7c6db52ce2259d8b1094889d389224b4069eac33f608f1630b6b92bdb0c37f488cf0c4254cd9cbbb052d3eeda2497ba560f3f49f0d32fa0b37753149e",
"size": null,
"ssdeep": null,
"state": "SUCCESS",
"submissions": [
{
"created_at": "2022-01-04T03:51:44+00:00",
"filename": null,
"submission_id": "61d3c45075dd613cd2318de3",
"url": "http://example.com/"
},
{
"created_at": "2021-12-10T10:47:23+00:00",
"filename": null,
"submission_id": "61b3303bee51fe1f135eb6b7",
"url": "http://example.com/"
},
{
"created_at": "2021-12-09T07:12:15+00:00",
"filename": null,
"submission_id": "61b1ac4fdf3fac4b3646afaf",
"url": "http://example.com/"
},
{
"created_at": "2021-12-06T06:45:16+00:00",
"filename": null,
"submission_id": "61adb17ce135f902cc551c48",
"url": "http://example.com/"
},
{
"created_at": "2021-12-06T06:44:27+00:00",
"filename": null,
"submission_id": "61adb14bc57a140f004524e3",
"url": "http://example.com/"
},
{
"created_at": "2021-12-03T02:13:39+00:00",
"filename": null,
"submission_id": "61a97d5379045c262d110cdd",
"url": "http://example.com/"
},
{
"created_at": "2021-12-03T02:13:03+00:00",
"filename": null,
"submission_id": "61a97d2fe02d87331d25e5a0",
"url": "http://example.com/"
},
{
"created_at": "2021-12-03T02:10:31+00:00",
"filename": null,
"submission_id": "61a97c97342971450f29b089",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:39:25+00:00",
"filename": null,
"submission_id": "6135633d41965265aa0a8dac",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:39:20+00:00",
"filename": null,
"submission_id": "613563381330f950b228416a",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:39:01+00:00",
"filename": null,
"submission_id": "6135632521e8ac3e5b189d17",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:47+00:00",
"filename": null,
"submission_id": "61355f1bcde472428f05416c",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:41+00:00",
"filename": null,
"submission_id": "61355f156c70b32ce5616a9a",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:16+00:00",
"filename": null,
"submission_id": "61355efcd71dbf0d2b05a084",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:04+00:00",
"filename": null,
"submission_id": "61355ef05278276a355a88d1",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:15:26+00:00",
"filename": null,
"submission_id": "6134ed1e68b3fa69b92a29a6",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:15:21+00:00",
"filename": null,
"submission_id": "6134ed19e76fc318ca444ce3",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:15:03+00:00",
"filename": null,
"submission_id": "6134ed07a94fd140c8512fe7",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:14:53+00:00",
"filename": null,
"submission_id": "6134ecfd6743b00302001a9f",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T08:35:09+00:00",
"filename": null,
"submission_id": "6134813d0ff3652bfc4886c3",
"url": "http://example.com/"
}
],
"submit_name": "http://example.com/",
"tags": [
"tag",
"tng"
],
"target_url": null,
"threat_level": 1,
"threat_score": null,
"total_network_connections": 0,
"total_processes": 0,
"total_signatures": 0,
"type": null,
"type_short": [],
"url_analysis": true,
"verdict": "suspicious",
"vx_family": null
}
],
"Submit": {
"environment_id": 300,
"job_id": "61f7a5f99741de6d6100bbc8",
"sha256": "0b1d27c7ef8651eac6933608d4cb0a4b9fd74c45b883d5a4da1eeaa540f6cc5c",
"submission_id": "61f7a5f99741de6d6100bbc9",
"submission_type": "page_url"
}
},
"DBotScore": {
"Indicator": "0b1d27c7ef8651eac6933608d4cb0a4b9fd74c45b883d5a4da1eeaa540f6cc5c",
"Reliability": "A - Completely reliable",
"Score": 2,
"Type": "file",
"Vendor": "CrowdStrike Falcon Sandbox V2"
},
"File": {
"JobID": null,
"MD5": "be69708899323a1c8d5f88d9909d7b7a",
"Name": "http://example.com/",
"SHA1": "017f143e0d7c33c65e4cb1a325e21c02c052c586",
"SHA256": "0b1d27c7ef8651eac6933608d4cb0a4b9fd74c45b883d5a4da1eeaa540f6cc5c",
"SHA512": "891aa9b7c6db52ce2259d8b1094889d389224b4069eac33f608f1630b6b92bdb0c37f488cf0c4254cd9cbbb052d3eeda2497ba560f3f49f0d32fa0b37753149e",
"analysis_start_time": "2020-02-03T08:39:15+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environmentDescription": "Static Analysis",
"environmentId": null,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"family": null,
"file_metadata": null,
"hosts": [],
"imphash": null,
"interesting": false,
"isurlanalysis": true,
"machine_learning_models": [],
"mitre_attcks": [],
"network_mode": "default",
"processes": [],
"sha512": "891aa9b7c6db52ce2259d8b1094889d389224b4069eac33f608f1630b6b92bdb0c37f488cf0c4254cd9cbbb052d3eeda2497ba560f3f49f0d32fa0b37753149e",
"size": null,
"ssdeep": null,
"state": "SUCCESS",
"submissions": [
{
"created_at": "2022-01-04T03:51:44+00:00",
"filename": null,
"submission_id": "61d3c45075dd613cd2318de3",
"url": "http://example.com/"
},
{
"created_at": "2021-12-10T10:47:23+00:00",
"filename": null,
"submission_id": "61b3303bee51fe1f135eb6b7",
"url": "http://example.com/"
},
{
"created_at": "2021-12-09T07:12:15+00:00",
"filename": null,
"submission_id": "61b1ac4fdf3fac4b3646afaf",
"url": "http://example.com/"
},
{
"created_at": "2021-12-06T06:45:16+00:00",
"filename": null,
"submission_id": "61adb17ce135f902cc551c48",
"url": "http://example.com/"
},
{
"created_at": "2021-12-06T06:44:27+00:00",
"filename": null,
"submission_id": "61adb14bc57a140f004524e3",
"url": "http://example.com/"
},
{
"created_at": "2021-12-03T02:13:39+00:00",
"filename": null,
"submission_id": "61a97d5379045c262d110cdd",
"url": "http://example.com/"
},
{
"created_at": "2021-12-03T02:13:03+00:00",
"filename": null,
"submission_id": "61a97d2fe02d87331d25e5a0",
"url": "http://example.com/"
},
{
"created_at": "2021-12-03T02:10:31+00:00",
"filename": null,
"submission_id": "61a97c97342971450f29b089",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:39:25+00:00",
"filename": null,
"submission_id": "6135633d41965265aa0a8dac",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:39:20+00:00",
"filename": null,
"submission_id": "613563381330f950b228416a",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:39:01+00:00",
"filename": null,
"submission_id": "6135632521e8ac3e5b189d17",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:47+00:00",
"filename": null,
"submission_id": "61355f1bcde472428f05416c",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:41+00:00",
"filename": null,
"submission_id": "61355f156c70b32ce5616a9a",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:16+00:00",
"filename": null,
"submission_id": "61355efcd71dbf0d2b05a084",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:04+00:00",
"filename": null,
"submission_id": "61355ef05278276a355a88d1",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:15:26+00:00",
"filename": null,
"submission_id": "6134ed1e68b3fa69b92a29a6",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:15:21+00:00",
"filename": null,
"submission_id": "6134ed19e76fc318ca444ce3",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:15:03+00:00",
"filename": null,
"submission_id": "6134ed07a94fd140c8512fe7",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:14:53+00:00",
"filename": null,
"submission_id": "6134ecfd6743b00302001a9f",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T08:35:09+00:00",
"filename": null,
"submission_id": "6134813d0ff3652bfc4886c3",
"url": "http://example.com/"
}
],
"submitname": "http://example.com/",
"tags": [
"tag",
"tng"
],
"target_url": null,
"threat_level": 1,
"threatscore": null,
"total_network_connections": 0,
"total_processes": 0,
"total_signatures": 0,
"type": null,
"type_short": [],
"verdict": "suspicious"
}
}
Human Readable Output
Scan Results
submit name threat level verdict total network connections total processes environment description interesting url analysis analysis start time total signatures sha256 http://example.com/ 1 suspicious 0 0 Static Analysis false true 2020-02-03T08:39:15+00:00 0 0b1d27c7ef8651eac6933608d4cb0a4b9fd74c45b883d5a4da1eeaa540f6cc5c
cs-falcon-sandbox-get-screenshots
Retrieves screenshots from a report
Base Command
cs-falcon-sandbox-get-screenshots
Input
| Argument Name | Description | Required |
|---|---|---|
| file | The sha256 hash of a file. | Optional |
| environmentID | The environment ID. Available environment IDs: 310: “Linux (Ubuntu 20, 64-bit)”, 200: “Android Static Analysis”, 120: “Windows 7 64 bit”, 110: “Windows 7 32 bit (HWP Support)”, 100: “Windows 7 32 bit”. Possible values are: 100, 110, 120, 200, 310. Default is 100. | Required |
| JobID | The file job ID. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| InfoFile.Name | string | The file name. |
| InfoFile.EntryID | string | The file entry ID. |
| InfoFile.Size | number | The file size. |
| InfoFile.Type | string | The file type, for example “PE”. |
| InfoFile.Info | string | Basic information about the file. |
| InfoFile.Extension | string | The file extension. |
Command example
!cs-falcon-sandbox-get-screenshots file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 environmentID=100
Context Example
{
"InfoFile": [
{
"EntryID": "414@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_0.png",
"Size": 285728,
"Type": "PNG image data, 1024 x 617, 8-bit/color RGBA, non-interlaced"
},
{
"EntryID": "415@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_1.png",
"Size": 245749,
"Type": "PNG image data, 1024 x 617, 8-bit/color RGBA, non-interlaced"
},
{
"EntryID": "416@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_2.png",
"Size": 115116,
"Type": "PNG image data, 1024 x 617, 8-bit/color RGBA, non-interlaced"
},
{
"EntryID": "417@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_3.png",
"Size": 96757,
"Type": "PNG image data, 1024 x 617, 8-bit/color RGBA, non-interlaced"
},
{
"EntryID": "418@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_4.png",
"Size": 38843,
"Type": "PNG image data, 1020 x 1320, 8-bit/color RGB, non-interlaced"
},
{
"EntryID": "419@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_5.png",
"Size": 28781,
"Type": "PNG image data, 1020 x 1320, 8-bit/color RGB, non-interlaced"
},
{
"EntryID": "420@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_6.png",
"Size": 113982,
"Type": "PNG image data, 1024 x 617, 8-bit/color RGBA, non-interlaced"
},
{
"EntryID": "421@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_7.png",
"Size": 107333,
"Type": "PNG image data, 1024 x 617, 8-bit/color RGBA, non-interlaced"
}
]
}
Human Readable Output
cs-falcon-sandbox-analysis-overview
Gets the hash overview.
Base Command
cs-falcon-sandbox-analysis-overview
Input
| Argument Name | Description | Required |
|---|---|---|
| file | The SHA256 hash of the file. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.AnalysisOverview.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.AnalysisOverview.last_file_name | String | The last name of the file. |
| CrowdStrike.AnalysisOverview.threat_score | Number | The file threat score. |
| CrowdStrike.AnalysisOverview.verdict | String | The file verdict. |
| CrowdStrike.AnalysisOverview.url_analysis | Boolean | Whether this report is url analysis. |
| CrowdStrike.AnalysisOverview.size | Number | The size of the file. |
| CrowdStrike.AnalysisOverview.type | String | The file type. |
| CrowdStrike.AnalysisOverview.type_short | String | The short description of the file type. |
| CrowdStrike.AnalysisOverview.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.AnalysisOverview.last_multi_scan | Date | The last multi-scan. |
| CrowdStrike.AnalysisOverview.architecture | String | The environment architecture. |
| CrowdStrike.AnalysisOverview.multiscan_result | Number | The multi-scan result. |
| CrowdStrike.AnalysisOverview.scanners.name | String | The name of the scanner. |
| CrowdStrike.AnalysisOverview.scanners.status | String | The status of the scanner. |
| CrowdStrike.AnalysisOverview.scanners.error_message | String | The error message. |
| CrowdStrike.AnalysisOverview.scanners.progress | Number | The progress of the scanner. |
| CrowdStrike.AnalysisOverview.scanners.total | Number | The total number of scanners. |
| CrowdStrike.AnalysisOverview.scanners.positives | Number | The number of positives. |
| CrowdStrike.AnalysisOverview.scanners.percent | Number | The percent of the scanner. |
| CrowdStrike.AnalysisOverview.scanners.anti_virus_results.name | String | The name of the antivirus results. |
| CrowdStrike.AnalysisOverview.scanners.anti_virus_results.result | Boolean | The antivirus result. |
| CrowdStrike.AnalysisOverview.scanners.anti_virus_results.threat_found | String | The threat found the the scanner. |
| CrowdStrike.AnalysisOverview.reports | String | The reports of the analysis. |
| CrowdStrike.AnalysisOverview.whitelisted | Boolean | If the result is whitelisted. |
| CrowdStrike.AnalysisOverview.children_in_queue | Number | The number of children in queue. |
| CrowdStrike.AnalysisOverview.children_in_progress | Number | The number of children in progress. |
| File.Size | number | The file size. |
| File.SHA256 | string | The SHA256 hash of the file. |
| File.Name | string | The file name. |
| File.type | string | The file type. |
Command example
!cs-falcon-sandbox-analysis-overview file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51
Context Example
{
"CrowdStrike": {
"AnalysisOverview": {
"analysis_start_time": "2022-01-10T08:33:11+00:00",
"architecture": "WINDOWS",
"children_in_progress": 0,
"children_in_queue": 0,
"last_file_name": "file",
"last_multi_scan": "2022-02-07T12:52:10+00:00",
"multiscan_result": 0,
"other_file_name": [
"5_Journals_3_Manuscripts_10_Version_1_Revision_0_CoverLetter.pdf",
"dyUQ2JAbImyU0WNH7TI1K3UYqUwDMsQBh1RwXWHG.pdf",
"k18zpzsrq3om4q1pu18mftdo2caaivqq.pdf",
"kuc86odvmimp0vd0tseubdekn9dg41jrff6lso01_parsed.eml",
"sample.pdf",
"samplePdf.pdf",
"test.pdf"
],
"related_children_hashes": [],
"related_parent_hashes": [
"77fbcad0cfe9e67946c0f9366d04df5ecf78c122ccceb78cb59c149911e3457d",
"30c37bbb86c6937256ae67be4d6311cb1a9d9d041966b282378b83eb213ae5ab",
"36327ca7afc02b525bc33428ab762419cdf3f93c8892de1df50bdb4b803032fb"
],
"related_reports": [
{
"environment_id": 100,
"error_origin": null,
"error_type": null,
"job_id": "5c5e1ea27ca3e12f285dc6b4",
"sha256": "30c37bbb86c6937256ae67be4d6311cb1a9d9d041966b282378b83eb213ae5ab",
"state": "SUCCESS",
"verdict": "no verdict"
},
{
"environment_id": 100,
"error_origin": null,
"error_type": null,
"job_id": "5f0c9b7eac8ef74e754f871e",
"sha256": "36327ca7afc02b525bc33428ab762419cdf3f93c8892de1df50bdb4b803032fb",
"state": "SUCCESS",
"verdict": "no verdict"
},
{
"environment_id": 100,
"error_origin": null,
"error_type": null,
"job_id": "5b881e5e7ca3e169b9340464",
"sha256": "77fbcad0cfe9e67946c0f9366d04df5ecf78c122ccceb78cb59c149911e3457d",
"state": "SUCCESS",
"verdict": "no verdict"
}
],
"reports": [
"5e95b682dd8c5642500399ce",
"5d8a1c67038838c50e69e5a8",
"5a6896886e3579ce99a80d4d",
"5f60f00aeac13102de2fce70",
"61ae29f24e69ff77d566ab48",
"5beb78777ca3e14af2036b03",
"61128689373f22669b654e8a",
"61a79f9a99b51b0fda1c1c4c",
"61dbe275436d0a13692564b8",
"61dbef47c143326cec7c2d3d"
],
"scanners": [
{
"anti_virus_results": [],
"error_message": "Unknown error occurred",
"name": "CrowdStrike Falcon Static Analysis (ML)",
"percent": null,
"positives": null,
"progress": 100,
"status": "error",
"total": null
},
{
"anti_virus_results": [
{
"name": "ByteHero",
"result": false,
"threat_found": null
},
{
"name": "AegisLab",
"result": false,
"threat_found": null
},
{
"name": "Trend Micro HouseCall",
"result": false,
"threat_found": null
},
{
"name": "Vir.IT eXplorer",
"result": false,
"threat_found": null
},
{
"name": "K7",
"result": false,
"threat_found": null
},
{
"name": "Kaspersky",
"result": false,
"threat_found": null
},
{
"name": "AhnLab",
"result": false,
"threat_found": null
},
{
"name": "Quick Heal",
"result": false,
"threat_found": null
},
{
"name": "RocketCyber",
"result": false,
"threat_found": null
},
{
"name": "Comodo",
"result": false,
"threat_found": null
},
{
"name": "IKARUS",
"result": false,
"threat_found": null
},
{
"name": "Huorong",
"result": false,
"threat_found": null
},
{
"name": "Bitdefender",
"result": false,
"threat_found": null
},
{
"name": "Avira",
"result": false,
"threat_found": null
},
{
"name": "Sophos",
"result": false,
"threat_found": null
},
{
"name": "VirusBlokAda",
"result": false,
"threat_found": null
},
{
"name": "McAfee",
"result": false,
"threat_found": null
},
{
"name": "Cyren",
"result": false,
"threat_found": null
},
{
"name": "TACHYON",
"result": false,
"threat_found": null
},
{
"name": "Antiy",
"result": false,
"threat_found": null
},
{
"name": "Xvirus Anti-Malware",
"result": false,
"threat_found": null
},
{
"name": "Trend Micro",
"result": false,
"threat_found": null
},
{
"name": "Emsisoft",
"result": false,
"threat_found": null
},
{
"name": "NANOAV",
"result": false,
"threat_found": null
},
{
"name": "ESET",
"result": false,
"threat_found": null
}
],
"error_message": null,
"name": "Metadefender",
"percent": 0,
"positives": 0,
"progress": 100,
"status": "clean",
"total": 25
},
{
"anti_virus_results": [],
"error_message": null,
"name": "VirusTotal",
"percent": 0,
"positives": 0,
"progress": 100,
"status": "clean",
"total": 54
}
],
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"size": 3506,
"submit_context": [],
"tags": [],
"threat_score": null,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"url_analysis": false,
"verdict": "whitelisted",
"whitelisted": true
}
},
"File": {
"Name": "file",
"SHA256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"Size": 3506,
"Type": "PDF document, version 1.3"
}
}
Human Readable Output
Analysis Overview
Last File Name Other File Name Sha 256 Verdict Url Analysis Size Type Type Short file 5_Journals_3_Manuscripts_10_Version_1_Revision_0_CoverLetter.pdf,
dyUQ2JAbImyU0WNH7TI1K3UYqUwDMsQBh1RwXWHG.pdf,
k18zpzsrq3om4q1pu18mftdo2caaivqq.pdf,
kuc86odvmimp0vd0tseubdekn9dg41jrff6lso01_parsed.eml,
sample.pdf,
samplePdf.pdf,
test.pdf8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 whitelisted false 3506 PDF document, version 1.3
cs-falcon-sandbox-analysis-overview-summary
Returns the hash overview.
Base Command
cs-falcon-sandbox-analysis-overview-summary
Input
| Argument Name | Description | Required |
|---|---|---|
| file | The SHA256 hash of the file. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.AnalysisOverviewSummary.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.AnalysisOverviewSummary.threat_score | Number | The file threat score. |
| CrowdStrike.AnalysisOverviewSummary.verdict | String | The file verdict. |
| CrowdStrike.AnalysisOverviewSummary.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.AnalysisOverviewSummary.last_multi_scan | Date | The last multi-scan. |
| CrowdStrike.AnalysisOverviewSummary.multiscan_result | Number | The multi-scan result. |
Command example
!cs-falcon-sandbox-analysis-overview-summary file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51
Context Example
{
"CrowdStrike": {
"AnalysisOverview": {
"analysis_start_time": "2022-01-10T08:33:11+00:00",
"last_multi_scan": "2022-02-07T12:52:10+00:00",
"multiscan_result": 0,
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"threat_score": null,
"verdict": "whitelisted"
}
}
}
Human Readable Output
Analysis Overview Summary
Analysis Start Time Last Multi Scan Multiscan Result Sha256 Verdict 2022-01-10T08:33:11+00:00 2022-02-07T12:52:10+00:00 0 8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 whitelisted
cs-falcon-sandbox-analysis-overview-refresh
Refreshes the overview and downloads fresh data from external services.
Base Command
cs-falcon-sandbox-analysis-overview-refresh
Input
| Argument Name | Description | Required |
|---|---|---|
| file | The SHA256 hash of the file. | Required |
Context Output
There is no context output for this command.
Command example
!cs-falcon-sandbox-analysis-overview-refresh file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51
Human Readable Output
The request to refresh the analysis overview was sent successfully.
file
Returns file information and reputation.
Base Command
file
Input
| Argument Name | Description | Required |
|---|---|---|
| file | A comma-separated list of file hashes (MD5, SHA1, or SHA256). | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.Report.job_id | String | The file job ID. |
| CrowdStrike.Report.environment_id | Number | The report environment ID. |
| CrowdStrike.Report.environment_description | String | The environment description. |
| CrowdStrike.Report.size | Number | The file size. |
| CrowdStrike.Report.type | String | The file type. |
| CrowdStrike.Report.type_short | String | The short description of the file type. |
| CrowdStrike.Report.target_url | String | The target url. |
| CrowdStrike.Report.state | String | The report state. |
| CrowdStrike.Report.error_type | String | The error type. |
| CrowdStrike.Report.error_origin | String | The error origin. |
| CrowdStrike.Report.submit_name | String | The file name when submitted. |
| CrowdStrike.Report.md5 | String | The MD5 hash of the file. |
| CrowdStrike.Report.sha1 | String | The SHA1 hash of the file. |
| CrowdStrike.Report.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.sha512 | String | The SHA512 hash of the file. |
| CrowdStrike.Report.ssdeep | String | The SSDeep hash of the file. |
| CrowdStrike.Report.imphash | String | The imphash hash of the file. |
| CrowdStrike.Report.av_detect | Number | The AV Multiscan range, for example 50-70 (min 0, max 100). |
| CrowdStrike.Report.vx_family | String | The file malware family. |
| CrowdStrike.Report.url_analysis | Boolean | Whether this report is url analysis. |
| CrowdStrike.Report.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.Report.threat_score | Number | The file threat score. |
| CrowdStrike.Report.interesting | Boolean | Whether the file was found to be interesting. |
| CrowdStrike.Report.threat_level | Number | The file threat level. |
| CrowdStrike.Report.verdict | String | The file verdict. |
| CrowdStrike.Report.total_network_connections | Number | The total number of network connections. |
| CrowdStrike.Report.total_processes | Number | The total number of processes. |
| CrowdStrike.Report.total_signatures | Number | The total number of signatures. |
| CrowdStrike.Report.file_metadata | Object | The file metadata. |
| CrowdStrike.Report.submissions.submission_id | String | The submission ID. |
| CrowdStrike.Report.submissions.filename | String | The name of the file. |
| CrowdStrike.Report.submissions.url | String | The url. |
| CrowdStrike.Report.submissions.created_at | Date | When the submission was created. |
| CrowdStrike.Report.network_mode | String | The network mode. |
| File.SHA256 | string | The SHA256 hash of the file. |
| File.SHA1 | string | The SHA1 hash of the file. |
| File.MD5 | string | The MD5 hash of the file. |
| File.Name | string | The file submission name. |
| File.MalwareFamily | string | The file family classification. |
| File.Malicious.Vendor | string | The vendor that decided the file was malicious. |
| File.Malicious.Description | string | The reason the vendor decided the file was malicious. |
| DBotScore.Indicator | string | The indicator that was tested. |
| DBotScore.Type | string | The indicator type. |
| DBotScore.Vendor | string | The vendor used to calculate the score. |
| DBotScore.Score | number | The actual score. |
Command example
!file file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51
Context Example
{
"CofenseIntelligence": {
"File": {
"Data": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"Threats": []
}
},
"CrowdStrike": {
"Report": [
{
"analysis_start_time": "2020-09-15T16:47:06+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environment_description": "Static Analysis",
"environment_id": null,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"file_metadata": null,
"hosts": [],
"imphash": null,
"interesting": false,
"job_id": null,
"machine_learning_models": [],
"md5": "4b41a3475132bd861b30a878e30aa56a",
"mitre_attcks": [],
"network_mode": "default",
"processes": [],
"sha1": "bfd009f500c057195ffde66fae64f92fa5f59b72",
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"sha512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"size": 3028,
"ssdeep": null,
"state": "SUCCESS",
"submissions": [
{
"created_at": "2021-12-30T09:34:22+00:00",
"filename": "file",
"submission_id": "61cd7d1ec35ca563e343e855",
"url": null
},
{
"created_at": "2021-12-18T23:47:33+00:00",
"filename": "file",
"submission_id": "61be731519ff990144369a85",
"url": null
},
{
"created_at": "2021-07-03T21:54:07+00:00",
"filename": "test.pdf",
"submission_id": "60e0dc7fda855364ee0d1826",
"url": null
},
{
"created_at": "2021-07-03T21:46:41+00:00",
"filename": "sample.pdf",
"submission_id": "60e0dac12daa5049bb51ad72",
"url": null
},
{
"created_at": "2021-07-03T21:45:44+00:00",
"filename": "sample.pdf",
"submission_id": "60e0da887bb12112723c8bea",
"url": null
},
{
"created_at": "2021-04-25T05:03:31+00:00",
"filename": "file",
"submission_id": "6084f823ea742a4783209d12",
"url": null
},
{
"created_at": "2021-03-01T14:42:05+00:00",
"filename": "sample.pdf",
"submission_id": "603cfd3d601d615839160474",
"url": "http://www.africau.edu/images/default/sample.pdf"
},
{
"created_at": "2021-01-24T05:00:32+00:00",
"filename": "file",
"submission_id": "600cfef0f365f820bf2f0b02",
"url": null
},
{
"created_at": "2020-12-08T18:15:16+00:00",
"filename": "5_Journals_3_Manuscripts_10_Version_1_Revision_0_CoverLetter.pdf",
"submission_id": "5fcfc2b4fe643e3bee4bf4f5",
"url": null
},
{
"created_at": "2020-09-15T16:47:06+00:00",
"filename": "file",
"submission_id": "5f60f00abbe4e913f73cfff9",
"url": null
}
],
"submit_name": "file",
"tags": [],
"target_url": null,
"threat_level": 0,
"threat_score": null,
"total_network_connections": 0,
"total_processes": 0,
"total_signatures": 0,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"url_analysis": false,
"verdict": "whitelisted",
"vx_family": null
},
{
"analysis_start_time": "2021-12-06T15:19:23+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environment_description": "Android Static Analysis",
"environment_id": 200,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"file_metadata": null,
"hosts": [],
"imphash": "Unknown",
"interesting": false,
"job_id": "61ae29f24e69ff77d566ab48",
"machine_learning_models": [],
"md5": "4b41a3475132bd861b30a878e30aa56a",
"mitre_attcks": [],
"network_mode": "default",
"processes": [],
"sha1": "bfd009f500c057195ffde66fae64f92fa5f59b72",
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"sha512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"size": 3506,
"ssdeep": "24:yPp9AA+I3ZpAIZpAL7xMk2uFVBX02ScAjfW2sX25cfW2SJI2k2y62NOfW2t9HZdF:yrQ+YIYbrXq/jeyjbvzGUsnTd3/i",
"state": "SUCCESS",
"submissions": [
{
"created_at": "2022-01-10T08:40:44+00:00",
"filename": "sample.pdf",
"submission_id": "61dbf10c213fbc5a3914cdd1",
"url": null
},
{
"created_at": "2022-01-10T08:35:47+00:00",
"filename": "sample.pdf",
"submission_id": "61dbefe33f8cec40d619833c",
"url": null
},
{
"created_at": "2021-12-06T15:52:44+00:00",
"filename": "samplePdf.pdf",
"submission_id": "61ae31cce601bf0d4a332f82",
"url": null
},
{
"created_at": "2021-12-06T15:19:14+00:00",
"filename": "samplePdf.pdf",
"submission_id": "61ae29f24e69ff77d566ab49",
"url": null
}
],
"submit_name": "samplePdf.pdf",
"tags": [],
"target_url": null,
"threat_level": 0,
"threat_score": null,
"total_network_connections": 0,
"total_processes": 0,
"total_signatures": 1,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"url_analysis": false,
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2020-04-14T13:11:37+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environment_description": "Windows 7 32 bit (HWP Support)",
"environment_id": 110,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"file_metadata": null,
"hosts": [],
"imphash": "Unknown",
"interesting": false,
"job_id": "5e95b682dd8c5642500399ce",
"machine_learning_models": [],
"md5": "4b41a3475132bd861b30a878e30aa56a",
"mitre_attcks": [],
"network_mode": "default",
"processes": [],
"sha1": "bfd009f500c057195ffde66fae64f92fa5f59b72",
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"sha512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"size": 3506,
"ssdeep": "24:yPp9AA+I3ZpAIZpAL7xMk2uFVBX02ScAjfW2sX25cfW2SJI2k2y62NOfW2t9HZdt:yrQ+YIYbrXq/jeyjbvzGUsnTd3/C",
"state": "SUCCESS",
"submissions": [
{
"created_at": "2020-04-14T13:11:30+00:00",
"filename": "file",
"submission_id": "5e95b682dd8c5642500399cf",
"url": null
}
],
"submit_name": "file",
"tags": [],
"target_url": null,
"threat_level": 0,
"threat_score": null,
"total_network_connections": 0,
"total_processes": 4,
"total_signatures": 14,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"url_analysis": false,
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-09-24T13:39:34+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"file_metadata": null,
"hosts": [],
"imphash": "Unknown",
"interesting": false,
"job_id": "5d8a1c67038838c50e69e5a8",
"machine_learning_models": [],
"md5": "4b41a3475132bd861b30a878e30aa56a",
"mitre_attcks": [],
"network_mode": "default",
"processes": [],
"sha1": "bfd009f500c057195ffde66fae64f92fa5f59b72",
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"sha512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"size": 3506,
"ssdeep": "24:yPp9AA+I3ZpAIZpAL7xMk2uFVBX02ScAjfW2sX25cfW2SJI2k2y62NOfW2t9HZdd:yrQ+YIYbrXq/jeyjbvzGUsnTd3/hxoxn",
"state": "SUCCESS",
"submissions": [
{
"created_at": "2020-12-17T11:38:35+00:00",
"filename": "sample.pdf",
"submission_id": "5fdb433be6562860c47942cf",
"url": null
},
{
"created_at": "2020-12-09T12:12:29+00:00",
"filename": "sample.pdf",
"submission_id": "5fd0bf2d8623f5298734d606",
"url": null
},
{
"created_at": "2020-05-26T07:00:18+00:00",
"filename": "sample.pdf",
"submission_id": "5eccbe8203b9557fac384586",
"url": null
},
{
"created_at": "2020-04-29T09:51:17+00:00",
"filename": "sample.pdf",
"submission_id": "5ea94e157d7c876d9c76ced3",
"url": null
},
{
"created_at": "2020-04-29T09:15:42+00:00",
"filename": "sample.pdf",
"submission_id": "5ea945be351cb361215586fe",
"url": null
},
{
"created_at": "2020-04-29T09:11:43+00:00",
"filename": "sample.pdf",
"submission_id": "5ea944cfe3893c0eb22505a3",
"url": null
},
{
"created_at": "2020-01-10T00:04:51+00:00",
"filename": "sample.pdf",
"submission_id": "5e17bfa39f797e0f87507547",
"url": null
},
{
"created_at": "2019-09-24T13:38:47+00:00",
"filename": "sample.pdf",
"submission_id": "5d8a1c67038838c50e69e5a7",
"url": null
}
],
"submit_name": "sample.pdf",
"tags": [],
"target_url": null,
"threat_level": 0,
"threat_score": null,
"total_network_connections": 0,
"total_processes": 4,
"total_signatures": 12,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"url_analysis": false,
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-02-09T01:41:57+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"file_metadata": null,
"hosts": [],
"imphash": "Unknown",
"interesting": false,
"job_id": "5a6896886e3579ce99a80d4d",
"machine_learning_models": [],
"md5": "4b41a3475132bd861b30a878e30aa56a",
"mitre_attcks": [],
"network_mode": "tor",
"processes": [],
"sha1": "bfd009f500c057195ffde66fae64f92fa5f59b72",
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"sha512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"size": 3506,
"ssdeep": "24:yPp9AA+I3ZpAIZpAL7xMk2uFVBX02ScAjfW2sX25cfW2SJI2k2y62NOfW2t9HZdV:yrQ+YIYbrXq/jeyjbvzGUsnTd3/S",
"state": "SUCCESS",
"submissions": [
{
"created_at": "2022-01-23T17:49:11+00:00",
"filename": "sample.pdf",
"submission_id": "61ed9517c284dd61265a0e6d",
"url": null
},
{
"created_at": "2022-01-09T16:03:26+00:00",
"filename": "sample.pdf",
"submission_id": "61db074e8782ed13a058f7a4",
"url": null
},
{
"created_at": "2022-01-09T16:03:04+00:00",
"filename": "sample.pdf",
"submission_id": "61db0738f93ee5253c369e74",
"url": null
},
{
"created_at": "2021-12-06T14:31:12+00:00",
"filename": "samplePdf.pdf",
"submission_id": "61ae1eb03be82d62c3775f70",
"url": null
},
{
"created_at": "2021-10-20T13:49:19+00:00",
"filename": "k18zpzsrq3om4q1pu18mftdo2caaivqq.pdf",
"submission_id": "61701e5f1c027f4e08299b54",
"url": null
},
{
"created_at": "2021-07-27T13:27:58+00:00",
"filename": "sample.pdf",
"submission_id": "610009dec612587a6d572e23",
"url": null
},
{
"created_at": "2021-07-15T16:15:50+00:00",
"filename": "sample.pdf",
"submission_id": "60f05f3660f4fd4ee42d0b6f",
"url": null
},
{
"created_at": "2021-07-03T21:50:01+00:00",
"filename": "sample.pdf",
"submission_id": "60e0db8928bccc0b2e405d30",
"url": null
},
{
"created_at": "2021-03-01T14:43:08+00:00",
"filename": "sample.pdf",
"submission_id": "603cfd7c60343f6d115db9f8",
"url": "http://www.africau.edu/images/default/sample.pdf"
},
{
"created_at": "2020-10-29T13:17:49+00:00",
"filename": "sample.pdf",
"submission_id": "5f9ac0fdd97ff17aac38bc84",
"url": "http://www.africau.edu/images/default/sample.pdf"
},
{
"created_at": "2020-07-14T13:09:08+00:00",
"filename": "sample.pdf",
"submission_id": "5f0dae74c122fb57fc3f360b",
"url": null
},
{
"created_at": "2020-07-14T10:54:02+00:00",
"filename": "sample.pdf",
"submission_id": "5f0d8eca91837459ca5cee1c",
"url": null
},
{
"created_at": "2020-07-14T10:48:02+00:00",
"filename": "sample.pdf",
"submission_id": "5f0d8d622560cc30d825588b",
"url": null
},
{
"created_at": "2020-07-13T17:48:02+00:00",
"filename": "sample.pdf",
"submission_id": "5f0c9e52f6150a35a72b8c99",
"url": null
},
{
"created_at": "2020-07-13T17:38:12+00:00",
"filename": "sample.pdf",
"submission_id": "5f0c9c040030d423b83a9991",
"url": null
},
{
"created_at": "2020-07-13T17:35:58+00:00",
"filename": "sample.pdf",
"submission_id": "5f0c9b7eac8ef74e754f8724",
"url": null
},
{
"created_at": "2019-04-11T15:08:01+00:00",
"filename": "sample.pdf",
"submission_id": "5caf58510388385b8b7b23ca",
"url": null
},
{
"created_at": "2019-03-10T11:11:01+00:00",
"filename": "sample.pdf",
"submission_id": "5c84f0c5028838b82ffc1ce3",
"url": null
},
{
"created_at": "2019-03-10T08:53:28+00:00",
"filename": "sample.pdf",
"submission_id": "5c84d088028838950cfc1ce4",
"url": null
},
{
"created_at": "2019-02-08T18:28:18-06:00",
"filename": "sample.pdf",
"submission_id": "5c5e1ea27ca3e12cd80ecf07",
"url": null
}
],
"submit_name": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51_1549672910345_sample.pdf",
"tags": [],
"target_url": null,
"threat_level": 0,
"threat_score": null,
"total_network_connections": 0,
"total_processes": 1,
"total_signatures": 9,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"url_analysis": false,
"verdict": "whitelisted",
"vx_family": null
}
]
},
"DBotScore": {
"Indicator": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"Reliability": "A - Completely reliable",
"Score": 1,
"Type": "file",
"Vendor": "CrowdStrike Falcon Sandbox V2"
},
"File": {
"JobID": "5a6896886e3579ce99a80d4d",
"MD5": "4b41a3475132bd861b30a878e30aa56a",
"Name": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51_1549672910345_sample.pdf",
"SHA1": "bfd009f500c057195ffde66fae64f92fa5f59b72",
"SHA256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"SHA512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"SSDeep": "24:yPp9AA+I3ZpAIZpAL7xMk2uFVBX02ScAjfW2sX25cfW2SJI2k2y62NOfW2t9HZdV:yrQ+YIYbrXq/jeyjbvzGUsnTd3/S",
"Size": 3506,
"Type": "PDF document, version 1.3",
"analysis_start_time": "2019-02-09T01:41:57+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environmentDescription": "Windows 7 32 bit",
"environmentId": 100,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"family": null,
"file_metadata": null,
"hosts": [],
"imphash": "Unknown",
"interesting": false,
"isurlanalysis": false,
"machine_learning_models": [],
"mitre_attcks": [],
"network_mode": "tor",
"processes": [],
"sha512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"size": 3506,
"ssdeep": "24:yPp9AA+I3ZpAIZpAL7xMk2uFVBX02ScAjfW2sX25cfW2SJI2k2y62NOfW2t9HZdV:yrQ+YIYbrXq/jeyjbvzGUsnTd3/S",
"state": "SUCCESS",
"submissions": [
{
"created_at": "2022-01-23T17:49:11+00:00",
"filename": "sample.pdf",
"submission_id": "61ed9517c284dd61265a0e6d",
"url": null
},
{
"created_at": "2022-01-09T16:03:26+00:00",
"filename": "sample.pdf",
"submission_id": "61db074e8782ed13a058f7a4",
"url": null
},
{
"created_at": "2022-01-09T16:03:04+00:00",
"filename": "sample.pdf",
"submission_id": "61db0738f93ee5253c369e74",
"url": null
},
{
"created_at": "2021-12-06T14:31:12+00:00",
"filename": "samplePdf.pdf",
"submission_id": "61ae1eb03be82d62c3775f70",
"url": null
},
{
"created_at": "2021-10-20T13:49:19+00:00",
"filename": "k18zpzsrq3om4q1pu18mftdo2caaivqq.pdf",
"submission_id": "61701e5f1c027f4e08299b54",
"url": null
},
{
"created_at": "2021-07-27T13:27:58+00:00",
"filename": "sample.pdf",
"submission_id": "610009dec612587a6d572e23",
"url": null
},
{
"created_at": "2021-07-15T16:15:50+00:00",
"filename": "sample.pdf",
"submission_id": "60f05f3660f4fd4ee42d0b6f",
"url": null
},
{
"created_at": "2021-07-03T21:50:01+00:00",
"filename": "sample.pdf",
"submission_id": "60e0db8928bccc0b2e405d30",
"url": null
},
{
"created_at": "2021-03-01T14:43:08+00:00",
"filename": "sample.pdf",
"submission_id": "603cfd7c60343f6d115db9f8",
"url": "http://www.africau.edu/images/default/sample.pdf"
},
{
"created_at": "2020-10-29T13:17:49+00:00",
"filename": "sample.pdf",
"submission_id": "5f9ac0fdd97ff17aac38bc84",
"url": "http://www.africau.edu/images/default/sample.pdf"
},
{
"created_at": "2020-07-14T13:09:08+00:00",
"filename": "sample.pdf",
"submission_id": "5f0dae74c122fb57fc3f360b",
"url": null
},
{
"created_at": "2020-07-14T10:54:02+00:00",
"filename": "sample.pdf",
"submission_id": "5f0d8eca91837459ca5cee1c",
"url": null
},
{
"created_at": "2020-07-14T10:48:02+00:00",
"filename": "sample.pdf",
"submission_id": "5f0d8d622560cc30d825588b",
"url": null
},
{
"created_at": "2020-07-13T17:48:02+00:00",
"filename": "sample.pdf",
"submission_id": "5f0c9e52f6150a35a72b8c99",
"url": null
},
{
"created_at": "2020-07-13T17:38:12+00:00",
"filename": "sample.pdf",
"submission_id": "5f0c9c040030d423b83a9991",
"url": null
},
{
"created_at": "2020-07-13T17:35:58+00:00",
"filename": "sample.pdf",
"submission_id": "5f0c9b7eac8ef74e754f8724",
"url": null
},
{
"created_at": "2019-04-11T15:08:01+00:00",
"filename": "sample.pdf",
"submission_id": "5caf58510388385b8b7b23ca",
"url": null
},
{
"created_at": "2019-03-10T11:11:01+00:00",
"filename": "sample.pdf",
"submission_id": "5c84f0c5028838b82ffc1ce3",
"url": null
},
{
"created_at": "2019-03-10T08:53:28+00:00",
"filename": "sample.pdf",
"submission_id": "5c84d088028838950cfc1ce4",
"url": null
},
{
"created_at": "2019-02-08T18:28:18-06:00",
"filename": "sample.pdf",
"submission_id": "5c5e1ea27ca3e12cd80ecf07",
"url": null
}
],
"submitname": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51_1549672910345_sample.pdf",
"tags": [],
"target_url": null,
"threat_level": 0,
"threatscore": null,
"total_network_connections": 0,
"total_processes": 1,
"total_signatures": 9,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"verdict": "whitelisted"
}
}
Human Readable Output
Scan Results
submit name threat level verdict total network connections total processes environment description interesting environment id url analysis analysis start time total signatures type type short sha256 8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51_1549672910345_sample.pdf 0 whitelisted 0 1 Windows 7 32 bit false 100 false 2019-02-09T01:41:57+00:00 9 PDF document, version 1.3 8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51
cs-falcon-sandbox-sample-download
Downloads the sample file.
Base Command
cs-falcon-sandbox-sample-download
Input
| Argument Name | Description | Required |
|---|---|---|
| file | The SHA256 hash of the file. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.SHA512 | String | The SHA512 hash of the file. |
| File.SSDeep | String | The SSDeep hash of the file. |
| File.EntryID | String | The file entry ID. |
| File.Info | String | Information about the file. |
| File.Type | String | The file type. |
| File.MD5 | String | The MD5 hash of the file. |
| File.Extension | String | The file extension. |
Command example
!cs-falcon-sandbox-sample-download file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51
Context Example
{
"File": {
"EntryID": "425@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "gz",
"Info": "gz",
"MD5": "227f491cfca844bc56127216c956c59a",
"Name": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51.bin.sample.gz",
"SHA1": "cc71f378f875b1daa6c462195301ddb8025d0d2f",
"SHA256": "1801097bfc747e5fab03e194a79c88e665b14f7510950d6702f27096ca41b85d",
"SHA512": "22464de2b59147cae9f7289308dd5a0e54686840c0a13032173705a280d1918c2aa40b6406dc756b8145ba2c3cea2abb3f5dca93e2ba3b7f8be2704419d12e9b",
"SSDeep": "24:Xv2b+nAJehSZ/KNNtZHUXXj1xJq34VWwA2uMQi87JTSvE3gt:Xw+IeYENN3cZxJO4V31HQi87cvE3gt",
"Size": 945,
"Type": "gzip compressed data, max compression, from Unix, original size 3028"
}
}
cs-falcon-sandbox-report-state
Gets the report state for the given ID.
Base Command
cs-falcon-sandbox-report-state
Input
| Argument Name | Description | Required |
|---|---|---|
| JobID | The file job ID. | Optional |
| environmentID | The environment ID. Available environment IDs: 310: “Linux (Ubuntu 20, 64-bit)”, 200: “Android Static Analysis”, 120: “Windows 7 64 bit”, 110: “Windows 7 32 bit (HWP Support)”, 100: “Windows 7 32 bit”. Possible values are: 100, 110, 120, 200, 310. Default is 100. | Required |
| file | The hash of the file. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.State.state | String | The state of the report. |
| CrowdStrike.State.error_type | String | The error type of the report. |
| CrowdStrike.State.error_origin | String | The error origin. |
| CrowdStrike.State.error | String | The error description. |
Command example
!cs-falcon-sandbox-report-state file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 environmentID=300
Context Example
{
"CrowdStrike": {
"State": {
"error": "The requested environment ID \"300\" and file type \"pdf\" have no available execution environment",
"error_origin": "CLIENT",
"error_type": "FILE_TYPE_BAD_ERROR",
"related_reports": [],
"state": "ERROR"
}
}
}
Human Readable Output
State
Error Error Origin Error Type Related Reports State The requested environment ID “300” and file type “pdf” have no available execution environment CLIENT FILE_TYPE_BAD_ERROR ERROR
Additional Notes
- The CrowdStrike Environment ID 300 has been deprecated and is now EOL. It is recommended to use Environment ID 310 for Linux sandboxing.
Configuration parameters
serverUrl— Server URL (e.g. https://hybrid-analysis.com) (required)credentials— (required)integrationReliability— Source Reliability (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (20)
-
crowdstrike-get-environmentsDeprecatedDeprecated. Use cs-falcon-sandbox-get-environments instead.
-
crowdstrike-get-screenshotsDeprecatedDeprecated. Use cs-falcon-sandbox-get-screenshots instead.
-
crowdstrike-resultDeprecatedDeprecated. Use cs-falcon-sandbox-result instead.
-
crowdstrike-scanDeprecatedDeprecated. Use cs-falcon-sandbox-scan instead.
-
crowdstrike-searchDeprecatedDeprecated. Use cs-falcon-sandbox-search instead.
-
crowdstrike-submit-sampleDeprecatedDeprecated. Use cs-falcon-sandbox-submit-sample instead.
-
crowdstrike-submit-urlDeprecatedDeprecated. Use cs-falcon-sandbox-submit-url instead.
-
cs-falcon-sandbox-analysis-overviewGets the hash overview.
-
cs-falcon-sandbox-analysis-overview-refreshRefreshes the overview and downloads fresh data from external services.
-
cs-falcon-sandbox-analysis-overview-summaryReturns the hash overview.
-
cs-falcon-sandbox-get-environmentsGets a list of all available environments.
-
cs-falcon-sandbox-get-screenshotsRetrieves screenshots from a report.
-
cs-falcon-sandbox-report-stateGets the report state for the given ID.
-
cs-falcon-sandbox-resultRetrieves result data on a file. Note: This command returns a file.
-
cs-falcon-sandbox-sample-downloadDownloads the sample file.
-
cs-falcon-sandbox-scanGets report summary information for a job_id or a sha256 hash.
-
cs-falcon-sandbox-searchSearches the database using the Falcon Sandbox search syntax.
-
cs-falcon-sandbox-submit-sampleSubmits a file from the investigation to the analysis server.
-
cs-falcon-sandbox-submit-urlSubmits a URL for analysis.
-
fileReturns file information and reputation.
from collections.abc import Callable from itertools import zip_longest from typing import Any import demistomock as demisto # noqa: F401 import urllib3 from CommonServerPython import * # noqa: F401 from requests import Response from urllib.parse import urlparse, urlunparse # Disable insecure warnings urllib3.disable_warnings() # pylint: disable=no-member SEARCH_TERM_QUERY_ARGS = ( "filename", "filetype", "filetype_desc", "env_id", "country", "verdict", "av_detect", "vx_family", "tag", "date_from", "date_to", "port", "host", "domain", "url", "similar_to", "context", "imp_hash", "ssdeep", "authentihash", ) # envid repeated for bw compatibility. Must be in this order so old overrides new default SUBMISSION_PARAMETERS = ( "environmentID", "environmentId", "no_share_third_party", "allow_community_access", "no_hash_lookup", "action_script", "hybrid_analysis", "experimental_anti_evasion", "script_logging", "input_sample_tampering", "network_settings", "email", "comment", "custom_cmd_line", "custom_run_time", "submit_name", "priority", "document_password", "environment_variable", ) IN_PROGRESS_STATES = ["IN_PROGRESS", "RUNNING"] class Client(BaseClient): def get_environments(self) -> List[dict]: return self._http_request(method="GET", url_suffix="/system/environments") def get_screenshots(self, key: str) -> List[dict[str, Any]]: return self._http_request(method="GET", url_suffix=f"/report/{key}/screenshots") def search(self, query_args: dict[str, Any]): self._headers["Content-Type"] = "application/x-www-form-urlencoded" return self._http_request(method="POST", url_suffix="/search/terms", data=query_args) def scan(self, file: str) -> dict[str, Any]: return self._http_request(method="GET", url_suffix=f"/report/{file}/summary") def analysis_overview(self, sha256hash: str) -> dict[str, Any]: return self._http_request(method="GET", url_suffix=f"/overview/{sha256hash}") def analysis_overview_summary(self, sha256hash: str) -> dict[str, Any]: return self._http_request(method="GET", url_suffix=f"/overview/{sha256hash}/summary") def analysis_overview_refresh(self, sha256hash: str): self._http_request(method="GET", url_suffix=f"/overview/{sha256hash}/refresh") def get_report(self, key: str, filetype: str) -> Response: return self._http_request( method="GET", url_suffix=f"/report/{key}/report/{filetype}", resp_type="response", ok_codes=(200, 404) ) def get_state(self, key: str) -> dict[str, Any]: return self._http_request(method="GET", url_suffix=f"/report/{key}/state") def submit_url(self, url: str, params: dict[str, Any]) -> dict[str, Any]: return self._http_request(method="POST", data={"url": url, **params}, url_suffix="/submit/url") def submit_file(self, file_contents: dict, params: dict[str, Any]) -> dict: return self._http_request( method="POST", data=params, url_suffix="/submit/file", files={"file": (file_contents["name"], open(file_contents["path"], "rb"))}, ) def download_sample(self, sha256hash: str) -> Response: return self._http_request(method="GET", url_suffix=f"/overview/{sha256hash}/sample", resp_type="response") # for BW compatibility with v1 we need to return same object keys def map_dict_keys(obj: dict, map_rules: dict[str, str], only_given_fields: bool = False) -> dict[Any, Any]: """ This function will switch the keys of a dictionary according to the provided map_rules. Example: map_dict_keys( {'a' : 'b', 'c' : 'd' }, {'a' : 'y', 'c' : 'z' }) -> {'y' : 'b' , 'z' : 'd'} Args: obj: The original dictionary map_rules: The mapping the keys should be changed by only_given_fields: whether fields besides for those in map_rules should be used Returns : a Dict according to the map_rules """ return {map_rules.get(key, key): obj[key] for key in obj if not only_given_fields or key in map_rules} def translate_verdict(param: str) -> int: return {"Whitelisted": 1, "NoVerdict": 2, "NoSpecificThreat": 3, "Suspicious": 4, "Malicious": 5}[param] def split_query_to_term_args(query: str) -> dict[str, Any]: def get_value(term: str) -> str: return term[term.index(":") + 1 :].strip() def get_key(term: str) -> str: return term[: term.index(":")].strip() return {get_key(term): get_value(term) for term in query.split(",") if get_value(term)} def validated_term(key: str, val: Any) -> Any: if key == "verdict": return translate_verdict(val) if key == "country" and len(val) != 3: raise ValueError("Country ISO code should be 3 characters long") return val def validated_search_terms(query_args: dict[str, Any]) -> dict[str, Any]: if len(query_args) == 0: raise ValueError("Must have at least one search term") return {key: validated_term(key, query_args[key]) for key in query_args} def get_search_term_args(args: dict[str, Any]) -> dict[str, Any]: if args.get("query"): return split_query_to_term_args(args["query"]) else: return {term: args[term] for term in SEARCH_TERM_QUERY_ARGS if args.get(term, None)} def get_api_id(args: dict[str, Any]) -> str: # must fist check environmentId (deprecated) to override default args of environmentID if args.get("file") and (args.get("environmentId") or args.get("environmentID")): return f"{args['file']}:{args.get('environmentId') or args.get('environmentID')}" elif args.get("JobID"): return args["JobID"] else: raise ValueError("Must supply JobID or environmentID and file") def get_scan_keys(args: dict[str, Any]) -> List[str]: """ Extracts scan keys from the provided arguments. Args: args (dict[str, Any]): Dictionary containing scan parameters - file: Comma-separated list of file hashes - environmentId/environmentID: Comma-separated list of environment IDs - JobID: Comma-separated list of job IDs Returns: List[str]: List of API IDs constructed from the parameters """ files = argToList(args.get("file", [])) env_ids = argToList(args.get("environmentId", []) or args.get("environmentID", [])) job_ids = argToList(args.get("JobID", [])) if (files and env_ids) and (len(files) != len(env_ids)): raise ValueError("When using files and environment IDs, they must be of the same length.") keys = [] for f, e, j in zip_longest(files, env_ids, job_ids): keys.append(get_api_id({"file": f, "environmentId": e, "JobID": j})) return keys def test_module(client: Client, _) -> str: """Tests API connectivity and authentication' :return: 'ok' if test passed, anything else will fail the test. :rtype: ``str`` """ try: client.get_environments() message = "ok" except DemistoException as e: if "Forbidden" in str(e) or "Authorization" in str(e): message = "Authorization Error: make sure API Key is correctly set" else: raise e return message def get_default_file_name(filetype: str) -> str: return f"CrowdStrike_report_{round(time.time())}.{get_file_suffix(filetype)}" def get_file_suffix(filetype: str = "bin") -> str: # check this if filetype in ("pcap", "bin", "xml", "html"): return "gz" if filetype == "json": return "json" if filetype in ("misp", "stix"): return "xml" return filetype def has_error_state(client: Client, key: str) -> bool: state = client.get_state(key) demisto.debug(f"state to check if should poll response: {state}") if state["state"] == "ERROR": raise Exception(f"Got Error state from server: {state}") return False class BWCFile(Common.File): def __init__(self, bwc_fields: dict, key_change_map: dict, only_given_fields, *args, **kwargs): super().__init__(*args, **kwargs) self.bwc_fields = bwc_fields self.key_change_map = key_change_map self.only_given_fields = only_given_fields def to_context(self) -> Any: super_ret = super().to_context() for key in super_ret: if key.startswith("File"): super_ret[key].update(map_dict_keys(self.bwc_fields, self.key_change_map, self.only_given_fields)) return super_ret def create_scan_results_readable_output(scan_response) -> Any: table_field_dict = { "submit_name": "submit name", "threat_level": "threat level", "threat_score": "threat score", "verdict": "verdict", "total_network_connections": "total network connections", "target_url": "target url", "classification_tags": "classification tags", "total_processes": "total processes", "environment_description": "environment description", "interesting": "interesting", "environment_id": "environment id", "url_analysis": "url analysis", "analysis_start_time": "analysis start time", "total_signatures": "total signatures", "type": "type", "type_short": "type short", "vx_family": "Malware Family", "sha256": "sha256", } return tableToMarkdown( "Scan Results:", scan_response, headers=list(table_field_dict.keys()), headerTransform=lambda x: table_field_dict.get(x, x), removeNull=True, ) def get_dbot_score(filehash, threat_score: int) -> Common.DBotScore: def calc_score() -> int: return {3: 0, 2: 3, 1: 2, 0: 1}.get(threat_score, 0) return Common.DBotScore( indicator=filehash, integration_name="CrowdStrike Falcon Sandbox V2", indicator_type=DBotScoreType.FILE, score=calc_score(), malicious_description=f"Score of {calc_score()}", reliability=DBotScoreReliability.get_dbot_score_reliability_from_str(demisto.params().get("integrationReliability")), ) def get_submission_arguments(args: dict[str, Any]) -> dict[str, Any]: return {camel_case_to_underscore(arg): args[arg] for arg in SUBMISSION_PARAMETERS if args.get(arg)} def submission_response(client, response, polling) -> List[CommandResults]: context = { "CrowdStrike.Submit(val.submission_id && val.submission_id === obj.submission_id)": response, "CrowdStrike.JobID": response.get("job_id"), "CrowdStrike.EnvironmentID": response.get("environment_id"), } submission_res = CommandResults( outputs_prefix="", outputs_key_field="", raw_response=response, outputs=context, readable_output=tableToMarkdown("Submission Data:", response, headerTransform=underscore_to_space), ) if not polling: return [submission_res] else: return_results(submission_res) # return early return crowdstrike_scan_command({"JobID": response.get("job_id"), "polling": True}, client) def crowdstrike_submit_url_command(client: Client, args: dict[str, Any]) -> List[CommandResults]: submission_args = get_submission_arguments(args) url = args["url"] response = client.submit_url(url, submission_args) return submission_response(client, response, args.get("polling")) def crowdstrike_submit_sample_command(client: Client, args: dict[str, Any]) -> List[CommandResults]: file_contents = demisto.getFilePath(args["entryId"]) submission_args = get_submission_arguments(args) response = client.submit_file(file_contents, submission_args) return submission_response(client, response, args.get("polling")) def crowdstrike_analysis_overview_command(client: Client, args: dict[str, Any]) -> CommandResults: result = client.analysis_overview(args["file"]) file = Common.File( Common.DBotScore.NONE, sha256=result.get("sha256"), size=result.get("size"), file_type=result.get("type"), name=result.get("last_file_name"), ) table_cols = [ "last_file_name", "threat_score", "other_file_name", "sha256", "verdict", "url_analysis", "size", "type", "type_short", ] return CommandResults( outputs_prefix="CrowdStrike.AnalysisOverview", outputs_key_field="sha256", outputs=result, raw_response=result, indicator=file, readable_output=tableToMarkdown( "Analysis Overview:", result, headers=table_cols, headerTransform=underscore_to_space, removeNull=True ), ) def crowdstrike_search_command(client: Client, args: dict[str, Any]) -> List[CommandResults]: query_args: dict = get_search_term_args(args) query_args = validated_search_terms(query_args) response = client.search(query_args) key_name_changes = { "job_id": "JobID", "sha256": "SHA256", "environment_id": "environmentId", "threat_score": "threatscore", "environment_description": "environmentDescription", "submit_name": "submitname", "analysis_start_time": "start_time", } # each indicator needs its own CR since indicators is deprecated. def convert_to_file_res(res) -> CommandResults: return CommandResults( readable_output=tableToMarkdown( "Search Results:", res, removeNull=True, headerTransform=underscore_to_space, headers=[ "submit_name", "verdict", "vx_family", "threat_score", "sha256", "size", "environment_id", "type", "type_short", "analysis_start_time", ], ), indicator=BWCFile( res, key_name_changes, False, size=res.get("size"), sha256=res.get("sha256"), dbot_score=Common.DBotScore.NONE, extension=res.get("type_short"), name=res.get("submit_name"), malware_family=res.get("vx_family"), ), ) try: return [ CommandResults( raw_response=response, outputs_prefix="CrowdStrike.Search", outputs_key_field="sha256", outputs=response.get("result"), readable_output=f"Search returned {response.get('count')} results. Limit set to {args['limit']}", ), *[convert_to_file_res(res) for res in response.get("result")[: max(int(args["limit"]), 1)]], ] except ValueError: raise ValueError("The limit argument must be numeric.") @polling_function("cs-falcon-sandbox-scan") def crowdstrike_scan_command(args: dict[str, Any], client: Client): scan_response = [] scan_keys = get_scan_keys(args) for key in scan_keys: scan_response.append(client.scan(key)) def file_with_bwc_fields(res) -> CommandResults: return CommandResults( readable_output=create_scan_results_readable_output(res), indicator=BWCFile( res, only_given_fields=False, size=res.get("size"), file_type=res.get("type"), sha1=res.get("sha1"), sha256=res.get("sha256"), md5=res.get("md5"), sha512=res.get("sha512"), name=res.get("submit_name"), ssdeep=res.get("ssdeep"), malware_family=res.get("vx_family"), dbot_score=get_dbot_score(res.get("sha256"), res.get("threat_level")), key_change_map={ "sha1": "SHA1", "sha256": "SHA256", "md5": "MD5", "job_id": "JobID", "environment_id": "environmentId", "threat_score": "threatscore", "environment_description": "environmentDescription", "submit_name": "submitname", "url_analysis": "isurlanalysis", "interesting:": "isinteresting", "vx_family": "family", }, ), ) continue_to_poll = any(res["state"] in IN_PROGRESS_STATES for res in scan_response) command_result = [ CommandResults( outputs_prefix="CrowdStrike.Report", raw_response=scan_response, outputs=scan_response, readable_output=f"Scan returned {len(scan_response)} results", ), *[file_with_bwc_fields(res) for res in scan_response if not continue_to_poll], ] return PollResult(continue_to_poll=continue_to_poll, response=command_result) def crowdstrike_analysis_overview_summary_command(client: Client, args: dict[str, Any]) -> CommandResults: result = client.analysis_overview_summary(args["file"]) return CommandResults( outputs_prefix="CrowdStrike.AnalysisOverview", outputs_key_field="sha256", outputs=result, raw_response=result, readable_output=tableToMarkdown( "Analysis Overview Summary:", result, headerTransform=lambda x: { "analysis_start_time": "Analysis Start Time", "last_multi_scan": "Last Multi Scan", "multiscan_result": "Multiscan Result", "threat_score": "Threat Score", "verdict": "Verdict", "sha256": "Sha256", }.get(x, x), removeNull=True, ), ) def crowdstrike_analysis_overview_refresh_command(client: Client, args: dict[str, Any]) -> CommandResults: client.analysis_overview_refresh(args["file"]) return CommandResults(readable_output="The request to refresh the analysis overview was sent successfully.") @polling_function("cs-falcon-sandbox-result") def crowdstrike_result_command(args: dict[str, Any], client: Client): key = get_api_id(args) report_response = client.get_report(key, args["file-type"]) demisto.debug(f"get report response code: {report_response.status_code}") successful_response = report_response.status_code == 200 if successful_response: ret_list = [ fileResult(get_default_file_name(args["file-type"]), report_response.content, file_type=EntryType.ENTRY_INFO_FILE) ] if args.get("file"): ret_list.append(crowdstrike_scan_command(args, client)) return PollResult(ret_list) else: error_response = CommandResults( raw_response=report_response, readable_output="Falcon Sandbox returned an error: status code " + f"{report_response.status_code}, response: " + f"{report_response.text}", entry_type=entryTypes["error"], ) return PollResult(continue_to_poll=lambda: not has_error_state(client, key), response=error_response) def underscore_to_space(x: str) -> str: return pascalToSpace(underscoreToCamelCase(x)) def crowdstrike_report_state_command(client: Client, args: dict[str, Any]) -> CommandResults: key = get_api_id(args) state = client.get_state(key) return CommandResults( outputs_prefix="CrowdStrike.State", raw_response=state, outputs=state, readable_output=tableToMarkdown("State", state, headerTransform=underscore_to_space), ) def crowdstrike_get_environments_command(client: Client, _) -> CommandResults: environments = client.get_environments() environments = [ map_dict_keys( env, { "environment_id": "ID", "total_virtual_machines": "VMs_total", "analysis_mode": "analysisMode", "group_icon": "groupicon", "busy_virtual_machines": "VMs_busy", }, ) for env in environments ] readable_output_column_conversion = { "ID": "_ID", "description": "Description", "architecture": "Architecture", "VMs_total": "Total VMS", "VMs_busy": "Busy VMS", "analysisMode": "Analysis mode", "groupicon": "Group icon", } return CommandResults( outputs_prefix="CrowdStrike.Environment", outputs_key_field="id", outputs=environments, readable_output=tableToMarkdown( "Execution Environments:", environments, list(readable_output_column_conversion.keys()), removeNull=True, headerTransform=lambda x: readable_output_column_conversion[x], ), raw_response=environments, ) def crowdstrike_get_screenshots_command(client: Client, args: dict[str, Any]): def to_image_result(image: dict): return fileResult(image["name"], base64.b64decode(image["image"]), entryTypes["entryInfoFile"]) key = get_api_id(args) ret = [to_image_result(image) for image in client.get_screenshots(key)] return ret if len(ret) > 0 else CommandResults(readable_output="No screenshots returned") def crowdstrike_sample_download_command(client: Client, args: dict[str, Any]): hash_value = args["file"] response = client.download_sample(hash_value) file_name = response.headers.get("Vx-Filename", hash_value + ".gz") return fileResult(file_name, data=response.content, file_type=EntryType.FILE) def main() -> None: """main function, parses params and runs command_func functions :return: :rtype: """ params: dict[str, Any] = demisto.params() args: dict[str, Any] = demisto.args() verify_certificate = not params.get("insecure", False) server_url = params.get("serverUrl", "") + "/api/v2" proxy = params.get("proxy", False) parsed_url = urlparse(server_url) if parsed_url.hostname == "www.hybrid-analysis.com": # Replace hostname and reconstruct the URL parsed_url = parsed_url._replace(netloc="hybrid-analysis.com") server_url = urlunparse(parsed_url) demisto_command = demisto.command() demisto.debug(f"Command being called is {demisto_command}") try: headers: dict = {"api-key": demisto.params().get("credentials", {}).get("password"), "User-Agent": "Falcon Sandbox"} client = Client(base_url=server_url, verify=verify_certificate, headers=headers, proxy=proxy) command_func: Callable if demisto_command in ["test-module"]: command_func = test_module elif demisto_command in ["cs-falcon-sandbox-search", "crowdstrike-search"]: command_func = crowdstrike_search_command elif demisto_command in ["cs-falcon-sandbox-scan", "crowdstrike-scan", "file"]: return_results(crowdstrike_scan_command(args, client)) return elif demisto_command in ["crowdstrike-get-environments", "cs-falcon-sandbox-get-environments"]: command_func = crowdstrike_get_environments_command elif demisto_command in ["cs-falcon-sandbox-get-screenshots", "crowdstrike-get-screenshots"]: command_func = crowdstrike_get_screenshots_command elif demisto_command in ["cs-falcon-sandbox-result", "crowdstrike-result"]: return_results(crowdstrike_result_command(args, client)) return elif demisto_command in ["cs-falcon-sandbox-analysis-overview"]: command_func = crowdstrike_analysis_overview_command elif demisto_command in ["cs-falcon-sandbox-analysis-overview-summary"]: command_func = crowdstrike_analysis_overview_summary_command elif demisto_command in ["cs-falcon-sandbox-analysis-overview-refresh"]: command_func = crowdstrike_analysis_overview_refresh_command elif demisto_command in ["crowdstrike-submit-sample", "cs-falcon-sandbox-submit-sample"]: command_func = crowdstrike_submit_sample_command elif demisto_command in ["cs-falcon-sandbox-submit-url", "crowdstrike-submit-url"]: command_func = crowdstrike_submit_url_command elif demisto_command in ["cs-falcon-sandbox-sample-download"]: command_func = crowdstrike_sample_download_command elif demisto_command in ["cs-falcon-sandbox-report-state"]: command_func = crowdstrike_report_state_command else: raise NotImplementedError(f"Command not implemented: {demisto_command}") return_results(command_func(client, args)) except Exception as e: return_error(f"Failed to execute {demisto_command} command_func.\nError:\n{e!s}") """ ENTRY POINT """ if __name__ in ("__main__", "__builtin__", "builtins"): main()