CrowdStrike Falcon Sandbox V2
Fully automated malware analysis using Hybrid Analysis API.
Forensics & Malware Analysis · CrowdStrike Falcon Sandbox
Details
| ID | CrowdStrike Falcon Sandbox V2 |
|---|---|
| Provider | CrowdStrike |
| Category | Forensics & Malware Analysis |
| From Version | 6.2.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
README
CrowdStrike Falcon Sandbox v2
Use the CrowdStrike Falcon Sandbox integration to submit and analyze files and URLs.
This integration is backwards compatible with the CrowdStrike Falcon Sandbox integration.
Prerequisites
Make sure you have the API key for CrowdStrike Falcon Sandbox v2.
Each API key has an associated authorization level, which determines the available endpoints. By default, all free, non-vetted accounts can issue restricted keys. You can upgrade to full default keys, enabling file submissions and downloads.
Get an API Key
You must have an account with Hybrid-Analysis. If you do not have an account, you can sign up here.
Obtain an API key by:
- In your profile page, from the top right menu navigate to the API key tab.
- Click the Create API key button.
Configure CrowdStrike Falcon Sandbox v2 in Cortex
| Parameter | Description | Required | |
|---|---|---|---|
| Server URL | The Server URL of the CrowdStrike Falcon Sandbox instance. By default, https://www.hybrid-analysis.com |
True | |
| API Key | True | ||
| Source Reliability | Reliability of the source providing the intelligence data. | True | |
| Trust any certificate (not secure) | False | ||
| Use system proxy settings | False |
Supported File Types
- PE (.exe, .scr, .pif, .dll, .com, .cpl, and so on)
- Microsoft Word (.doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub)
- APK
- JAR executables
- Windows Script Component (.sct)
- Windows Shortcut (.lnk)
- Windows Help (.chm)
- HTML Application (.hta)
- Windows Script File (*.wsf)
- Javascript (.js)
- Visual Basic (.vbs,.vbe)
- Shockwave Flash (.swf)
- Perl (.pl)
- PowerShell (.ps1, .psd1, .psm1)
- Scalable Vector Graphics (.svg)
- Python scripts (.py)
- Perl scripts (.pl)
- Linux ELF executables
- MIME RFC 822 (*.eml)
- Outlook (*.msg files)
The maximum file upload size is 100 MB.
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
cs-falcon-sandbox-scan
Gets report summary information for a job_id or a sha256 hash.
Base Command
cs-falcon-sandbox-scan
Input
| Argument Name | Description | Required |
|---|---|---|
| file | A comma-separated list of file hashes (SHA256), followed by an environment ID, separated by colon (:). For example, SHA256_1:ENV_ID_1,SHA256_2:ENV_ID_2. Use this argument or the job_id argument. | Optional |
| environmentID | A comma-separated list of environment IDs. That list would be used with, and should be the same length, as the file argument. Available environment IDs: 310: “Linux (Ubuntu 20, 64-bit)”, 200: “Android Static Analysis”, 120: “Windows 7 64 bit”, 110: “Windows 7 32 bit (HWP Support)”, 100: “Windows 7 32 bit”. | Optional |
| polling | Whether to poll until there is at least one result. Possible values are: true, false. | Optional |
| JobID | A comma-separated list of JobIDs to check the state of when polling. Use this argument or the file argument. | Optional |
| hide_polling_output | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.Report.job_id | String | The report job ID. |
| CrowdStrike.Report.environment_id | Number | The report environment ID. |
| CrowdStrike.Report.environment_description | String | The environment description. |
| CrowdStrike.Report.size | Number | The file size. |
| CrowdStrike.Report.type | String | The file type. |
| CrowdStrike.Report.type_short | String | The short description of the file type. |
| CrowdStrike.Report.target_url | String | The target url. |
| CrowdStrike.Report.state | String | The report state. |
| CrowdStrike.Report.error_type | String | The error type. |
| CrowdStrike.Report.error_origin | String | The error origin. |
| CrowdStrike.Report.submit_name | String | The name of the file when submitted. |
| CrowdStrike.Report.md5 | String | The MD5 hash of the file. |
| CrowdStrike.Report.sha1 | String | The SHA1 hash of the file. |
| CrowdStrike.Report.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.sha512 | String | The SHA512 hash of the file. |
| CrowdStrike.Report.ssdeep | String | The SSDeep hash of the file. |
| CrowdStrike.Report.imphash | String | The imphash hash of the file. |
| CrowdStrike.Report.av_detect | Number | The AV Multiscan range, for example 50-70 (min 0, max 100). |
| CrowdStrike.Report.vx_family | String | The file malware family. |
| CrowdStrike.Report.url_analysis | Boolean | Whether this report is url analysis. |
| CrowdStrike.Report.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.Report.threat_score | Number | The file threat score. |
| CrowdStrike.Report.interesting | Boolean | Whether the file was found to be interesting. |
| CrowdStrike.Report.threat_level | Number | The file threat level. |
| CrowdStrike.Report.verdict | String | The file verdict. |
| CrowdStrike.Report.total_network_connections | Number | The total number of network connections. |
| CrowdStrike.Report.total_processes | Number | The total number of processes. |
| CrowdStrike.Report.total_signatures | Number | The total number of signatures. |
| CrowdStrike.Report.file_metadata | Object | The file metadata. |
| CrowdStrike.Report.submissions.submission_id | String | The submission ID. |
| CrowdStrike.Report.submissions.filename | String | The name of the file. |
| CrowdStrike.Report.submissions.url | String | The url. |
| CrowdStrike.Report.submissions.created_at | Date | When the submission was created. |
| CrowdStrike.Report.network_mode | String | The network mode. |
| File.SHA256 | string | The SHA256 hash of the file. |
| File.SHA1 | string | The SHA1 hash of the file. |
| File.MD5 | string | The MD5 hash of the file. |
| File.Name | string | The file submission name. |
| File.MalwareFamily | string | The file family classification. |
| File.Malicious.Vendor | string | The vendor that decided the file was malicious. |
| File.Malicious.Description | string | The reason the vendor decided the file was malicious. |
| DBotScore.Indicator | string | The tested indicator. |
| DBotScore.Type | string | The indicator type. |
| DBotScore.Vendor | string | The vendor used to calculate the score. |
| DBotScore.Score | number | The actual score. |
cs-falcon-sandbox-get-environments
Gets a list of all available environments.
Base Command
cs-falcon-sandbox-get-environments
Input
| Argument Name | Description | Required |
| — | — | — |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.Environment.ID | number | The environment ID. |
| CrowdStrike.Environment.description | string | The environment description. |
| CrowdStrike.Environment.architecture | string | The environment architecture. |
| CrowdStrike.Environment.VMs_total | number | The total number of virtual machines in the environment. |
| CrowdStrike.Environment.VMs_busy | number | The number of busy virtual machines in the environment. |
| CrowdStrike.Environment.analysisMode | string | The environment analysis mode. |
| CrowdStrike.Environment.groupicon | string | The environment icon. |
Command example
#### Context Example
```json
{
"CrowdStrike": {
"Environment": [
{
"ID": 100,
"VMs_busy": 9223372036854776000,
"VMs_total": 9223372036854776000,
"analysisMode": "KERNELMODE",
"architecture": "WINDOWS",
"description": "Windows 7 32 bit",
"groupicon": "windows",
"id": "100",
"invalid_virtual_machines": 0,
"virtual_machines": []
},
{
"ID": 110,
"VMs_busy": 9223372036854776000,
"VMs_total": 9223372036854776000,
"analysisMode": "KERNELMODE",
"architecture": "WINDOWS",
"description": "Windows 7 32 bit (HWP Support)",
"groupicon": "windows",
"id": "110",
"invalid_virtual_machines": 0,
"virtual_machines": []
},
{
"ID": 120,
"VMs_busy": 9223372036854776000,
"VMs_total": 9223372036854776000,
"analysisMode": "KERNELMODE",
"architecture": "WINDOWS",
"description": "Windows 7 64 bit",
"groupicon": "windows",
"id": "120",
"invalid_virtual_machines": 0,
"virtual_machines": []
},
{
"ID": 300,
"VMs_busy": 9223372036854776000,
"VMs_total": 9223372036854776000,
"analysisMode": "USERMODE",
"architecture": "LINUX",
"description": "Linux (Ubuntu 16.04, 64 bit)",
"groupicon": "linux",
"id": "300",
"invalid_virtual_machines": 0,
"virtual_machines": []
},
{
"ID": 200,
"VMs_busy": 9223372036854776000,
"VMs_total": 9223372036854776000,
"analysisMode": "USERMODE",
"architecture": "ANDROID",
"description": "Android Static Analysis",
"groupicon": "android",
"id": "200",
"invalid_virtual_machines": 0,
"virtual_machines": []
}
]
}
}
Human Readable Output
Execution Environments
_ID Description Architecture Total VMS Busy VMS Analysis mode Group icon 100 Windows 7 32 bit WINDOWS 9223372036854775807 9223372036854775807 KERNELMODE windows 110 Windows 7 32 bit (HWP Support) WINDOWS 9223372036854775807 9223372036854775807 KERNELMODE windows 120 Windows 7 64 bit WINDOWS 9223372036854775807 9223372036854775807 KERNELMODE windows 300 Linux (Ubuntu 16.04, 64 bit) LINUX 9223372036854775807 9223372036854775807 USERMODE linux 200 Android Static Analysis ANDROID 9223372036854775807 9223372036854775807 USERMODE android
cs-falcon-sandbox-submit-sample
Submits a file from the investigation to the analysis server.
Base Command
cs-falcon-sandbox-submit-sample
Input
| Argument Name | Description | Required |
|---|---|---|
| entryId | The War Room entry ID. | Required |
| environmentID | The environment ID. Available environment IDs: 310: “Linux (Ubuntu 20, 64-bit)”, 200: “Android Static Analysis”, 120: “Windows 7 64 bit”, 110: “Windows 7 32 bit (HWP Support)”, 100: “Windows 7 32 bit”. Possible values are: 100, 110, 120, 200, 310. Default is 100. | Required |
| polling | Whether the command should poll until the result is ready. Possible values are: true, false. | Optional |
| no_share_third_party | When set to ‘true’, the sample is never shared with any third party. Possible values are: true, false. | Optional |
| no_hash_lookup | When set to ‘true’, no hash lookup is done on the sample. Possible values are: true, false. | Optional |
| allow_community_access | When set to ‘true’, the sample is available for the community. Possible values are: true, false. | Optional |
| action_script | Optional custom runtime action script. Available runtime scripts: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie. Possible values are: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie. | Optional |
| hybrid_analysis | When set to ‘false’, no memory dump or memory dump analysis is done. Possible values are: true, false. | Optional |
| experimental_anti_evasion | When set to ‘true’, sets all Kernelmode Monitor experimental anti-evasion options. Possible values are: true, false. | Optional |
| script_logging | When set to ‘true’, sets the Kernelmode Monitor in-depth script logging engine. Possible values are: true, false. | Optional |
| input_sample_tampering | When set to ‘true’, allows Kernelmode Monitor experimental anti-evasion options that tamper with the input sample. Possible values are: true, false. | Optional |
| network_settings | Network settings. Available options: default: ‘Fully operating network’, tor: ‘Route network traffic via TOR’, simulated: ‘Simulate network traffic’. Possible values are: default, tor, simulated. | Optional |
| Optional email address that may be associated with the submission for notification. | Optional | |
| comment | Optional comment text that may be associated with the submission/sample (Note: you can use #tags). | Optional |
| custom_cmd_line | Optional command line that should be passed to the analysis file. | Optional |
| custom_run_time | Optional runtime duration (in seconds). | Optional |
| submit_name | Optional ‘submission name’ field that will be used for file type detection and analysis. Ignored unless url contains a file. | Optional |
| priority | Optional priority value between 1 (lowest) and 10 (highest). By default all samples run with highest priority. Possible values are: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10. | Optional |
| document_password | Optional document password used to fill in Adobe/Office password prompts. | Optional |
| environment_variable | Optional system environment value. The value is provided in the format name=value. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.Submit.job_id | String | The submitted report job ID. |
| CrowdStrike.Submit.submission_id | String | The report submission ID. |
| CrowdStrike.Submit.environment_id | Number | The report environment ID. |
| CrowdStrike.Submit.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.job_id | String | The report job ID. |
| CrowdStrike.Report.environment_id | Number | The report environment ID. |
| CrowdStrike.Report.environment_description | String | The environment description. |
| CrowdStrike.Report.size | Number | The file size. |
| CrowdStrike.Report.type | String | The file type. |
| CrowdStrike.Report.type_short | String | The short description of the file type. |
| CrowdStrike.Report.target_url | String | The target url. |
| CrowdStrike.Report.state | String | The report state. |
| CrowdStrike.Report.error_type | String | The error type. |
| CrowdStrike.Report.error_origin | String | The error origin. |
| CrowdStrike.Report.submit_name | String | The name of the file when submitted. |
| CrowdStrike.Report.md5 | String | The MD5 hash of the file. |
| CrowdStrike.Report.sha1 | String | The SHA1 hash of the file. |
| CrowdStrike.Report.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.sha512 | String | The SHA512 hash of the file. |
| CrowdStrike.Report.ssdeep | String | The SSDeep hash of the file. |
| CrowdStrike.Report.imphash | String | The imphash hash of the file. |
| CrowdStrike.Report.av_detect | Number | The AV Multiscan range, for example 50-70 (min 0, max 100). |
| CrowdStrike.Report.vx_family | String | The file malware family. |
| CrowdStrike.Report.url_analysis | Boolean | Whether this report is url analysis. |
| CrowdStrike.Report.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.Report.threat_score | Number | The file threat score. |
| CrowdStrike.Report.interesting | Boolean | Whether the file was found to be interesting. |
| CrowdStrike.Report.threat_level | Number | The file threat level. |
| CrowdStrike.Report.verdict | String | The file verdict. |
| CrowdStrike.Report.total_network_connections | Number | The total number of network connections. |
| CrowdStrike.Report.total_processes | Number | The total number of processes. |
| CrowdStrike.Report.total_signatures | Number | The total number of signatures. |
| CrowdStrike.Report.file_metadata | Object | The file metadata. |
| CrowdStrike.Report.submissions.submission_id | String | The submission ID |
| CrowdStrike.Report.submissions.filename | String | The name of the file. |
| CrowdStrike.Report.submissions.url | String | The url. |
| CrowdStrike.Report.submissions.created_at | Date | When the submission was created. |
| CrowdStrike.Report.network_mode | String | The network mode. |
| File.SHA256 | string | The SHA256 hash of the file. |
| File.SHA1 | string | The SHA1 hash of the file |
| File.MD5 | string | The MD5 hash of the file. |
| File.Name | string | The file submission name. |
| File.MalwareFamily | string | The file family classification. |
| File.Malicious.Vendor | string | The vendor that decided the file was malicious. |
| File.Malicious.Description | string | The reason the vendor decided the file was malicious. |
| DBotScore.Indicator | string | The tested indicator. |
| DBotScore.Type | string | The indicator type. |
| DBotScore.Vendor | string | The vendor used to calculate the score. |
| DBotScore.Score | number | The actual score. |
cs-falcon-sandbox-search
Searches the database using the Falcon Sandbox search syntax.
Base Command
cs-falcon-sandbox-search
Input
| Argument Name | Description | Required |
|---|---|---|
| query | The Falcon Sandbox query syntax, for example url:google,host:95.181.53.78. This argument integrates all other arguments into one and cannot be given along with the other arguments. | Optional |
| filename | The file name, for example invoice.exe. | Optional |
| filetype | The file type. Available options: 64bits, android, assembly, bat, cmd, com, csv, data, doc, docx, elf, empty, executable, flash, html, hwp, hwpx, img, iqy, java, javascript, library, lnk, macho, mshelp, msi, native, neexe, office, outlook, pdf, pedll, peexe, perl, ppt, pptx, ps, pub, python, rtf, script, sct, sh, svg, text, url, vbe, vbs, wsf, xls, xlsx. | Optional |
| filetype_desc | The file type description, for example PE32 executable. | Optional |
| env_id | The environment ID. | Optional |
| country | The country (3 digit ISO), for example swe. | Optional |
| verdict | The search result verdict. Available options: Whitelisted, NoVerdict, NoSpecificThreat, Suspicious, Malicious. Possible values are: Whitelisted, NoVerdict, NoSpecificThreat, Suspicious, Malicious. | Optional |
| av_detect | The AV Multiscan range, for example 50-70 (min 0, max 100). | Optional |
| vx_family | The AV Family Substring, for example nemucod. | Optional |
| limit | The max number of search results to return. Default is 10. | Optional |
| tag | The hashtag, for example ransomware. | Optional |
| date_from | The date from in format ‘YYYY-MM-DD HH:MM’, for example 2018-09-28 15:30. | Optional |
| date_to | The date to in format ‘YYYY-MM-DD HH:MM’, for example 2018-09-28 15:30. | Optional |
| port | The port, for example 8080. | Optional |
| host | The host, for example 192.168.0.1. | Optional |
| domain | The domain, for example checkip.dyndns.org. | Optional |
| url | The HTTP request substring, for example google. | Optional |
| similar_to | Similar samples, for example <sha256>. | Optional |
| context | Sample context, for example <sha256>. | Optional |
| imp_hash | The import hash. | Optional |
| ssdeep | The SSDeep hash. | Optional |
| authentihash | The file authentihash. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| File.SHA256 | string | The SHA256 hash of the file. |
| File.Name | string | The file submission name. |
| File.MalwareFamily | string | The file family classification. |
| File.Extension | string | The file extension. |
| File.MalwareFamily | String | The malware family associated with the file. |
| CrowdStrike.Search.search_terms.id | String | The id of the search term. |
| CrowdStrike.Search.search_terms.value | String | The value of the search term. |
| CrowdStrike.Search.count | Number | The number of results for this search. |
| CrowdStrike.Search.result.verdict | String | The file verdict. |
| CrowdStrike.Search.result.av_detect | String | The AV Multiscan range, for example 50-70 (min 0, max 100). |
| CrowdStrike.Search.result.threat_score | Number | The file threat score. |
| CrowdStrike.Search.result.vx_family | String | The file malware family. |
| CrowdStrike.Search.result.job_id | String | The JobID of the result. |
| CrowdStrike.Search.result.sha256 | String | The sha256 hash of the file. |
| CrowdStrike.Search.result.environment_id | Number | The environment ID. |
| CrowdStrike.Search.result.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.Search.result.submit_name | String | The name of the file. |
| CrowdStrike.Search.result.environment_description | String | The environment description. |
| CrowdStrike.Search.result.size | Number | The size of the file. |
| CrowdStrike.Search.result.type | String | The file type. |
| CrowdStrike.Search.result.type_short | String | The short description of the file type. |
Command example
!cs-falcon-sandbox-search filename=sample.pdf
Context Example
{
"CrowdStrike": {
"Search": [
{
"analysis_start_time": "2020-09-15T16:47:06+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "5f60f00aeac13102de2fce70",
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"size": 3028,
"submit_name": "file",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "whitelisted",
"vx_family": null
},
{
"analysis_start_time": "2021-11-30 03:00:10",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "61a593b82d8c3b27e521d683",
"sha256": "e4c0b73252211528f355e7db301da6369e69e079c6daad9e8fbb0134cc44ce27",
"size": 160626,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-11-05 17:02:53",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "618551a497ef941c2b423271",
"sha256": "2f0de9415b0e746b1189d939d84d0dd15ea93d457bd0a42ebec8b52475c2be63",
"size": 468452,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-08-09 07:15:50",
"av_detect": "25",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "6110d6214689581ac34e89ab",
"sha256": "98983e00b47bcbe9ebbaf5f28ea6cdbf619dd88c91f481b18fec7ffdb68ab741",
"size": 254635,
"submit_name": "Sample.pdf",
"threat_score": 100,
"type": null,
"type_short": "pdf",
"verdict": "malicious",
"vx_family": "RDN/Generic.cf"
},
{
"analysis_start_time": "2021-07-30 17:31:11",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "61043759e4ae00628e4757d9",
"sha256": "45d2de1252ebd402728b2cb810d8a9232a99e9887f75146d2e7d1d84d46fd360",
"size": 561412,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-06-24 02:53:57",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "60d3f3bb942da51feb3c77b5",
"sha256": "b33d6fa9eac776c1ad07c406bacef7c9af8ce052a181a5801a0bffa1f24ebf1d",
"size": 25138418,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-06-03 09:49:10",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "60b8a59139899b32c2459c98",
"sha256": "7207460b6cf6e4965b7ab20bfadca652ab1629240781e49f7e783de8a9c31900",
"size": 370299,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2020-08-04 18:46:31",
"av_detect": "2",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5f29acffc8af093b787e92de",
"sha256": "4af3aa3c6afd3db86a65f191bd69306650e12475fd5611ccaec5519543276d5a",
"size": 64532,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": "Unavailable"
},
{
"analysis_start_time": "2020-07-08 15:39:36",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5f05c7c22ada7e11701edcc2",
"sha256": "02b0fcf5406a4cd1c816ea21bc25f6f0bcb5ae36b8da9526d3af6f5aab89b6de",
"size": 394003,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2020-06-18 15:15:46",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5eeb85187ce0e079d35424e7",
"sha256": "3714ef17995d459f9c81d99b77bdef830b24dbe28d893b2b4f1952279ca91aa6",
"size": 5639308,
"submit_name": "sample.pdf",
"threat_score": 29,
"type": null,
"type_short": "pdf",
"verdict": "suspicious",
"vx_family": null
},
{
"analysis_start_time": "2020-06-05T07:35:10+00:00",
"av_detect": "42",
"environment_description": "Linux (Ubuntu 16.04, 64 bit)",
"environment_id": 300,
"job_id": "5ed9f5ae2466ef104967e5bb",
"sha256": "9d0bfa6a3c99f83bb6d9fb4822855c488dedd3a9a2fe19010e0e176437422b04",
"size": 5732088,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "64-bit elf",
"verdict": null,
"vx_family": "Unavailable"
},
{
"analysis_start_time": "2020-06-04 05:21:19",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5ed884ca8989f014bf0a2867",
"sha256": "91f5a577e0df35103c8bf6d5d5ea6690b97ed319570ba61688379d254fe9b1ed",
"size": 159219,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2020-05-10 06:06:38",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5eb799e4098ed957b177f7f1",
"sha256": "6822023d6f22b0f08f788c4528eed07c424603b1d68fc4fdb8ef8a9e6dfab3b6",
"size": 69992,
"submit_name": "Sample.pdf",
"threat_score": 56,
"type": null,
"type_short": "pdf",
"verdict": "suspicious",
"vx_family": null
},
{
"analysis_start_time": "2020-02-14 04:50:05",
"av_detect": null,
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5e4626f1428a7c6bd26e42e8",
"sha256": "a5963f78a27e384421e23ff54974094a34112b8eeec77615cd4235d7b82812c7",
"size": 35270,
"submit_name": "sample.pdf",
"threat_score": 35,
"type": null,
"type_short": "html",
"verdict": "suspicious",
"vx_family": null
},
{
"analysis_start_time": "2019-09-25 07:30:35",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5d8b17a8028838f13e7f6bf4",
"sha256": "7856688c84402d991250abf44d8bea30131837f11a69891fb9597816e8902f4e",
"size": 189630,
"submit_name": "sample.pdf",
"threat_score": 45,
"type": null,
"type_short": "pdf",
"verdict": "suspicious",
"vx_family": null
},
{
"analysis_start_time": "2019-09-25 07:04:24",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5d8b1180028838e40e7f6bc1",
"sha256": "ed511c548b99fe89836cbd9258e81a9f84df95bb8fc8cccc7958b2b5bd40a6e3",
"size": 186763,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": "Unavailable"
},
{
"analysis_start_time": "2019-09-09 09:07:09",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5d7616ef0388386b85511900",
"sha256": "6d056be8945a60bc2f68c6468bd4f6b68a37f99e69090478e0f8f078b9763176",
"size": 50790,
"submit_name": "sample.pdf",
"threat_score": 29,
"type": null,
"type_short": "pdf",
"verdict": "suspicious",
"vx_family": null
},
{
"analysis_start_time": "2019-09-01T10:31:54+00:00",
"av_detect": null,
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5d6b9e1a0288383930c48455",
"sha256": "8b46920adaa5a4d2d2912f68452dea622fa215d78e923a878647a5febe082a36",
"size": 58,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "text",
"verdict": null,
"vx_family": null
},
{
"analysis_start_time": "2019-09-01T10:00:10+00:00",
"av_detect": null,
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5d6b96660388389c397057c2",
"sha256": "84e0435537ceedd0819188759387f4eeb59c8bc63d243c9b4a3399a90e564715",
"size": 41,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "text",
"verdict": null,
"vx_family": null
},
{
"analysis_start_time": "2019-06-22 12:25:24",
"av_detect": "0",
"environment_description": "Windows 7 32 bit (HWP Support)",
"environment_id": 110,
"job_id": "5d0e1e790288380b0e2af5eb",
"sha256": "9fcb5ed2265c1aca54a8e4ebc847e0c9c19b7aa7984f3e7ca0794b314057505e",
"size": 2669339,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-04-22 06:41:37",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5cbd62160388381a4caf198e",
"sha256": "6042d499aca0c5700fb416a4970fdd9238272397732beda9b4065a21c0150e8e",
"size": 440654,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-03-29 04:41:26",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5c9da41c02883869997acd28",
"sha256": "c979e4b6a1850794609860fcc68bda58edc0f51989d57a199808d3f1a2564d7a",
"size": 95318,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-03-20T17:45:03+00:00",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5c927c1f038838b59636b712",
"sha256": "b26054c33e5f201a2a4cafb5047c576115c389451e5a74f3f75400e4f0504512",
"size": 95271,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": null,
"vx_family": null
},
{
"analysis_start_time": "2019-03-19 06:38:41",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5c909092028838fe55b4f755",
"sha256": "f8bf163014405cd4dc8f133fc563886e92a2b98862edd98d5f8656eba67db284",
"size": 496372,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-03-14 17:06:41",
"av_detect": null,
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5c8a8c39038838899a329921",
"sha256": "65ab8a0fd8920379c37d03ad3b5f7d62d5a8b00b902c5d72229269328aa2221f",
"size": 1317691,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-03-09 06:40:22",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5c8361e20388387f5d1006a4",
"sha256": "e28401b6fa6f8fafc7db5946c30a18ab2d306748b277609caec5ecf970506529",
"size": 696561,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-02-26 18:41:27",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5c758a5a038838514ca50f27",
"sha256": "a84b84b85911e68b421172a1d857da81706a7608eae6415e9a52bb9e59801e59",
"size": 1154729,
"submit_name": "sample.pdf",
"threat_score": 20,
"type": null,
"type_short": "pdf",
"verdict": "malicious",
"vx_family": null
},
{
"analysis_start_time": "2019-02-15 09:36:27",
"av_detect": "0",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5c6676c07ca3e17d121f3f11",
"sha256": "855e15b9e02ff992d81e2cf93fdec286b81e8374b5acad5a9009d1569ca86cf0",
"size": 324101,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-01-30T18:15:14-06:00",
"av_detect": "0",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "5c5236d97ca3e107a93e8333",
"sha256": "33adb4f6630443600d5d1381350ac018f1676d8523084af814b5c01da3e7a609",
"size": 80468,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "raw data",
"verdict": null,
"vx_family": null
},
{
"analysis_start_time": "2018-10-17 08:14:46",
"av_detect": "67",
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"job_id": "5bc6d34b7ca3e104a26ff5c3",
"sha256": "a927b3f2244e901e23e50f6b7a4929b837f0f0d1d8e0dc0a1957f5208b4e4e51",
"size": 11961,
"submit_name": "extract-1424750780.560286-HTTP-FTdiED2cMH3iOTs3c4.raw.pdf",
"threat_score": 100,
"type": null,
"type_short": "pdf",
"verdict": "malicious",
"vx_family": "PDF:Exploit.PDF"
},
{
"analysis_start_time": "2016-08-27 06:28:06",
"av_detect": "75",
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"job_id": "57c116c0aac2edfe59c7c2a0",
"sha256": "86a96ec03ba8242c1486456d67ee17f919128754846dbb3bdf5e836059091dba",
"size": 10866,
"submit_name": "pdf-doc-vba-eicar-dropper.pdf",
"threat_score": 100,
"type": null,
"type_short": "pdf",
"verdict": "malicious",
"vx_family": "Trojan.Eicartest"
},
{
"analysis_start_time": "2022-01-11T03:46:07+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "61dcfd7f797bea289de8eaff",
"sha256": "55c3b94ca033edb56010d8cfbbc17c900911e0f5bc938020debdc8d454a15313",
"size": 254738,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2022-01-05T12:02:39+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "61d588df797bea289d371b1d",
"sha256": "6332a96c88c486d1b396f9346e689d1ad15c06ae733539cd4e66a2bd8dbec9ff",
"size": 218816,
"submit_name": "SAMPLE.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-07-28T05:48:32+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "6100efb09a02dd8ce6bb695a",
"sha256": "177661da747aebe78fa66313ca239143a226be23d397a5327329c732c4d2670b",
"size": 727215,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": "Unavailable"
},
{
"analysis_start_time": "2021-03-17T06:15:46+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "60519e929a02dd8ce6f4090c",
"sha256": "111ee199588c1a167be496933b037fefaa69c45404f915054edc8e209a73fa4c",
"size": 215461,
"submit_name": "SAMPLE.PDF",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-01-11T08:18:07+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "5ffc09bf40fe1d5daa5ca658",
"sha256": "dc13bd74b9e78ea241bbb0736a8e660eb56afc53b2701b75964d89cb47f6edb0",
"size": 1285713,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2021-01-08T05:47:16+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "5ff7f1e440fe1d5daa17422b",
"sha256": "6486ef92ad7b591f6da0eacf04304840e8d293b591ca4e48c2eeca664bf0d120",
"size": 2037209,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2020-12-10T03:33:47+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "5fd1971b40fe1d5daa721221",
"sha256": "d60dee8111b0289e66e5858dd27f29855d1611f3602564f0cdfe06725790c144",
"size": 268886,
"submit_name": "sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2020-11-25T13:16:42+00:00",
"av_detect": "0",
"environment_description": "Static Analysis",
"environment_id": null,
"job_id": "5fbe593a40fe1d5daa57823e",
"sha256": "5ff12f55a1a8c198ccafff9e1920b9e2a5d5cde0f2f6cfe787264c43cbac808c",
"size": 381447,
"submit_name": "Sample.pdf",
"threat_score": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
}
]
},
"File": [
{
"Extension": "pdf",
"JobID": "620587e270d21856e87f7164",
"MalwareFamily": "Trojan.PDF.Phishing",
"Name": "sample.pdf",
"SHA256": "9e8eb1889ec6b32a6074dd5b963c84fd27d7ba7f314ea997f3e3eb4a1ac70757",
"Size": 164833,
"av_detect": "61",
"environmentDescription": "Windows 7 32 bit",
"environmentId": 100,
"size": 164833,
"start_time": "2022-02-10 21:47:19",
"submitname": "sample.pdf",
"threatscore": 95,
"type": null,
"type_short": "pdf",
"verdict": "malicious",
"vx_family": "Trojan.PDF.Phishing"
},
{
"Extension": "pdf",
"JobID": "6204334534edcd3b4a77c57e",
"Name": "sample.pdf",
"SHA256": "05fd3790624f8eed569a244ea550231f173e9c697c85a8a762a1cdac156548c8",
"Size": 96456,
"av_detect": "0",
"environmentDescription": "Linux (Ubuntu 16.04, 64 bit)",
"environmentId": 300,
"size": 96456,
"start_time": "2022-02-09T21:33:57+00:00",
"submitname": "sample.pdf",
"threatscore": null,
"type": null,
"type_short": "pdf",
"verdict": null,
"vx_family": null
},
{
"Extension": "pdf",
"JobID": "620232a39f065a6af02c3ca3",
"Name": "sample.pdf",
"SHA256": "2834c221137f03516befdfb3fec545442bb77de3984f141212e4813da924e0c2",
"Size": 126204,
"av_detect": "0",
"environmentDescription": "Windows 7 32 bit",
"environmentId": 100,
"size": 126204,
"start_time": "2022-02-08 09:06:45",
"submitname": "sample.pdf",
"threatscore": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"Extension": "pdf",
"JobID": "6201302fba54b008a31228ef",
"Name": "sample.pdf",
"SHA256": "fb6dd79ebb7755eb5aeabf605e6a30e0de5090e4b3039c9b0337877f435c4d66",
"Size": 120719,
"av_detect": "0",
"environmentDescription": "Windows 7 32 bit",
"environmentId": 100,
"size": 120719,
"start_time": "2022-02-07 14:44:06",
"submitname": "sample.pdf",
"threatscore": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"Extension": "pdf",
"JobID": "61ae29f24e69ff77d566ab48",
"Name": "samplePdf.pdf",
"SHA256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"Size": 3506,
"av_detect": "0",
"environmentDescription": "Android Static Analysis",
"environmentId": 200,
"size": 3506,
"start_time": "2021-12-06 15:19:23",
"submitname": "samplePdf.pdf",
"threatscore": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"Extension": "pdf",
"JobID": "61a593b82d8c3b27e521d683",
"Name": "Sample.pdf",
"SHA256": "e4c0b73252211528f355e7db301da6369e69e079c6daad9e8fbb0134cc44ce27",
"Size": 160626,
"av_detect": "0",
"environmentDescription": "Windows 7 32 bit",
"environmentId": 100,
"size": 160626,
"start_time": "2021-11-30 03:00:10",
"submitname": "Sample.pdf",
"threatscore": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"Extension": "pdf",
"JobID": "618551a497ef941c2b423271",
"Name": "sample.pdf",
"SHA256": "2f0de9415b0e746b1189d939d84d0dd15ea93d457bd0a42ebec8b52475c2be63",
"Size": 468452,
"av_detect": "0",
"environmentDescription": "Windows 7 32 bit",
"environmentId": 100,
"size": 468452,
"start_time": "2021-11-05 17:02:53",
"submitname": "sample.pdf",
"threatscore": null,
"type": null,
"type_short": "pdf",
"verdict": "no specific threat",
"vx_family": null
},
{
"Extension": "pdf",
"JobID": "6110d6214689581ac34e89ab",
"MalwareFamily": "RDN/Generic.cf",
"Name": "Sample.pdf",
"SHA256": "98983e00b47bcbe9ebbaf5f28ea6cdbf619dd88c91f481b18fec7ffdb68ab741",
"Size": 254635,
"av_detect": "25",
"environmentDescription": "Windows 7 64 bit",
"environmentId": 120,
"size": 254635,
"start_time": "2021-08-09 07:15:50",
"submitname": "Sample.pdf",
"threatscore": 100,
"type": null,
"type_short": "pdf",
"verdict": "malicious",
"vx_family": "RDN/Generic.cf"
}
]
}
Human Readable Output
Search Results
Submit Name Verdict Vx Family Threat Score Sha 256 Size Environment Id Type Short Analysis Start Time sample.pdf 8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 3028 300 2022-01-10T08:33:11+00:00 sample.pdf 8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 3028 300 2022-01-10T07:38:29+00:00 samplePdf.pdf no specific threat 8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 3506 200 2021-12-06 15:19:23 Sample.pdf no specific threat e4c0b73252211528f355e7db301da6369e69e079c6daad9e8fbb0134cc44ce27 160626 100 2021-11-30 03:00:10 sample.pdf no specific threat 2f0de9415b0e746b1189d939d84d0dd15ea93d457bd0a42ebec8b52475c2be63 468452 100 2021-11-05 17:02:53 Sample.pdf malicious RDN/Generic.cf 100 98983e00b47bcbe9ebbaf5f28ea6cdbf619dd88c91f481b18fec7ffdb68ab741 254635 120 2021-08-09 07:15:50
cs-falcon-sandbox-result
Retrieves result data on a file. Note: This command returns a file.
Base Command
cs-falcon-sandbox-result
Input
| Argument Name | Description | Required |
|---|---|---|
| polling | Whether the command should poll until the result is ready. Possible values are: true, false. Default is True. | Optional |
| file | The file hash (MD5, SHA1, or SHA256). | Optional |
| environmentID | The environment ID. Available environment IDs: 310: “Linux (Ubuntu 20, 64-bit)”, 200: “Android Static Analysis”, 120: “Windows 7 64 bit”, 110: “Windows 7 32 bit (HWP Support)”, 100: “Windows 7 32 bit”. Possible values are: 100, 110, 120, 200, 310. Default is 100. | Required |
| JobID | The file job ID to generate a report for. | Optional |
| file-type | The file type. Possible values are: xml, json, html, pdf, maec, stix, misp, misp-json, openioc. Default is pdf. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.Report.job_id | String | The file job ID. |
| CrowdStrike.Report.environment_id | Number | The report environment ID. |
| CrowdStrike.Report.environment_description | String | The environment description. |
| CrowdStrike.Report.size | Number | The file size. |
| CrowdStrike.Report.type | String | The file type. |
| CrowdStrike.Report.type_short | String | The short description of the file type. |
| CrowdStrike.Report.target_url | String | The target url. |
| CrowdStrike.Report.state | String | The report state. |
| CrowdStrike.Report.error_type | String | The error type. |
| CrowdStrike.Report.error_origin | String | The error origin. |
| CrowdStrike.Report.submit_name | String | The file name when submitted. |
| CrowdStrike.Report.md5 | String | The MD5 hash of the file. |
| CrowdStrike.Report.sha1 | String | The SHA1 hash of the file. |
| CrowdStrike.Report.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.sha512 | String | The SHA512 hash of the file. |
| CrowdStrike.Report.ssdeep | String | The SSDeep hash of the file. |
| CrowdStrike.Report.imphash | String | The imphash hash of the file. |
| CrowdStrike.Report.av_detect | Number | The AV Multiscan range, for example 50-70 (min 0, max 100). |
| CrowdStrike.Report.vx_family | String | The file malware family. |
| CrowdStrike.Report.url_analysis | Boolean | Whether this report is url analysis. |
| CrowdStrike.Report.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.Report.threat_score | Number | The file threat score. |
| CrowdStrike.Report.interesting | Boolean | Whether the file was found to be interesting. |
| CrowdStrike.Report.threat_level | Number | The file threat level. |
| CrowdStrike.Report.verdict | String | The file verdict. |
| CrowdStrike.Report.total_network_connections | Number | The total number of network connections. |
| CrowdStrike.Report.total_processes | Number | The total number of processes. |
| CrowdStrike.Report.total_signatures | Number | The total number of signatures. |
| CrowdStrike.Report.file_metadata | Object | The file metadata. |
| CrowdStrike.Report.submissions.submission_id | String | The ID of the submission. |
| CrowdStrike.Report.submissions.filename | String | The name of the file. |
| CrowdStrike.Report.submissions.url | String | The url. |
| CrowdStrike.Report.submissions.created_at | Date | When the submission was created. |
| CrowdStrike.Report.network_mode | String | The network mode. |
| File.SHA256 | string | The SHA256 hash of the file. |
| File.SHA1 | string | The SHA1 hash of the file. |
| File.MD5 | string | The MD5 hash of the file. |
| File.Name | string | The file submission name. |
| File.MalwareFamily | string | The file family classification. |
| File.Malicious.Vendor | string | The vendor that decided the file was malicious. |
| File.Malicious.Description | string | The reason the vendor decided the file was malicious. |
| DBotScore.Indicator | string | The tested indicator. |
| DBotScore.Type | string | The indicator type. |
| DBotScore.Vendor | string | The vendor used to calculate the score. |
| DBotScore.Score | number | The actual score. |
| InfoFile.Name | string | The file name. |
| InfoFile.EntryID | string | The file entry ID. |
| InfoFile.Size | number | The file size. |
| InfoFile.Type | string | The file type, for example “PE”. |
| InfoFile.Info | string | Basic information about the file. |
| InfoFile.Extension | string | The file extension. |
cs-falcon-sandbox-submit-url
Submits a URL for analysis.
Base Command
cs-falcon-sandbox-submit-url
Input
| Argument Name | Description | Required |
|---|---|---|
| url | The URL for analysis or the URL of the file to submit. | Required |
| environmentID | The environment ID. Available environment IDs: 310: “Linux (Ubuntu 20, 64-bit)”, 200: “Android Static Analysis”, 120: “Windows 7 64 bit”, 110: “Windows 7 32 bit (HWP Support)”, 100: “Windows 7 32 bit”. Possible values are: 100, 110, 120, 200, 310. Default is 100. | Required |
| polling | Whether the command should poll until the result is ready. Possible values are: true, false. | Optional |
| no_share_third_party | When set to ‘true’, the sample is never shared with any third party. Possible values are: true, false. | Optional |
| no_hash_lookup | When set to ‘true’, no hash lookup is done on the sample. Possible values are: true, false. | Optional |
| allow_community_access | When set to ‘true’, the sample is available for the community. Possible values are: true, false. | Optional |
| action_script | Optional custom runtime action script. Available runtime scripts: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie. Possible values are: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie. | Optional |
| hybrid_analysis | When set to ‘false’, no memory dump or memory dump analysis is done. Possible values are: true, false. | Optional |
| experimental_anti_evasion | When set to ‘true’, sets all Kernelmode Monitor experimental anti-evasion options. Possible values are: true, false. | Optional |
| script_logging | When set to ‘true’, sets the Kernelmode Monitor in-depth script logging engine. Possible values are: true, false. | Optional |
| input_sample_tampering | When set to ‘true’, allows Kernelmode Monitor experimental anti-evasion options that tamper with the input sample. Possible values are: true, false. | Optional |
| network_settings | Network settings. Available options: default: ‘Fully operating network’, tor: ‘Route network traffic via TOR’, simulated: ‘Simulate network traffic’. Possible values are: default, tor, simulated. | Optional |
| Optional email address that may be associated with the submission for notification. | Optional | |
| comment | Optional comment text that may be associated with the submission/sample (Note: you can use #tags). | Optional |
| custom_cmd_line | Optional command line that should be passed to the analysis file. | Optional |
| custom_run_time | Optional runtime duration (in seconds). | Optional |
| submit_name | Optional ‘submission name’ field that will be used for file type detection and analysis. Ignored unless url contains a file. | Optional |
| priority | Optional priority value between 1 (lowest) and 10 (highest). By default all samples run with highest priority. Possible values are: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10. | Optional |
| document_password | Optional document password used to fill in Adobe/Office password prompts. | Optional |
| environment_variable | Optional system environment value. The value is provided in the format name=value. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.Submit.job_id | String | The The submitted report job ID. |
| CrowdStrike.Submit.submission_type | String | The type of the submission. |
| CrowdStrike.Submit.submission_id | String | The submission ID. |
| CrowdStrike.Submit.environment_id | Number | The submission environment ID. |
| CrowdStrike.Submit.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.job_id | String | The report job ID. |
| CrowdStrike.Report.environment_id | Number | The report environment ID. |
| CrowdStrike.Report.environment_description | String | The environment description. |
| CrowdStrike.Report.size | Number | The file size. |
| CrowdStrike.Report.type | String | The file type. |
| CrowdStrike.Report.type_short | String | The short description of the file type. |
| CrowdStrike.Report.target_url | String | The target url. |
| CrowdStrike.Report.state | String | The report state. |
| CrowdStrike.Report.error_type | String | The error type. |
| CrowdStrike.Report.error_origin | String | The error origin. |
| CrowdStrike.Report.submit_name | String | The file name when submitted. |
| CrowdStrike.Report.md5 | String | The MD5 hash of the file. |
| CrowdStrike.Report.sha1 | String | The SHA1 hash of the file. |
| CrowdStrike.Report.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.sha512 | String | The SHA512 hash of the file. |
| CrowdStrike.Report.ssdeep | String | The SSDeep hash of the file. |
| CrowdStrike.Report.imphash | String | The imphash hash of the file. |
| CrowdStrike.Report.av_detect | Number | The AV Multiscan range, for example 50-70 (min 0, max 100) |
| CrowdStrike.Report.vx_family | String | The file malware famil. |
| CrowdStrike.Report.url_analysis | Boolean | Whether this report is url analysis. |
| CrowdStrike.Report.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.Report.threat_score | Number | The file threat score. |
| CrowdStrike.Report.interesting | Boolean | Whether the file was found to be interesting. |
| CrowdStrike.Report.threat_level | Number | The file threat level. |
| CrowdStrike.Report.verdict | String | The file verdict. |
| CrowdStrike.Report.total_network_connections | Number | The total number of network connections. |
| CrowdStrike.Report.total_processes | Number | The total number of processes. |
| CrowdStrike.Report.total_signatures | Number | The total number of signatures. |
| CrowdStrike.Report.file_metadata | Object | The file metadata. |
| CrowdStrike.Report.submissions.submission_id | String | The submission ID. |
| CrowdStrike.Report.submissions.filename | String | The name of the file. |
| CrowdStrike.Report.submissions.url | String | The url. |
| CrowdStrike.Report.submissions.created_at | Date | When the submission was created. |
| CrowdStrike.Report.network_mode | String | The network mode. |
| File.SHA256 | string | The SHA256 hash of the file. |
| File.SHA1 | string | The SHA1 hash of the file. |
| File.MD5 | string | The MD5 hash of the file. |
| File.Name | string | The file submission name. |
| File.MalwareFamily | string | The file family classification. |
| File.Malicious.Vendor | string | The vendor that decided the file was malicious. |
| File.Malicious.Description | string | The reason the vendor decided the file was malicious. |
| DBotScore.Indicator | string | The tested indicator. |
| DBotScore.Type | string | The indicator type. |
| DBotScore.Vendor | string | The vendor used to calculate the score. |
| DBotScore.Score | number | The actual score. |
Command example
!cs-falcon-sandbox-submit-url url=example.com environmentID=300
Context Example
{
"CrowdStrike": {
"EnvironmentID": 300,
"JobID": "61f7a5f99741de6d6100bbc8",
"Report": [
{
"analysis_start_time": "2020-02-03T08:39:15+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environment_description": "Static Analysis",
"environment_id": null,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"file_metadata": null,
"hosts": [],
"imphash": null,
"interesting": false,
"job_id": null,
"machine_learning_models": [],
"md5": "be69708899323a1c8d5f88d9909d7b7a",
"mitre_attcks": [],
"network_mode": "default",
"processes": [],
"sha1": "017f143e0d7c33c65e4cb1a325e21c02c052c586",
"sha256": "0b1d27c7ef8651eac6933608d4cb0a4b9fd74c45b883d5a4da1eeaa540f6cc5c",
"sha512": "891aa9b7c6db52ce2259d8b1094889d389224b4069eac33f608f1630b6b92bdb0c37f488cf0c4254cd9cbbb052d3eeda2497ba560f3f49f0d32fa0b37753149e",
"size": null,
"ssdeep": null,
"state": "SUCCESS",
"submissions": [
{
"created_at": "2022-01-04T03:51:44+00:00",
"filename": null,
"submission_id": "61d3c45075dd613cd2318de3",
"url": "http://example.com/"
},
{
"created_at": "2021-12-10T10:47:23+00:00",
"filename": null,
"submission_id": "61b3303bee51fe1f135eb6b7",
"url": "http://example.com/"
},
{
"created_at": "2021-12-09T07:12:15+00:00",
"filename": null,
"submission_id": "61b1ac4fdf3fac4b3646afaf",
"url": "http://example.com/"
},
{
"created_at": "2021-12-06T06:45:16+00:00",
"filename": null,
"submission_id": "61adb17ce135f902cc551c48",
"url": "http://example.com/"
},
{
"created_at": "2021-12-06T06:44:27+00:00",
"filename": null,
"submission_id": "61adb14bc57a140f004524e3",
"url": "http://example.com/"
},
{
"created_at": "2021-12-03T02:13:39+00:00",
"filename": null,
"submission_id": "61a97d5379045c262d110cdd",
"url": "http://example.com/"
},
{
"created_at": "2021-12-03T02:13:03+00:00",
"filename": null,
"submission_id": "61a97d2fe02d87331d25e5a0",
"url": "http://example.com/"
},
{
"created_at": "2021-12-03T02:10:31+00:00",
"filename": null,
"submission_id": "61a97c97342971450f29b089",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:39:25+00:00",
"filename": null,
"submission_id": "6135633d41965265aa0a8dac",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:39:20+00:00",
"filename": null,
"submission_id": "613563381330f950b228416a",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:39:01+00:00",
"filename": null,
"submission_id": "6135632521e8ac3e5b189d17",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:47+00:00",
"filename": null,
"submission_id": "61355f1bcde472428f05416c",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:41+00:00",
"filename": null,
"submission_id": "61355f156c70b32ce5616a9a",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:16+00:00",
"filename": null,
"submission_id": "61355efcd71dbf0d2b05a084",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:04+00:00",
"filename": null,
"submission_id": "61355ef05278276a355a88d1",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:15:26+00:00",
"filename": null,
"submission_id": "6134ed1e68b3fa69b92a29a6",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:15:21+00:00",
"filename": null,
"submission_id": "6134ed19e76fc318ca444ce3",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:15:03+00:00",
"filename": null,
"submission_id": "6134ed07a94fd140c8512fe7",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:14:53+00:00",
"filename": null,
"submission_id": "6134ecfd6743b00302001a9f",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T08:35:09+00:00",
"filename": null,
"submission_id": "6134813d0ff3652bfc4886c3",
"url": "http://example.com/"
}
],
"submit_name": "http://example.com/",
"tags": [
"tag",
"tng"
],
"target_url": null,
"threat_level": 1,
"threat_score": null,
"total_network_connections": 0,
"total_processes": 0,
"total_signatures": 0,
"type": null,
"type_short": [],
"url_analysis": true,
"verdict": "suspicious",
"vx_family": null
}
],
"Submit": {
"environment_id": 300,
"job_id": "61f7a5f99741de6d6100bbc8",
"sha256": "0b1d27c7ef8651eac6933608d4cb0a4b9fd74c45b883d5a4da1eeaa540f6cc5c",
"submission_id": "61f7a5f99741de6d6100bbc9",
"submission_type": "page_url"
}
},
"DBotScore": {
"Indicator": "0b1d27c7ef8651eac6933608d4cb0a4b9fd74c45b883d5a4da1eeaa540f6cc5c",
"Reliability": "A - Completely reliable",
"Score": 2,
"Type": "file",
"Vendor": "CrowdStrike Falcon Sandbox V2"
},
"File": {
"JobID": null,
"MD5": "be69708899323a1c8d5f88d9909d7b7a",
"Name": "http://example.com/",
"SHA1": "017f143e0d7c33c65e4cb1a325e21c02c052c586",
"SHA256": "0b1d27c7ef8651eac6933608d4cb0a4b9fd74c45b883d5a4da1eeaa540f6cc5c",
"SHA512": "891aa9b7c6db52ce2259d8b1094889d389224b4069eac33f608f1630b6b92bdb0c37f488cf0c4254cd9cbbb052d3eeda2497ba560f3f49f0d32fa0b37753149e",
"analysis_start_time": "2020-02-03T08:39:15+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environmentDescription": "Static Analysis",
"environmentId": null,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"family": null,
"file_metadata": null,
"hosts": [],
"imphash": null,
"interesting": false,
"isurlanalysis": true,
"machine_learning_models": [],
"mitre_attcks": [],
"network_mode": "default",
"processes": [],
"sha512": "891aa9b7c6db52ce2259d8b1094889d389224b4069eac33f608f1630b6b92bdb0c37f488cf0c4254cd9cbbb052d3eeda2497ba560f3f49f0d32fa0b37753149e",
"size": null,
"ssdeep": null,
"state": "SUCCESS",
"submissions": [
{
"created_at": "2022-01-04T03:51:44+00:00",
"filename": null,
"submission_id": "61d3c45075dd613cd2318de3",
"url": "http://example.com/"
},
{
"created_at": "2021-12-10T10:47:23+00:00",
"filename": null,
"submission_id": "61b3303bee51fe1f135eb6b7",
"url": "http://example.com/"
},
{
"created_at": "2021-12-09T07:12:15+00:00",
"filename": null,
"submission_id": "61b1ac4fdf3fac4b3646afaf",
"url": "http://example.com/"
},
{
"created_at": "2021-12-06T06:45:16+00:00",
"filename": null,
"submission_id": "61adb17ce135f902cc551c48",
"url": "http://example.com/"
},
{
"created_at": "2021-12-06T06:44:27+00:00",
"filename": null,
"submission_id": "61adb14bc57a140f004524e3",
"url": "http://example.com/"
},
{
"created_at": "2021-12-03T02:13:39+00:00",
"filename": null,
"submission_id": "61a97d5379045c262d110cdd",
"url": "http://example.com/"
},
{
"created_at": "2021-12-03T02:13:03+00:00",
"filename": null,
"submission_id": "61a97d2fe02d87331d25e5a0",
"url": "http://example.com/"
},
{
"created_at": "2021-12-03T02:10:31+00:00",
"filename": null,
"submission_id": "61a97c97342971450f29b089",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:39:25+00:00",
"filename": null,
"submission_id": "6135633d41965265aa0a8dac",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:39:20+00:00",
"filename": null,
"submission_id": "613563381330f950b228416a",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:39:01+00:00",
"filename": null,
"submission_id": "6135632521e8ac3e5b189d17",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:47+00:00",
"filename": null,
"submission_id": "61355f1bcde472428f05416c",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:41+00:00",
"filename": null,
"submission_id": "61355f156c70b32ce5616a9a",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:16+00:00",
"filename": null,
"submission_id": "61355efcd71dbf0d2b05a084",
"url": "http://example.com/"
},
{
"created_at": "2021-09-06T00:21:04+00:00",
"filename": null,
"submission_id": "61355ef05278276a355a88d1",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:15:26+00:00",
"filename": null,
"submission_id": "6134ed1e68b3fa69b92a29a6",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:15:21+00:00",
"filename": null,
"submission_id": "6134ed19e76fc318ca444ce3",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:15:03+00:00",
"filename": null,
"submission_id": "6134ed07a94fd140c8512fe7",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T16:14:53+00:00",
"filename": null,
"submission_id": "6134ecfd6743b00302001a9f",
"url": "http://example.com/"
},
{
"created_at": "2021-09-05T08:35:09+00:00",
"filename": null,
"submission_id": "6134813d0ff3652bfc4886c3",
"url": "http://example.com/"
}
],
"submitname": "http://example.com/",
"tags": [
"tag",
"tng"
],
"target_url": null,
"threat_level": 1,
"threatscore": null,
"total_network_connections": 0,
"total_processes": 0,
"total_signatures": 0,
"type": null,
"type_short": [],
"verdict": "suspicious"
}
}
Human Readable Output
Scan Results
submit name threat level verdict total network connections total processes environment description interesting url analysis analysis start time total signatures sha256 http://example.com/ 1 suspicious 0 0 Static Analysis false true 2020-02-03T08:39:15+00:00 0 0b1d27c7ef8651eac6933608d4cb0a4b9fd74c45b883d5a4da1eeaa540f6cc5c
cs-falcon-sandbox-get-screenshots
Retrieves screenshots from a report
Base Command
cs-falcon-sandbox-get-screenshots
Input
| Argument Name | Description | Required |
|---|---|---|
| file | The sha256 hash of a file. | Optional |
| environmentID | The environment ID. Available environment IDs: 310: “Linux (Ubuntu 20, 64-bit)”, 200: “Android Static Analysis”, 120: “Windows 7 64 bit”, 110: “Windows 7 32 bit (HWP Support)”, 100: “Windows 7 32 bit”. Possible values are: 100, 110, 120, 200, 310. Default is 100. | Required |
| JobID | The file job ID. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| InfoFile.Name | string | The file name. |
| InfoFile.EntryID | string | The file entry ID. |
| InfoFile.Size | number | The file size. |
| InfoFile.Type | string | The file type, for example “PE”. |
| InfoFile.Info | string | Basic information about the file. |
| InfoFile.Extension | string | The file extension. |
Command example
!cs-falcon-sandbox-get-screenshots file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 environmentID=100
Context Example
{
"InfoFile": [
{
"EntryID": "414@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_0.png",
"Size": 285728,
"Type": "PNG image data, 1024 x 617, 8-bit/color RGBA, non-interlaced"
},
{
"EntryID": "415@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_1.png",
"Size": 245749,
"Type": "PNG image data, 1024 x 617, 8-bit/color RGBA, non-interlaced"
},
{
"EntryID": "416@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_2.png",
"Size": 115116,
"Type": "PNG image data, 1024 x 617, 8-bit/color RGBA, non-interlaced"
},
{
"EntryID": "417@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_3.png",
"Size": 96757,
"Type": "PNG image data, 1024 x 617, 8-bit/color RGBA, non-interlaced"
},
{
"EntryID": "418@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_4.png",
"Size": 38843,
"Type": "PNG image data, 1020 x 1320, 8-bit/color RGB, non-interlaced"
},
{
"EntryID": "419@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_5.png",
"Size": 28781,
"Type": "PNG image data, 1020 x 1320, 8-bit/color RGB, non-interlaced"
},
{
"EntryID": "420@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_6.png",
"Size": 113982,
"Type": "PNG image data, 1024 x 617, 8-bit/color RGBA, non-interlaced"
},
{
"EntryID": "421@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "png",
"Info": "image/png",
"Name": "screen_7.png",
"Size": 107333,
"Type": "PNG image data, 1024 x 617, 8-bit/color RGBA, non-interlaced"
}
]
}
Human Readable Output
cs-falcon-sandbox-analysis-overview
Gets the hash overview.
Base Command
cs-falcon-sandbox-analysis-overview
Input
| Argument Name | Description | Required |
|---|---|---|
| file | The SHA256 hash of the file. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.AnalysisOverview.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.AnalysisOverview.last_file_name | String | The last name of the file. |
| CrowdStrike.AnalysisOverview.threat_score | Number | The file threat score. |
| CrowdStrike.AnalysisOverview.verdict | String | The file verdict. |
| CrowdStrike.AnalysisOverview.url_analysis | Boolean | Whether this report is url analysis. |
| CrowdStrike.AnalysisOverview.size | Number | The size of the file. |
| CrowdStrike.AnalysisOverview.type | String | The file type. |
| CrowdStrike.AnalysisOverview.type_short | String | The short description of the file type. |
| CrowdStrike.AnalysisOverview.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.AnalysisOverview.last_multi_scan | Date | The last multi-scan. |
| CrowdStrike.AnalysisOverview.architecture | String | The environment architecture. |
| CrowdStrike.AnalysisOverview.multiscan_result | Number | The multi-scan result. |
| CrowdStrike.AnalysisOverview.scanners.name | String | The name of the scanner. |
| CrowdStrike.AnalysisOverview.scanners.status | String | The status of the scanner. |
| CrowdStrike.AnalysisOverview.scanners.error_message | String | The error message. |
| CrowdStrike.AnalysisOverview.scanners.progress | Number | The progress of the scanner. |
| CrowdStrike.AnalysisOverview.scanners.total | Number | The total number of scanners. |
| CrowdStrike.AnalysisOverview.scanners.positives | Number | The number of positives. |
| CrowdStrike.AnalysisOverview.scanners.percent | Number | The percent of the scanner. |
| CrowdStrike.AnalysisOverview.scanners.anti_virus_results.name | String | The name of the antivirus results. |
| CrowdStrike.AnalysisOverview.scanners.anti_virus_results.result | Boolean | The antivirus result. |
| CrowdStrike.AnalysisOverview.scanners.anti_virus_results.threat_found | String | The threat found the the scanner. |
| CrowdStrike.AnalysisOverview.reports | String | The reports of the analysis. |
| CrowdStrike.AnalysisOverview.whitelisted | Boolean | If the result is whitelisted. |
| CrowdStrike.AnalysisOverview.children_in_queue | Number | The number of children in queue. |
| CrowdStrike.AnalysisOverview.children_in_progress | Number | The number of children in progress. |
| File.Size | number | The file size. |
| File.SHA256 | string | The SHA256 hash of the file. |
| File.Name | string | The file name. |
| File.type | string | The file type. |
Command example
!cs-falcon-sandbox-analysis-overview file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51
Context Example
{
"CrowdStrike": {
"AnalysisOverview": {
"analysis_start_time": "2022-01-10T08:33:11+00:00",
"architecture": "WINDOWS",
"children_in_progress": 0,
"children_in_queue": 0,
"last_file_name": "file",
"last_multi_scan": "2022-02-07T12:52:10+00:00",
"multiscan_result": 0,
"other_file_name": [
"5_Journals_3_Manuscripts_10_Version_1_Revision_0_CoverLetter.pdf",
"dyUQ2JAbImyU0WNH7TI1K3UYqUwDMsQBh1RwXWHG.pdf",
"k18zpzsrq3om4q1pu18mftdo2caaivqq.pdf",
"kuc86odvmimp0vd0tseubdekn9dg41jrff6lso01_parsed.eml",
"sample.pdf",
"samplePdf.pdf",
"test.pdf"
],
"related_children_hashes": [],
"related_parent_hashes": [
"77fbcad0cfe9e67946c0f9366d04df5ecf78c122ccceb78cb59c149911e3457d",
"30c37bbb86c6937256ae67be4d6311cb1a9d9d041966b282378b83eb213ae5ab",
"36327ca7afc02b525bc33428ab762419cdf3f93c8892de1df50bdb4b803032fb"
],
"related_reports": [
{
"environment_id": 100,
"error_origin": null,
"error_type": null,
"job_id": "5c5e1ea27ca3e12f285dc6b4",
"sha256": "30c37bbb86c6937256ae67be4d6311cb1a9d9d041966b282378b83eb213ae5ab",
"state": "SUCCESS",
"verdict": "no verdict"
},
{
"environment_id": 100,
"error_origin": null,
"error_type": null,
"job_id": "5f0c9b7eac8ef74e754f871e",
"sha256": "36327ca7afc02b525bc33428ab762419cdf3f93c8892de1df50bdb4b803032fb",
"state": "SUCCESS",
"verdict": "no verdict"
},
{
"environment_id": 100,
"error_origin": null,
"error_type": null,
"job_id": "5b881e5e7ca3e169b9340464",
"sha256": "77fbcad0cfe9e67946c0f9366d04df5ecf78c122ccceb78cb59c149911e3457d",
"state": "SUCCESS",
"verdict": "no verdict"
}
],
"reports": [
"5e95b682dd8c5642500399ce",
"5d8a1c67038838c50e69e5a8",
"5a6896886e3579ce99a80d4d",
"5f60f00aeac13102de2fce70",
"61ae29f24e69ff77d566ab48",
"5beb78777ca3e14af2036b03",
"61128689373f22669b654e8a",
"61a79f9a99b51b0fda1c1c4c",
"61dbe275436d0a13692564b8",
"61dbef47c143326cec7c2d3d"
],
"scanners": [
{
"anti_virus_results": [],
"error_message": "Unknown error occurred",
"name": "CrowdStrike Falcon Static Analysis (ML)",
"percent": null,
"positives": null,
"progress": 100,
"status": "error",
"total": null
},
{
"anti_virus_results": [
{
"name": "ByteHero",
"result": false,
"threat_found": null
},
{
"name": "AegisLab",
"result": false,
"threat_found": null
},
{
"name": "Trend Micro HouseCall",
"result": false,
"threat_found": null
},
{
"name": "Vir.IT eXplorer",
"result": false,
"threat_found": null
},
{
"name": "K7",
"result": false,
"threat_found": null
},
{
"name": "Kaspersky",
"result": false,
"threat_found": null
},
{
"name": "AhnLab",
"result": false,
"threat_found": null
},
{
"name": "Quick Heal",
"result": false,
"threat_found": null
},
{
"name": "RocketCyber",
"result": false,
"threat_found": null
},
{
"name": "Comodo",
"result": false,
"threat_found": null
},
{
"name": "IKARUS",
"result": false,
"threat_found": null
},
{
"name": "Huorong",
"result": false,
"threat_found": null
},
{
"name": "Bitdefender",
"result": false,
"threat_found": null
},
{
"name": "Avira",
"result": false,
"threat_found": null
},
{
"name": "Sophos",
"result": false,
"threat_found": null
},
{
"name": "VirusBlokAda",
"result": false,
"threat_found": null
},
{
"name": "McAfee",
"result": false,
"threat_found": null
},
{
"name": "Cyren",
"result": false,
"threat_found": null
},
{
"name": "TACHYON",
"result": false,
"threat_found": null
},
{
"name": "Antiy",
"result": false,
"threat_found": null
},
{
"name": "Xvirus Anti-Malware",
"result": false,
"threat_found": null
},
{
"name": "Trend Micro",
"result": false,
"threat_found": null
},
{
"name": "Emsisoft",
"result": false,
"threat_found": null
},
{
"name": "NANOAV",
"result": false,
"threat_found": null
},
{
"name": "ESET",
"result": false,
"threat_found": null
}
],
"error_message": null,
"name": "Metadefender",
"percent": 0,
"positives": 0,
"progress": 100,
"status": "clean",
"total": 25
},
{
"anti_virus_results": [],
"error_message": null,
"name": "VirusTotal",
"percent": 0,
"positives": 0,
"progress": 100,
"status": "clean",
"total": 54
}
],
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"size": 3506,
"submit_context": [],
"tags": [],
"threat_score": null,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"url_analysis": false,
"verdict": "whitelisted",
"whitelisted": true
}
},
"File": {
"Name": "file",
"SHA256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"Size": 3506,
"Type": "PDF document, version 1.3"
}
}
Human Readable Output
Analysis Overview
Last File Name Other File Name Sha 256 Verdict Url Analysis Size Type Type Short file 5_Journals_3_Manuscripts_10_Version_1_Revision_0_CoverLetter.pdf,
dyUQ2JAbImyU0WNH7TI1K3UYqUwDMsQBh1RwXWHG.pdf,
k18zpzsrq3om4q1pu18mftdo2caaivqq.pdf,
kuc86odvmimp0vd0tseubdekn9dg41jrff6lso01_parsed.eml,
sample.pdf,
samplePdf.pdf,
test.pdf8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 whitelisted false 3506 PDF document, version 1.3
cs-falcon-sandbox-analysis-overview-summary
Returns the hash overview.
Base Command
cs-falcon-sandbox-analysis-overview-summary
Input
| Argument Name | Description | Required |
|---|---|---|
| file | The SHA256 hash of the file. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.AnalysisOverviewSummary.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.AnalysisOverviewSummary.threat_score | Number | The file threat score. |
| CrowdStrike.AnalysisOverviewSummary.verdict | String | The file verdict. |
| CrowdStrike.AnalysisOverviewSummary.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.AnalysisOverviewSummary.last_multi_scan | Date | The last multi-scan. |
| CrowdStrike.AnalysisOverviewSummary.multiscan_result | Number | The multi-scan result. |
Command example
!cs-falcon-sandbox-analysis-overview-summary file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51
Context Example
{
"CrowdStrike": {
"AnalysisOverview": {
"analysis_start_time": "2022-01-10T08:33:11+00:00",
"last_multi_scan": "2022-02-07T12:52:10+00:00",
"multiscan_result": 0,
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"threat_score": null,
"verdict": "whitelisted"
}
}
}
Human Readable Output
Analysis Overview Summary
Analysis Start Time Last Multi Scan Multiscan Result Sha256 Verdict 2022-01-10T08:33:11+00:00 2022-02-07T12:52:10+00:00 0 8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 whitelisted
cs-falcon-sandbox-analysis-overview-refresh
Refreshes the overview and downloads fresh data from external services.
Base Command
cs-falcon-sandbox-analysis-overview-refresh
Input
| Argument Name | Description | Required |
|---|---|---|
| file | The SHA256 hash of the file. | Required |
Context Output
There is no context output for this command.
Command example
!cs-falcon-sandbox-analysis-overview-refresh file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51
Human Readable Output
The request to refresh the analysis overview was sent successfully.
file
Returns file information and reputation.
Base Command
file
Input
| Argument Name | Description | Required |
|---|---|---|
| file | A comma-separated list of file hashes (MD5, SHA1, or SHA256). | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.Report.job_id | String | The file job ID. |
| CrowdStrike.Report.environment_id | Number | The report environment ID. |
| CrowdStrike.Report.environment_description | String | The environment description. |
| CrowdStrike.Report.size | Number | The file size. |
| CrowdStrike.Report.type | String | The file type. |
| CrowdStrike.Report.type_short | String | The short description of the file type. |
| CrowdStrike.Report.target_url | String | The target url. |
| CrowdStrike.Report.state | String | The report state. |
| CrowdStrike.Report.error_type | String | The error type. |
| CrowdStrike.Report.error_origin | String | The error origin. |
| CrowdStrike.Report.submit_name | String | The file name when submitted. |
| CrowdStrike.Report.md5 | String | The MD5 hash of the file. |
| CrowdStrike.Report.sha1 | String | The SHA1 hash of the file. |
| CrowdStrike.Report.sha256 | String | The SHA256 hash of the file. |
| CrowdStrike.Report.sha512 | String | The SHA512 hash of the file. |
| CrowdStrike.Report.ssdeep | String | The SSDeep hash of the file. |
| CrowdStrike.Report.imphash | String | The imphash hash of the file. |
| CrowdStrike.Report.av_detect | Number | The AV Multiscan range, for example 50-70 (min 0, max 100). |
| CrowdStrike.Report.vx_family | String | The file malware family. |
| CrowdStrike.Report.url_analysis | Boolean | Whether this report is url analysis. |
| CrowdStrike.Report.analysis_start_time | Date | The start time of the analysis. |
| CrowdStrike.Report.threat_score | Number | The file threat score. |
| CrowdStrike.Report.interesting | Boolean | Whether the file was found to be interesting. |
| CrowdStrike.Report.threat_level | Number | The file threat level. |
| CrowdStrike.Report.verdict | String | The file verdict. |
| CrowdStrike.Report.total_network_connections | Number | The total number of network connections. |
| CrowdStrike.Report.total_processes | Number | The total number of processes. |
| CrowdStrike.Report.total_signatures | Number | The total number of signatures. |
| CrowdStrike.Report.file_metadata | Object | The file metadata. |
| CrowdStrike.Report.submissions.submission_id | String | The submission ID. |
| CrowdStrike.Report.submissions.filename | String | The name of the file. |
| CrowdStrike.Report.submissions.url | String | The url. |
| CrowdStrike.Report.submissions.created_at | Date | When the submission was created. |
| CrowdStrike.Report.network_mode | String | The network mode. |
| File.SHA256 | string | The SHA256 hash of the file. |
| File.SHA1 | string | The SHA1 hash of the file. |
| File.MD5 | string | The MD5 hash of the file. |
| File.Name | string | The file submission name. |
| File.MalwareFamily | string | The file family classification. |
| File.Malicious.Vendor | string | The vendor that decided the file was malicious. |
| File.Malicious.Description | string | The reason the vendor decided the file was malicious. |
| DBotScore.Indicator | string | The indicator that was tested. |
| DBotScore.Type | string | The indicator type. |
| DBotScore.Vendor | string | The vendor used to calculate the score. |
| DBotScore.Score | number | The actual score. |
Command example
!file file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51
Context Example
{
"CofenseIntelligence": {
"File": {
"Data": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"Threats": []
}
},
"CrowdStrike": {
"Report": [
{
"analysis_start_time": "2020-09-15T16:47:06+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environment_description": "Static Analysis",
"environment_id": null,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"file_metadata": null,
"hosts": [],
"imphash": null,
"interesting": false,
"job_id": null,
"machine_learning_models": [],
"md5": "4b41a3475132bd861b30a878e30aa56a",
"mitre_attcks": [],
"network_mode": "default",
"processes": [],
"sha1": "bfd009f500c057195ffde66fae64f92fa5f59b72",
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"sha512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"size": 3028,
"ssdeep": null,
"state": "SUCCESS",
"submissions": [
{
"created_at": "2021-12-30T09:34:22+00:00",
"filename": "file",
"submission_id": "61cd7d1ec35ca563e343e855",
"url": null
},
{
"created_at": "2021-12-18T23:47:33+00:00",
"filename": "file",
"submission_id": "61be731519ff990144369a85",
"url": null
},
{
"created_at": "2021-07-03T21:54:07+00:00",
"filename": "test.pdf",
"submission_id": "60e0dc7fda855364ee0d1826",
"url": null
},
{
"created_at": "2021-07-03T21:46:41+00:00",
"filename": "sample.pdf",
"submission_id": "60e0dac12daa5049bb51ad72",
"url": null
},
{
"created_at": "2021-07-03T21:45:44+00:00",
"filename": "sample.pdf",
"submission_id": "60e0da887bb12112723c8bea",
"url": null
},
{
"created_at": "2021-04-25T05:03:31+00:00",
"filename": "file",
"submission_id": "6084f823ea742a4783209d12",
"url": null
},
{
"created_at": "2021-03-01T14:42:05+00:00",
"filename": "sample.pdf",
"submission_id": "603cfd3d601d615839160474",
"url": "http://www.africau.edu/images/default/sample.pdf"
},
{
"created_at": "2021-01-24T05:00:32+00:00",
"filename": "file",
"submission_id": "600cfef0f365f820bf2f0b02",
"url": null
},
{
"created_at": "2020-12-08T18:15:16+00:00",
"filename": "5_Journals_3_Manuscripts_10_Version_1_Revision_0_CoverLetter.pdf",
"submission_id": "5fcfc2b4fe643e3bee4bf4f5",
"url": null
},
{
"created_at": "2020-09-15T16:47:06+00:00",
"filename": "file",
"submission_id": "5f60f00abbe4e913f73cfff9",
"url": null
}
],
"submit_name": "file",
"tags": [],
"target_url": null,
"threat_level": 0,
"threat_score": null,
"total_network_connections": 0,
"total_processes": 0,
"total_signatures": 0,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"url_analysis": false,
"verdict": "whitelisted",
"vx_family": null
},
{
"analysis_start_time": "2021-12-06T15:19:23+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environment_description": "Android Static Analysis",
"environment_id": 200,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"file_metadata": null,
"hosts": [],
"imphash": "Unknown",
"interesting": false,
"job_id": "61ae29f24e69ff77d566ab48",
"machine_learning_models": [],
"md5": "4b41a3475132bd861b30a878e30aa56a",
"mitre_attcks": [],
"network_mode": "default",
"processes": [],
"sha1": "bfd009f500c057195ffde66fae64f92fa5f59b72",
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"sha512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"size": 3506,
"ssdeep": "24:yPp9AA+I3ZpAIZpAL7xMk2uFVBX02ScAjfW2sX25cfW2SJI2k2y62NOfW2t9HZdF:yrQ+YIYbrXq/jeyjbvzGUsnTd3/i",
"state": "SUCCESS",
"submissions": [
{
"created_at": "2022-01-10T08:40:44+00:00",
"filename": "sample.pdf",
"submission_id": "61dbf10c213fbc5a3914cdd1",
"url": null
},
{
"created_at": "2022-01-10T08:35:47+00:00",
"filename": "sample.pdf",
"submission_id": "61dbefe33f8cec40d619833c",
"url": null
},
{
"created_at": "2021-12-06T15:52:44+00:00",
"filename": "samplePdf.pdf",
"submission_id": "61ae31cce601bf0d4a332f82",
"url": null
},
{
"created_at": "2021-12-06T15:19:14+00:00",
"filename": "samplePdf.pdf",
"submission_id": "61ae29f24e69ff77d566ab49",
"url": null
}
],
"submit_name": "samplePdf.pdf",
"tags": [],
"target_url": null,
"threat_level": 0,
"threat_score": null,
"total_network_connections": 0,
"total_processes": 0,
"total_signatures": 1,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"url_analysis": false,
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2020-04-14T13:11:37+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environment_description": "Windows 7 32 bit (HWP Support)",
"environment_id": 110,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"file_metadata": null,
"hosts": [],
"imphash": "Unknown",
"interesting": false,
"job_id": "5e95b682dd8c5642500399ce",
"machine_learning_models": [],
"md5": "4b41a3475132bd861b30a878e30aa56a",
"mitre_attcks": [],
"network_mode": "default",
"processes": [],
"sha1": "bfd009f500c057195ffde66fae64f92fa5f59b72",
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"sha512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"size": 3506,
"ssdeep": "24:yPp9AA+I3ZpAIZpAL7xMk2uFVBX02ScAjfW2sX25cfW2SJI2k2y62NOfW2t9HZdt:yrQ+YIYbrXq/jeyjbvzGUsnTd3/C",
"state": "SUCCESS",
"submissions": [
{
"created_at": "2020-04-14T13:11:30+00:00",
"filename": "file",
"submission_id": "5e95b682dd8c5642500399cf",
"url": null
}
],
"submit_name": "file",
"tags": [],
"target_url": null,
"threat_level": 0,
"threat_score": null,
"total_network_connections": 0,
"total_processes": 4,
"total_signatures": 14,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"url_analysis": false,
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-09-24T13:39:34+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environment_description": "Windows 7 64 bit",
"environment_id": 120,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"file_metadata": null,
"hosts": [],
"imphash": "Unknown",
"interesting": false,
"job_id": "5d8a1c67038838c50e69e5a8",
"machine_learning_models": [],
"md5": "4b41a3475132bd861b30a878e30aa56a",
"mitre_attcks": [],
"network_mode": "default",
"processes": [],
"sha1": "bfd009f500c057195ffde66fae64f92fa5f59b72",
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"sha512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"size": 3506,
"ssdeep": "24:yPp9AA+I3ZpAIZpAL7xMk2uFVBX02ScAjfW2sX25cfW2SJI2k2y62NOfW2t9HZdd:yrQ+YIYbrXq/jeyjbvzGUsnTd3/hxoxn",
"state": "SUCCESS",
"submissions": [
{
"created_at": "2020-12-17T11:38:35+00:00",
"filename": "sample.pdf",
"submission_id": "5fdb433be6562860c47942cf",
"url": null
},
{
"created_at": "2020-12-09T12:12:29+00:00",
"filename": "sample.pdf",
"submission_id": "5fd0bf2d8623f5298734d606",
"url": null
},
{
"created_at": "2020-05-26T07:00:18+00:00",
"filename": "sample.pdf",
"submission_id": "5eccbe8203b9557fac384586",
"url": null
},
{
"created_at": "2020-04-29T09:51:17+00:00",
"filename": "sample.pdf",
"submission_id": "5ea94e157d7c876d9c76ced3",
"url": null
},
{
"created_at": "2020-04-29T09:15:42+00:00",
"filename": "sample.pdf",
"submission_id": "5ea945be351cb361215586fe",
"url": null
},
{
"created_at": "2020-04-29T09:11:43+00:00",
"filename": "sample.pdf",
"submission_id": "5ea944cfe3893c0eb22505a3",
"url": null
},
{
"created_at": "2020-01-10T00:04:51+00:00",
"filename": "sample.pdf",
"submission_id": "5e17bfa39f797e0f87507547",
"url": null
},
{
"created_at": "2019-09-24T13:38:47+00:00",
"filename": "sample.pdf",
"submission_id": "5d8a1c67038838c50e69e5a7",
"url": null
}
],
"submit_name": "sample.pdf",
"tags": [],
"target_url": null,
"threat_level": 0,
"threat_score": null,
"total_network_connections": 0,
"total_processes": 4,
"total_signatures": 12,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"url_analysis": false,
"verdict": "no specific threat",
"vx_family": null
},
{
"analysis_start_time": "2019-02-09T01:41:57+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environment_description": "Windows 7 32 bit",
"environment_id": 100,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"file_metadata": null,
"hosts": [],
"imphash": "Unknown",
"interesting": false,
"job_id": "5a6896886e3579ce99a80d4d",
"machine_learning_models": [],
"md5": "4b41a3475132bd861b30a878e30aa56a",
"mitre_attcks": [],
"network_mode": "tor",
"processes": [],
"sha1": "bfd009f500c057195ffde66fae64f92fa5f59b72",
"sha256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"sha512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"size": 3506,
"ssdeep": "24:yPp9AA+I3ZpAIZpAL7xMk2uFVBX02ScAjfW2sX25cfW2SJI2k2y62NOfW2t9HZdV:yrQ+YIYbrXq/jeyjbvzGUsnTd3/S",
"state": "SUCCESS",
"submissions": [
{
"created_at": "2022-01-23T17:49:11+00:00",
"filename": "sample.pdf",
"submission_id": "61ed9517c284dd61265a0e6d",
"url": null
},
{
"created_at": "2022-01-09T16:03:26+00:00",
"filename": "sample.pdf",
"submission_id": "61db074e8782ed13a058f7a4",
"url": null
},
{
"created_at": "2022-01-09T16:03:04+00:00",
"filename": "sample.pdf",
"submission_id": "61db0738f93ee5253c369e74",
"url": null
},
{
"created_at": "2021-12-06T14:31:12+00:00",
"filename": "samplePdf.pdf",
"submission_id": "61ae1eb03be82d62c3775f70",
"url": null
},
{
"created_at": "2021-10-20T13:49:19+00:00",
"filename": "k18zpzsrq3om4q1pu18mftdo2caaivqq.pdf",
"submission_id": "61701e5f1c027f4e08299b54",
"url": null
},
{
"created_at": "2021-07-27T13:27:58+00:00",
"filename": "sample.pdf",
"submission_id": "610009dec612587a6d572e23",
"url": null
},
{
"created_at": "2021-07-15T16:15:50+00:00",
"filename": "sample.pdf",
"submission_id": "60f05f3660f4fd4ee42d0b6f",
"url": null
},
{
"created_at": "2021-07-03T21:50:01+00:00",
"filename": "sample.pdf",
"submission_id": "60e0db8928bccc0b2e405d30",
"url": null
},
{
"created_at": "2021-03-01T14:43:08+00:00",
"filename": "sample.pdf",
"submission_id": "603cfd7c60343f6d115db9f8",
"url": "http://www.africau.edu/images/default/sample.pdf"
},
{
"created_at": "2020-10-29T13:17:49+00:00",
"filename": "sample.pdf",
"submission_id": "5f9ac0fdd97ff17aac38bc84",
"url": "http://www.africau.edu/images/default/sample.pdf"
},
{
"created_at": "2020-07-14T13:09:08+00:00",
"filename": "sample.pdf",
"submission_id": "5f0dae74c122fb57fc3f360b",
"url": null
},
{
"created_at": "2020-07-14T10:54:02+00:00",
"filename": "sample.pdf",
"submission_id": "5f0d8eca91837459ca5cee1c",
"url": null
},
{
"created_at": "2020-07-14T10:48:02+00:00",
"filename": "sample.pdf",
"submission_id": "5f0d8d622560cc30d825588b",
"url": null
},
{
"created_at": "2020-07-13T17:48:02+00:00",
"filename": "sample.pdf",
"submission_id": "5f0c9e52f6150a35a72b8c99",
"url": null
},
{
"created_at": "2020-07-13T17:38:12+00:00",
"filename": "sample.pdf",
"submission_id": "5f0c9c040030d423b83a9991",
"url": null
},
{
"created_at": "2020-07-13T17:35:58+00:00",
"filename": "sample.pdf",
"submission_id": "5f0c9b7eac8ef74e754f8724",
"url": null
},
{
"created_at": "2019-04-11T15:08:01+00:00",
"filename": "sample.pdf",
"submission_id": "5caf58510388385b8b7b23ca",
"url": null
},
{
"created_at": "2019-03-10T11:11:01+00:00",
"filename": "sample.pdf",
"submission_id": "5c84f0c5028838b82ffc1ce3",
"url": null
},
{
"created_at": "2019-03-10T08:53:28+00:00",
"filename": "sample.pdf",
"submission_id": "5c84d088028838950cfc1ce4",
"url": null
},
{
"created_at": "2019-02-08T18:28:18-06:00",
"filename": "sample.pdf",
"submission_id": "5c5e1ea27ca3e12cd80ecf07",
"url": null
}
],
"submit_name": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51_1549672910345_sample.pdf",
"tags": [],
"target_url": null,
"threat_level": 0,
"threat_score": null,
"total_network_connections": 0,
"total_processes": 1,
"total_signatures": 9,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"url_analysis": false,
"verdict": "whitelisted",
"vx_family": null
}
]
},
"DBotScore": {
"Indicator": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"Reliability": "A - Completely reliable",
"Score": 1,
"Type": "file",
"Vendor": "CrowdStrike Falcon Sandbox V2"
},
"File": {
"JobID": "5a6896886e3579ce99a80d4d",
"MD5": "4b41a3475132bd861b30a878e30aa56a",
"Name": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51_1549672910345_sample.pdf",
"SHA1": "bfd009f500c057195ffde66fae64f92fa5f59b72",
"SHA256": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51",
"SHA512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"SSDeep": "24:yPp9AA+I3ZpAIZpAL7xMk2uFVBX02ScAjfW2sX25cfW2SJI2k2y62NOfW2t9HZdV:yrQ+YIYbrXq/jeyjbvzGUsnTd3/S",
"Size": 3506,
"Type": "PDF document, version 1.3",
"analysis_start_time": "2019-02-09T01:41:57+00:00",
"av_detect": 0,
"certificates": [],
"classification_tags": [],
"compromised_hosts": [],
"domains": [],
"environmentDescription": "Windows 7 32 bit",
"environmentId": 100,
"error_origin": null,
"error_type": null,
"extracted_files": [],
"family": null,
"file_metadata": null,
"hosts": [],
"imphash": "Unknown",
"interesting": false,
"isurlanalysis": false,
"machine_learning_models": [],
"mitre_attcks": [],
"network_mode": "tor",
"processes": [],
"sha512": "eaf7542ade2c338d8d2cc76fcbf883e62c31336e60cb236f86ed66c8154ea9fb836fd88367880911529bdafed0e76cd34272123a4d656db61b120b95eaa3e069",
"size": 3506,
"ssdeep": "24:yPp9AA+I3ZpAIZpAL7xMk2uFVBX02ScAjfW2sX25cfW2SJI2k2y62NOfW2t9HZdV:yrQ+YIYbrXq/jeyjbvzGUsnTd3/S",
"state": "SUCCESS",
"submissions": [
{
"created_at": "2022-01-23T17:49:11+00:00",
"filename": "sample.pdf",
"submission_id": "61ed9517c284dd61265a0e6d",
"url": null
},
{
"created_at": "2022-01-09T16:03:26+00:00",
"filename": "sample.pdf",
"submission_id": "61db074e8782ed13a058f7a4",
"url": null
},
{
"created_at": "2022-01-09T16:03:04+00:00",
"filename": "sample.pdf",
"submission_id": "61db0738f93ee5253c369e74",
"url": null
},
{
"created_at": "2021-12-06T14:31:12+00:00",
"filename": "samplePdf.pdf",
"submission_id": "61ae1eb03be82d62c3775f70",
"url": null
},
{
"created_at": "2021-10-20T13:49:19+00:00",
"filename": "k18zpzsrq3om4q1pu18mftdo2caaivqq.pdf",
"submission_id": "61701e5f1c027f4e08299b54",
"url": null
},
{
"created_at": "2021-07-27T13:27:58+00:00",
"filename": "sample.pdf",
"submission_id": "610009dec612587a6d572e23",
"url": null
},
{
"created_at": "2021-07-15T16:15:50+00:00",
"filename": "sample.pdf",
"submission_id": "60f05f3660f4fd4ee42d0b6f",
"url": null
},
{
"created_at": "2021-07-03T21:50:01+00:00",
"filename": "sample.pdf",
"submission_id": "60e0db8928bccc0b2e405d30",
"url": null
},
{
"created_at": "2021-03-01T14:43:08+00:00",
"filename": "sample.pdf",
"submission_id": "603cfd7c60343f6d115db9f8",
"url": "http://www.africau.edu/images/default/sample.pdf"
},
{
"created_at": "2020-10-29T13:17:49+00:00",
"filename": "sample.pdf",
"submission_id": "5f9ac0fdd97ff17aac38bc84",
"url": "http://www.africau.edu/images/default/sample.pdf"
},
{
"created_at": "2020-07-14T13:09:08+00:00",
"filename": "sample.pdf",
"submission_id": "5f0dae74c122fb57fc3f360b",
"url": null
},
{
"created_at": "2020-07-14T10:54:02+00:00",
"filename": "sample.pdf",
"submission_id": "5f0d8eca91837459ca5cee1c",
"url": null
},
{
"created_at": "2020-07-14T10:48:02+00:00",
"filename": "sample.pdf",
"submission_id": "5f0d8d622560cc30d825588b",
"url": null
},
{
"created_at": "2020-07-13T17:48:02+00:00",
"filename": "sample.pdf",
"submission_id": "5f0c9e52f6150a35a72b8c99",
"url": null
},
{
"created_at": "2020-07-13T17:38:12+00:00",
"filename": "sample.pdf",
"submission_id": "5f0c9c040030d423b83a9991",
"url": null
},
{
"created_at": "2020-07-13T17:35:58+00:00",
"filename": "sample.pdf",
"submission_id": "5f0c9b7eac8ef74e754f8724",
"url": null
},
{
"created_at": "2019-04-11T15:08:01+00:00",
"filename": "sample.pdf",
"submission_id": "5caf58510388385b8b7b23ca",
"url": null
},
{
"created_at": "2019-03-10T11:11:01+00:00",
"filename": "sample.pdf",
"submission_id": "5c84f0c5028838b82ffc1ce3",
"url": null
},
{
"created_at": "2019-03-10T08:53:28+00:00",
"filename": "sample.pdf",
"submission_id": "5c84d088028838950cfc1ce4",
"url": null
},
{
"created_at": "2019-02-08T18:28:18-06:00",
"filename": "sample.pdf",
"submission_id": "5c5e1ea27ca3e12cd80ecf07",
"url": null
}
],
"submitname": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51_1549672910345_sample.pdf",
"tags": [],
"target_url": null,
"threat_level": 0,
"threatscore": null,
"total_network_connections": 0,
"total_processes": 1,
"total_signatures": 9,
"type": "PDF document, version 1.3",
"type_short": [
"pdf"
],
"verdict": "whitelisted"
}
}
Human Readable Output
Scan Results
submit name threat level verdict total network connections total processes environment description interesting environment id url analysis analysis start time total signatures type type short sha256 8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51_1549672910345_sample.pdf 0 whitelisted 0 1 Windows 7 32 bit false 100 false 2019-02-09T01:41:57+00:00 9 PDF document, version 1.3 8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51
cs-falcon-sandbox-sample-download
Downloads the sample file.
Base Command
cs-falcon-sandbox-sample-download
Input
| Argument Name | Description | Required |
|---|---|---|
| file | The SHA256 hash of the file. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.SHA512 | String | The SHA512 hash of the file. |
| File.SSDeep | String | The SSDeep hash of the file. |
| File.EntryID | String | The file entry ID. |
| File.Info | String | Information about the file. |
| File.Type | String | The file type. |
| File.MD5 | String | The MD5 hash of the file. |
| File.Extension | String | The file extension. |
Command example
!cs-falcon-sandbox-sample-download file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51
Context Example
{
"File": {
"EntryID": "425@8aab2ce5-e14e-4cfc-81dc-6eef69c76e68",
"Extension": "gz",
"Info": "gz",
"MD5": "227f491cfca844bc56127216c956c59a",
"Name": "8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51.bin.sample.gz",
"SHA1": "cc71f378f875b1daa6c462195301ddb8025d0d2f",
"SHA256": "1801097bfc747e5fab03e194a79c88e665b14f7510950d6702f27096ca41b85d",
"SHA512": "22464de2b59147cae9f7289308dd5a0e54686840c0a13032173705a280d1918c2aa40b6406dc756b8145ba2c3cea2abb3f5dca93e2ba3b7f8be2704419d12e9b",
"SSDeep": "24:Xv2b+nAJehSZ/KNNtZHUXXj1xJq34VWwA2uMQi87JTSvE3gt:Xw+IeYENN3cZxJO4V31HQi87cvE3gt",
"Size": 945,
"Type": "gzip compressed data, max compression, from Unix, original size 3028"
}
}
cs-falcon-sandbox-report-state
Gets the report state for the given ID.
Base Command
cs-falcon-sandbox-report-state
Input
| Argument Name | Description | Required |
|---|---|---|
| JobID | The file job ID. | Optional |
| environmentID | The environment ID. Available environment IDs: 310: “Linux (Ubuntu 20, 64-bit)”, 200: “Android Static Analysis”, 120: “Windows 7 64 bit”, 110: “Windows 7 32 bit (HWP Support)”, 100: “Windows 7 32 bit”. Possible values are: 100, 110, 120, 200, 310. Default is 100. | Required |
| file | The hash of the file. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CrowdStrike.State.state | String | The state of the report. |
| CrowdStrike.State.error_type | String | The error type of the report. |
| CrowdStrike.State.error_origin | String | The error origin. |
| CrowdStrike.State.error | String | The error description. |
Command example
!cs-falcon-sandbox-report-state file=8decc8571946d4cd70a024949e033a2a2a54377fe9f1c1b944c20f9ee11a9e51 environmentID=300
Context Example
{
"CrowdStrike": {
"State": {
"error": "The requested environment ID \"300\" and file type \"pdf\" have no available execution environment",
"error_origin": "CLIENT",
"error_type": "FILE_TYPE_BAD_ERROR",
"related_reports": [],
"state": "ERROR"
}
}
}
Human Readable Output
State
Error Error Origin Error Type Related Reports State The requested environment ID “300” and file type “pdf” have no available execution environment CLIENT FILE_TYPE_BAD_ERROR ERROR
Additional Notes
- The CrowdStrike Environment ID 300 has been deprecated and is now EOL. It is recommended to use Environment ID 310 for Linux sandboxing.
Configuration parameters
serverUrl— Server URL (e.g. https://hybrid-analysis.com) (required)credentials— (required)integrationReliability— Source Reliability (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (20)
-
crowdstrike-get-environmentsDeprecatedDeprecated. Use cs-falcon-sandbox-get-environments instead.
-
crowdstrike-get-screenshotsDeprecatedDeprecated. Use cs-falcon-sandbox-get-screenshots instead.
-
crowdstrike-resultDeprecatedDeprecated. Use cs-falcon-sandbox-result instead.
-
crowdstrike-scanDeprecatedDeprecated. Use cs-falcon-sandbox-scan instead.
-
crowdstrike-searchDeprecatedDeprecated. Use cs-falcon-sandbox-search instead.
-
crowdstrike-submit-sampleDeprecatedDeprecated. Use cs-falcon-sandbox-submit-sample instead.
-
crowdstrike-submit-urlDeprecatedDeprecated. Use cs-falcon-sandbox-submit-url instead.
-
cs-falcon-sandbox-analysis-overviewGets the hash overview.
-
cs-falcon-sandbox-analysis-overview-refreshRefreshes the overview and downloads fresh data from external services.
-
cs-falcon-sandbox-analysis-overview-summaryReturns the hash overview.
-
cs-falcon-sandbox-get-environmentsGets a list of all available environments.
-
cs-falcon-sandbox-get-screenshotsRetrieves screenshots from a report.
-
cs-falcon-sandbox-report-stateGets the report state for the given ID.
-
cs-falcon-sandbox-resultRetrieves result data on a file. Note: This command returns a file.
-
cs-falcon-sandbox-sample-downloadDownloads the sample file.
-
cs-falcon-sandbox-scanGets report summary information for a job_id or a sha256 hash.
-
cs-falcon-sandbox-searchSearches the database using the Falcon Sandbox search syntax.
-
cs-falcon-sandbox-submit-sampleSubmits a file from the investigation to the analysis server.
-
cs-falcon-sandbox-submit-urlSubmits a URL for analysis.
-
fileReturns file information and reputation.
commonfields: id: CrowdStrike Falcon Sandbox V2 version: -1 sectionorder: - Connect - Collect name: CrowdStrike Falcon Sandbox V2 display: CrowdStrike Falcon Sandbox v2 (Hybrid-Analysis) category: Forensics & Malware Analysis provider: CrowdStrike description: Fully automated malware analysis using Hybrid Analysis API. configuration: - name: serverUrl required: true defaultvalue: https://hybrid-analysis.com type: 0 display: Server URL (e.g. https://hybrid-analysis.com) section: Connect - name: credentials required: true defaultvalue: type: 9 displaypassword: API Key hiddenusername: true section: Connect - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: C - Fairly reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 section: Collect - name: insecure display: Trust any certificate (not secure) type: 8 additionalinfo: required: false section: Connect - name: proxy display: Use system proxy settings type: 8 additionalinfo: required: false section: Connect script: script: "-" subtype: python3 type: python dockerimage: demisto/python3:3.12.13.10116658 commands: - name: cs-falcon-sandbox-scan polling: true arguments: - name: file description: "A comma-separated list of file hashes (SHA256)." required: false isArray: true - name: environmentID description: 'A comma-separated list of environment IDs. That list would be used with, and should be the same length, as the file argument. Available environment IDs: 310: "Linux (Ubuntu 20, 64-bit)", 200: "Android Static Analysis", 120: "Windows 7 64 bit", 110: "Windows 7 32 bit (HWP Support)", 100: "Windows 7 32 bit".' - name: polling description: "Whether to poll until there is at least one result." auto: PREDEFINED predefined: - "true" - "false" - name: JobID description: "A comma-separated list of JobIDs to check the state of when polling. Use this argument or the file argument." isArray: true - name: hide_polling_output deprecated: true description: '' outputs: - contextPath: CrowdStrike.Report.job_id description: 'The report job ID.' type: String - contextPath: CrowdStrike.Report.environment_id description: 'The report environment ID.' type: Number - contextPath: CrowdStrike.Report.environment_description description: 'The environment description.' type: String - contextPath: CrowdStrike.Report.size description: 'The file size.' type: Number - contextPath: CrowdStrike.Report.type description: 'The file type.' type: String - contextPath: CrowdStrike.Report.type_short description: 'The short description of the file type.' type: String - contextPath: CrowdStrike.Report.target_url description: 'The target url.' type: String - contextPath: CrowdStrike.Report.state description: 'The report state.' type: String - contextPath: CrowdStrike.Report.error_type description: 'The error type.' type: String - contextPath: CrowdStrike.Report.error_origin description: 'The error origin.' type: String - contextPath: CrowdStrike.Report.submit_name description: 'The name of the file when submitted.' type: String - contextPath: CrowdStrike.Report.md5 description: 'The MD5 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha1 description: 'The SHA1 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha256 description: 'The SHA256 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha512 description: 'The SHA512 hash of the file.' type: String - contextPath: CrowdStrike.Report.ssdeep description: 'The SSDeep hash of the file.' type: String - contextPath: CrowdStrike.Report.imphash description: 'The imphash hash of the file.' type: String - contextPath: CrowdStrike.Report.av_detect description: 'The AV Multiscan range, for example 50-70 (min 0, max 100).' type: Number - contextPath: CrowdStrike.Report.vx_family description: 'The file malware family.' type: String - contextPath: CrowdStrike.Report.url_analysis description: 'Whether this report is url analysis.' type: Boolean - contextPath: CrowdStrike.Report.analysis_start_time description: 'The start time of the analysis.' type: Date - contextPath: CrowdStrike.Report.threat_score description: 'The file threat score.' type: Number - contextPath: CrowdStrike.Report.interesting description: 'Whether the file was found to be interesting.' type: Boolean - contextPath: CrowdStrike.Report.threat_level description: 'The file threat level.' type: Number - contextPath: CrowdStrike.Report.verdict description: 'The file verdict.' type: String - contextPath: CrowdStrike.Report.total_network_connections description: 'The total number of network connections.' type: Number - contextPath: CrowdStrike.Report.total_processes description: 'The total number of processes.' type: Number - contextPath: CrowdStrike.Report.total_signatures description: 'The total number of signatures.' type: Number - contextPath: CrowdStrike.Report.file_metadata description: 'The file metadata.' type: Object - contextPath: CrowdStrike.Report.submissions.submission_id description: 'The submission ID.' type: String - contextPath: CrowdStrike.Report.submissions.filename description: 'The name of the file.' type: String - contextPath: CrowdStrike.Report.submissions.url description: 'The url.' type: String - contextPath: CrowdStrike.Report.submissions.created_at description: 'When the submission was created.' type: Date - contextPath: CrowdStrike.Report.network_mode description: 'The network mode.' type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File.MD5 description: The MD5 hash of the file. type: string - contextPath: File.Name description: The file submission name. type: string - contextPath: File.MalwareFamily description: The file family classification. type: string - contextPath: File.Malicious.Vendor description: The vendor that decided the file was malicious. type: string - contextPath: File.Malicious.Description description: The reason the vendor decided the file was malicious. type: string - contextPath: DBotScore.Indicator description: The tested indicator. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number description: Gets report summary information for a job_id or a sha256 hash. - name: crowdstrike-scan polling: true deprecated: true arguments: - name: file description: A comma-separated list of file hashes (MD5, SHA1, or SHA256). required: true isArray: true defaultValue: "" - name: polling description: "Whether to poll until there is at least one result." auto: PREDEFINED predefined: - "true" - "false" - name: JobID description: The JobID to check the state of when polling. - name: hide_polling_output deprecated: true description: '' outputs: - contextPath: CrowdStrike.Report.job_id description: 'The file job ID.' type: String - contextPath: CrowdStrike.Report.environment_id description: 'The report environment ID.' type: Number - contextPath: CrowdStrike.Report.environment_description description: 'The environment description.' type: String - contextPath: CrowdStrike.Report.size description: 'The file size.' type: Number - contextPath: CrowdStrike.Report.type description: 'The file type.' type: String - contextPath: CrowdStrike.Report.type_short description: 'The short description of the file type.' type: String - contextPath: CrowdStrike.Report.target_url description: 'The target url.' type: String - contextPath: CrowdStrike.Report.state description: 'The report state.' type: String - contextPath: CrowdStrike.Report.error_type description: 'The error type.' type: String - contextPath: CrowdStrike.Report.error_origin description: 'The error origin.' type: String - contextPath: CrowdStrike.Report.submit_name description: 'The file name when submitted.' type: String - contextPath: CrowdStrike.Report.md5 description: 'The MD5 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha1 description: 'The SHA1 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha256 description: 'The SHA256 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha512 description: 'The SHA512 hash of the file.' type: String - contextPath: CrowdStrike.Report.ssdeep description: 'The SSDeep hash of the file.' type: String - contextPath: CrowdStrike.Report.imphash description: 'The imphash hash of the file.' type: String - contextPath: CrowdStrike.Report.av_detect description: 'The AV Multiscan range, for example 50-70 (min 0, max 100).' type: Number - contextPath: CrowdStrike.Report.vx_family description: 'The file malware family.' type: String - contextPath: CrowdStrike.Report.url_analysis description: 'Whether this report is url analysis.' type: Boolean - contextPath: CrowdStrike.Report.analysis_start_time description: 'The start time of the analysis.' type: Date - contextPath: CrowdStrike.Report.threat_score description: 'The file threat score.' type: Number - contextPath: CrowdStrike.Report.interesting description: 'Whether the file was found to be interesting.' type: Boolean - contextPath: CrowdStrike.Report.threat_level description: 'The file threat level.' type: Number - contextPath: CrowdStrike.Report.verdict description: 'The file verdict.' type: String - contextPath: CrowdStrike.Report.total_network_connections description: 'The total number of network connections.' type: Number - contextPath: CrowdStrike.Report.total_processes description: 'The total number of processes.' type: Number - contextPath: CrowdStrike.Report.total_signatures description: 'The total number of signatures.' type: Number - contextPath: CrowdStrike.Report.file_metadata description: 'The file metadata.' type: Object - contextPath: CrowdStrike.Report.submissions.submission_id description: 'The report submission ID.' type: String - contextPath: CrowdStrike.Report.submissions.filename description: 'The name of the file.' type: String - contextPath: CrowdStrike.Report.submissions.url description: 'The url.' type: String - contextPath: CrowdStrike.Report.submissions.created_at description: 'When the submission was created.' type: Date - contextPath: CrowdStrike.Report.network_mode description: 'The network mode.' type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File.MD5 description: The MD5 hash of the file. type: string - contextPath: File.Name description: The file submission name. type: string - contextPath: File.MalwareFamily description: The file family classification. type: string - contextPath: File.Malicious.Vendor description: The vendor that decided the file was malicious. type: string - contextPath: File.Malicious.Description description: The reason the vendor decided the file was malicious. type: string - contextPath: DBotScore.Indicator description: The tested indicator. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number description: Deprecated. Use cs-falcon-sandbox-scan instead. - name: cs-falcon-sandbox-get-environments arguments: [] outputs: - contextPath: CrowdStrike.Environment.ID description: The environment ID. type: number - contextPath: CrowdStrike.Environment.description description: The environment description. type: string - contextPath: CrowdStrike.Environment.architecture description: The environment architecture. type: string - contextPath: CrowdStrike.Environment.VMs_total description: The total number of virtual machines in the environment. type: number - contextPath: CrowdStrike.Environment.VMs_busy description: The number of busy virtual machines in the environment. type: number - contextPath: CrowdStrike.Environment.analysisMode description: "The environment analysis mode." type: string - contextPath: CrowdStrike.Environment.groupicon description: The environment icon. type: string description: Gets a list of all available environments. - name: crowdstrike-get-environments deprecated: true arguments: [] outputs: - contextPath: CrowdStrike.Environment.ID description: The environment ID. type: number - contextPath: CrowdStrike.Environment.description description: The environment description. type: string - contextPath: CrowdStrike.Environment.architecture description: The environment architecture. type: string - contextPath: CrowdStrike.Environment.VMs_total description: The total number of virtual machines in the environment. type: number - contextPath: CrowdStrike.Environment.VMs_busy description: The number of busy virtual machines in the environment. type: number - contextPath: CrowdStrike.Environment.analysisMode description: "The environment analysis mode." type: string - contextPath: CrowdStrike.Environment.groupicon description: The environment icon. type: string description: Deprecated. Use cs-falcon-sandbox-get-environments instead. - name: cs-falcon-sandbox-submit-sample description: Submits a file from the investigation to the analysis server. polling: true arguments: - name: entryId description: The War Room entry ID. required: true defaultValue: "" - name: environmentID description: 'The environment ID. Available environment IDs: 310: "Linux (Ubuntu 20, 64-bit)", 200: "Android Static Analysis", 120: "Windows 7 64 bit", 110: "Windows 7 32 bit (HWP Support)", 100: "Windows 7 32 bit".' required: true auto: PREDEFINED defaultValue: "100" predefined: - "100" - "110" - "120" - "200" - "310" - name: polling description: Whether the command should poll until the result is ready. auto: PREDEFINED predefined: - "true" - "false" - name: no_share_third_party description: When set to 'true', the sample is never shared with any third party. auto: PREDEFINED predefined: - "true" - "false" - name: no_hash_lookup description: When set to 'true', no hash lookup is done on the sample. auto: PREDEFINED predefined: - "true" - "false" - name: allow_community_access description: When set to 'true', the sample is available for the community. auto: PREDEFINED predefined: - "true" - "false" - name: action_script description: "Optional custom runtime action script. Available runtime scripts: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie." auto: PREDEFINED defaultValue: "" predefined: - default - default_maxantievasion - default_randomfiles - default_randomtheme - default_openie - name: hybrid_analysis description: When set to 'false', no memory dump or memory dump analysis is done. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: experimental_anti_evasion description: When set to 'true', sets all Kernelmode Monitor experimental anti-evasion options. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: script_logging description: When set to 'true', sets the Kernelmode Monitor in-depth script logging engine. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: input_sample_tampering description: When set to 'true', allows Kernelmode Monitor experimental anti-evasion options that tamper with the input sample. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: network_settings description: "Network settings. Available options: default: 'Fully operating network', tor: 'Route network traffic via TOR', simulated: 'Simulate network traffic'." defaultValue: "" auto: PREDEFINED predefined: - default - tor - simulated - name: email description: Optional email address that may be associated with the submission for notification. defaultValue: "" - name: comment description: "Optional comment text that may be associated with the submission/sample (Note: you can use #tags)." defaultValue: "" - name: custom_cmd_line description: Optional command line that should be passed to the analysis file. defaultValue: "" - name: custom_run_time description: Optional runtime duration (in seconds). defaultValue: "" - name: submit_name description: "Optional 'submission name' field that will be used for file type detection and analysis. Ignored unless url contains a file." defaultValue: "" - name: priority description: Optional priority value between 1 (lowest) and 10 (highest). By default all samples run with highest priority. defaultValue: "" auto: PREDEFINED predefined: - "1" - "2" - "3" - "4" - "5" - "6" - "7" - "8" - "9" - "10" - name: document_password description: Optional document password used to fill in Adobe/Office password prompts. defaultValue: "" - name: environment_variable description: "Optional system environment value. The value is provided in the format name=value." defaultValue: "" outputs: - contextPath: CrowdStrike.Submit.job_id description: 'The submitted report job ID.' type: String - contextPath: CrowdStrike.Submit.submission_id description: 'The report submission ID.' type: String - contextPath: CrowdStrike.Submit.environment_id description: The report environment ID. type: Number - contextPath: CrowdStrike.Submit.sha256 description: 'The SHA256 hash of the file.' type: String - contextPath: CrowdStrike.Report.job_id description: 'The report job ID.' type: String - contextPath: CrowdStrike.Report.environment_id description: 'The report environment ID.' type: Number - contextPath: CrowdStrike.Report.environment_description description: 'The environment description.' type: String - contextPath: CrowdStrike.Report.size description: 'The file size.' type: Number - contextPath: CrowdStrike.Report.type description: 'The file type.' type: String - contextPath: CrowdStrike.Report.type_short description: 'The short description of the file type.' type: String - contextPath: CrowdStrike.Report.target_url description: 'The target url.' type: String - contextPath: CrowdStrike.Report.state description: 'The report state.' type: String - contextPath: CrowdStrike.Report.error_type description: 'The error type.' type: String - contextPath: CrowdStrike.Report.error_origin description: 'The error origin.' type: String - contextPath: CrowdStrike.Report.submit_name description: 'The name of the file when submitted.' type: String - contextPath: CrowdStrike.Report.md5 description: 'The MD5 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha1 description: 'The SHA1 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha256 description: 'The SHA256 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha512 description: 'The SHA512 hash of the file.' type: String - contextPath: CrowdStrike.Report.ssdeep description: 'The SSDeep hash of the file.' type: String - contextPath: CrowdStrike.Report.imphash description: 'The imphash hash of the file.' type: String - contextPath: CrowdStrike.Report.av_detect description: 'The AV Multiscan range, for example 50-70 (min 0, max 100).' type: Number - contextPath: CrowdStrike.Report.vx_family description: 'The file malware family.' type: String - contextPath: CrowdStrike.Report.url_analysis description: 'Whether this report is url analysis.' type: Boolean - contextPath: CrowdStrike.Report.analysis_start_time description: 'The start time of the analysis.' type: Date - contextPath: CrowdStrike.Report.threat_score description: 'The file threat score.' type: Number - contextPath: CrowdStrike.Report.interesting description: 'Whether the file was found to be interesting.' type: Boolean - contextPath: CrowdStrike.Report.threat_level description: 'The file threat level.' type: Number - contextPath: CrowdStrike.Report.verdict description: 'The file verdict.' type: String - contextPath: CrowdStrike.Report.total_network_connections description: 'The total number of network connections.' type: Number - contextPath: CrowdStrike.Report.total_processes description: 'The total number of processes.' type: Number - contextPath: CrowdStrike.Report.total_signatures description: 'The total number of signatures.' type: Number - contextPath: CrowdStrike.Report.file_metadata description: 'The file metadata.' type: Object - contextPath: CrowdStrike.Report.submissions.submission_id description: 'The submission ID.' type: String - contextPath: CrowdStrike.Report.submissions.filename description: 'The name of the file.' type: String - contextPath: CrowdStrike.Report.submissions.url description: 'The url.' type: String - contextPath: CrowdStrike.Report.submissions.created_at description: 'When the submission was created.' type: Date - contextPath: CrowdStrike.Report.network_mode description: 'The network mode.' type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File.MD5 description: The MD5 hash of the file. type: string - contextPath: File.Name description: The file submission name. type: string - contextPath: File.MalwareFamily description: The file family classification. type: string - contextPath: File.Malicious.Vendor description: The vendor that decided the file was malicious. type: string - contextPath: File.Malicious.Description description: The reason the vendor decided the file was malicious. type: string - contextPath: DBotScore.Indicator description: The tested indicator. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - name: crowdstrike-submit-sample description: Deprecated. Use cs-falcon-sandbox-submit-sample instead. deprecated: true polling: true arguments: - name: entryId description: The War Room entry ID. required: true defaultValue: "" - name: environmentID description: 'The environment ID. Available environment IDs: 310: "Linux (Ubuntu 20, 64-bit)", 200: "Android Static Analysis", 120: "Windows 7 64 bit", 110: "Windows 7 32 bit (HWP Support)", 100: "Windows 7 32 bit".' required: true auto: PREDEFINED defaultValue: "100" predefined: - "100" - "110" - "120" - "200" - "310" - name: environmentId deprecated: true description: 'The environment ID.' - name: polling description: Whether the command should poll until the result is ready. auto: PREDEFINED predefined: - "true" - "false" - name: no_share_third_party description: When set to 'true', the sample is never shared with any third party. auto: PREDEFINED predefined: - "true" - "false" - name: no_hash_lookup description: When set to 'true', no hash lookup is done on the sample. auto: PREDEFINED predefined: - "true" - "false" - name: allow_community_access description: When set to 'true', the sample is available for the community. auto: PREDEFINED predefined: - "true" - "false" - name: action_script description: "Optional custom runtime action script. Available runtime scripts: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie." auto: PREDEFINED defaultValue: "" predefined: - default - default_maxantievasion - default_randomfiles - default_randomtheme - default_openie - name: hybrid_analysis description: When set to 'false', no memory dump or memory dump analysis is done. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: experimental_anti_evasion description: When set to 'true', sets all Kernelmode Monitor experimental anti-evasion options. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: script_logging description: When set to 'true', sets the Kernelmode Monitor in-depth script logging engine. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: input_sample_tampering description: When set to 'true', allows Kernelmode Monitor experimental anti-evasion options that tamper with the input sample. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: network_settings description: "Network settings. Available options: default: 'Fully operating network', tor: 'Route network traffic via TOR', simulated: 'Simulate network traffic'." defaultValue: "" auto: PREDEFINED predefined: - default - tor - simulated - name: email description: Optional email address that may be associated with the submission for notification. defaultValue: "" - name: comment description: "Optional comment text that may be associated with the submission/sample (Note: you can use #tags)." defaultValue: "" - name: custom_cmd_line description: Optional command line that should be passed to the analysis file. defaultValue: "" - name: custom_run_time description: Optional runtime duration (in seconds). defaultValue: "" - name: submit_name description: "Optional 'submission name' field that will be used for file type detection and analysis. Ignored unless url contains a file." defaultValue: "" - name: priority description: Optional priority value between 1 (lowest) and 10 (highest). By default all samples run with highest priority. defaultValue: "" auto: PREDEFINED predefined: - "1" - "2" - "3" - "4" - "5" - "6" - "7" - "8" - "9" - "10" - name: document_password description: Optional document password used to fill in Adobe/Office password prompts. defaultValue: "" - name: environment_variable description: "Optional system environment value. The value is provided in the format name=value." defaultValue: "" outputs: - contextPath: CrowdStrike.Submit.job_id description: 'The file job ID.' type: String - contextPath: CrowdStrike.Submit.submission_id description: 'The submission ID.' type: String - contextPath: CrowdStrike.Submit.environment_id description: The submission environment ID. type: Number - contextPath: CrowdStrike.Submit.sha256 description: 'The SHA256 hash of the file.' type: String - name: cs-falcon-sandbox-search description: Searches the database using the Falcon Sandbox search syntax. arguments: - name: query description: 'The Falcon Sandbox query syntax, for example url:google,host:95.181.53.78. This argument integrates all other arguments into one and cannot be given along with the other arguments.' defaultValue: "" - name: filename description: The file name, for example invoice.exe. defaultValue: "" - name: filetype description: "The file type. Available options: 64bits, android, assembly, bat, cmd, com, csv, data, doc, docx, elf, empty, executable, flash, html, hwp, hwpx, img, iqy, java, javascript, library, lnk, macho, mshelp, msi, native, neexe, office, outlook, pdf, pedll, peexe, perl, ppt, pptx, ps, pub, python, rtf, script, sct, sh, svg, text, url, vbe, vbs, wsf, xls, xlsx." defaultValue: "" - name: filetype_desc description: The file type description, for example PE32 executable. defaultValue: "" - name: env_id description: The environment ID. defaultValue: "" - name: country description: The country (3 digit ISO), for example swe. defaultValue: "" - name: verdict description: "The search result verdict. Available options: Whitelisted, NoVerdict, NoSpecificThreat, Suspicious, Malicious." auto: PREDEFINED defaultValue: "" predefined: - Whitelisted - NoVerdict - NoSpecificThreat - Suspicious - Malicious - name: av_detect description: The AV Multiscan range, for example 50-70 (min 0, max 100). defaultValue: "" - name: vx_family description: The AV Family Substring, for example nemucod. defaultValue: "" - name: limit description: The max number of search results to return. defaultValue: 10 - name: tag description: The hashtag, for example ransomware. defaultValue: "" - name: date_from description: "The date from in format 'YYYY-MM-DD HH:MM', for example 2018-09-28 15:30." defaultValue: "" - name: date_to description: "The date to in format 'YYYY-MM-DD HH:MM', for example 2018-09-28 15:30." defaultValue: "" - name: port description: The port, for example 8080. defaultValue: "" - name: host description: The host, for example 192.168.0.1. defaultValue: "" - name: domain description: The domain, for example checkip.dyndns.org defaultValue: "" - name: url description: The HTTP request substring, for example google. defaultValue: "" - name: similar_to description: Similar samples, for example <sha256>. defaultValue: "" - name: context description: Sample context, for example <sha256>. defaultValue: "" - name: imp_hash description: The import hash. defaultValue: "" - name: ssdeep description: The SSDeep hash. defaultValue: "" - name: authentihash description: The file authentihash. defaultValue: "" outputs: - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.Name description: The file submission name. type: string - contextPath: File.MalwareFamily description: The file family classification. type: string - contextPath: File.Extension description: 'The file extension.' type: string - contextPath: File.MalwareFamily description: The malware family associated with the file. type: String - contextPath: CrowdStrike.Search.search_terms.id description: 'The id of the search term.' type: String - contextPath: CrowdStrike.Search.search_terms.value description: 'The value of the search term.' type: String - contextPath: CrowdStrike.Search.count description: 'The number of results for this search.' type: Number - contextPath: CrowdStrike.Search.result.verdict description: 'The file verdict.' type: String - contextPath: CrowdStrike.Search.result.av_detect description: 'The AV Multiscan range, for example 50-70 (min 0, max 100).' type: String - contextPath: CrowdStrike.Search.result.threat_score description: 'The file threat score.' type: Number - contextPath: CrowdStrike.Search.result.vx_family description: 'The file malware family.' type: String - contextPath: CrowdStrike.Search.result.job_id description: 'The JobID of the result.' type: String - contextPath: CrowdStrike.Search.result.sha256 description: 'The sha256 hash of the file.' type: String - contextPath: CrowdStrike.Search.result.environment_id description: 'The environment ID.' type: Number - contextPath: CrowdStrike.Search.result.analysis_start_time description: 'The start time of the analysis.' type: Date - contextPath: CrowdStrike.Search.result.submit_name description: 'The name of the file.' type: String - contextPath: CrowdStrike.Search.result.environment_description description: 'The environment description.' type: String - contextPath: CrowdStrike.Search.result.size description: 'The size of the file.' type: Number - contextPath: CrowdStrike.Search.result.type description: 'The file type.' type: String - contextPath: CrowdStrike.Search.result.type_short description: 'The short description of the file type.' type: String - name: crowdstrike-search description: Deprecated. Use cs-falcon-sandbox-search instead. deprecated: true arguments: - name: query description: 'The Falcon Sandbox query syntax, for example url:google,host:95.181.53.78. This argument integrates all other arguments into one and cannot be given along with the other arguments.' defaultValue: "" - name: filename description: The file name, for example invoice.exe. defaultValue: "" - name: filetype description: "The file type. Available options: 64bits, android, assembly, bat, cmd, com, csv, data, doc, docx, elf, empty, executable, flash, html, hwp, hwpx, img, iqy, java, javascript, library, lnk, macho, mshelp, msi, native, neexe, office, outlook, pdf, pedll, peexe, perl, ppt, pptx, ps, pub, python, rtf, script, sct, sh, svg, text, url, vbe, vbs, wsf, xls, xlsx." defaultValue: "" - name: filetype_desc description: The file type description, for example PE32 executable. defaultValue: "" - name: env_id description: The environment ID. defaultValue: "" - name: country description: The country (3 digit ISO), for example swe. defaultValue: "" - name: verdict description: "The search result verdict. Available options: Whitelisted, NoVerdict, NoSpecificThreat, Suspicious, Malicious." auto: PREDEFINED defaultValue: "" predefined: - Whitelisted - NoVerdict - NoSpecificThreat - Suspicious - Malicious - name: av_detect description: The AV Multiscan range, for example 50-70 (min 0, max 100). defaultValue: "" - name: vx_family description: The AV Family Substring, for example nemucod. defaultValue: "" - name: limit description: The max number of search results to return. defaultValue: 10 - name: tag description: The hashtag, for example ransomware. defaultValue: "" - name: date_from description: "The date from in format 'YYYY-MM-DD HH:MM', for example 2018-09-28 15:30." defaultValue: "" - name: date_to description: "The date to in format 'YYYY-MM-DD HH:MM', for example 2018-09-28 15:30." defaultValue: "" - name: port description: The port, for example 8080. defaultValue: "" - name: host description: The host, for example 192.168.0.1. defaultValue: "" - name: domain description: The domain, for example checkip.dyndns.org defaultValue: "" - name: url description: HTTP Request Substring e.g. google. defaultValue: "" - name: similar_to description: Similar samples, for example <sha256>. defaultValue: "" - name: context description: Sample context, for example <sha256>. defaultValue: "" - name: imp_hash description: The import hash of the file. defaultValue: "" - name: ssdeep description: The SSDeep hash of the file. defaultValue: "" - name: authentihash description: The file authentihash. defaultValue: "" outputs: - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.Name description: The file submission name. type: string - contextPath: File.MalwareFamily description: The file family classification. type: string - contextPath: File.Extension description: 'The file extension.' type: string - contextPath: File.MalwareFamily description: The malware family associated with the file. type: String - contextPath: CrowdStrike.Search.search_terms.id description: 'The ID of the search term.' type: String - contextPath: CrowdStrike.Search.search_terms.value description: 'The value of the search term.' type: String - contextPath: CrowdStrike.Search.count description: 'The number of results for this search.' type: Number - contextPath: CrowdStrike.Search.result.verdict description: 'The file verdict.' type: String - contextPath: CrowdStrike.Search.result.av_detect description: 'The AV Multiscan range, for example 50-70 (min 0, max 100).' type: String - contextPath: CrowdStrike.Search.result.threat_score description: 'The file threat score.' type: Number - contextPath: CrowdStrike.Search.result.vx_family description: 'The file malware family.' type: String - contextPath: CrowdStrike.Search.result.job_id description: 'The JobID of the result.' type: String - contextPath: CrowdStrike.Search.result.sha256 description: 'The sha256 of the file.' type: String - contextPath: CrowdStrike.Search.result.environment_id description: 'The environment ID.' type: Number - contextPath: CrowdStrike.Search.result.analysis_start_time description: 'The start time of the analysis.' type: Date - contextPath: CrowdStrike.Search.result.submit_name description: 'The name of the file.' type: String - contextPath: CrowdStrike.Search.result.environment_description description: 'The environment description.' type: String - contextPath: CrowdStrike.Search.result.size description: 'The size of the file.' type: Number - contextPath: CrowdStrike.Search.result.type description: 'The file type.' type: String - contextPath: CrowdStrike.Search.result.type_short description: 'The short description of the file type.' type: String - name: cs-falcon-sandbox-result polling: true description: "Retrieves result data on a file. Note: This command returns a file." arguments: - name: polling description: Whether the command should poll until the result is ready. defaultValue: true auto: PREDEFINED predefined: - "true" - "false" - name: file description: The file hash (MD5, SHA1, or SHA256). defaultValue: "" - name: hide_polling_output deprecated: true description: '' - name: environmentID description: 'The environment ID. Available environment IDs: 310: "Linux (Ubuntu 20, 64-bit)", 200: "Android Static Analysis", 120: "Windows 7 64 bit", 110: "Windows 7 32 bit (HWP Support)", 100: "Windows 7 32 bit".' auto: PREDEFINED defaultValue: "" predefined: - "100" - "110" - "120" - "200" - "310" - name: JobID description: The file job ID to generate a report for. defaultValue: "" - name: file-type description: The file type. auto: PREDEFINED defaultValue: "pdf" predefined: - xml - json - html - pdf - maec - stix - misp - misp-json - openioc outputs: - contextPath: CrowdStrike.Report.job_id description: 'The file job ID.' type: String - contextPath: CrowdStrike.Report.environment_id description: 'The report environment ID.' type: Number - contextPath: CrowdStrike.Report.environment_description description: 'The environment description.' type: String - contextPath: CrowdStrike.Report.size description: 'The file size.' type: Number - contextPath: CrowdStrike.Report.type description: 'The file type.' type: String - contextPath: CrowdStrike.Report.type_short description: 'The short description of the file type.' type: String - contextPath: CrowdStrike.Report.target_url description: 'The target url.' type: String - contextPath: CrowdStrike.Report.state description: 'The report state.' type: String - contextPath: CrowdStrike.Report.error_type description: 'The error type.' type: String - contextPath: CrowdStrike.Report.error_origin description: 'The error origin.' type: String - contextPath: CrowdStrike.Report.submit_name description: 'The file name when submitted.' type: String - contextPath: CrowdStrike.Report.md5 description: 'The MD5 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha1 description: 'The SHA1 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha256 description: 'The SHA256 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha512 description: 'The SHA512 hash of the file.' type: String - contextPath: CrowdStrike.Report.ssdeep description: 'The SSDeep hash of the file.' type: String - contextPath: CrowdStrike.Report.imphash description: 'The imphash hash of the file.' type: String - contextPath: CrowdStrike.Report.av_detect description: 'The AV Multiscan range, for example 50-70 (min 0, max 100).' type: Number - contextPath: CrowdStrike.Report.vx_family description: 'The file malware family.' type: String - contextPath: CrowdStrike.Report.url_analysis description: 'Whether this report is url analysis.' type: Boolean - contextPath: CrowdStrike.Report.analysis_start_time description: 'The start time of the analysis.' type: Date - contextPath: CrowdStrike.Report.threat_score description: 'The file threat score.' type: Number - contextPath: CrowdStrike.Report.interesting description: 'Whether the file was found to be interesting.' type: Boolean - contextPath: CrowdStrike.Report.threat_level description: 'The file threat level.' type: Number - contextPath: CrowdStrike.Report.verdict description: 'The file verdict.' type: String - contextPath: CrowdStrike.Report.total_network_connections description: 'The total number of network connections.' type: Number - contextPath: CrowdStrike.Report.total_processes description: 'The total number of processes.' type: Number - contextPath: CrowdStrike.Report.total_signatures description: 'The total number of signatures.' type: Number - contextPath: CrowdStrike.Report.file_metadata description: 'The file metadata.' type: Object - contextPath: CrowdStrike.Report.submissions.submission_id description: 'The ID of the submission.' type: String - contextPath: CrowdStrike.Report.submissions.filename description: 'The name of the file.' type: String - contextPath: CrowdStrike.Report.submissions.url description: 'The url.' type: String - contextPath: CrowdStrike.Report.submissions.created_at description: 'When the submission was created.' type: Date - contextPath: CrowdStrike.Report.network_mode description: 'The network mode.' type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File.MD5 description: The MD5 hash of the file. type: string - contextPath: File.Name description: The file submission name. type: string - contextPath: File.MalwareFamily description: The file family classification. type: string - contextPath: File.Malicious.Vendor description: The vendor that decided the file was malicious. type: string - contextPath: File.Malicious.Description description: The reason the vendor decided the file was malicious. type: string - contextPath: DBotScore.Indicator description: The tested indicator. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: InfoFile.Name description: The file name. type: string - contextPath: InfoFile.EntryID description: The file entry ID. type: string - contextPath: InfoFile.Size description: The file size. type: number - contextPath: InfoFile.Type description: The file type, for example "PE". type: string - contextPath: InfoFile.Info description: Basic information about the file. type: string - contextPath: InfoFile.Extension description: The file extension. type: string - name: crowdstrike-result polling: true description: Deprecated. Use cs-falcon-sandbox-result instead. deprecated: true arguments: - name: polling description: Whether the command should poll until the result is ready. defaultValue: true auto: PREDEFINED predefined: - "true" - "false" - name: file description: The file hash (MD5, SHA1 or SHA256). defaultValue: "" - name: hide_polling_output deprecated: true description: '' - name: environmentID description: 'The environment ID. Available environment IDs: 310: "Linux (Ubuntu 20, 64-bit)", 200: "Android Static Analysis", 120: "Windows 7 64 bit", 110: "Windows 7 32 bit (HWP Support)", 100: "Windows 7 32 bit".' auto: PREDEFINED defaultValue: "" predefined: - "100" - "110" - "120" - "200" - "310" - name: environmentId deprecated: true description: 'The environment ID.' - name: JobID description: The file job ID to generate a report for. defaultValue: "" - name: file-type description: The file type. auto: PREDEFINED defaultValue: "pdf" predefined: - xml - json - html - pdf - maec - stix - misp - misp-json - openioc - "" outputs: - contextPath: CrowdStrike.Report.job_id description: 'The file job ID.' type: String - contextPath: CrowdStrike.Report.environment_id description: 'The report environment ID.' type: Number - contextPath: CrowdStrike.Report.environment_description description: 'The environment description.' type: String - contextPath: CrowdStrike.Report.size description: 'The file size.' type: Number - contextPath: CrowdStrike.Report.type description: 'The file type.' type: String - contextPath: CrowdStrike.Report.type_short description: 'The short description of the file type.' type: String - contextPath: CrowdStrike.Report.target_url description: 'The target url.' type: String - contextPath: CrowdStrike.Report.state description: 'The report state.' type: String - contextPath: CrowdStrike.Report.error_type description: 'The error type.' type: String - contextPath: CrowdStrike.Report.error_origin description: 'The error origin.' type: String - contextPath: CrowdStrike.Report.submit_name description: 'The file name when submitted.' type: String - contextPath: CrowdStrike.Report.md5 description: 'The MD5 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha1 description: 'The SHA1 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha256 description: 'The SHA256 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha512 description: 'The SHA512 hash of the file.' type: String - contextPath: CrowdStrike.Report.ssdeep description: 'The SSDeep hash of the file.' type: String - contextPath: CrowdStrike.Report.imphash description: 'The imphash hash of the file.' type: String - contextPath: CrowdStrike.Report.av_detect description: 'The AV Multiscan range, for example 50-70 (min 0, max 100).' type: Number - contextPath: CrowdStrike.Report.vx_family description: 'The file malware family.' type: String - contextPath: CrowdStrike.Report.url_analysis description: 'Whether this report is url analysis.' type: Boolean - contextPath: CrowdStrike.Report.analysis_start_time description: 'The start time of the analysis.' type: Date - contextPath: CrowdStrike.Report.threat_score description: 'The file threat score.' type: Number - contextPath: CrowdStrike.Report.interesting description: 'Whether the file was found to be interesting.' type: Boolean - contextPath: CrowdStrike.Report.threat_level description: 'The file threat level.' type: Number - contextPath: CrowdStrike.Report.verdict description: 'The file verdict.' type: String - contextPath: CrowdStrike.Report.total_network_connections description: 'The total number of network connections.' type: Number - contextPath: CrowdStrike.Report.total_processes description: 'The total number of processes.' type: Number - contextPath: CrowdStrike.Report.total_signatures description: 'The total number of signatures.' type: Number - contextPath: CrowdStrike.Report.file_metadata description: 'The file metadata.' type: Object - contextPath: CrowdStrike.Report.submissions.submission_id description: 'The submission ID.' type: String - contextPath: CrowdStrike.Report.submissions.filename description: 'The name of the file.' type: String - contextPath: CrowdStrike.Report.submissions.url description: 'The url.' type: String - contextPath: CrowdStrike.Report.submissions.created_at description: 'When the submission was created.' type: Date - contextPath: CrowdStrike.Report.network_mode description: 'The network mode.' type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File.MD5 description: The MD5 hash of the file. type: string - contextPath: File.Name description: The file submission name. type: string - contextPath: File.MalwareFamily description: The file family classification. type: string - contextPath: File.Malicious.Vendor description: The vendor that decided the file was malicious. type: string - contextPath: File.Malicious.Description description: The reason the vendor decided the file was malicious. type: string - contextPath: DBotScore.Indicator description: The tested indicator. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: InfoFile.Name description: The file name. type: string - contextPath: InfoFile.EntryID description: The file entry ID. type: string - contextPath: InfoFile.Size description: The file size. type: number - contextPath: InfoFile.Type description: The file type, for example "PE". type: string - contextPath: InfoFile.Info description: Basic information about the file. type: string - contextPath: InfoFile.Extension description: The file extension. type: string - name: cs-falcon-sandbox-submit-url polling: true description: Submits a URL for analysis. arguments: - name: url description: The URL for analysis or the URL of the file to submit. required: true defaultValue: "" - name: environmentID description: 'The environment ID. Available environment IDs: 310: "Linux (Ubuntu 20, 64-bit)", 200: "Android Static Analysis", 120: "Windows 7 64 bit", 110: "Windows 7 32 bit (HWP Support)", 100: "Windows 7 32 bit".' required: true auto: PREDEFINED defaultValue: "100" predefined: - "100" - "110" - "120" - "200" - "310" - name: polling description: Whether the command should poll until the result is ready. auto: PREDEFINED predefined: - "true" - "false" - name: no_share_third_party description: When set to 'true', the sample is never shared with any third party. auto: PREDEFINED predefined: - "true" - "false" - name: no_hash_lookup description: When set to 'true', no hash lookup is done on the sample. auto: PREDEFINED predefined: - "true" - "false" - name: allow_community_access description: When set to 'true', the sample is available for the community. auto: PREDEFINED predefined: - "true" - "false" - name: action_script description: "Optional custom runtime action script. Available runtime scripts: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie." auto: PREDEFINED defaultValue: "" predefined: - default - default_maxantievasion - default_randomfiles - default_randomtheme - default_openie - name: hybrid_analysis description: When set to 'false', no memory dump or memory dump analysis is done. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: experimental_anti_evasion description: When set to 'true', sets all Kernelmode Monitor experimental anti-evasion options. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: script_logging description: When set to 'true', sets the Kernelmode Monitor in-depth script logging engine. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: input_sample_tampering description: When set to 'true', allows Kernelmode Monitor experimental anti-evasion options that tamper with the input sample. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: network_settings description: "Network settings. Available options: default: 'Fully operating network', tor: 'Route network traffic via TOR', simulated: 'Simulate network traffic'." defaultValue: "" auto: PREDEFINED predefined: - default - tor - simulated - name: email description: 'Optional email address that may be associated with the submission for notification.' defaultValue: "" - name: comment description: "Optional comment text that may be associated with the submission/sample (Note: you can use #tags)." defaultValue: "" - name: custom_cmd_line description: Optional command line that should be passed to the analysis file. defaultValue: "" - name: custom_run_time description: Optional runtime duration (in seconds). defaultValue: "" - name: submit_name description: "Optional 'submission name' field that will be used for file type detection and analysis. Ignored unless url contains a file." defaultValue: "" - name: priority description: Optional priority value between 1 (lowest) and 10 (highest). By default all samples run with highest priority. defaultValue: "" auto: PREDEFINED predefined: - "1" - "2" - "3" - "4" - "5" - "6" - "7" - "8" - "9" - "10" - name: document_password description: Optional document password used to fill in Adobe/Office password prompts. defaultValue: "" - name: environment_variable description: "Optional system environment value. The value is provided in the format name=value." defaultValue: "" outputs: - contextPath: CrowdStrike.Submit.job_id description: 'The The submitted report job ID.' type: String - contextPath: CrowdStrike.Submit.submission_type description: 'The type of the submission.' type: String - contextPath: CrowdStrike.Submit.submission_id description: 'The submission ID.' type: String - contextPath: CrowdStrike.Submit.environment_id description: The submission environment ID. type: Number - contextPath: CrowdStrike.Submit.sha256 description: 'The SHA256 hash of the file.' type: String - contextPath: CrowdStrike.Report.job_id description: 'The report job ID.' type: String - contextPath: CrowdStrike.Report.environment_id description: 'The report environment ID.' type: Number - contextPath: CrowdStrike.Report.environment_description description: 'The environment description.' type: String - contextPath: CrowdStrike.Report.size description: 'The file size.' type: Number - contextPath: CrowdStrike.Report.type description: 'The file type.' type: String - contextPath: CrowdStrike.Report.type_short description: 'The short description of the file type.' type: String - contextPath: CrowdStrike.Report.target_url description: 'The target url.' type: String - contextPath: CrowdStrike.Report.state description: 'The report state.' type: String - contextPath: CrowdStrike.Report.error_type description: 'The error type.' type: String - contextPath: CrowdStrike.Report.error_origin description: 'The error origin.' type: String - contextPath: CrowdStrike.Report.submit_name description: 'The file name when submitted.' type: String - contextPath: CrowdStrike.Report.md5 description: 'The MD5 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha1 description: 'The SHA1 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha256 description: 'The SHA256 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha512 description: 'The SHA512 hash of the file.' type: String - contextPath: CrowdStrike.Report.ssdeep description: 'The SSDeep hash of the file.' type: String - contextPath: CrowdStrike.Report.imphash description: 'The imphash hash of the file.' type: String - contextPath: CrowdStrike.Report.av_detect description: 'The AV Multiscan range, for example 50-70 (min 0, max 100).' type: Number - contextPath: CrowdStrike.Report.vx_family description: 'The file malware famil.' type: String - contextPath: CrowdStrike.Report.url_analysis description: 'Whether this report is url analysis.' type: Boolean - contextPath: CrowdStrike.Report.analysis_start_time description: 'The start time of the analysis.' type: Date - contextPath: CrowdStrike.Report.threat_score description: 'The file threat score.' type: Number - contextPath: CrowdStrike.Report.interesting description: 'Whether the file was found to be interesting.' type: Boolean - contextPath: CrowdStrike.Report.threat_level description: 'The file threat level.' type: Number - contextPath: CrowdStrike.Report.verdict description: 'The file verdict.' type: String - contextPath: CrowdStrike.Report.total_network_connections description: 'The total number of network connections.' type: Number - contextPath: CrowdStrike.Report.total_processes description: 'The total number of processes.' type: Number - contextPath: CrowdStrike.Report.total_signatures description: 'The total number of signatures.' type: Number - contextPath: CrowdStrike.Report.file_metadata description: 'The file metadata.' type: Object - contextPath: CrowdStrike.Report.submissions.submission_id description: 'The submission ID.' type: String - contextPath: CrowdStrike.Report.submissions.filename description: 'The name of the file.' type: String - contextPath: CrowdStrike.Report.submissions.url description: 'The url.' type: String - contextPath: CrowdStrike.Report.submissions.created_at description: 'When the submission was created.' type: Date - contextPath: CrowdStrike.Report.network_mode description: 'The network mode.' type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File.MD5 description: The MD5 hash of the file. type: string - contextPath: File.Name description: The file submission name. type: string - contextPath: File.MalwareFamily description: The file family classification. type: string - contextPath: File.Malicious.Vendor description: The vendor that decided the file was malicious. type: string - contextPath: File.Malicious.Description description: The reason the vendor decided the file was malicious. type: string - contextPath: DBotScore.Indicator description: The tested indicator. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - name: crowdstrike-submit-url polling: true description: Deprecated. Use cs-falcon-sandbox-submit-url instead. deprecated: true arguments: - name: url description: The URL for analysis or the URL of the file to submit. required: true defaultValue: "" - name: environmentID description: 'The environment ID. Available environment IDs: 310: "Linux (Ubuntu 20, 64-bit)", 200: "Android Static Analysis", 120: "Windows 7 64 bit", 110: "Windows 7 32 bit (HWP Support)", 100: "Windows 7 32 bit".' required: true auto: PREDEFINED defaultValue: "100" predefined: - "100" - "110" - "120" - "200" - "310" - name: polling description: Whether the command should poll until the result is ready. auto: PREDEFINED predefined: - "true" - "false" - name: no_share_third_party description: When set to 'true', the sample is never shared with any third party. auto: PREDEFINED predefined: - "true" - "false" - name: no_hash_lookup description: When set to 'true', no hash lookup is done on the sample. auto: PREDEFINED predefined: - "true" - "false" - name: allow_community_access description: When set to 'true', the sample is available for the community. auto: PREDEFINED predefined: - "true" - "false" - name: action_script description: "Optional custom runtime action script. Available runtime scripts: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie." auto: PREDEFINED defaultValue: "" predefined: - default - default_maxantievasion - default_randomfiles - default_randomtheme - default_openie - name: hybrid_analysis description: When set to 'false', no memory dump or memory dump analysis is done. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: experimental_anti_evasion description: When set to 'true', sets all Kernelmode Monitor experimental anti-evasion options. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: script_logging description: When set to 'true', sets the Kernelmode Monitor in-depth script logging engine. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: input_sample_tampering description: When set to 'true', allows Kernelmode Monitor experimental anti-evasion options that tamper with the input sample. defaultValue: "" auto: PREDEFINED predefined: - "true" - "false" - name: network_settings description: "Network settings. Available options: default: 'Fully operating network', tor: 'Route network traffic via TOR', simulated: 'Simulate network traffic'." defaultValue: "" auto: PREDEFINED predefined: - default - tor - simulated - name: email description: Optional email address that may be associated with the submission for notification. defaultValue: "" - name: comment description: "Optional comment text that may be associated with the submission/sample (Note: you can use #tags)." defaultValue: "" - name: custom_cmd_line description: Optional command line that should be passed to the analysis file. defaultValue: "" - name: custom_run_time description: Optional runtime duration (in seconds). defaultValue: "" - name: submit_name description: "Optional 'submission name' field that will be used for file type detection and analysis. Ignored unless url contains a file." defaultValue: "" - name: priority description: Optional priority value between 1 (lowest) and 10 (highest). By default all samples run with highest priority. defaultValue: "" auto: PREDEFINED predefined: - "1" - "2" - "3" - "4" - "5" - "6" - "7" - "8" - "9" - "10" - name: document_password description: Optional document password used to fill in Adobe/Office password prompts. defaultValue: "" - name: environment_variable description: "Optional system environment value. The value is provided in the format name=value." defaultValue: "" outputs: - contextPath: CrowdStrike.Submit.job_id description: 'The JobID of the file.' type: String - contextPath: CrowdStrike.Submit.submission_type description: 'The type of the submission.' type: String - contextPath: CrowdStrike.Submit.submission_id description: 'The submission id.' type: String - contextPath: CrowdStrike.Submit.environment_id description: The environment id for the submission. type: Number - contextPath: CrowdStrike.Submit.sha256 description: 'The sha256 hash of the file.' type: String - name: cs-falcon-sandbox-get-screenshots description: "Retrieves screenshots from a report." arguments: - name: file description: The sha256 hash of a file. defaultValue: "" - name: environmentID description: 'The environment ID. Available environment IDs: 310: "Linux (Ubuntu 20, 64-bit)", 200: "Android Static Analysis", 120: "Windows 7 64 bit", 110: "Windows 7 32 bit (HWP Support)", 100: "Windows 7 32 bit".' auto: PREDEFINED defaultValue: "" predefined: - "100" - "110" - "120" - "200" - "310" - name: JobID description: The file job ID. defaultValue: "" outputs: - contextPath: InfoFile.Name description: The file name. type: string - contextPath: InfoFile.EntryID description: The file entry ID. type: string - contextPath: InfoFile.Size description: The file size. type: number - contextPath: InfoFile.Type description: The file type, for example "PE". type: string - contextPath: InfoFile.Info description: Basic information about the file. type: string - contextPath: InfoFile.Extension description: The file extension. type: string - name: crowdstrike-get-screenshots description: Deprecated. Use cs-falcon-sandbox-get-screenshots instead. deprecated: true arguments: - name: file description: The SHA256 hash of a file. defaultValue: "" - name: environmentID description: 'The environment ID. Available environment IDs: 310: "Linux (Ubuntu 20, 64-bit)", 200: "Android Static Analysis", 120: "Windows 7 64 bit", 110: "Windows 7 32 bit (HWP Support)", 100: "Windows 7 32 bit".' auto: PREDEFINED defaultValue: "" predefined: - "100" - "110" - "120" - "200" - "310" - name: JobID description: The file job ID. defaultValue: "" outputs: [] - name: cs-falcon-sandbox-analysis-overview description: Gets the hash overview. arguments: - name: file description: The SHA256 hash of the file. required: true defaultValue: "" outputs: - contextPath: CrowdStrike.AnalysisOverview.sha256 description: The SHA256 hash of the file. type: String - contextPath: CrowdStrike.AnalysisOverview.last_file_name description: 'The last name of the file.' type: String - contextPath: CrowdStrike.AnalysisOverview.threat_score description: 'The file threat score.' type: Number - contextPath: CrowdStrike.AnalysisOverview.verdict description: 'The file verdict.' type: String - contextPath: CrowdStrike.AnalysisOverview.url_analysis description: 'Whether this report is url analysis.' type: Boolean - contextPath: CrowdStrike.AnalysisOverview.size description: 'The size of the file.' type: Number - contextPath: CrowdStrike.AnalysisOverview.type description: 'The file type.' type: String - contextPath: CrowdStrike.AnalysisOverview.type_short description: 'The short description of the file type.' type: String - contextPath: CrowdStrike.AnalysisOverview.analysis_start_time description: 'The start time of the analysis.' type: Date - contextPath: CrowdStrike.AnalysisOverview.last_multi_scan description: 'The last multi-scan.' type: Date - contextPath: CrowdStrike.AnalysisOverview.architecture description: 'The environment architecture.' type: String - contextPath: CrowdStrike.AnalysisOverview.multiscan_result description: 'The multi-scan result.' type: Number - contextPath: CrowdStrike.AnalysisOverview.scanners.name description: 'The name of the scanner.' type: String - contextPath: CrowdStrike.AnalysisOverview.scanners.status description: 'The status of the scanner.' type: String - contextPath: CrowdStrike.AnalysisOverview.scanners.error_message description: 'The error message.' type: String - contextPath: CrowdStrike.AnalysisOverview.scanners.progress description: 'The progress of the scanner.' type: Number - contextPath: CrowdStrike.AnalysisOverview.scanners.total description: 'The total number of scanners.' type: Number - contextPath: CrowdStrike.AnalysisOverview.scanners.positives description: 'The number of positives.' type: Number - contextPath: CrowdStrike.AnalysisOverview.scanners.percent description: 'The percent of the scanner.' type: Number - contextPath: CrowdStrike.AnalysisOverview.scanners.anti_virus_results.name description: 'The name of the antivirus results.' type: String - contextPath: CrowdStrike.AnalysisOverview.scanners.anti_virus_results.result description: 'The antivirus result.' type: Boolean - contextPath: CrowdStrike.AnalysisOverview.scanners.anti_virus_results.threat_found description: 'The threat found the the scanner.' type: String - contextPath: CrowdStrike.AnalysisOverview.reports description: 'The reports of the analysis.' type: String - contextPath: CrowdStrike.AnalysisOverview.whitelisted description: 'If the result is whitelisted.' type: Boolean - contextPath: CrowdStrike.AnalysisOverview.children_in_queue description: 'The number of children in queue.' type: Number - contextPath: CrowdStrike.AnalysisOverview.children_in_progress description: 'The number of children in progress.' type: Number - contextPath: File.Size description: 'The file size.' type: number - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.Name description: 'The file name.' type: string - contextPath: File.type description: 'The file type.' type: string - name: cs-falcon-sandbox-analysis-overview-summary description: Returns the hash overview. arguments: - name: file description: The SHA256 hash of the file. required: true defaultValue: '' outputs: - contextPath: CrowdStrike.AnalysisOverviewSummary.sha256 description: 'The SHA256 hash of the file.' type: String - contextPath: CrowdStrike.AnalysisOverviewSummary.threat_score description: 'The file threat score.' type: Number - contextPath: CrowdStrike.AnalysisOverviewSummary.verdict description: 'The file verdict.' type: String - contextPath: CrowdStrike.AnalysisOverviewSummary.analysis_start_time description: 'The start time of the analysis.' type: Date - contextPath: CrowdStrike.AnalysisOverviewSummary.last_multi_scan description: 'The last multi-scan.' type: Date - contextPath: CrowdStrike.AnalysisOverviewSummary.multiscan_result description: 'The multi-scan result.' type: Number - name: cs-falcon-sandbox-analysis-overview-refresh description: Refreshes the overview and downloads fresh data from external services. arguments: - name: file description: The SHA256 hash of the file. required: true defaultValue: '' outputs: [] - name: file description: Returns file information and reputation. arguments: - name: file default: true required: true description: A comma-separated list of file hashes (MD5, SHA1, or SHA256). isArray: true outputs: - contextPath: CrowdStrike.Report.job_id description: 'The file job ID.' type: String - contextPath: CrowdStrike.Report.environment_id description: 'The report environment ID.' type: Number - contextPath: CrowdStrike.Report.environment_description description: 'The environment description.' type: String - contextPath: CrowdStrike.Report.size description: 'The file size.' type: Number - contextPath: CrowdStrike.Report.type description: 'The file type.' type: String - contextPath: CrowdStrike.Report.type_short description: 'The short description of the file type.' type: String - contextPath: CrowdStrike.Report.target_url description: 'The target url.' type: String - contextPath: CrowdStrike.Report.state description: 'The report state.' type: String - contextPath: CrowdStrike.Report.error_type description: 'The error type.' type: String - contextPath: CrowdStrike.Report.error_origin description: 'The error origin.' type: String - contextPath: CrowdStrike.Report.submit_name description: 'The file name when submitted.' type: String - contextPath: CrowdStrike.Report.md5 description: 'The MD5 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha1 description: 'The SHA1 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha256 description: 'The SHA256 hash of the file.' type: String - contextPath: CrowdStrike.Report.sha512 description: 'The SHA512 hash of the file.' type: String - contextPath: CrowdStrike.Report.ssdeep description: 'The SSDeep hash of the file.' type: String - contextPath: CrowdStrike.Report.imphash description: 'The imphash hash of the file.' type: String - contextPath: CrowdStrike.Report.av_detect description: 'The AV Multiscan range, for example 50-70 (min 0, max 100).' type: Number - contextPath: CrowdStrike.Report.vx_family description: 'The file malware family.' type: String - contextPath: CrowdStrike.Report.url_analysis description: 'Whether this report is url analysis.' type: Boolean - contextPath: CrowdStrike.Report.analysis_start_time description: 'The start time of the analysis.' type: Date - contextPath: CrowdStrike.Report.threat_score description: 'The file threat score.' type: Number - contextPath: CrowdStrike.Report.interesting description: 'Whether the file was found to be interesting.' type: Boolean - contextPath: CrowdStrike.Report.threat_level description: 'The file threat level.' type: Number - contextPath: CrowdStrike.Report.verdict description: 'The file verdict.' type: String - contextPath: CrowdStrike.Report.total_network_connections description: 'The total number of network connections.' type: Number - contextPath: CrowdStrike.Report.total_processes description: 'The total number of processes.' type: Number - contextPath: CrowdStrike.Report.total_signatures description: 'The total number of signatures.' type: Number - contextPath: CrowdStrike.Report.file_metadata description: 'The file metadata.' type: Object - contextPath: CrowdStrike.Report.submissions.submission_id description: 'The submission ID.' type: String - contextPath: CrowdStrike.Report.submissions.filename description: 'The name of the file.' type: String - contextPath: CrowdStrike.Report.submissions.url description: 'The url.' type: String - contextPath: CrowdStrike.Report.submissions.created_at description: 'When the submission was created.' type: Date - contextPath: CrowdStrike.Report.network_mode description: 'The network mode.' type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File.MD5 description: The MD5 hash of the file. type: string - contextPath: File.Name description: The file submission name. type: string - contextPath: File.MalwareFamily description: The file family classification. type: string - contextPath: File.Malicious.Vendor description: The vendor that decided the file was malicious. type: string - contextPath: File.Malicious.Description description: The reason the vendor decided the file was malicious. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - name: cs-falcon-sandbox-sample-download description: Downloads the sample file. arguments: - name: file description: The SHA256 hash of the file. required: true defaultValue: '' outputs: - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.SHA512 description: The SHA512 hash of the file. type: String - contextPath: File.SSDeep description: The SSDeep hash of the file. type: String - contextPath: File.EntryID description: The file entry ID. type: String - contextPath: File.Info description: Information about the file. type: String - contextPath: File.Type description: The file type. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.Extension description: The file extension. type: String - name: cs-falcon-sandbox-report-state description: Gets the report state for the given ID. arguments: - name: JobID description: The file job ID. defaultValue: "" - name: environmentID description: 'The environment ID. Available environment IDs: 310: "Linux (Ubuntu 20, 64-bit)", 200: "Android Static Analysis", 120: "Windows 7 64 bit", 110: "Windows 7 32 bit (HWP Support)", 100: "Windows 7 32 bit".' auto: PREDEFINED defaultValue: "" predefined: - "100" - "110" - "120" - "200" - "310" - name: file description: The hash of the file. outputs: - contextPath: CrowdStrike.State.state description: 'The state of the report.' type: String - contextPath: CrowdStrike.State.error_type description: 'The error type of the report.' type: String - contextPath: CrowdStrike.State.error_origin description: 'The error origin.' type: String - contextPath: CrowdStrike.State.error description: 'The error description.' type: String runonce: false tests: - CrowdstrikeFalconSandbox2 Test fromversion: 6.2.0