FortiSandbox Deprecated

FortiSandbox integration is used to submit files to FortiSandbox for malware analysis and retrieving the report of the analysis. It can also provide file rating based on hashes for already scanned files. Deprecated. Use FortiSandboxv2 instead.

Forensics & Malware Analysis · FortiSandbox

Details

IDFortiSandbox
ProviderFortinet
CategoryForensics & Malware Analysis
From Version6.0.0
Docker Imagedemisto/python3:3.10.12.63474
Supported ModulesAgentix XSIAM

README

FortiSandbox integration is used to submit files to FortiSandbox for malware analysis and retrieving the report of the analysis. It can also provide file rating based on hashes for already scanned files.

Configure FortiSandbox on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for FortiSandbox.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    Server URL URL of the Fortisandbox server. True
    Credentials   True
    Password   True
    Trust any certificate (not secure) By default SSL certification validation is enabled. False
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

fortisandbox-simple-file-rating-sha256

Get file rating of SHA-256 Checksum

Base Command

fortisandbox-simple-file-rating-sha256

Input

Argument Name Description Required
checksum SHA-256 Checksum to check the rating. Required

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

### fortisandbox-simple-file-rating-sha1

***
Get File Rating of SHA-1 checksum

#### Base Command

`fortisandbox-simple-file-rating-sha1`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| checksum | SHA-1 Checksum to check the rating. | Required |

#### Context Output

There is no context output for this command.

#### Command Example

Human Readable Output

fortisandbox-url-rating

Get URL Rating from FortiSandbox

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

fortisandbox-url-rating

Input

Argument Name Description Required
url Comma separated URLs to get url rating. Required

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

### fortisandbox-get-file-verdict-detailed

***
Query file's verdict through its checksum (returns JSON)

#### Base Command

`fortisandbox-get-file-verdict-detailed`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| checksum | Checksum value to query. | Required |
| checksum_type | Type of checksum - sha1 or sha256. Possible values are: sha1, sha256. | Required |

#### Context Output

There is no context output for this command.

#### Command Example

Human Readable Output

fortisandbox-upload-file

Upload file (on-demand submit)

Base Command

fortisandbox-upload-file

Input

Argument Name Description Required
file_entry_id Entry ID of the file to upload. Required
archive_password Password for archived/zipped files. Optional
vm_csv_list VMs to scan the File on, comma seperated. (Ex.WIN7X86VM,WINXPVM). Optional
skip_steps Do not use this parameter if no step to skip. 1 = Skip AV, 2= Skip Cloud, 4= Skip sandboxing, 8= Skip Static Scan. Optional
malpkg Set the value as “1” to require to add the sample to malware package if it satisfy the malware critia. By default, the value is “0”. Default is 0. Optional
sha256 File SHA-256 used to get scan report. Required

Context Output

Path Type Description
FortiSandbox.Upload.SubmissionId string Submission ID of file submission
FortiSandbox.Upload.FileName string File Uploaded
FortiSandbox.Upload.SHA256 string SHA256 of uploaded file used for getting report
FortiSandbox.Upload.Status string Scan status

Command Example


#### Human Readable Output

### fortisandbox-query-job-verdict

***
Query File Scan verdict from FortiSandbox based on Job ID

#### Base Command

`fortisandbox-query-job-verdict`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| job_id | Scan Job ID for file. | Required |

#### Context Output

There is no context output for this command.

#### Command Example

Human Readable Output

fortisandbox-jobid-from-submission

Get Job IDs from an uploaded Submission using the submission ID

Base Command

fortisandbox-jobid-from-submission

Input

Argument Name Description Required
submission_id Submission ID of uploaded file to scan. Required

Context Output

Path Type Description
FortiSandbox.Upload.Status string scan status
FortiSandbox.Upload.JobIds string job ids for submission

Command Example


#### Human Readable Output

### fortisandbox-get-pdf-report

***
Get PDF Report of scanned item

#### Base Command

`fortisandbox-get-pdf-report`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| query_type | Select query method - job ID or sha256. Possible values are: jid, sha256. | Required |
| query_value | Enter query value - job ID value or Sha256 hash of the file. | Required |

#### Context Output

There is no context output for this command.

#### Command Example

Human Readable Output

fortisandbox-upload-urls

Upload CSV URLs

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

fortisandbox-upload-urls

Input

Argument Name Description Required
urls Comma seperated url values. Required

Context Output

There is no context output for this command.

Command Example

``````

Human Readable Output

Configuration parameters

  • server — Server URL (required)
  • credentials — Credentials (required)
  • secure — Trust any certificate (not secure)

Commands (9)

  • fortisandbox-get-file-verdict-detailed

    Query file's verdict through its checksum (returns JSON)

  • fortisandbox-get-pdf-report

    Get PDF Report of scanned item

  • fortisandbox-jobid-from-submission

    Get Job IDs from an uploaded Submission using the submission ID

  • fortisandbox-query-job-verdict

    Query File Scan verdict from FortiSandbox based on Job ID

  • fortisandbox-simple-file-rating-sha1

    Get File Rating of SHA-1 checksum

  • fortisandbox-simple-file-rating-sha256

    Get file rating of SHA-256 Checksum

  • fortisandbox-upload-file

    Upload file (on-demand submit)

  • fortisandbox-upload-urls

    Upload CSV URLs

  • fortisandbox-url-rating

    Get URL Rating from FortiSandbox

Source

FortiSandbox.py FortiSandbox.yml FortiSandbox_description.md
Download History Raw 
category: Forensics & Malware Analysis
provider: Fortinet
commonfields:
  id: FortiSandbox
  version: -1
deprecated: true
configuration:
- additionalinfo: URL of the Fortisandbox server.
  display: Server URL
  name: server
  required: true
  type: 0
- display: Credentials
  name: credentials
  required: true
  type: 9
- additionalinfo: By default SSL certification validation is enabled.
  defaultvalue: "true"
  display: Trust any certificate (not secure)
  name: secure
  type: 8
  required: false
description: FortiSandbox integration is used to submit files to FortiSandbox for malware analysis and retrieving the report of the analysis. It can also provide file rating based on hashes for already scanned files. Deprecated. Use FortiSandboxv2 instead.
display: FortiSandbox (Deprecated)
name: FortiSandbox
script:
  commands:
  - arguments:
    - description: SHA-256 Checksum to check the rating
      name: checksum
      required: true
    description: Get file rating of SHA-256 Checksum
    name: fortisandbox-simple-file-rating-sha256
  - arguments:
    - description: SHA-1 Checksum to check the rating
      name: checksum
      required: true
    description: Get File Rating of SHA-1 checksum
    name: fortisandbox-simple-file-rating-sha1
  - arguments:
    - description: Comma separated URLs  to get url rating
      name: url
      required: true
    description: Get URL Rating from FortiSandbox
    name: fortisandbox-url-rating
  - arguments:
    - description: Checksum value to query
      name: checksum
      required: true
    - auto: PREDEFINED
      description: Type of checksum - sha1 or sha256
      name: checksum_type
      predefined:
      - sha1
      - sha256
      required: true
    description: Query file's verdict through its checksum (returns JSON)
    name: fortisandbox-get-file-verdict-detailed
  - arguments:
    - description: Entry ID of the file to upload
      name: file_entry_id
      required: true
    - description: Password for archived/zipped files
      name: archive_password
    - description: VMs to scan the File on, comma seperated. (Ex.WIN7X86VM,WINXPVM)
      name: vm_csv_list
    - description: Do not use this parameter if no step to skip. 1 = Skip AV, 2= Skip Cloud, 4= Skip sandboxing, 8= Skip Static Scan.
      name: skip_steps
    - defaultValue: "0"
      description: Set the value as "1" to require to add the sample to malware package if it satisfy the malware critia. By default, the value is "0".
      name: malpkg
    - description: File SHA-256 used to get scan report
      name: sha256
      required: true
    description: Upload file (on-demand submit)
    name: fortisandbox-upload-file
    outputs:
    - contextPath: FortiSandbox.Upload.SubmissionId
      description: Submission ID of file submission
      type: string
    - contextPath: FortiSandbox.Upload.FileName
      description: File Uploaded
      type: string
    - contextPath: FortiSandbox.Upload.SHA256
      description: SHA256 of uploaded file used for getting report
      type: string
    - contextPath: FortiSandbox.Upload.Status
      description: Scan status
      type: string
  - arguments:
    - description: Scan Job ID for file
      name: job_id
      required: true
    description: Query File Scan verdict from FortiSandbox based on Job ID
    name: fortisandbox-query-job-verdict
  - arguments:
    - description: Submission ID of uploaded file to scan
      name: submission_id
      required: true
    description: Get Job IDs from an uploaded Submission using the submission ID
    name: fortisandbox-jobid-from-submission
    outputs:
    - contextPath: FortiSandbox.Upload.Status
      description: scan status
      type: string
    - contextPath: FortiSandbox.Upload.JobIds
      description: job ids for submission
      type: string
  - arguments:
    - auto: PREDEFINED
      description: Select query method - job ID or sha256
      name: query_type
      predefined:
      - jid
      - sha256
      required: true
    - description: Enter query value - job ID value or Sha256 hash of the file
      name: query_value
      required: true
    description: Get PDF Report of scanned item
    name: fortisandbox-get-pdf-report
  - arguments:
    - description: Comma seperated url values
      name: urls
      required: true
    description: Upload CSV URLs
    name: fortisandbox-upload-urls
  dockerimage: demisto/python3:3.10.12.63474
  runonce: true
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)