FortiSandboxv2

FortiSandbox is an advanced security tool that goes beyond standard sandboxing. It combines proactive mitigation, enhanced threat detection, and in-depth reporting, using Fortinet’s dynamic antivirus technology, dual-level sandboxing, and FortiGuard cloud integration to counter advanced threats. It effectively detects viruses, Advanced Persistent Threats (APTs), and malicious URLs, integrating seamlessly with existing Fortinet devices like FortiGate and FortiMail for comprehensive network protection.
This integration was integrated and tested with version 4.4.3 of FortiSandboxv2.

Some changes have been made that might affect your existing content.
If you are upgrading from a previous version of this integration, see Breaking Changes.

Configure FortiSandbox v2 on Cortex XSOAR

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for FortiSandbox v2.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Required
   Base URL		True
   Username		True
   Password		True
   Trust any certificate (not secure)		False
   Use system proxy settings		False
   Source Reliability	Reliability of the source providing the intelligence data.	True

4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

file

Runs reputation on files.

Base Command

file

Input

Context Output

Command example

!file file=936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af

Context Example

{
    "DBotScore": {
        "Indicator": "936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af",
        "Reliability": "C - Fairly reliable",
        "Score": 1,
        "Type": "file",
        "Vendor": "FortiSandboxv2"
    },
    "File": {
        "Extension": "txt",
        "Hashes": [
            {
                "type": "SHA256",
                "value": "936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af"
            }
        ],
        "Name": "helloworld.txt",
        "SHA256": "936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af"
    }
}

Human Readable Output

Metrics reported successfully.

url

Runs reputation on URLs.

Base Command

url

Input

Context Output

Command example

!url url=www.google.com

Context Example

{
    "DBotScore": {
        "Indicator": "www.google.com",
        "Reliability": "C - Fairly reliable",
        "Score": 1,
        "Type": "url",
        "Vendor": "FortiSandboxv2"
    },
    "URL": {
        "Data": "www.google.com"
    }
}

Human Readable Output

Metrics reported successfully.

fortisandbox-submission-file-upload

Scheduled command to upload any file type to be sandboxed. The system swiftly identifies and mitigates threats in files.

Base Command

fortisandbox-submission-file-upload

Input

Context Output

Command example

!fortisandbox-submission-file-upload entry_id=418@e75b29e7-17a8-41bc-8555-ef233dd8bac9

Human Readable Output

No jobs were created yet for the submission 7048126795285831956

fortisandbox-submission-url-upload

Scheduled command to upload URLs through a text file or directly to be sandboxed individually. The system rigorously examines URLs for online security hazards.

Base Command

fortisandbox-submission-url-upload

Input

Context Output

Command example

!fortisandbox-submission-url-upload urls=www.google.com

Human Readable Output

No jobs were created yet for the submission 7048126856924000534

fortisandbox-submission-cancel

Cancel a running job submission. Note: Jobs that are already being processed cannot be canceled, only jobs that are in the queue.

Base Command

fortisandbox-submission-cancel

Input

Context Output

There is no context output for this command.

Command example

!fortisandbox-submission-cancel id=7047969418633282747

Human Readable Output

The cancellation of the submission 7047969418633282747 was successfully sent

fortisandbox-submission-job-verdict

Get the verdict of the provided job.

Base Command

fortisandbox-submission-job-verdict

Input

Context Output

Command example

!fortisandbox-submission-job-verdict id=7047959279104315513

Context Example

{
    "DBotScore": {
        "Indicator": "936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af",
        "Message": "https://0.0.0.0/job-detail/?sid=7047959252528592869&jid=7047959279104315513&req_type=file-csearch",
        "Reliability": "C - Fairly reliable",
        "Score": 1,
        "Type": "file",
        "Vendor": "FortiSandboxv2"
    },
    "File": {
        "Extension": "txt",
        "Hashes": [
            {
                "type": "SHA1",
                "value": "6adfb183a4a2c94a2f92dab5ade762a47889a5a1"
            },
            {
                "type": "SHA256",
                "value": "936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af"
            }
        ],
        "Name": "helloworld.txt",
        "SHA1": "6adfb183a4a2c94a2f92dab5ade762a47889a5a1",
        "SHA256": "936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af"
    },
    "FortiSandbox": {
        "Submission": {
            "category": "NotApplicable",
            "detail_url": "https://0.0.0.0/job-detail/?sid=7047959252528592869&jid=7047959279104315513&req_type=file-csearch",
            "detection_os": "",
            "download_url": "aGVsbG93b3JsZC50eHQK",
            "false_positive_negative": 0,
            "file_name": "helloworld.txt",
            "finish_ts": 1710245223,
            "ftype": "txt",
            "infected_os": "",
            "jid": "7047959279104315513",
            "malware_name": "N/A",
            "name": "helloworld.txt\n",
            "now": 1710254987,
            "rating": "Clean",
            "rating_source": "Static Scan Engine",
            "score": 0,
            "sha1": "6adfb183a4a2c94a2f92dab5ade762a47889a5a1",
            "sha256": "936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af",
            "start_ts": 1710245223,
            "untrusted": 1,
            "vid": 0
        }
    }
}

Human Readable Output

The verdict for the job 7047959279104315513

Jid	Name	Start Ts	Finish Ts	Category	Malware Name	Rating	Detail Url
7047959279104315513	helloworld.txt	1710245223	1710245223	NotApplicable	N/A	Clean	https://0.0.0.0/job-detail/?sid=7047959252528592869&jid=7047959279104315513&req_type=file-csearch

fortisandbox-submission-job-list

Get a list of jobs that were created from a submission.

Base Command

fortisandbox-submission-job-list

Input

Context Output

Command example

!fortisandbox-submission-job-list id=7047969418633282747

Context Example

{
    "FortiSandbox": {
        "Submission": {
            "jid": "7047969436160637757",
            "sid": "7047969418633282747"
        }
    }
}

Human Readable Output

The submission 7047969418633282747 job IDs

Jid
7047969436160637757

fortisandbox-submission-job-report

Get a PDF report of the provided submission.

Base Command

fortisandbox-submission-job-report

Input

Context Output

Command example

!fortisandbox-submission-job-report identifier=7047959279104315513

Context Example

{
    "InfoFile": {
        "EntryID": "449@e75b29e7-17a8-41bc-8555-ef233dd8bac9",
        "Extension": "pdf",
        "Info": "application/pdf",
        "Name": "7047959279104315513.pdf",
        "Size": 2605722,
        "Type": "PDF document, version 1.4"
    }
}

Human Readable Output

Breaking changes from the previous version of this integration - FortiSandbox v2

Commands

The following commands were removed in this version

• fortisandbox-simple-file-rating-sha256 - this command was replaced by file.
• fortisandbox-simple-file-rating-sha1 - this command was replaced by file.
• fortisandbox-url-rating - this command was replaced by url.
• fortisandbox-get-file-verdict-detailed - this command was replaced by file.
• fortisandbox-upload-file - this command was replaced by fortisandbox-submission-upload-file.
• fortisandbox-query-job-verdict - this command was replaced by fortisandbox-submission-job-verdict.
• fortisandbox-jobid-from-submission - this command was replaced by fortisandbox-submission-job-list.
• fortisandbox-get-pdf-report - this command was replaced by fortisandbox-submission-job-report.
• fortisandbox-upload-urls - this command was replaced by fortisandbox-submission-upload-url.