JoeSecurityV2

Access the full set of possibilities the JoeSandbox Cloud provides via the RESTful Web API v2.

Forensics & Malware Analysis · Joe Security

Details

IDJoeSecurityV2
ProviderJoe Security GmbH
CategoryForensics & Malware Analysis
From Version6.8.0
Docker Imagedemisto/vendors-sdk:1.0.0.10120494
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Access the full set of possibilities the Joe Sandbox Cloud provides via RESTful Web API v2.
This integration was integrated and tested with version 3.18.0 of jbxapi.

Some changes have been made that might affect your existing content.
If you are upgrading from a previous version of this integration, see Breaking Changes.

Configure Joe Security v2 on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Joe Security v2.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    Server URL   True
    API Key   True
    Source Reliability Reliability of the source providing the intelligence data. True
    Create relationships Create relationships between indicators as part of Enrichment. False
    Trust any certificate (not secure)   False
    Use system proxy settings   False
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Note: Most of the commands have the full_display boolean argument that when set to true, indicators information, including their DBot Scores, will be displayed.

joe-is-online

Check if the Joe Sandbox analysis server is online or in maintenance mode.

Base Command

joe-is-online

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Joe.ServerStatus.Online Boolean The server status.

Command example


#### Context Example

```json
{
    "Joe": {
        "ServerStatus": {
            "Online": true
        }
    }
}

Human Readable Output

Joe server is online

joe-analysis-info

Get information about an analysis.

Base Command

joe-analysis-info

Input

Argument Name Description Required
webid The analysis web ID. Required
full_display When set to true, indicators information, including their DBot Scores, will be displayed. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String The reliability of the source providing the intelligence data.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
File.Hashes.type String The hash type.
File.Hashes.value String The hash value.
File.Name String The full file name.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.MD5 String The MD5 hash of the file.
URL.Data String The URL.
Joe.Analysis.AnalysisID String The analysis ID Joe Security.
Joe.Analysis.Classification String The classification of the analysis.
Joe.Analysis.Comments String Comments regarding the analysis.
Joe.Analysis.detection String The analysis detection. Can be one of unknown, clean, suspicious, malicious.
Joe.Analysis.duration Number The duration of the analysis in seconds.
Joe.Analysis.encrypted Boolean True if the analysis data is encrypted.
Joe.Analysis.filename String The file name of the analysis.
Joe.Analysis.md5 String The file MD5.
Joe.Analysis.runs.detection String The run detection. Can be one of unknown, clean, suspicious, malicious.
Joe.Analysis.runs.error Unknown The run errors.
Joe.Analysis.runs.score Number The run score.
Joe.Analysis.runs.sigma Boolean The run sigma.
Joe.Analysis.runs.snort Boolean The run snort.
Joe.Analysis.runs.system String The run operation system.
Joe.Analysis.runs.yara Boolean The run YARA.
Joe.Analysis.score Number The run score.
Joe.Analysis.scriptname String The run script name.
Joe.Analysis.sha1 String The file SHA1.
Joe.Analysis.sha256 String The file SHA256.
Joe.Analysis.status String The status is one of submitted, running, finished.
Joe.Analysis.threatname String The analysis threat name.
Joe.Analysis.time Date The analysis time.
Joe.Analysis.webid String The web ID from Joe Security.

Command example

!joe-analysis-info webid=2722073

Context Example

{
    "Joe": {
        "Analysis": [
            {
                "analysisid": "1",
                "classification": "",
                "comments": "(example)",
                "detection": "clean",
                "duration": 558,
                "encrypted": false,
                "filename": "test_file.txt",
                "md5": "11111111111111111111111111111111",
                "runs": [
                    {
                        "detection": "clean",
                        "error": null,
                        "score": 1,
                        "sigma": false,
                        "snort": false,
                        "system": "w10x64_21h1_office",
                        "yara": false
                    },
                    {
                        "detection": "clean",
                        "error": null,
                        "score": 0,
                        "sigma": false,
                        "snort": false,
                        "system": "w7x64_office",
                        "yara": false
                    }
                ],
                "score": 1,
                "scriptname": "example.jbs",
                "sha1": "1111111111111111111111111111111111111111",
                "sha256": "1111111111111111111111111111111111111111111111111111111111111111",
                "status": "finished",
                "tags": [],
                "threatname": "Unknown",
                "time": "2022-09-15T10:57:20+02:00",
                "webid": "1111111"
            }
        ]
    }
}

Human Readable Output

Analysis Result

Id SampleName Status Time MD5 SHA1 SHA256 Systems Result Errors Comments
1 test_file.txt finished 2022-09-15T10:57:20+02:00 11111111111111111111111111111111 1111111111111111111111111111111111111111 1111111111111111111111111111111111111111111111111111111111111111 w7x64_office,
w10x64_21h1_office		 clean None (example)

joe-list-analysis

Lists all analyses.

Base Command

joe-list-analysis

Input

Argument Name Description Required
page Page number to display. Optional
page_size Determine how many entries to display on each page. Optional
limit Limit the number of entries to display. Default is 50. Optional
full_display When set to true, indicators information, including their DBot Scores, will be displayed. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String The reliability of the source providing the intelligence data.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
File.Hashes.type String The hash type.
File.Hashes.value String The hash value.
File.Name String The full file name.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.MD5 String The MD5 hash of the file.
URL.Data String The URL.
Joe.Analysis.AnalysisID String The analysis ID.
Joe.Analysis.Classification String The classification of the analysis.
Joe.Analysis.Comments String Comments regarding the analysis.
Joe.Analysis.detection String The analysis detection. Can be one of unknown, clean, suspicious, malicious.
Joe.Analysis.duration Number The duration of the analysis in seconds.
Joe.Analysis.encrypted Boolean True if the analysis data is encrypted.
Joe.Analysis.filename String The file name of the analysis.
Joe.Analysis.md5 String The file MD5.
Joe.Analysis.runs.detection String The run detection. Can be one of unknown, clean, suspicious, malicious.
Joe.Analysis.runs.error Unknown The run errors.
Joe.Analysis.runs.score Number The run score.
Joe.Analysis.runs.sigma Boolean The run sigma.
Joe.Analysis.runs.snort Boolean The run snort.
Joe.Analysis.runs.system String The run operation system.
Joe.Analysis.runs.yara Boolean The run YARA.
Joe.Analysis.score Number The run score.
Joe.Analysis.scriptname String The run script name.
Joe.Analysis.sha1 String The file SHA1.
Joe.Analysis.sha256 String The file SHA256.
Joe.Analysis.status String The status is one of submitted, running, finished.
Joe.Analysis.threatname String The analysis threat name.
Joe.Analysis.time Date The analysis time.
Joe.Analysis.webid String The web ID from Joe Security.

Command example

!joe-list-analysis limit=1

Context Example

{
    "Joe": {
        "Analysis": [
            {
                "analysisid": "1",
                "classification": "",
                "comments": "(example)",
                "detection": "clean",
                "duration": 558,
                "encrypted": false,
                "filename": "test_file.txt",
                "md5": "11111111111111111111111111111111",
                "runs": [
                    {
                        "detection": "clean",
                        "error": null,
                        "score": 1,
                        "sigma": false,
                        "snort": false,
                        "system": "w10x64_21h1_office",
                        "yara": false
                    },
                    {
                        "detection": "clean",
                        "error": null,
                        "score": 0,
                        "sigma": false,
                        "snort": false,
                        "system": "w7x64_office",
                        "yara": false
                    }
                ],
                "score": 1,
                "scriptname": "example.jbs",
                "sha1": "1111111111111111111111111111111111111111",
                "sha256": "1111111111111111111111111111111111111111111111111111111111111111",
                "status": "finished",
                "tags": [],
                "threatname": "Unknown",
                "time": "2022-09-15T10:57:20+02:00",
                "webid": "1111111"
            }
        ]
    }
}

Human Readable Output

Analysis Result

Id SampleName Status Time MD5 SHA1 SHA256 Systems Result Errors Comments
1 test_file.txt finished 2022-09-15T10:57:20+02:00 11111111111111111111111111111111 1111111111111111111111111111111111111111 1111111111111111111111111111111111111111111111111111111111111111 w7x64_office,
w10x64_21h1_office		 clean None (example)

joe-download-report

Download a resource belonging to a report. This can be the full report, dropped binaries, etc. See the integration README for the full list of supported report types.

Base Command

joe-download-report

Input

Argument Name Description Required
webid The Web ID. Required
type The resource type to download. Possible values are: html, json, pcap, pdf, xml, iocjson. Default is html. Optional

Context Output

Path Type Description
InfoFile.Name string Filename.
InfoFile.EntryID string The entry ID of the report
InfoFile.Size number File size.
InfoFile.Type string File type. e.g., “PE”.
InfoFile.Info string Basic information of the file.
File.Extension string File extension.

Command example

!joe-download-report webid=1

Context Example

{
    "InfoFile": {
        "EntryID": "111@",
        "Extension": "html",
        "Info": "text/html; charset=utf-8",
        "Name": "1_report.html",
        "Size": 3823558,
        "Type": "HTML document, ASCII text, with very long lines"
    }
}

Human Readable Output

Returned file: 1_report.html Download

joe-download-sample

Download a sample.

Base Command

joe-download-sample

Input

Argument Name Description Required
webid Web ID. Required

Context Output

Path Type Description
File.Size number File size.
File.SHA1 string SHA1 hash of the file
File.SHA256 string SHA256 hash of the file
File.Name string The sample name.
File.SSDeep string SSDeep hash of the file.
File.EntryID string War.Room entry ID of the file.
File.Info string Basic information of the file
File.Type string File type, e.g., “PE”.
File MD5 string MD5 hash of the file.
File.Extension string File extension.

Command example

!joe-download-sample webid=2722073

Context Example

{
    "File": {
        "EntryID": "111@",
        "Extension": "dontrun",
        "Info": "dontrun",
        "MD5": "11111111111111111111111111111111",
        "Name": "1.dontrun",
        "SHA1": "1111111111111111111111111111111111111111",
        "SHA256": "1111111111111111111111111111111111111111111111111111111111111111",
        "SHA512": "11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111",
        "SSDeep": "3:PFoESNt/FPl2X1sjO3//lGF/llllBl9SLEZWxIUclll7D8/+l/AltdUshMl//:PgG2s/RIUctM/+l/MusKl//",
        "Size": 276,
        "Type": "AppleDouble encoded Macintosh file"
    }
}

Human Readable Output

Uploaded file: 1.dontrun Download

file

Retrieves files information from Joe Security.

Base Command

file

Input

Argument Name Description Required
file A comma-separated list of file names, SHA1, SHA256, or MD5 hashes. Required

Context Output

Path Type Description
File.Name String Name of the file.
File.MD5 String MD5 hash of the file.
File.SHA1 String SHA1 hash of the file.
File.SHA256 String SHA256 hash of the file.
File.Tags String Tags of the file.
File.Name String Name of the file.
Joe.File.MD5 String MD5 hash of the file.
Joe.File.SHA1 String SHA1 hash of the file.
Joe.File.SHA256 String SHA256 hash of the file.
Joe.File.Tags String Tags of the file.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.

Command example

!file file=example

Context Example

{
    "DBotScore": [
        {
            "Indicator": "example",
            "Reliability": "C - Fairly reliable",
            "Score": 1,
            "Type": "file",
            "Vendor": "JoeSecurityV2"
        }
    ],
    "File": {
        "Hashes": [
            {
                "type": "MD5",
                "value": "11111111111111111111111111111111"
            },
            {
                "type": "SHA1",
                "value": "1111111111111111111111111111111111111111"
            },
            {
                "type": "SHA256",
                "value": "1111111111111111111111111111111111111111111111111111111111111111"
            }
        ],
        "MD5": "11111111111111111111111111111111",
        "Name": "example",
        "SHA1": "1111111111111111111111111111111111111111",
        "SHA256": "1111111111111111111111111111111111111111111111111111111111111111"
    },
    "Joe": {
      "File Name": "example",
      "MD5": "11111111111111111111111111111111",
      "SHA1": "1111111111111111111111111111111111111111",
      "SHA256": "1111111111111111111111111111111111111111111111111111111111111111"
    }
}

Human Readable Output

File Result

File Name Sha1 Sha256 Md5
example 1111111111111111111111111111111111111111 1111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111

url

Retrieves URL information from Joe Security.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name Description Required
url A comma-separated list of URLs. Required

Context Output

Path Type Description
URL.Data String The URL data.
Joe.URL.Name String Name of the URL.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.

Command example

!url url=http://google.com

Context Example

{
    "DBotScore": [
        {
            "Indicator": "http://google.com",
            "Reliability": "C - Fairly reliable",
            "Score": 1,
            "Type": "url",
            "Vendor": "JoeSecurityV2"
        }
    ],
    "Joe": {
        "URL": "http://google.com"
    },
    "URL": {
        "Data": "http://google.com"
    }
}

Human Readable Output

Url Result

Url
http://google.com

joe-list–lia-countries

Retrieve a list of localized internet anonymization countries.

Base Command

joe-list–lia-countries

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Joe.LIACountry String A list of localized internet anonymization countries.

Command example


#### Context Example

```json
{
    "Joe": {
        "LIACountry": [
            "Argentina",
            "Australia",
            "Austria",
            "Belgium",
            "Brazil"
        ]
    }
}

Human Readable Output

Results

Name
Argentina
Australia
Austria
Belgium
Brazil

joe-list-lang-locales

Retrieve a list of available language and locale combinations.

Base Command

joe-list-lang-locales

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Joe.LangLocale String A list of available language and locale combinations.

Command example


#### Context Example

```json
{
    "Joe": {
        "LangLocale": [
            "Arabic - Egypt",
            "Arabic - Qatar",
            "Arabic - Saudi Arabia",
            "Chinese - PRC",
            "Chinese - Taiwan",
            "English - Australia"
        ]
    }
}

Human Readable Output

Results

Name
Arabic - Egypt
Arabic - Qatar
Arabic - Saudi Arabia
Chinese - PRC
Chinese - Taiwan
English - Australia

joe-get-account-quota

Retrieve the account quota.

Base Command

joe-get-account-quota

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Joe.AccountQuota String The account quota.
Joe.AccountQuota.quota.daily.current Number The current daily quota.
Joe.AccountQuota.quota.daily.limit Number The daily quota limit.
Joe.AccountQuota.quota.daily.remaining Number The remaining daily quota.
Joe.AccountQuota.quota.monthly.current Number The current monthly quota.
Joe.AccountQuota.quota.monthly.limit Number The monthly quota limit.
Joe.AccountQuota.quota.monthly.remaining Number The remaining monthly quota.
Joe.AccountQuota.type String The quota type.

Command example

Human Readable Output

Results

Quota Type Daily Quota Current Daily Quota Limit Daily Quote Remaining Monthly Quota Current Monthly Quota Limit Monthly Quota Remaining
ultimate 0 100 100 150 250 100

joe-submission-info

Retrieve the submission info.

Base Command

joe-submission-info

Input

Argument Name Description Required
submission_ids A comma-separated list of submission IDs. Required
full_display When set to true, indicators information, including their DBot Scores, will be displayed. Possible values are: true, false. Default is true. Optional

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String The reliability of the source providing the intelligence data.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
File.Hashes.type String The hash type.
File.Hashes.value String The hash value.
File.MD5 String The MD5 hash of the file.
File.Name String The full file name.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
URL.Data String The URL.
Joe.Analysis.AnalysisID String The analysis ID.
Joe.Analysis.Classification String The classification.
Joe.Analysis.Comments String The comments.
Joe.Analysis.detection String The detection.
Joe.Analysis.duration Number The duration.
Joe.Analysis.encrypted Boolean Whether the analysis is encrypted.
Joe.Analysis.filename String The filename.
Joe.Analysis.runs.detection String The detection.
Joe.Analysis.runs.error Unknown The error.
Joe.Analysis.runs.score Number The score.
Joe.Analysis.runs.sigma Boolean The sigma.
Joe.Analysis.runs.snort Boolean The snort.
Joe.Analysis.runs.system String The system.
Joe.Analysis.runs.yara Boolean The YARA.
Joe.Analysis.score Number The score.
Joe.Analysis.scriptname String The script name.
Joe.Analysis.status String The status.
Joe.Analysis.threatname String The threat name.
Joe.Analysis.time Date The time.
Joe.Analysis.webid String The web ID.
Joe.Submission.most_relevant_analysis.detection String The detection.
Joe.Submission.most_relevant_analysis.score Number The score.
Joe.Submission.most_relevant_analysis.webid String The web ID.
Joe.Submission.name String The name.
Joe.Submission.status String The status.
Joe.Submission.submission_id String The submission ID.
Joe.Submission.time Date The time.

Command example

!joe-submission-info submission_ids=1111111

Context Example

{
    "DBotScore": [
        {
            "Indicator": "example.txt",
            "Reliability": "C - Fairly reliable",
            "Score": 1,
            "Type": "file",
            "Vendor": "JoeSecurityV2"
        }
    ],
    "File": [
        {
            "Hashes": [
                {
                    "type": "MD5",
                    "value": "11111111111111111111111111111111"
                },
                {
                    "type": "SHA1",
                    "value": "1111111111111111111111111111111111111111"
                },
                {
                    "type": "SHA256",
                    "value": "1111111111111111111111111111111111111111111111111111111111111111"
                }
            ],
            "MD5": "11111111111111111111111111111111",
            "Name": "example.txt",
            "SHA1": "1111111111111111111111111111111111111111",
            "SHA256": "1111111111111111111111111111111111111111111111111111111111111111"
        }
    ],
    "Joe": {
        "Analysis": [
            {
                "analysisid": "1",
                "classification": "",
                "comments": "example comment",
                "detection": "clean",
                "duration": 500,
                "encrypted": false,
                "filename": "example.txt",
                "md5": "11111111111111111111111111111111",
                "runs": [
                    {
                        "detection": "clean",
                        "error": null,
                        "score": 1,
                        "sigma": false,
                        "snort": false,
                        "system": "w10x64_21h1_office",
                        "yara": false
                    },
                    {
                        "detection": "clean",
                        "error": null,
                        "score": 0,
                        "sigma": false,
                        "snort": false,
                        "system": "w7x64_office",
                        "yara": false
                    }
                ],
                "score": 1,
                "scriptname": "example.jbs",
                "sha1": "1111111111111111111111111111111111111111",
                "sha256": "1111111111111111111111111111111111111111111111111111111111111111",
                "status": "finished",
                "tags": [],
                "threatname": "Unknown",
                "time": "2022-09-15T10:57:20+02:00",
                "webid": "1"
            }
        ],
        "Submission": {
            "most_relevant_analysis": {
                "detection": "clean",
                "score": 1,
                "webid": "1"
            },
            "name": "example.zip",
            "status": "finished",
            "submission_id": "1111111",
            "time": "2022-09-15T10:57:14+02:00"
        }
    }
}

Human Readable Output

Submission Results

Submission Id Sample Name Time Status Web Id Encrypted Analysis Id Classification Threat Name Score Detection SHA256 MD5 SHA1 File Name
1 example.zip 2022-09-15T10:57:14+02:00 finished 1 false 1   Unknown 1 clean 1111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111 1111111111111111111111111111111111111111 example.txt

joe-submit-sample

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

joe-submit-sample

Input

Argument Name Description Required
entry_id The War Room entry ID of the file to submit. Required
file_name The filename of the submitted sample Optional
full_display When set to true, indicators information, including their DBot Scores, will be displayed. Possible values are: true, false. Default is true. Optional
timeout The timeout for the polling in seconds. Default is 1200. Optional
hide_polling_output Hide polling output. Optional
report_type The report type. Possible values are: html, json, pcap, pdf, xml, iocjson. Default is html. Optional
cookbook Uploads a cookbook together with the sample. Needs to be a file-like object or a tuple in the shape (filename, file-like object). Optional
comments A comment to be added to the analysis. Optional
tags A comma-separated list of tags to be added to the analysis. Optional
systems A comma-separated list of operating systems to be used for the analysis. Possible values are: w7, w7x64, w7_1, w7_2, w7_4, w7_5, w7native, android2, android3, mac1, w7l, w7x64l, w10, android4, w7x64native, w7_3, w10native, android5native_1, w10x64, w7x64_hvm, android6, iphone1, w7_sec, macvm, w7_lang_packs, w7x64native_hvm, lnxubuntu1, lnxcentos1, android7_nougat. Optional
internet_access Whether to allow internet access for the analysis. Default is true. Optional
archive_no_unpack Whether to archive the sample without unpacking it. Default is false. Optional
ssl_inspection Whether to enable SSL inspection. Default is false. Optional
localized_internet_country The localized internet anonymization country. Optional
internet_simulation Whether to enable internet simulation. Default is false. Optional
hybrid_code_analysis Whether to enable hybrid code analysis. Default is true. Optional
hybrid_decompilation Whether to enable hybrid decompilation. Default is false. Optional
vba_instrumentation Whether to enable VBA instrumentation. Default is true. Optional
js_instrumentation Whether to enable JS instrumentation. Default is true. Optional
java_jar_tracing Whether to enable Java JAR tracing. Default is true. Optional
dotnet_tracing Whether to enable .NET tracing. Default is true. Optional
amsi_unpacking Whether to enable Microsoft Antimalware Scan Interface unpacking. Default is true. Optional
fast_mode Whether to enable fast mode. It focuses on fast analysis and detection versus deep forensic analysis. Default is false. Optional
secondary_results Whether to enable secondary results, such as Yara rule generation, classification via Joe Sandbox Class as well as several detail reports. Default is false. Optional
report_cache Whether to enable report cache. Default is false. Optional
command_line_argument A command line argument to be passed to the sample. Optional
live_interaction Whether to enable live interaction. Default is false. Optional
document_password The document password. Optional
archive_password The archive password. Optional
start_as_normal_user Whether to start the analysis as a normal user. Default is false. Optional
language_and_locale Changes the language and locale of the analysis machine. Optional
delete_after_days The number of days after which the analysis will be deleted. Default is 30. Optional
encrypt_with_password The password to encrypt the analysis with. Optional
export_to_jbxview Whether to export the analysis to JBXView. Default is false. Optional
email_notification Send an email notification once the analysis completes. Default is false. Optional

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String The reliability of the source providing the intelligence data.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
File.Hashes.type String The hash type.
File.Hashes.value String The hash value.
File.MD5 String The MD5 hash of the file.
File.Name String The full file name.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
Joe.Analysis.AnalysisID String The analysis ID.
Joe.Analysis.Classification String The classification.
Joe.Analysis.Comments String The comments.
Joe.Analysis.detection String The detection.
Joe.Analysis.duration Number The duration.
Joe.Analysis.encrypted Boolean Whether the analysis is encrypted.
Joe.Analysis.filename String The filename.
Joe.Analysis.runs.detection String The detection.
Joe.Analysis.runs.error Unknown The error.
Joe.Analysis.runs.score Number The score.
Joe.Analysis.runs.sigma Boolean The sigma.
Joe.Analysis.runs.snort Boolean The snort.
Joe.Analysis.runs.system String The system.
Joe.Analysis.runs.yara Boolean The YARA.
Joe.Analysis.score Number The score.
Joe.Analysis.scriptname String The script name.
Joe.Analysis.status String The status.
Joe.Analysis.threatname String The threat name.
Joe.Analysis.time Date The time.
Joe.Analysis.webid String The web ID.
Joe.Submission.most_relevant_analysis.detection String The detection.
Joe.Submission.most_relevant_analysis.score Number The score.
Joe.Submission.most_relevant_analysis.webid String The web ID.
Joe.Submission.name String The name.
Joe.Submission.status String The status.
Joe.Submission.submission_id String The submission ID.
Joe.Submission.time Date The time.

Command example

!joe-submit-sample entry_id=1111@1111111111-1111-1111-1111-1 systems=w10x64

Context Example

{
    "DBotScore": [
        {
            "Indicator": "example.txt",
            "Reliability": "C - Fairly reliable",
            "Score": 1,
            "Type": "file",
            "Vendor": "JoeSecurityV2"
        }
    ],
    "File": [
        {
            "Hashes": [
                {
                    "type": "MD5",
                    "value": "11111111111111111111111111111111"
                },
                {
                    "type": "SHA1",
                    "value": "1111111111111111111111111111111111111111"
                },
                {
                    "type": "SHA256",
                    "value": "1111111111111111111111111111111111111111111111111111111111111111"
                }
            ],
            "MD5": "11111111111111111111111111111111",
            "Name": "example.txt",
            "SHA1": "1111111111111111111111111111111111111111",
            "SHA256": "1111111111111111111111111111111111111111111111111111111111111111"
        }
    ],
    "Joe": {
        "Analysis": [
            {
                "analysisid": "1",
                "classification": "",
                "comments": "example comment",
                "detection": "clean",
                "duration": 500,
                "encrypted": false,
                "filename": "example.txt",
                "md5": "11111111111111111111111111111111",
                "runs": [
                    {
                        "detection": "clean",
                        "error": null,
                        "score": 1,
                        "sigma": false,
                        "snort": false,
                        "system": "w10x64",
                        "yara": false
                    }
                ],
                "score": 1,
                "scriptname": "example.jbs",
                "sha1": "1111111111111111111111111111111111111111",
                "sha256": "1111111111111111111111111111111111111111111111111111111111111111",
                "status": "finished",
                "tags": [],
                "threatname": "Unknown",
                "time": "2022-09-15T10:57:20+02:00",
                "webid": "1"
            }
        ],
        "Submission": {
            "most_relevant_analysis": {
                "detection": "clean",
                "score": 1,
                "webid": "1"
            },
            "name": "example.txt",
            "status": "finished",
            "submission_id": "1111111",
            "time": "2022-09-15T10:57:14+02:00"
        }
    }
}

Human Readable Output

Submission Results

Submission Id Sample Name Time Status Web Id Encrypted Analysis Id Classification Threat Name Score Detection SHA256 MD5 SHA1 File Name
1 example.zip 2022-09-15T10:57:14+02:00 finished 1 false 1   Unknown 1 clean 1111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111 1111111111111111111111111111111111111111 example.txt

joe-submit-url

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

joe-submit-url

Input

Argument Name Description Required
url The URL to submit. Required
url_reputation The URL reputation. Possible values are: true, false. Default is false. Optional
full_display When set to true, indicators information, including their DBot Scores, will be displayed. Possible values are: true, false. Default is true. Optional
timeout The timeout for the polling in seconds. Default is 1200. Optional
hide_polling_output Hide polling output. Optional
report_type The report type. Possible values are: html, json, pcap, pdf, xml, iocjson. Default is html. Optional
comments A comment to be added to the analysis. Optional
tags A comma-separated list of tags to be added to the analysis. Optional
systems A comma-separated list of operating systems to be used for the analysis. Possible values are: w7, w7x64, w7_1, w7_2, w7_4, w7_5, w7native, android2, android3, mac1, w7l, w7x64l, w10, android4, w7x64native, w7_3, w10native, android5native_1, w10x64, w7x64_hvm, android6, iphone1, w7_sec, macvm, w7_lang_packs, w7x64native_hvm, lnxubuntu1, lnxcentos1, android7_nougat. Optional
internet_access Whether to allow internet access for the analysis. Default is true. Optional
archive_no_unpack Whether to archive the sample without unpacking it. Default is false. Optional
ssl_inspection Whether to enable SSL inspection. Default is false. Optional
localized_internet_country The localized internet anonymization country. Optional
internet_simulation Whether to enable internet simulation. Default is false. Optional
hybrid_code_analysis Whether to enable hybrid code analysis. Default is false. Optional
hybrid_decompilation Whether to enable hybrid decompilation. Default is false. Optional
vba_instrumentation Whether to enable VBA instrumentation. Default is true. Optional
js_instrumentation Whether to enable JS instrumentation. Default is true. Optional
java_jar_tracing Whether to enable Java JAR tracing. Default is true. Optional
dotnet_tracing Whether to enable .NET tracing. Default is true. Optional
amsi_unpacking Whether to enable Microsoft Antimalware Scan Interface unpacking. Default is true. Optional
fast_mode Whether to enable fast mode, focuses on fast analysis and detection versus deep forensic analysis. Default is false. Optional
secondary_results Whether to enable secondary results, such as Yara rule generation, classification via Joe Sandbox Class as well as several detail reports. Default is false. Optional
report_cache Whether to enable report cache. Default is false. Optional
command_line_argument A command line argument to be passed to the sample. Optional
live_interaction Whether to enable live interaction. Default is false. Optional
document_password The document password. Optional
archive_password The archive password. Optional
start_as_normal_user Whether to start the analysis as a normal user. Default is false. Optional
language_and_locale Changes the language and locale of the analysis machine. Optional
delete_after_days The number of days after which the analysis will be deleted. Default is 30. Optional
encrypt_with_password The password to encrypt the analysis with. Optional
export_to_jbxview Whether to export the analysis to JBXView. Default is false. Optional
email_notification Send an email notification once the analysis completes. Default is false. Optional

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String The reliability of the source providing the intelligence data.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
URL.Data String The URL.
Joe.Analysis.AnalysisID String The analysis ID.
Joe.Analysis.Classification String The classification.
Joe.Analysis.Comments String The comments.
Joe.Analysis.detection String The detection.
Joe.Analysis.duration Number The duration.
Joe.Analysis.encrypted Boolean Whether the analysis is encrypted.
Joe.Analysis.filename String The filename.
Joe.Analysis.runs.detection String The detection.
Joe.Analysis.runs.error Unknown The error.
Joe.Analysis.runs.score Number The score.
Joe.Analysis.runs.sigma Boolean The sigma.
Joe.Analysis.runs.snort Boolean The snort.
Joe.Analysis.runs.system String The system.
Joe.Analysis.runs.yara Boolean The YARA.
Joe.Analysis.score Number The score.
Joe.Analysis.scriptname String The script name.
Joe.Analysis.status String The status.
Joe.Analysis.threatname String The threat name.
Joe.Analysis.time Date The time.
Joe.Analysis.webid String The web ID.
Joe.Submission.most_relevant_analysis.detection String The detection.
Joe.Submission.most_relevant_analysis.score Number The score.
Joe.Submission.most_relevant_analysis.webid String The web ID.
Joe.Submission.name String The name.
Joe.Submission.status String The status.
Joe.Submission.submission_id String The submission ID.
Joe.Submission.time Date The time.

Command example

!joe-submit-url url=http://example.com

Context Example

{
  "DBotScore": [
    {
      "Indicator": "example.txt",
      "Reliability": "C - Fairly reliable",
      "Score": 1,
      "Type": "url",
      "Vendor": "JoeSecurityV2"
    }
  ],
  "URL": [
    {
      "Data": "http://example.com"
    }
  ],
  "Joe": {
    "Analysis": [
      {
        "analysisid": "1",
        "classification": "",
        "comments": "example comment",
        "detection": "clean",
        "duration": 500,
        "encrypted": false,
        "filename": "http://example.com",
        "md5": "",
        "runs": [
          {
            "detection": "clean",
            "error": null,
            "score": 0,
            "sigma": false,
            "snort": false,
            "system": "w7",
            "yara": false
          }
        ],
        "score": 1,
        "scriptname": "example.jbs",
        "sha1": "",
        "sha256": "",
        "status": "finished",
        "tags": [],
        "threatname": "Unknown",
        "time": "2022-09-15T10:57:20+02:00",
        "webid": "1"
      }
    ],
    "Submission": {
      "most_relevant_analysis": {
        "detection": "clean",
        "score": 0,
        "webid": "1"
      },
      "name": "http://example.com",
      "status": "finished",
      "submission_id": "1111111",
      "time": "2022-09-15T10:57:14+02:00"
    }
  }
}

Human Readable Output

Submission Results

Submission Id Sample Name Time Status Web Id Encrypted Analysis Id Classification Threat Name Score Detection URL
1 http://example.com 2022-09-15T10:57:14+02:00 finished 1 false 1   Unknown 1 clean http://example.com

Breaking Changes

Commands

The following commands were removed in this version

  • joe-analysis-submit-sample - this command was replaced by joe-submit-sample.
  • joe-analysis-submit-url - this command was replaced by joe-submit-url.
  • joe-search command, the query argument now supports comma-separated values.

Playbooks

The following playbooks were deprecated

Detonate File - JoeSecurity - Use the joe-submit-sample command instead.
Detonate File From URL - JoeSecurity - Use the joe-submit-sample command instead.
Detonate URL - JoeSecurity - Use the joe-submit-url command instead.

Configuration parameters

  • url — Server URL (required)
  • credentials — (required)
  • Reliability — Source Reliability
  • onprem — On-Premise
  • create_relationships — Create relationships
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (14)

  • file

    Retrieves files information from Joe Security.

  • joe-analysis-info

    Get information about an analysis.

  • joe-download-report

    Download a resource belonging to a report. This can be the full report, dropped binaries, etc. See the integration README for the full list of supported report types.

  • joe-download-sample

    Download a sample.

  • joe-get-account-quota

    Retrieve the account quota.

  • joe-is-online

    Check if the Joe Sandbox analysis backend is online or in maintenance mode.

  • joe-list-analysis

    Lists all analyses.

  • joe-list-lang-locales

    Retrieve a list of available language and locale combinations.

  • joe-list–lia-countries

    Retrieve a list of localized internet anonymization countries.

  • joe-search

    Search through all analyses.

  • joe-submission-info

    Retrieve the submission info.

  • joe-submit-sample

    Submit a sample for sandbox analysis.

  • joe-submit-url

    Submit an URL for sandbox analysis.

  • url

    Retrieves URL information from Joe Security.

Source

JoeSecurityV2.py JoeSecurityV2_test.py JoeSecurityV2.yml JoeSecurityV2_description.md command_examples.txt
Download History Raw 
category: Forensics & Malware Analysis
provider: Joe Security GmbH
sectionorder:
- Connect
- Collect
commonfields:
  id: JoeSecurityV2
  version: -1
configuration:
- name: url
  display: Server URL
  required: true
  defaultvalue: https://jbxcloud.joesecurity.org
  type: 0
  section: Connect
- name: credentials
  displaypassword: API Key
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- name: Reliability
  additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  section: Collect
  required: false
  type: 15
- name: onprem
  display: On-Premise
  type: 8
  additionalinfo: Only use Features that are available in On-Premise installations
  required: false
  section: Connect
  defaultvalue: 'false'
- name: create_relationships
  display: Create relationships
  type: 8
  additionalinfo: Create relationships between indicators as part of enrichment.
  required: false
  section: Collect
- name: insecure
  display: Trust any certificate (not secure)
  type: 8
  additionalinfo:
  required: false
  section: Connect
- name: proxy
  display: Use system proxy settings
  type: 8
  additionalinfo:
  required: false
  section: Connect
description: Access the full set of possibilities the JoeSandbox Cloud provides via the RESTful Web API v2.
display: Joe Security v2
name: JoeSecurityV2
script:
  commands:
  - name: joe-is-online
    description: Check if the Joe Sandbox analysis backend is online or in maintenance mode.
    arguments: []
    outputs:
    - contextPath: Joe.ServerStatus.Online
      description: The server status.
      type: Boolean
  - name: joe-analysis-info
    description: Get information about an analysis.
    arguments:
    - name: webid
      description: The analysis ID.
      required: true
    - name: full_display
      description: When set to true, indicators information, including their DBot Scores, will be displayed.
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: The reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: File.Hashes.type
      description: The hash type.
      type: String
    - contextPath: File.Hashes.value
      description: The hash value.
      type: String
    - contextPath: File.Name
      description: The full file name.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: Joe.Analysis.AnalysisID
      description: The analysis ID from Joe Security.
      type: String
    - contextPath: Joe.Analysis.Classification
      description: The classification of the analysis.
      type: String
    - contextPath: Joe.Analysis.Comments
      description: Comments regarding the analysis.
      type: String
    - contextPath: Joe.Analysis.detection
      description: The analysis detection. Can be one of unknown, clean, suspicious, malicious.
      type: String
    - contextPath: Joe.Analysis.duration
      description: The duration of the analysis in seconds.
      type: Number
    - contextPath: Joe.Analysis.encrypted
      description: True if the analysis data is encrypted.
      type: Boolean
    - contextPath: Joe.Analysis.filename
      description: The file name of the analysis.
      type: String
    - contextPath: Joe.Analysis.md5
      description: The file MD5.
      type: String
    - contextPath: Joe.Analysis.runs.detection
      description: The run detection. Can be one of unknown, clean, suspicious, malicious.
      type: String
    - contextPath: Joe.Analysis.runs.error
      description: The run errors.
      type: Unknown
    - contextPath: Joe.Analysis.runs.score
      description: The run score.
      type: Number
    - contextPath: Joe.Analysis.runs.sigma
      description: The run sigma.
      type: Boolean
    - contextPath: Joe.Analysis.runs.snort
      description: The run snort.
      type: Boolean
    - contextPath: Joe.Analysis.runs.system
      description: The run operation system.
      type: String
    - contextPath: Joe.Analysis.runs.yara
      description: The run YARA.
      type: Boolean
    - contextPath: Joe.Analysis.score
      description: The run score.
      type: Number
    - contextPath: Joe.Analysis.scriptname
      description: The run script name.
      type: String
    - contextPath: Joe.Analysis.sha1
      description: The file SHA1.
      type: String
    - contextPath: Joe.Analysis.sha256
      description: The file SHA256.
      type: String
    - contextPath: Joe.Analysis.status
      description: The status is one of submitted, running, finished.
      type: String
    - contextPath: Joe.Analysis.threatname
      description: The analysis threat name.
      type: String
    - contextPath: Joe.Analysis.time
      description: The analysis time.
      type: Date
    - contextPath: Joe.Analysis.webid
      description: The web ID from Joe Security.
      type: String
  - name: joe-list-analysis
    description: Lists all analyses.
    arguments:
    - name: page
      description: Page number to display.
    - name: page_size
      description: Determine how many entries to display on each page.
    - name: limit
      description: Limit the number of entries to display.
      defaultValue: '50'
    - name: full_display
      description: When set to true, indicators information, including their DBot Scores, will be displayed.
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: The reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: File.Hashes.type
      description: The hash type.
      type: String
    - contextPath: File.Hashes.value
      description: The hash value.
      type: String
    - contextPath: File.Name
      description: The full file name.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: Joe.Analysis.AnalysisID
      description: The analysis ID.
      type: String
    - contextPath: Joe.Analysis.Classification
      description: The classification of the analysis.
      type: String
    - contextPath: Joe.Analysis.Comments
      description: Comments regarding the analysis.
      type: String
    - contextPath: Joe.Analysis.detection
      description: The analysis detection. Can be one of unknown, clean, suspicious, malicious.
      type: String
    - contextPath: Joe.Analysis.duration
      description: The duration of the analysis in seconds.
      type: Number
    - contextPath: Joe.Analysis.encrypted
      description: True if the analysis data is encrypted.
      type: Boolean
    - contextPath: Joe.Analysis.filename
      description: The file name of the analysis.
      type: String
    - contextPath: Joe.Analysis.md5
      description: The file MD5.
      type: String
    - contextPath: Joe.Analysis.runs.detection
      description: The run detection. Can be one of unknown, clean, suspicious, malicious.
      type: String
    - contextPath: Joe.Analysis.runs.error
      description: The run errors.
      type: Unknown
    - contextPath: Joe.Analysis.runs.score
      description: The run score.
      type: Number
    - contextPath: Joe.Analysis.runs.sigma
      description: The run sigma.
      type: Boolean
    - contextPath: Joe.Analysis.runs.snort
      description: The run snort.
      type: Boolean
    - contextPath: Joe.Analysis.runs.system
      description: The run operation system.
      type: String
    - contextPath: Joe.Analysis.runs.yara
      description: The run YARA.
      type: Boolean
    - contextPath: Joe.Analysis.score
      description: The run score.
      type: Number
    - contextPath: Joe.Analysis.scriptname
      description: The run script name.
      type: String
    - contextPath: Joe.Analysis.sha1
      description: The file SHA1.
      type: String
    - contextPath: Joe.Analysis.sha256
      description: The file SHA256.
      type: String
    - contextPath: Joe.Analysis.status
      description: The status is one of submitted, running, finished.
      type: String
    - contextPath: Joe.Analysis.threatname
      description: The analysis threat name.
      type: String
    - contextPath: Joe.Analysis.time
      description: The analysis time.
      type: Date
    - contextPath: Joe.Analysis.webid
      description: The web ID from Joe Security.
      type: String
  - name: joe-download-report
    arguments:
    - name: webid
      default: true
      description: Web ID.
      required: true
    - name: type
      defaultValue: html
      description: The resource type to download.
      auto: PREDEFINED
      predefined:
      - html
      - json
      - pcap
      - pdf
      - xml
      - iocjson
    description: Download a resource belonging to a report. This can be the full report, dropped binaries, etc. See the integration README for the full list of supported report types.
    outputs:
    - contextPath: InfoFile.Name
      description: The filename.
      type: string
    - contextPath: InfoFile.EntryID
      description: The entry ID of the report.
      type: string
    - contextPath: InfoFile.Size
      description: File size.
      type: number
    - contextPath: InfoFile.Type
      description: File type, e.g., "PE".
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file.
      type: string
    - contextPath: File.Extension
      description: File extension.
      type: string
  - name: joe-download-sample
    arguments:
    - name: webid
      default: true
      description: Web ID.
      required: true
    description: Download a sample.
    outputs:
    - contextPath: File.Size
      description: File size.
      type: number
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: File.Name
      description: The sample name.
      type: string
    - contextPath: File.SSDeep
      description: SSDeep hash of the file.
      type: string
    - contextPath: File.EntryID
      description: War Room entry ID of the file.
      type: string
    - contextPath: File.Info
      description: Basic information of the file.
      type: string
    - contextPath: File.Type
      description: File type, e.g., "PE".
      type: string
    - contextPath: File MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.Extension
      description: File extension.
      type: string
  - name: joe-search
    arguments:
    - name: query
      description: 'Search string which will search in the following fields only: md5, sha1, sha256, filename, URL, comments.'
      required: true
    - name: full_display
      description: When set to true, indicators information, including their DBot Scores, will be displayed.
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    description: Search through all analyses.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: The reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: File.Hashes.type
      description: The hash type.
      type: String
    - contextPath: File.Hashes.value
      description: The hash value.
      type: String
    - contextPath: File.Name
      description: The full file name.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: Joe.Analysis.AnalysisID
      description: The analysis ID.
      type: String
    - contextPath: Joe.Analysis.Classification
      description: The classification of the analysis.
      type: String
    - contextPath: Joe.Analysis.Comments
      description: Comments regarding the analysis.
      type: String
    - contextPath: Joe.Analysis.detection
      description: The analysis detection. Can be one of unknown, clean, suspicious, malicious.
      type: String
    - contextPath: Joe.Analysis.duration
      description: The duration of the analysis in seconds.
      type: Number
    - contextPath: Joe.Analysis.encrypted
      description: True if the analysis data is encrypted.
      type: Boolean
    - contextPath: Joe.Analysis.filename
      description: The file name of the analysis.
      type: String
    - contextPath: Joe.Analysis.md5
      description: The file MD5.
      type: String
    - contextPath: Joe.Analysis.runs.detection
      description: The run detection. Can be one of unknown, clean, suspicious, malicious.
      type: String
    - contextPath: Joe.Analysis.runs.error
      description: The run errors.
      type: Unknown
    - contextPath: Joe.Analysis.runs.score
      description: The run score.
      type: Number
    - contextPath: Joe.Analysis.runs.sigma
      description: The run sigma.
      type: Boolean
    - contextPath: Joe.Analysis.runs.snort
      description: The run snort.
      type: Boolean
    - contextPath: Joe.Analysis.runs.system
      description: The run operation system.
      type: String
    - contextPath: Joe.Analysis.runs.yara
      description: The run YARA.
      type: Boolean
    - contextPath: Joe.Analysis.score
      description: The run score.
      type: Number
    - contextPath: Joe.Analysis.scriptname
      description: The run script name.
      type: String
    - contextPath: Joe.Analysis.sha1
      description: The file SHA1.
      type: String
    - contextPath: Joe.Analysis.sha256
      description: The file SHA256.
      type: String
    - contextPath: Joe.Analysis.status
      description: The status is one of submitted, running, finished.
      type: String
    - contextPath: Joe.Analysis.threatname
      description: The analysis threat name.
      type: String
    - contextPath: Joe.Analysis.time
      description: The analysis time.
      type: Date
    - contextPath: Joe.Analysis.webid
      description: The web ID from Joe Security.
      type: String
  - name: file
    arguments:
    - name: file
      isArray: true
      description: 'A comma-separated list of file names, SHA1, SHA256, or MD5 hashes.'
      required: true
      default: true
    description: Retrieves files information from Joe Security.
    outputs:
    - contextPath: File.Name
      description: Name of the file.
      type: String
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: String
    - contextPath: File.Tags
      description: Tags of the file.
      type: String
    - contextPath: File.Name
      description: Name of the file.
      type: String
    - contextPath: Joe.File.MD5
      description: MD5 hash of the file.
      type: String
    - contextPath: Joe.File.SHA1
      description: SHA1 hash of the file.
      type: String
    - contextPath: Joe.File.SHA256
      description: SHA256 hash of the file.
      type: String
    - contextPath: Joe.File.Tags
      description: Tags of the file.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
  - name: url
    arguments:
    - name: url
      isArray: true
      description: A comma-separated list of URLs.
      required: true
    description: Retrieves URL information from Joe Security.
    outputs:
    - contextPath: URL.Data
      description: The URL data.
      type: String
    - contextPath: Joe.URL.Name
      description: Name of the URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
  - name: joe-list–lia-countries
    arguments: []
    description: Retrieve a list of localized internet anonymization countries.
    outputs:
    - contextPath: Joe.LIACountry
      description: A list of localized internet anonymization countries.
      type: String
  - name: joe-list-lang-locales
    arguments: []
    description: Retrieve a list of available language and locale combinations.
    outputs:
    - contextPath: Joe.LangLocale
      description: A list of available language and locale combinations.
      type: String
  - name: joe-get-account-quota
    arguments: []
    description: Retrieve the account quota.
    outputs:
    - contextPath: Joe.AccountQuota
      description: The account quota.
      type: String
    - contextPath: Joe.AccountQuota.quota.daily.current
      description: The current daily quota.
      type: Number
    - contextPath: Joe.AccountQuota.quota.daily.limit
      description: The daily quota limit.
      type: Number
    - contextPath: Joe.AccountQuota.quota.daily.remaining
      description: The remaining daily quota.
      type: Number
    - contextPath: Joe.AccountQuota.quota.monthly.current
      description: The current monthly quota.
      type: Number
    - contextPath: Joe.AccountQuota.quota.monthly.limit
      description: The monthly quota limit.
      type: Number
    - contextPath: Joe.AccountQuota.quota.monthly.remaining
      description: The remaining monthly quota.
      type: Number
    - contextPath: Joe.AccountQuota.type
      description: The quota type.
      type: String
  - name: joe-submission-info
    arguments:
    - name: submission_ids
      description: A comma-separated list of submission IDs.
      required: true
    - name: full_display
      description: When set to true, indicators information, including their DBot Scores, will be displayed.
      defaultValue: "true"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    description: Retrieve the submission info.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: The reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: File.Hashes.type
      description: The hash type.
      type: String
    - contextPath: File.Hashes.value
      description: The hash value.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Name
      description: The full file name.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: Joe.Analysis.AnalysisID
      description: The analysis ID.
      type: String
    - contextPath: Joe.Analysis.Classification
      description: The classification.
      type: String
    - contextPath: Joe.Analysis.Comments
      description: The comments.
      type: String
    - contextPath: Joe.Analysis.detection
      description: The detection.
      type: String
    - contextPath: Joe.Analysis.duration
      description: The duration.
      type: Number
    - contextPath: Joe.Analysis.encrypted
      description: True if the analysis data is encrypted.
      type: Boolean
    - contextPath: Joe.Analysis.filename
      description: The filename.
      type: String
    - contextPath: Joe.Analysis.runs.detection
      description: The detection.
      type: String
    - contextPath: Joe.Analysis.runs.error
      description: The error.
      type: Unknown
    - contextPath: Joe.Analysis.runs.score
      description: The score.
      type: Number
    - contextPath: Joe.Analysis.runs.sigma
      description: The sigma.
      type: Boolean
    - contextPath: Joe.Analysis.runs.snort
      description: The snort.
      type: Boolean
    - contextPath: Joe.Analysis.runs.system
      description: The system.
      type: String
    - contextPath: Joe.Analysis.runs.yara
      description: The YARA.
      type: Boolean
    - contextPath: Joe.Analysis.score
      description: The score.
      type: Number
    - contextPath: Joe.Analysis.scriptname
      description: The script name.
      type: String
    - contextPath: Joe.Analysis.status
      description: The status.
      type: String
    - contextPath: Joe.Analysis.threatname
      description: The threat name.
      type: String
    - contextPath: Joe.Analysis.time
      description: The time.
      type: Date
    - contextPath: Joe.Analysis.webid
      description: The web ID.
      type: String
    - contextPath: Joe.Submission.most_relevant_analysis.detection
      description: The detection.
      type: String
    - contextPath: Joe.Submission.most_relevant_analysis.score
      description: The score.
      type: Number
    - contextPath: Joe.Submission.most_relevant_analysis.webid
      description: The web ID.
      type: String
    - contextPath: Joe.Submission.name
      description: The name.
      type: String
    - contextPath: Joe.Submission.status
      description: The status.
      type: String
    - contextPath: Joe.Submission.submission_id
      description: The submission ID.
      type: String
    - contextPath: Joe.Submission.time
      description: The time.
      type: Date
  - name: joe-submit-sample
    arguments:
    - name: submission_id
      description: The submission ID.
      deprecated: true
    - name: entry_id
      description: The War Room entry ID of the file to submit.
      required: true
    - name: file_name
      description: The filename of the submitted sample.
    - name: full_display
      description: When is set to true, indicators information, including their DBot Scores, will be displayed.
      defaultValue: "true"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - name: timeout
      description: The timeout for the polling in seconds.
      defaultValue: "1200"
    - name: interval_in_seconds
      description: The timeout for the interval in seconds.
      defaultValue: "45"
    - name: hide_polling_output
      description: Hide polling output.
      deprecated: true
    - name: report_type
      description: The report type.
      auto: PREDEFINED
      predefined:
      - html
      - json
      - pcap
      - pdf
      - xml
      - iocjson
      defaultValue: 'html'
    - name: cookbook
      description: Uploads a cookbook together with the sample. Needs to be a file-like object or a tuple in the shape (filename, file-like object).
    - name: comments
      description: A comment to be added to the analysis.
    - name: tags
      description: A comma-separated list of tags to be added to the analysis.
    - name: systems
      description: A comma-separated list of operating systems to be used for the analysis.
      auto: PREDEFINED
      predefined:
      - w7
      - w7x64
      - w7_1
      - w7_2
      - w7_4
      - w7_5
      - w7native
      - android2
      - android3
      - mac1
      - w7l
      - w7x64l
      - w10
      - android4
      - w7x64native
      - w7_3
      - w10native
      - android5native_1
      - w10x64
      - w7x64_hvm
      - android6
      - iphone1
      - w7_sec
      - macvm
      - w7_lang_packs
      - w7x64native_hvm
      - lnxubuntu1
      - lnxcentos1
      - android7_nougat
    - name: internet_access
      description: Whether to allow internet access for the analysis.
      defaultValue: 'true'
    - name: archive_no_unpack
      description: Whether to archive the sample without unpacking it.
      defaultValue: 'false'
    - name: ssl_inspection
      description: Whether to enable SSL inspection.
      defaultValue: 'false'
    - name: localized_internet_country
      description: The localized internet anonymization country.
    - name: internet_simulation
      description: Whether to enable internet simulation.
      defaultValue: 'false'
    - name: hybrid_code_analysis
      description: Whether to enable hybrid code analysis.
      defaultValue: 'true'
    - name: hybrid_decompilation
      description: Whether to enable hybrid decompilation.
      defaultValue: 'false'
    - name: vba_instrumentation
      description: Whether to enable VBA instrumentation.
      defaultValue: 'true'
    - name: js_instrumentation
      description: Whether to enable JS instrumentation.
      defaultValue: 'true'
    - name: java_jar_tracing
      description: Whether to enable Java JAR tracing.
      defaultValue: 'true'
    - name: dotnet_tracing
      description: Whether to enable .NET tracing.
      defaultValue: 'true'
    - name: amsi_unpacking
      description: Whether to enable Microsoft Antimalware Scan Interface unpacking.
      defaultValue: 'true'
    - name: fast_mode
      description: Whether to enable fast mode. It focuses on fast analysis and detection versus deep forensic analysis.
      defaultValue: 'false'
    - name: secondary_results
      description: Whether to enable secondary results, such as YARA rule generation, classification via Joe Sandbox Class as well as several detail reports.
      defaultValue: 'false'
    - name: report_cache
      description: Whether to enable report cache.
      defaultValue: 'false'
    - name: command_line_argument
      description: A command line argument to be passed to the sample.
    - name: live_interaction
      description: Whether to enable live interaction.
      defaultValue: 'false'
    - name: document_password
      description: The document password.
    - name: archive_password
      description: The archive password.
    - name: start_as_normal_user
      description: Whether to start the analysis as a normal user.
      defaultValue: 'false'
    - name: language_and_locale
      description: Changes the language and locale of the analysis machine.
    - name: delete_after_days
      description: The number of days after which the analysis will be deleted.
      defaultValue: '30'
    - name: encrypt_with_password
      description: The password with which to encrypt the analysis.
    - name: export_to_jbxview
      description: Whether to export the analysis to JBXView.
      defaultValue: 'false'
      deprecated: true
    - name: email_notification
      description: Send an email notification once the analysis completes.
      defaultValue: 'false'
    description: Submit a sample for sandbox analysis.
    polling: true
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: The reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: File.Hashes.type
      description: The hash type.
      type: String
    - contextPath: File.Hashes.value
      description: The hash value.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Name
      description: The full file name.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: Joe.Analysis.AnalysisID
      description: The analysis ID.
      type: String
    - contextPath: Joe.Analysis.Classification
      description: The classification.
      type: String
    - contextPath: Joe.Analysis.Comments
      description: The comments.
      type: String
    - contextPath: Joe.Analysis.detection
      description: The detection.
      type: String
    - contextPath: Joe.Analysis.duration
      description: The duration.
      type: Number
    - contextPath: Joe.Analysis.encrypted
      description: True if the analysis data is encrypted.
      type: Boolean
    - contextPath: Joe.Analysis.filename
      description: The filename.
      type: String
    - contextPath: Joe.Analysis.runs.detection
      description: The detection.
      type: String
    - contextPath: Joe.Analysis.runs.error
      description: The error.
      type: Unknown
    - contextPath: Joe.Analysis.runs.score
      description: The score.
      type: Number
    - contextPath: Joe.Analysis.runs.sigma
      description: The sigma.
      type: Boolean
    - contextPath: Joe.Analysis.runs.snort
      description: The snort.
      type: Boolean
    - contextPath: Joe.Analysis.runs.system
      description: The system.
      type: String
    - contextPath: Joe.Analysis.runs.yara
      description: The YARA.
      type: Boolean
    - contextPath: Joe.Analysis.score
      description: The score.
      type: Number
    - contextPath: Joe.Analysis.scriptname
      description: The script name.
      type: String
    - contextPath: Joe.Analysis.status
      description: The status.
      type: String
    - contextPath: Joe.Analysis.threatname
      description: The threat name.
      type: String
    - contextPath: Joe.Analysis.time
      description: The time.
      type: Date
    - contextPath: Joe.Analysis.webid
      description: The web ID.
      type: String
    - contextPath: Joe.Submission.most_relevant_analysis.detection
      description: The detection.
      type: String
    - contextPath: Joe.Submission.most_relevant_analysis.score
      description: The score.
      type: Number
    - contextPath: Joe.Submission.most_relevant_analysis.webid
      description: The web ID.
      type: String
    - contextPath: Joe.Submission.name
      description: The name.
      type: String
    - contextPath: Joe.Submission.status
      description: The status.
      type: String
    - contextPath: Joe.Submission.submission_id
      description: The submission ID.
      type: String
    - contextPath: Joe.Submission.time
      description: The time.
      type: Date
  - name: joe-submit-url
    arguments:
    - name: submission_id
      description: The submission ID.
      deprecated: true
    - name: url
      description: The URL to submit.
      required: true
    - name: url_reputation
      description: The URL reputation.
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - name: full_display
      description: When set to true. indicators information, including their DBot Scores, will be displayed.
      defaultValue: "true"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - name: timeout
      description: The timeout for the polling in seconds.
      defaultValue: "1200"
    - name: hide_polling_output
      description: Hide polling output.
      deprecated: true
    - name: report_type
      description: The report type.
      auto: PREDEFINED
      predefined:
      - html
      - json
      - pcap
      - pdf
      - xml
      - iocjson
      defaultValue: 'html'
    - name: comments
      description: A comment to be added to the analysis.
    - name: tags
      description: A comma-separated list of tags to be added to the analysis.
    - name: systems
      description: A comma-separated list of operating systems to be used for the analysis.
      auto: PREDEFINED
      predefined:
      - w7
      - w7x64
      - w7_1
      - w7_2
      - w7_4
      - w7_5
      - w7native
      - android2
      - android3
      - mac1
      - w7l
      - w7x64l
      - w10
      - android4
      - w7x64native
      - w7_3
      - w10native
      - android5native_1
      - w10x64
      - w7x64_hvm
      - android6
      - iphone1
      - w7_sec
      - macvm
      - w7_lang_packs
      - w7x64native_hvm
      - lnxubuntu1
      - lnxcentos1
      - android7_nougat
    - name: internet_access
      description: Whether to allow internet access for the analysis.
      defaultValue: 'true'
    - name: archive_no_unpack
      description: Whether to archive the sample without unpacking it.
      defaultValue: 'false'
    - name: ssl_inspection
      description: Whether to enable SSL inspection.
      defaultValue: 'false'
    - name: localized_internet_country
      description: The localized internet anonymization country.
    - name: internet_simulation
      description: Whether to enable internet simulation.
      defaultValue: 'false'
    - name: hybrid_code_analysis
      description: Whether to enable hybrid code analysis.
      defaultValue: 'false'
    - name: hybrid_decompilation
      description: Whether to enable hybrid decompilation.
      defaultValue: 'false'
    - name: vba_instrumentation
      description: Whether to enable VBA instrumentation.
      defaultValue: 'true'
    - name: js_instrumentation
      description: Whether to enable JS instrumentation.
      defaultValue: 'true'
    - name: java_jar_tracing
      description: Whether to enable Java JAR tracing.
      defaultValue: 'true'
    - name: dotnet_tracing
      description: Whether to enable .NET tracing.
      defaultValue: 'true'
    - name: amsi_unpacking
      description: Whether to enable Microsoft Antimalware Scan Interface unpacking.
      defaultValue: 'true'
    - name: fast_mode
      description: Whether to enable fast mode. It focuses on fast analysis and detection versus deep forensic analysis.
      defaultValue: 'false'
    - name: secondary_results
      description: Whether to enable secondary results, such as YARA rule generation, classification via Joe Sandbox Class as well as several detail reports.
      defaultValue: 'false'
    - name: report_cache
      description: Whether to enable report cache.
      defaultValue: 'false'
    - name: command_line_argument
      description: A command line argument to be passed to the sample.
    - name: live_interaction
      description: Whether to enable live interaction.
      defaultValue: 'false'
    - name: document_password
      description: The document password.
    - name: archive_password
      description: The archive password.
    - name: start_as_normal_user
      description: Whether to start the analysis as a normal user.
      defaultValue: 'false'
    - name: language_and_locale
      description: Changes the language and locale of the analysis machine.
    - name: delete_after_days
      description: The number of days after which the analysis will be deleted.
      defaultValue: '30'
    - name: encrypt_with_password
      description: The password with which to encrypt the analysis.
    - name: export_to_jbxview
      description: Whether to export the analysis to JBXView.
      defaultValue: 'false'
      deprecated: true
    - name: email_notification
      description: Send an email notification once the analysis completes.
      defaultValue: 'false'
    description: Submit an URL for sandbox analysis.
    polling: true
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: The reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: Joe.Analysis.AnalysisID
      description: The analysis ID.
      type: String
    - contextPath: Joe.Analysis.Classification
      description: The classification.
      type: String
    - contextPath: Joe.Analysis.Comments
      description: The comments.
      type: String
    - contextPath: Joe.Analysis.detection
      description: The detection.
      type: String
    - contextPath: Joe.Analysis.duration
      description: The duration.
      type: Number
    - contextPath: Joe.Analysis.encrypted
      description: True if the analysis data is encrypted.
      type: Boolean
    - contextPath: Joe.Analysis.filename
      description: The filename.
      type: String
    - contextPath: Joe.Analysis.runs.detection
      description: The detection.
      type: String
    - contextPath: Joe.Analysis.runs.error
      description: The error.
      type: Unknown
    - contextPath: Joe.Analysis.runs.score
      description: The score.
      type: Number
    - contextPath: Joe.Analysis.runs.sigma
      description: The sigma.
      type: Boolean
    - contextPath: Joe.Analysis.runs.snort
      description: The snort.
      type: Boolean
    - contextPath: Joe.Analysis.runs.system
      description: The system.
      type: String
    - contextPath: Joe.Analysis.runs.yara
      description: The YARA.
      type: Boolean
    - contextPath: Joe.Analysis.score
      description: The score.
      type: Number
    - contextPath: Joe.Analysis.scriptname
      description: The script name.
      type: String
    - contextPath: Joe.Analysis.status
      description: The status.
      type: String
    - contextPath: Joe.Analysis.threatname
      description: The threat name.
      type: String
    - contextPath: Joe.Analysis.time
      description: The time.
      type: Date
    - contextPath: Joe.Analysis.webid
      description: The web ID.
      type: String
    - contextPath: Joe.Submission.most_relevant_analysis.detection
      description: The detection.
      type: String
    - contextPath: Joe.Submission.most_relevant_analysis.score
      description: The score.
      type: Number
    - contextPath: Joe.Submission.most_relevant_analysis.webid
      description: The web ID.
      type: String
    - contextPath: Joe.Submission.name
      description: The name.
      type: String
    - contextPath: Joe.Submission.status
      description: The status.
      type: String
    - contextPath: Joe.Submission.submission_id
      description: The submission ID.
      type: String
    - contextPath: Joe.Submission.time
      description: The time.
      type: Date
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/vendors-sdk:1.0.0.10120494
fromversion: 6.8.0
tests:
- testplaybook-JoeSecuirtyV2