MetaDefender Sandbox

Details

ID	`MetaDefender Sandbox`
Provider	OPSWAT
Category	Forensics & Malware Analysis
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`

README

Unique adaptive threat analysis technology, enabling zero-day malware detection and more Indicator of Compromise (IOCs) extraction. (previously known as OPSWAT Filescan Sandbox)

Configure MetaDefender Sandbox in Cortex

Parameter	Required
Server URL (e.g. https://www.filescan.io/api)	True
API Key	True
Trust any certificate (not secure)	False
Use system proxy settings	False
Verbose	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

metadefender-sandbox-scan-url

Scan URL with MetaDefender Sandbox

Note: MetaDefender Sandbox handles URL scanning as a file scan.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

metadefender-sandbox-scan-url

Input

Argument Name	Description	Required
url	The URL to submit	Required
timeout	The timeout for the polling in seconds	Optional
hide_polling_output	Hide polling output	Optional
description	Uploaded file/url description	Optional
tags	Tags array to propagate	Optional
password	Custom password, in case uploaded archive is protected	Optional
is_private	If file should not be available for download by other users	Optional

Context Output

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
File.Name	String	The full file name.
File.SHA256	String	The SHA256 hash of the file.
File.Malicious.Vendor	String	The vendor that reported the file as malicious.
MetaDefender.Sandbox.Analysis.finalVerdict.verdict	String	The final verdict.
MetaDefender.Sandbox.Analysis.allTags	Unknown	All tags.
MetaDefender.Sandbox.Analysis.overallState	String	Overall state of the scan.
MetaDefender.Sandbox.Analysis.taskReference.name	String	Name of the main scan task.
MetaDefender.Sandbox.Analysis.taskReference.additionalInfo	Unknown	Additional informations about the main scan task.
MetaDefender.Sandbox.Analysis.taskReference.ID	String	ID of the main scan task.
MetaDefender.Sandbox.Analysis.taskReference.state	String	State of the main scan task.
MetaDefender.Sandbox.Analysis.taskReference.resourceReference	Unknown	Resource reference of the main scan task.
MetaDefender.Sandbox.Analysis.taskReference.opcount	Number	Counter.
MetaDefender.Sandbox.Analysis.taskReference.processTime	Number	processTime.
MetaDefender.Sandbox.Analysis.subtaskReferences	Unknown	Status of scan subtasks.
MetaDefender.Sandbox.Analysis.allSignalGroups	Unknown	All signal groups.
MetaDefender.Sandbox.Analysis.resources	Unknown	Resources.
MetaDefender.Sandbox.Analysis.file.name	String	The name of the file.
MetaDefender.Sandbox.Analysis.file.hash	String	The SHA256 of the file.
MetaDefender.Sandbox.Analysis.file.type	String	The type of the submission.

Command example

!metadefender-sandbox-scan-url url=https://www.test.com

Context Example

{
{
    "DBotScore":
    [
        {
            "Indicator": "1111111111111111111111111111111111111111111111111111111111111111",
            "Score": 1,
            "Type": "file",
            "Vendor": "MetaDefender Sandbox"
        }
    ],
    "File":
    [
        {
            "Name": "https://www.test.com",
            "SHA256": "1111111111111111111111111111111111111111111111111111111111111111"
        }
    ],
    "MetaDefender":
    {
        "Sandbox":
        {
            "Analysis":
            [
                {
                    "finalVerdict":
                    {
                        "verdict": "BENIGN"
                    },
                    "allTags":
                    [
                        {
                            "source": "MEDIA_TYPE",
                            "sourceIdentifier": "12345678",
                            "isRootTag": true,
                            "tag":
                            {
                                "name": "html",
                                "synonyms":
                                [],
                                "descriptions":
                                [],
                                "verdict":
                                {
                                    "verdict": "NO_THREAT",
                                    "threatLevel": 0.1,
                                    "confidence": 1
                                }
                            }
                        }
                    ],
                    "overallState": "success_partial",
                    "taskReference":
                    {
                        "name": "transform-file",
                        "additionalInfo":
                        {
                            "submitName": "https://www.test.com",
                            "submitTime": 1679014774270,
                            "digests":
                            {
                                "SHA-256": "1111111111111111111111111111111111111111111111111111111111111111"
                            }
                        },
                        "ID": "abcd-1234",
                        "state": "SUCCESS",
                        "resourceReference":
                        {
                            "type": "TRANSFORM_FILE",
                            "name": "file",
                            "ID": "abcd-5678"
                        },
                        "opcount": 1,
                        "processTime": 20350
                    },
                    "subtaskReferences":
                    [
                        {
                            "name": "domain-resolve",
                            "additionalInfo": 72,
                            "ID": "12345678",
                            "state": "SUCCESS",
                            "resourceReference":
                            {
                                "type": "DOMAIN_RESOLVE",
                                "name": "domain-resolve",
                                "ID": "123456789"
                            },
                            "opcount": 20,
                            "processTime": 11309
                        }
                    ],
                    "allSignalGroups":
                    [
                        {
                            "identifier": "I000",
                            "description": "OSINT source detected malicious resource",
                            "averageSignalStrength": 0.75,
                            "peakSignalStrength": 0.75,
                            "finalSignalStrength": 0.75,
                            "verdict":
                            {
                                "verdict": "LIKELY_MALICIOUS",
                                "threatLevel": 0.75,
                                "confidence": 1
                            },
                            "allTags":
                            [],
                            "signals":
                            [
                                {
                                    "strength": 0.75,
                                    "isStrictlyBasedOnInputData": false,
                                    "signalReadable": "OSINT provider TEST provider (2/93)",
                                    "additionalInfo": "https://www.google.com",
                                    "originPath": "osint.results.verdict",
                                    "originType": "INPUT_FILE",
                                    "originIdentifier": "1234"
                                }
                            ]
                        }
                    ],
                    "resources":
                    {
                        "00f1e4d6-27fb-45e8-8a02-dc53818044ec":
                        {
                            "resourceReference":
                            {
                                "name": "osint"
                            },
                            "results":
                            []
                        }
                    },
                    "file":
                    {
                        "name": "https://www.test.com",
                        "hash": "1111111111111111111111111111111111111111111111111111111111111111",
                        "type": "other"
                    }
                }
            ]
        }
    }
}

Human Readable Output

Scan Result (digest)

FileHash FileName FileType FinalVerdict SubtaskReferences Tags

1111111111111111111111111111111111111111111111111111111111111111 https://www.test.com other BENIGN osint, url-render, domain-resolve html, png

FileHash	FileName	FileType	FinalVerdict	SubtaskReferences	Tags
1111111111111111111111111111111111111111111111111111111111111111	https://www.test.com	other	BENIGN	osint, url-render, domain-resolve	html, png

metadefender-sandbox-scan-file

Scan File with MetaDefender Sandbox

Base Command

metadefender-sandbox-scan-file

Input

Argument Name	Description	Required
entry_id	he War Room entry ID of the file to submit	Required
timeout	The timeout for the polling in seconds	Optional
hide_polling_output	Hide polling output	Optional
description	Uploaded file/url description	Optional
tags	Tags array to propagate	Optional
password	Custom password, in case uploaded archive is protected	Optional
is_private	If file should not be available for download by other users	Optional

Context Output

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
File.Name	String	The full file name.
File.SHA256	String	The SHA256 hash of the file.
File.Malicious.Vendor	String	The vendor that reported the file as malicious.
MetaDefender.Sandbox.Analysis.finalVerdict.verdict	String	The final verdict.
MetaDefender.Sandbox.Analysis.allTags	Unknown	All tags.
MetaDefender.Sandbox.Analysis.overallState	String	Overall state of the scan.
MetaDefender.Sandbox.Analysis.taskReference.name	String	Name of the main scan task.
MetaDefender.Sandbox.Analysis.taskReference.additionalInfo	Unknown	Additional informations about the main scan task.
MetaDefender.Sandbox.Analysis.taskReference.ID	String	ID of the main scan task.
MetaDefender.Sandbox.Analysis.taskReference.state	String	State of the main scan task.
MetaDefender.Sandbox.Analysis.taskReference.resourceReference	Unknown	Resource reference of the main scan task.
MetaDefender.Sandbox.Analysis.taskReference.opcount	Number	Counter.
MetaDefender.Sandbox.Analysis.taskReference.processTime	Number	processTime.
MetaDefender.Sandbox.Analysis.subtaskReferences	Unknown	Status of scan subtasks.
MetaDefender.Sandbox.Analysis.allSignalGroups	Unknown	All signal groups.
MetaDefender.Sandbox.Analysis.resources	Unknown	Resources.
MetaDefender.Sandbox.Analysis.file.name	String	The name of the file.
MetaDefender.Sandbox.Analysis.file.hash	String	The SHA256 of the file.
MetaDefender.Sandbox.Analysis.file.type	String	The type of the submission.

Command example

!metadefender-sandbox-scan-file entry_id=1234@abcd-efgh-ijkl-mnop-xyz

Context Example

{
{
    "DBotScore":
    [
        {
            "Indicator": "1111111111111111111111111111111111111111111111111111111111111111",
            "Score": 1,
            "Type": "file",
            "Vendor": "MetaDefender Sandbox"
        }
    ],
    "File":
    [
        {
            "Name": "1234@abcd-efgh-ijkl-mnop-xyz",
            "SHA256": "1111111111111111111111111111111111111111111111111111111111111111"
        }
    ],
    "MetaDefender":
    {
        "Sandbox":
        {
            "Analysis":
            [
                {
                    "finalVerdict":
                    {
                        "verdict": "MALICIOUS"
                    },
                    "allTags":
                    [
                        {
                            "source": "SIGNAL",
                            "sourceIdentifier": "1234",
                            "isRootTag": false,
                            "tag": 
                            {
                                "name": "packed",
                                "synonyms": [],
                                "descriptions": [],
                                "verdict": {
                                    "verdict": "SUSPICIOUS",
                                    "threatLevel": 0.5,
                                    "confidence": 1
                                }
                            }
                        }
                    ],
                    "overallState": "success_partial",
                    "taskReference":
                    {
                        "name": "transform-file",
                        "additionalInfo": {
                            "submitName": "bad_file.exe",
                            "submitTime": 1679011634945,
                            "digests": {
                                "SHA-256": "1111111111111111111111111111111111111111111111111111111111111111"
                            }
                        },
                        "ID": "1234",
                        "state": "SUCCESS",
                        "resourceReference": {
                            "type": "TRANSFORM_FILE",
                            "name": "file",
                            "ID": "0101010101"
                        },
                        "opcount": 1,
                        "processTime": 7180
                    },
                    "subtaskReferences":
                    [
                        {
                            "name": "domain-resolve",
                            "additionalInfo": 72,
                            "ID": "12345678",
                            "state": "SUCCESS",
                            "resourceReference":
                            {
                                "type": "DOMAIN_RESOLVE",
                                "name": "domain-resolve",
                                "ID": "123456789"
                            },
                            "opcount": 20,
                            "processTime": 11309
                        }
                    ],
                    "allSignalGroups":
                    [
                        {
                            "identifier": "Y002",
                            "description": "Matched a malicious YARA rule",
                            "averageSignalStrength": 1,
                            "peakSignalStrength": 1,
                            "finalSignalStrength": 1,
                            "verdict": {
                                "verdict": "MALICIOUS",
                                "threatLevel": 1,
                                "confidence": 1
                            },
                            "allTags": [],
                            "signals": [
                                {
                                    "strength": 1,
                                    "isStrictlyBasedOnInputData": true,
                                    "signalReadable": "Matched YARA with strength \"0.75\"",
                                    "additionalInfo": "PUP_InstallRex_AntiFWb",
                                    "originPath": "file.yaraMatches",
                                    "originType": "INPUT_FILE",
                                    "originIdentifier": "111111111111111111111111111"
                                }
                            ]
                        }
                    ],
                    "resources":
                    {
                        "00f1e4d6-27fb-45e8-8a02-dc53818044ec":
                        {
                            "resourceReference":
                            {
                                "name": "osint"
                            },
                            "results":
                            []
                        }
                    },
                    "file":
                    {
                        "name": "1234@abcd-efgh-ijkl-mnop-xyz",
                        "hash": "1111111111111111111111111111111111111111111111111111111111111111",
                        "type": "other"
                    }
                }
            ]
        }
    }
}

Human Readable Output

Scan Result (digest)

FileHash FileName FileType FinalVerdict SubtaskReferences Tags

1111111111111111111111111111111111111111111111111111111111111111 1234@abcd-efgh-ijkl-mnop-xyz pe MALICIOUS visualization, osint, domain-resolve html, peexe

FileHash	FileName	FileType	FinalVerdict	SubtaskReferences	Tags
1111111111111111111111111111111111111111111111111111111111111111	1234@abcd-efgh-ijkl-mnop-xyz	pe	MALICIOUS	visualization, osint, domain-resolve	html, peexe

metadefender-sandbox-search-query

Search for reports. Finds reports and uploaded files by various tokens.

Base Command

metadefender-sandbox-search-query

Input

Argument Name	Description	Required
query	The query string	Required
limit	Number of total results. Maximum 50	Optional
page	Page number, starting from 1	Optional
page_size	The page size. Can be 5, 10 or 20	Optional

Context Output

Path	Type	Description
MetaDefender.Sandbox.Analysis.id	String	The analysis id.
MetaDefender.Sandbox.Analysis.file.name	String	The name of the file.
MetaDefender.Sandbox.Analysis.file.sha256	String	The SHA256 of the file.
MetaDefender.Sandbox.Analysis.verdict	String	The final verdict.
MetaDefender.Sandbox.Analysis.state	String	Overall state of the scan.
MetaDefender.Sandbox.Analysis.date	Date	The scan date.
MetaDefender.Sandbox.Analysis.file.mime_type	String	The file MimeType.
MetaDefender.Sandbox.Analysis.file.short_type	String	The type of the submission.
MetaDefender.Sandbox.Analysis.tags	Unknown	All tags.

Command example

!metadefender-sandbox-search-query query="834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"

Context Example

{
    "MetaDefender":
    {
        "Sandbox":
        {
            "Analysis":
            [
                {
                    "id": "b4f92c03-0fc2-4a40-9d34-8f2b05dd240c",
                    "file": {
                        "name": "bad_file.exe",
                        "mime_type": "application/x-msdownload",
                        "short_type": "peexe",
                        "sha256": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
                    },
                    "state": "success",
                    "verdict": "malicious",
                    "tags": [
                        {
                            "source": "MEDIA_TYPE",
                            "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
                            "isRootTag": true,
                            "tag": {
                                "name": "peexe",
                                "synonyms": [],
                                "descriptions": [],
                                "verdict": {
                                    "verdict": "NO_THREAT",
                                    "threatLevel": 0.1,
                                    "confidence": 1
                                }
                            }
                        }
                    ],
                    "date": "03/20/2023, 14:28:09"
                }
            ]
        }
    }
}

Human Readable Output

Analysis Result

Id SampleName SHA256 Verdict State Date

8c38be8c-7cfd-4d64-be41-c98a795c9ce0 bad_file.exe 834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc MALICIOUS success_partial 03/14/2023, 15:07:07

e334d27f-e2b1-46c9-9936-7d3155eb3706 bad_file.exe 834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc UNKNOWN success 03/14/2020, 15:03:48

Id	SampleName	SHA256	Verdict	State	Date
8c38be8c-7cfd-4d64-be41-c98a795c9ce0	bad_file.exe	834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc	MALICIOUS	success_partial	03/14/2023, 15:07:07
e334d27f-e2b1-46c9-9936-7d3155eb3706	bad_file.exe	834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc	UNKNOWN	success	03/14/2020, 15:03:48

Configuration parameters

url — Server URL (e.g. https://www.filescan.io/api) (required)
api_key — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (3)

metadefender-sandbox-scan-file
Scan file resource.
metadefender-sandbox-scan-url
Scan URL resource.
metadefender-sandbox-search-query
Search for reports. Finds reports and uploaded files by various tokens.

Source

MetaDefenderSandbox.py MetaDefenderSandbox_test.py MetaDefenderSandbox.yml MetaDefenderSandbox_description.md command_examples.txt

Download History Raw

commonfields:
  id: MetaDefender Sandbox
  version: -1
name: MetaDefender Sandbox
display: MetaDefender Sandbox (Deprecated)
category: Forensics & Malware Analysis
provider: OPSWAT
description: Deprecated. Use MetaDefender Aether instead.
deprecated: true
configuration:
- name: url
  display: Server URL (e.g. https://www.filescan.io/api)
  defaultvalue: https://www.filescan.io/api
  required: true
  type: 0
- name: api_key
  displaypassword: API Key
  additionalinfo: The API Key to use for connection
  required: true
  hiddenusername: true
  type: 9
- name: insecure
  display: Trust any certificate (not secure)
  type: 8
  required: false
- name: proxy
  display: Use system proxy settings
  type: 8
  required: false
script:
  script: "-"
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  commands:
  - name: metadefender-sandbox-scan-url
    description: Scan URL resource.
    polling: true
    arguments:
    - name: flow_id
      description: The flow ID what needs to poll.
      deprecated: true
    - name: url
      description: The URL to submit.
      required: true
      default: true
    - name: timeout
      description: The timeout for the polling in seconds.
      defaultValue: "600"
    - name: hide_polling_output
      description: Hide polling output.
      deprecated: true
    - name: description
      description: Uploaded file/url description.
    - name: tags
      description: Tags array to propagate.
    - name: password
      description: Custom password, in case uploaded archive is protected.
      secret: true
    - name: is_private
      description: If file should not be available for download by other users.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Malicious.Vendor
      description: The vendor that reported the file as malicious.
      type: String
    - contextPath: MetaDefender.Sandbox.Submission.flow_id
      description: The flow ID.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.finalVerdict.verdict
      description: The final verdict.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.allTags
      description: All tags.
      type: Unknown
    - contextPath: MetaDefender.Sandbox.Analysis.overallState
      description: Overall state of the scan.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.name
      description: Name of the main scan task.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.additionalInfo
      description: Additional informations about the main scan task.
      type: Unknown
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.ID
      description: ID of the main scan task.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.state
      description: State of the main scan task.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.resourceReference
      description: Resource reference of the main scan task.
      type: Unknown
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.opcount
      description: Counter.
      type: Number
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.processTime
      description: processTime.
      type: Number
    - contextPath: MetaDefender.Sandbox.Analysis.subtaskReferences
      description: Status of scan subtasks.
      type: Unknown
    - contextPath: MetaDefender.Sandbox.Analysis.allSignalGroups
      description: All signal groups.
      type: Unknown
    - contextPath: MetaDefender.Sandbox.Analysis.resources
      description: Resources.
      type: Unknown
    - contextPath: MetaDefender.Sandbox.Analysis.file.name
      description: The name of the file.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.file.hash
      description: The SHA256 of the file.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.file.type
      description: The type of the submission.
      type: String

  - name: metadefender-sandbox-scan-file
    description: Scan file resource.
    polling: true
    arguments:
    - name: flow_id
      description: The flow ID what needs to poll.
      deprecated: true
    - name: entry_id
      description: The War Room entry ID of the file to submit.
      required: true
    - name: timeout
      description: The timeout for the polling in seconds.
      defaultValue: "1200"
    - name: hide_polling_output
      description: Hide polling output.
      deprecated: true
    - name: description
      description: Uploaded file/url description.
    - name: tags
      description: Tags array to propagate.
    - name: password
      description: Custom password, in case uploaded archive is protected.
      secret: true
    - name: is_private
      description: If file should not be available for download by other users.
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Malicious.Vendor
      description: The vendor that reported the file as malicious.
      type: String
    - contextPath: MetaDefender.Sandbox.Submission.flow_id
      description: The flow ID.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.finalVerdict.verdict
      description: The final verdict.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.allTags
      description: All tags.
      type: Unknown
    - contextPath: MetaDefender.Sandbox.Analysis.overallState
      description: Overall state of the scan.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.name
      description: Name of the main scan task.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.additionalInfo
      description: Additional informations about the main scan task.
      type: Unknown
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.ID
      description: ID of the main scan task.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.state
      description: State of the main scan task.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.resourceReference
      description: Resource reference of the main scan task.
      type: Unknown
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.opcount
      description: Counter.
      type: Number
    - contextPath: MetaDefender.Sandbox.Analysis.taskReference.processTime
      description: processTime.
      type: Number
    - contextPath: MetaDefender.Sandbox.Analysis.subtaskReferences
      description: Status of scan subtasks.
      type: Unknown
    - contextPath: MetaDefender.Sandbox.Analysis.allSignalGroups
      description: All signal groups.
      type: Unknown
    - contextPath: MetaDefender.Sandbox.Analysis.resources
      description: Resources.
      type: Unknown
    - contextPath: MetaDefender.Sandbox.Analysis.file.name
      description: The name of the file.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.file.hash
      description: The SHA256 of the file.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.file.type
      description: The type of the submission.
      type: String

  - name: metadefender-sandbox-search-query
    description: Search for reports. Finds reports and uploaded files by various tokens.
    arguments:
    - name: query
      required: true
      default: true
      description: The query string.
    - name: page
      description: Page number, starting from 1.
    - name: page_size
      description: Page size. Can be 5, 10 or 20.
      auto: PREDEFINED
      predefined:
      - '5'
      - '10'
      - '20'
    - name: limit
      description: Number of total results. Maximum 50 (if page and page_size was also provided, then it will be ignored).
    outputs:
    - contextPath: MetaDefender.Sandbox.Analysis.id
      description: The analysis id.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.file.name
      description: The file name.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.file.sha256
      description: The file SHA256.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.verdict
      description: The scan verdict.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.state
      description: The scan state. Eg. success, failed.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.date
      description: The scan date.
      type: Date
    - contextPath: MetaDefender.Sandbox.Analysis.file.mime_type
      description: The file MimeType.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.file.short_type
      description: The type of the submission.
      type: String
    - contextPath: MetaDefender.Sandbox.Analysis.tags
      description: Tags.
      type: Unknown
fromversion: 6.0.0
tests:
- No tests

MetaDefender Sandbox Deprecated

Details

README

Configure MetaDefender Sandbox in Cortex

Commands

metadefender-sandbox-scan-url

Base Command

Input

Context Output

Command example

Context Example

Human Readable Output

Scan Result (digest)

metadefender-sandbox-scan-file

Base Command

Input

Context Output

Command example

Context Example

Human Readable Output

Scan Result (digest)

metadefender-sandbox-search-query

Base Command

Input

Context Output

Command example

Context Example

Human Readable Output

Analysis Result

Configuration parameters

Commands (3)

Source