SNDBOX Deprecated

Deprecated. No available replacement.

Forensics & Malware Analysis · SNDBOX (Deprecated)

Details

IDSNDBOX
ProviderPalo Alto Networks
CategoryForensics & Malware Analysis
From Version5.0.0
Docker Imagedemisto/python:2.7.18.24398
Supported ModulesAgentix

README

 

Use the SNDBOX integration to detect and analyze potentially malicious files.

SNDBOX Playbook

  • Detonate File - SNDBOX

Use Cases

  • Sample a file.
  • Get information on an old analysis.

Supported File Types

SNDBOX supports the following file types:

  • Microsoft (2003 and earlier): doc, dot, xls, csv, xlt, xlm, ppt, pot, pps
  • Microsoft (2007 and later): docx, docm, dotx, dotm, dotm, xlsx, xlsm, xltx, xltm, xlsb, xla, xlam, iqy, pptx, pptm, potx, ppsx, xml
  • Other: pe32, rtf, pdf, vbs, vbe, ps1, js, lnk, html, bat

Configure SNDBOX on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for SNDBOX.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Use Public API Key. (By approving SNDBOX public API you are accepting SNDBOX TOS @ https://app.sndbox.com/tos). Public submissions are shared with the community
    • Private API Key
    • Use system proxy settings
    • Trust any certificate (not secure)
    • Max. Polling Time (in seconds):
    • Verbose (show log in case of error)
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Check SNDBOX status: sndbox-is-online
  2. Get information for an analysis: sndbox-analysis-info
  3. Submit a sample for analysis: sndbox-analysis-submit-sample
  4. Download a report resource: sndbox-download-report
  5. (Deprecated) Detonate a report: sndbox-detonate-file
  6. Download a file sample of an analysis: sndbox-download-sample

1. Check SNDBOX status

Checks if SNDBOX is online or in maintenance mode.

Base Command

sndbox-is-online

Input

There is no input for this command. 

Context Output

There is no context output for this command.

2. Get information for an analysis

Show information about an analysis.

Base Command

sndbox-analysis-info

Input
Argument Name Description Required
analysis_id Analysis IDs, supports CSV arrays Required
 
Context Output
Path Type Description
SNDBOX.Analysis.ID string Analysis ID
SNDBOX.Analysis.SampleName string Sample data
SNDBOX.Analysis.Status string Analysis status
SNDBOX.Analysis.Time date Submitted time
SNDBOX.Analysis.Score float Analysis score
SNDBOX.Analysis.Result string Analysis results
SNDBOX.Analysis.Errors unknown Raised errors during sampling
SNDBOX.Analysis.Link string Analysis link
SNDBOX.Analysis.MD5 string MD5 of analysis sample
SNDBOX.Analysis.SHA1 string SHA-1 of analysis sample
SNDBOX.Analysis.SHA256 string SHA-256 of analysis sample
DBotScore.Vendor string Vendor name: SNDBOX
DBotScore.Indicator unknown The name of the sample file
DBotScore.Type string File type
DBotScore.Score number The actual score
DBotScore.Malicious.Vendor string Vendor name: SNDBOX
DBotScore.Malicious.Detections string The sub-analysis detection statuses
DBotScore.Malicious.SHA1 string SHA-1 of the file
 
Command Example
!sndbox-analysis-info analysis_id="65577395-48d8-4d51-bc97-bc2486f49ca0"
Context Example

image

Human Readable Output

image

3. Submit a sample for analysis

Submit a sample for analysis.

Base Command

sndbox-analysis-submit-sample

Input
Argument Name Description Required
file_id War Room entry of a file, e.g., 3245@4 Optional
should_wait Should the command poll for the result of the analysis Optional
 
Context Output
Path Type Description
SNDBOX.Analysis.ID string Analysis ID
SNDBOX.Analysis.SampleName string Sample data, (file name or URL)
SNDBOX.Analysis.Status string Analysis status
SNDBOX.Analysis.Time date Submitted time
SNDBOX.Analysis.Result string Analysis results
SNDBOX.Analysis.Errors unknown Raised errors during sampling
SNDBOX.Analysis.Link string Analysis Link
SNDBOX.Analysis.MD5 string MD5 of analysis sample
SNDBOX.Analysis.SHA1 string SHA-1 of analysis sample
SNDBOX.Analysis.SHA256 string SHA-256 of analysis sample
DBotScore.Vendor string Vendor name: SNDBOX
DBotScore.Indicator unknown The name of the sample file or URL
DBotScore.Type string 'url' for url samples, otherwise 'file'
DBotScore.Score number The actual score
DBotScore.Malicious.Vendor string Vendor name: SNDBOX
DBotScore.Malicious.SHA1 string SHA-1 of the file
 
Command Example
!sndbox-analysis-submit-sample file_id="288@670"
Context Example

image

Human Readable Output

image

4. Download a report resource

Download a resource belonging to a report. This can be the full report, dropped binaries, etc.

Base Command

sndbox-download-report

Input
Argument Name Description Required
analysis_id Analysis ID Required
type The resource type to download. Default is JSON. Optional
 
Context Output
Path Type Description
InfoFile.Name string File name
InfoFile.EntryID string The EntryID of the report
InfoFile.Size number File size
InfoFile.Type string File type, e.g., "PE"
InfoFile.Info string Basic information of the file
InfoFile.Extension string File extension
 
Command Example
!sndbox-download-report analysis_id=65577395-48d8-4d51-bc97-bc2486f49ca0 type=json
Context Example

image

Human Readable Output

image

5. (Deprecated) Detonate a file

Submit a sample for detonation. This command is deprecated.

Base Command

sndbox-detonate-file

Input
Argument Name Description Required
file_id War Room entry of a file, e.g., 3245@4 Optional
 
Context Output
Path Type Description
SNDBOX.Analysis.ID string Analysis ID
SNDBOX.Analysis.SampleName string Sample data (file name or URL)
SNDBOX.Analysis.Status string Analysis status
SNDBOX.Analysis.Time date Submitted time
SNDBOX.Analysis.Result string Analysis results
SNDBOX.Analysis.Errors unknown Raised errors during sampling
SNDBOX.Analysis.Link string Analysis link
SNDBOX.Analysis.MD5 string MD5 of analysis sample
SNDBOX.Analysis.SHA1 string SHA-1 of analysis sample
SNDBOX.Analysis.SHA256 string SHA-256 of analysis sample
DBotScore.Vendor string Vendor name: SNDBOX
DBotScore.Indicator unknown The name of the sample file or URL
DBotScore.Type string File
DBotScore.Score number The actual score
DBotScore.Malicious.Vendor string Vendor name: SNDBOX
DBotScore.Malicious.Detections string The sub-analysis detection statuses
DBotScore.Malicious.SHA1 string SHA-1 of the file
 
 

6. Download the sample file of an analysis

Download the sample file of an analysis. For security reasons, the file extension will be .dontrun.

Base Command

sndbox-download-sample

Input
Argument Name Description Required
analysis_id Analysis ID Required
 
Context Output
Path Type Description
File.Size number File size
File.SHA1 string SHA-1 hash of the file
File.SHA256 string SHA-256 hash of the file
File.Name string The sample name
File.SSDeep string SSDeep hash of the file
File.EntryID string War Room entry ID of the file
File.Info string Basic information of the file
File.Type string File type, e.g., "PE"
File MD5 string MD5 hash of the file
File.Extension string File extension
 
Command Example
!sndbox-download-sample analysis_id=65577395-48d8-4d51-bc97-bc2486f49ca0
Context Example

image

Configuration parameters

  • public_api_key — Use Public API Key. (By approving SNDBOX public API you are accepting SNDBOX TOS @ https://app.sndbox.com/tos). Public submissions are shared with the community
  • api_key — Private API Key (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • maxpolls — Max. Polling Time (in seconds):
  • verbose — Verbose (show log in case of error)

Commands (5)

  • sndbox-analysis-info

    Show information about an analysis.

  • sndbox-analysis-submit-sample

    Submit a sample for analysis.

  • sndbox-download-report

    Download a resource belonging to a report. This can be the full report, dropped binaries, etc.

  • sndbox-download-sample

    Download the sample file of an analysis. for security reasons, the extension will be "dontrun"

  • sndbox-is-online

    Check if SNDBOX is online or in maintenance mode.

Source

SNDBOX.py SNDBOX.yml SNDBOX_description.md
Download History Raw 
commonfields:
  id: SNDBOX
  version: -1
name: SNDBOX
display: SNDBOX (Deprecated)
deprecated: true
category: Forensics & Malware Analysis
provider: Palo Alto Networks
description: Deprecated. No available replacement.
configuration:
- display: 'Use Public API Key. (By approving SNDBOX public API you are accepting SNDBOX TOS @ https://app.sndbox.com/tos). Public submissions are shared with the community'
  name: public_api_key
  defaultvalue: ''
  type: 8
  required: false
- display: 'Private API Key'
  name: api_key
  defaultvalue: ''
  type: 4
  required: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: 'Max. Polling Time (in seconds):'
  name: maxpolls
  defaultvalue: '300'
  type: 0
  required: false
- display: 'Verbose (show log in case of error) '
  name: verbose
  defaultvalue: ''
  type: 8
  required: false
script:
  script: ''
  type: python
  subtype: python2
  commands:
  - name: sndbox-is-online
    arguments: []
    description: Check if SNDBOX is online or in maintenance mode.
  - name: sndbox-analysis-info
    arguments:
    - name: analysis_id
      required: true
      default: true
      description: Analysis IDs, supports comma-seperated arrays.
      isArray: true
    outputs:
    - contextPath: SNDBOX.Analysis.ID
      description: Analysis ID
      type: string
    - contextPath: SNDBOX.Analysis.SampleName
      description: Sample Data
      type: string
    - contextPath: SNDBOX.Analysis.Status
      description: Analysis Status
      type: string
    - contextPath: SNDBOX.Analysis.Time
      description: Submitted Time
      type: date
    - contextPath: SNDBOX.Analysis.Score
      description: Analysis Score
      type: float
    - contextPath: SNDBOX.Analysis.Result
      description: Analysis Results
      type: string
    - contextPath: SNDBOX.Analysis.Errors
      description: Raised errors during sampling
    - contextPath: SNDBOX.Analysis.Link
      description: Analysis Link
      type: string
    - contextPath: SNDBOX.Analysis.MD5
      description: MD5 of analysis sample
      type: string
    - contextPath: SNDBOX.Analysis.SHA1
      description: SHA1 of analysis sample
      type: string
    - contextPath: SNDBOX.Analysis.SHA256
      description: SHA256 of analysis sample
      type: string
    - contextPath: DBotScore.Vendor
      description: 'The name of the vendor: SNDBOX'
      type: string
    - contextPath: DBotScore.Indicator
      description: The name of the sample file
    - contextPath: DBotScore.Type
      description: file
      type: string
    - contextPath: DBotScore.Score
      description: The actual score
      type: number
    - contextPath: DBotScore.Malicious.Vendor
      description: 'The name of the vendor: SNDBOX'
      type: string
    - contextPath: DBotScore.Malicious.Detections
      description: The sub analysis detection statuses
      type: string
    - contextPath: DBotScore.Malicious.SHA1
      description: The SHA1 of the file
      type: string
    description: Show information about an analysis.
  - name: sndbox-analysis-submit-sample
    arguments:
    - name: file_id
      default: true
      description: War Room entry of a file (for example, 3245@4)
    - name: should_wait
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      description: Should the command poll for the result of the analysis
      defaultValue: 'False'
    outputs:
    - contextPath: SNDBOX.Analysis.ID
      description: Analysis ID
      type: string
    - contextPath: SNDBOX.Analysis.SampleName
      description: Sample Data, could be a file name or URL
      type: string
    - contextPath: SNDBOX.Analysis.Status
      description: Analysis Status
      type: string
    - contextPath: SNDBOX.Analysis.Time
      description: Submitted Time
      type: date
    - contextPath: SNDBOX.Analysis.Result
      description: Analysis Results
      type: string
    - contextPath: SNDBOX.Analysis.Errors
      description: Raised errors during sampling
    - contextPath: SNDBOX.Analysis.Link
      description: Analysis Link
      type: string
    - contextPath: SNDBOX.Analysis.MD5
      description: MD5 of analysis sample
      type: string
    - contextPath: SNDBOX.Analysis.SHA1
      description: SHA1 of analysis sample
      type: string
    - contextPath: SNDBOX.Analysis.SHA256
      description: SHA256 of analysis sample
      type: string
    - contextPath: DBotScore.Vendor
      description: 'The name of the vendor: SNDBOX'
      type: string
    - contextPath: DBotScore.Indicator
      description: The name of the sample file or URL
    - contextPath: DBotScore.Type
      description: "'url' for url samples, otherwise 'file'"
      type: string
    - contextPath: DBotScore.Score
      description: The actual score
      type: number
    - contextPath: DBotScore.Malicious.Vendor
      description: 'The name of the vendor: SNDBOX'
      type: string
    - contextPath: DBotScore.Malicious.SHA1
      description: The SHA1 of the file
      type: string
    description: Submit a sample for analysis.
  - name: sndbox-download-report
    arguments:
    - name: analysis_id
      required: true
      default: true
      description: Analysis ID
    - name: type
      auto: PREDEFINED
      predefined:
      - json
      - pcap
      description: The resource type to download. Defaults to json.
      defaultValue: json
    outputs:
    - contextPath: InfoFile.Name
      description: FileName
      type: string
    - contextPath: InfoFile.EntryID
      description: The EntryID of the report
      type: string
    - contextPath: InfoFile.Size
      description: File Size
      type: number
    - contextPath: InfoFile.Type
      description: File type e.g. "PE"
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file
      type: string
    - contextPath: InfoFile.Extension
      description: File Extension
      type: string
    description: Download a resource belonging to a report. This can be the full report, dropped binaries, etc.
  - name: sndbox-download-sample
    arguments:
    - name: analysis_id
      required: true
      default: true
      description: Analysis ID
    outputs:
    - contextPath: File.Size
      description: File Size
      type: number
    - contextPath: File.SHA1
      description: SHA1 hash of the file
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file
      type: string
    - contextPath: File.Name
      description: The sample name
      type: string
    - contextPath: File.SSDeep
      description: SSDeep hash of the file
      type: string
    - contextPath: File.EntryID
      description: War-Room Entry ID of the file
      type: string
    - contextPath: File.Info
      description: Basic information of the file
      type: string
    - contextPath: File.Type
      description: File type e.g. "PE"
      type: string
    - contextPath: File MD5
      description: MD5 hash of the file
      type: string
    - contextPath: File.Extension
      description: File Extension
      type: string
    description: Download the sample file of an analysis. for security reasons, the extension will be "dontrun"
  dockerimage: demisto/python:2.7.18.24398
tests:
- SNDBOX_Test
fromversion: 5.0.0