ThreatZone

ThreatZone malware analysis sandboxing.

Forensics & Malware Analysis · ThreatZone

Details

ID	`ThreatZone`
Provider	Malwation
Category	Forensics & Malware Analysis
From Version	6.9.0
Docker Image	`demisto/threatzone-sdk:1.1.1.12287331`
Supported Modules	Agentix XSIAM

README

ThreatZone malware analysis sandboxing.
This integration was integrated and tested with ThreatZone.

Configure ThreatZone in Cortex

Parameter	Description	Required
Server URL (e.g. https://app.threat.zone)	The ThreatZone instance root or /public-api URL. The integration appends the suffix exactly once.	True
ThreatZone API Key	The API key generated for the ThreatZone workspace.	True
Source Reliability	The reliability of the source providing the intelligence data.	False
Trust any certificate (not secure)	Whether to trust any certificate (not secure) by disabling TLS certificate validation.	False
Use system proxy settings	Whether to use the system proxy settings for SDK requests.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

tz-sandbox-upload-sample

Submits a sample to ThreatZone for sandbox analysis.

Base Command

tz-sandbox-upload-sample

Input

Argument Name	Description	Required
entry_id	The entry ID of the file to submit.	Required
environment	The environment to run the submission in. Possible values are: w7_x64, w10_x64, w11_x64, linux-ubuntu_2204, macos-ventura, android9. Default is w7_x64.	Optional
private	Whether the submission is private. If omitted, the current ThreatZone API-provided default is used. Possible values are: true, false.	Optional
extension_check	Whether to enforce MIME-based extension correction before sandbox execution. If omitted, the current ThreatZone API-provided default is used. Possible values are: true, false.	Optional
auto	Whether to automatically select a sandbox environment based on the uploaded file type, ignoring the environment argument. Possible values are: true, false. Default is false.	Optional
modules	The legacy compatibility argument. ThreatZone v3.2 does not support per-submission module selection, so this value is validated but not forwarded.	Optional
analyze_config	The raw analyzeConfig JSON used to override or add sandbox metafields.	Optional
timeout	The duration of the submission analysis. If omitted, the current ThreatZone API-provided default is used. Possible values are: 60, 120, 180, 300.	Optional
work_path	The working path of the submission. If omitted, the current ThreatZone API-provided default is used. Possible values are: desktop, root, appdata, windows, temp.	Optional
mouse_simulation	Whether to enable mouse simulation. If omitted, the current ThreatZone API-provided default is used. Possible values are: true, false.	Optional
https_inspection	Whether to enable HTTPS inspection for encrypted traffic. If omitted, the current ThreatZone API-provided default is used. Possible values are: true, false.	Optional
internet_connection	Whether to enable internet connection. If omitted, the current ThreatZone API-provided default is used. Possible values are: true, false.	Optional
raw_logs	Whether to request raw logs. This legacy compatibility argument is not forwarded because ThreatZone v3.2 does not accept the metafield. Possible values are: true, false.	Optional
snapshot	Whether to enable Fast Bootup. If omitted, the current ThreatZone API-provided default is used. Possible values are: true, false.	Optional
entrypoint	The filename inside the archive to execute (for archives).	Optional
password	The password for password-protected archives.	Optional
configurations	The advanced execution configuration as a JSON object (for example preScript, startArguments, or networkConfig).	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.Sandbox.UUID	String	The UUID of the sample.
ThreatZone.Limits.E_Mail	String	The owner e-mail of current plan.
ThreatZone.Limits.API_Limit	String	The remaining/total API request limits of the current plan.
ThreatZone.Limits.Concurrent_Limit	String	The remaining/total concurrent analysis limits of the current plan.
ThreatZone.Limits.Daily_Submission_Limit	String	The remaining/total daily submission limits of the current plan.

tz-static-upload-sample

Submits a sample to ThreatZone for static analysis.

Base Command

tz-static-upload-sample

Input

Argument Name	Description	Required
entry_id	The entry ID of the file to submit.	Required
private	Whether the submission is visible only to members of your workspace. When false, the submission is visible to everyone. Possible values are: true, false. Default is true.	Optional
extension_check	Whether to enforce MIME-based extension correction before static scan. Possible values are: true, false. Default is false.	Optional
entrypoint	The filename inside the archive to analyze (for archives).	Optional
password	The password for password-protected archives.	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.Static.UUID	String	The UUID of the sample.
ThreatZone.Limits.E_Mail	String	The owner e-mail of current plan.
ThreatZone.Limits.API_Limit	String	The remaining/total API request limits of the current plan.
ThreatZone.Limits.Concurrent_Limit	String	The remaining/total concurrent analysis limits of the current plan.
ThreatZone.Limits.Daily_Submission_Limit	String	The remaining/total daily submission limits of the current plan.

tz-cdr-upload-sample

Submits a sample to ThreatZone for CDR.

Base Command

tz-cdr-upload-sample

Input

Argument Name	Description	Required
entry_id	The entry ID of the file to submit.	Required
private	Whether the submission is visible only to members of your workspace. When false, the submission is visible to everyone. Possible values are: true, false. Default is true.	Optional
extension_check	Whether to enforce MIME-based extension correction before sanitization. Possible values are: true, false. Default is true.	Optional
entrypoint	The filename inside the archive to sanitize (for archives).	Optional
password	The password for password-protected archives.	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.CDR.UUID	String	The UUID of the sample.
ThreatZone.Limits.E_Mail	String	The owner e-mail of current plan.
ThreatZone.Limits.API_Limit	String	The remaining/total API request limits of the current plan.
ThreatZone.Limits.Concurrent_Limit	String	The remaining/total concurrent analysis limits of the current plan.
ThreatZone.Limits.Daily_Submission_Limit	String	The remaining/total daily submission limits of the current plan.

tz-url-analysis

Submits a URL to ThreatZone for analysis.

Base Command

tz-url-analysis

Input

Argument Name	Description	Required
url	The URL to analyze.	Required
private	Whether to mark the submission as workspace-private. Possible values are: true, false. Default is true.	Optional
safe_browsing	Whether to start an isolated safe-browsing session alongside URL analysis. Possible values are: true, false. Default is false.	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.URL.UUID	String	The UUID of the URL submission.
ThreatZone.Submission.URL.URL	String	The URL submitted for analysis.
ThreatZone.Limits.E_Mail	String	The owner e-mail of current plan.
ThreatZone.Limits.API_Limit	String	The remaining/total API request limits of the current plan.
ThreatZone.Limits.Concurrent_Limit	String	The remaining/total concurrent analysis limits of the current plan.
ThreatZone.Limits.Daily_Submission_Limit	String	The remaining/total daily submission limits of the current plan.

tz-get-result

Retrieve the analysis result from ThreatZone.

Base Command

tz-get-result

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
details	Whether to include inline Indicators, IOCs, YARA matches, artifacts, and configuration data in the readable output. Possible values are: true, false. Default is false.	Optional
download_sanitized	Whether to download the sanitized file after a CDR analysis completes. Possible values are: true, false. Default is false.	Optional

Context Output

Path	Type	Description
ThreatZone.Submission	Unknown	The raw submission data returned by ThreatZone.
ThreatZone.Analysis.STATUS	Number	The status of the submission scanning process as an integer code (0=declined, 1=file received, 2=accepted, 3=running, 4=VM ready, 5=finished).
ThreatZone.Analysis.LEVEL	Number	The threat level of the scanned file as an integer code (0=not measured, 1=informative, 2=suspicious, 3=malicious).
ThreatZone.Analysis.INFO	String	The submission metadata such as file name/URL and privacy status.
ThreatZone.Analysis.REPORT	String	The analysis report of the submission.
ThreatZone.Analysis.URL	String	The result page url of the submission.
ThreatZone.Analysis.MD5	String	The md5 hash of the submission.
ThreatZone.Analysis.SHA1	String	The sha1 hash of the submission.
ThreatZone.Analysis.SHA256	String	The sha256 hash of the submission.
ThreatZone.Analysis.UUID	String	The UUID of the submission.
ThreatZone.Analysis.SANITIZED	String	The url of the sanitized file.
ThreatZone.IOC.URL	List	The URL data extracted from IOC.
ThreatZone.IOC.IP	List	The IP data extracted from IOC.
ThreatZone.IOC.DOMAIN	List	The DOMAIN data extracted from IOC.
ThreatZone.IOC.EMAIL	List	The EMAIL data extracted from IOC.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Reliability	String	The reliability of the source providing the intelligence data.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	unknown	The vendor used to calculate the score.

tz-get-indicator-result

Retrieves dynamic behaviour indicators for a submission from ThreatZone.

Base Command

tz-get-indicator-result

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
level	The indicator severity to filter by. Possible values are: benign, suspicious, malicious.	Optional
category	The indicator category to filter by.	Optional
pid	The process ID to filter by.	Optional
attack_code	The MITRE ATT&CK technique code to filter by.	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.Indicators.UUID	String	The UUID of the submission.
ThreatZone.Submission.Indicators.Data	Unknown	The dynamic behaviour indicators returned by ThreatZone.

tz-get-ioc-result

Retrieves Indicators of Compromise for a submission from ThreatZone.

Base Command

tz-get-ioc-result

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
type	The IOC type to filter by.	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.IOCs.UUID	String	The UUID of the submission.
ThreatZone.Submission.IOCs.Data	Unknown	The Indicators of Compromise returned by ThreatZone.

tz-get-yara-result

Retrieves YARA rules matched during analysis. Use tz-download-yara-rule for the generated rule file.

Base Command

tz-get-yara-result

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
category	The matched YARA rule category to filter by.	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.YaraMatches.UUID	String	The UUID of the submission.
ThreatZone.Submission.YaraMatches.Data	Unknown	The matched YARA rules returned by ThreatZone.

tz-get-artifact-result

Retrieves analysis artifacts for a submission from ThreatZone.

Base Command

tz-get-artifact-result

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.Artifacts.UUID	String	The UUID of the submission.
ThreatZone.Submission.Artifacts.Data	Unknown	The analysis artifacts returned by ThreatZone.

tz-get-config-result

Retrieves configuration extractor results for a submission from ThreatZone.

Base Command

tz-get-config-result

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.Config.UUID	String	The UUID of the submission.
ThreatZone.Submission.Config.Data	Unknown	The configuration extractor results returned by ThreatZone.

tz-get-sanitized

Downloads a sanitized file from the ThreatZone API and uploads it to the War Room.

Base Command

tz-get-sanitized

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
InfoFile.Extension	String	The extension of the file sanitized by CDR.
InfoFile.Name	String	The name of the file sanitized by CDR.
InfoFile.Size	Number	The size of the file sanitized by CDR.
InfoFile.EntryID	String	The entry ID of the file sanitized by CDR.
InfoFile.Info	String	The info of the file sanitized by CDR.
InfoFile.MD5	String	The MD5 hash of the file sanitized by CDR.
InfoFile.SHA1	String	The SHA1 hash of the file sanitized by CDR.
InfoFile.SHA256	String	The SHA256 hash of the file sanitized by CDR.
InfoFile.SHA512	String	The SHA512 hash of the file sanitized by CDR.
InfoFile.SSDeep	String	The SSDeep hash of the file sanitized by CDR.

tz-download-html-report

Downloads the HTML report for a submission and uploads it to the War Room.

Base Command

tz-download-html-report

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
InfoFile.Extension	String	The extension of the HTML report.
InfoFile.Name	String	The name of the downloaded HTML report.
InfoFile.Size	Number	The size of the downloaded HTML report.
InfoFile.EntryID	String	The entry ID of the downloaded HTML report.
InfoFile.Info	String	The info for the downloaded HTML report.
InfoFile.MD5	String	The MD5 hash of the downloaded HTML report.
InfoFile.SHA1	String	The SHA1 hash of the downloaded HTML report.
InfoFile.SHA256	String	The SHA256 hash of the downloaded HTML report.
InfoFile.SHA512	String	The SHA512 hash of the downloaded HTML report.
InfoFile.SSDeep	String	The SSDeep hash of the downloaded HTML report.

tz-get-metafields

Retrieves available ThreatZone metafields, optionally filtered by scan type.

Base Command

tz-get-metafields

Input

Argument Name	Description	Required
scan_type	The scan type to filter metafields. Possible values are: sandbox, static, cdr, url, open_in_browser.	Optional

Context Output

Path	Type	Description
ThreatZone.Configuration.Metafields.ScanType	String	The scan type used to filter the metafields.
ThreatZone.Configuration.Metafields.Data	Unknown	The metafield definitions returned by ThreatZone.

tz-get-environments

Retrieves available ThreatZone sandbox environments.

Base Command

tz-get-environments

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
ThreatZone.Configuration.Environments.Data	Unknown	The sandbox environment definitions returned by ThreatZone.

tz-list-network-configs

Lists network configurations available to the current ThreatZone workspace.

Base Command

tz-list-network-configs

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
ThreatZone.Configuration.NetworkConfigurations.Data	Unknown	The network configuration summaries returned by ThreatZone.

tz-open-in-browser

Creates a ThreatZone open-in-browser submission.

Base Command

tz-open-in-browser

Input

Argument Name	Description	Required
url	The URL to open in an isolated browser environment.	Required
environment	The sandbox environment key for browser execution.	Optional
auto	Whether to let ThreatZone select the browser environment. Possible values are: true, false. Default is false.	Optional
metafields	The open-in-browser metafields as a JSON object.	Optional
private	Whether to mark the submission as workspace-private. Possible values are: true, false. Default is true.	Optional
configurations	The advanced execution configuration as a JSON object.	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.OpenInBrowser.UUID	String	The UUID of the open-in-browser submission.
ThreatZone.Submission.OpenInBrowser.URL	String	The URL submitted to ThreatZone.

tz-list-submissions

Lists ThreatZone submissions with optional filters.

Base Command

tz-list-submissions

Input

Argument Name	Description	Required
page	The page number, starting at 1. Default is 1.	Optional
limit	The number of submissions per page (1-100). Default is 20.	Optional
level	The comma-separated threat levels.	Optional
type	The submission type. Possible values are: file, url.	Optional
sha256	The SHA256 hash filter.	Optional
filename	The partial filename filter.	Optional
start_date	The ISO 8601 date to include submissions created on or after (for example, 2020-01-01T00:11:22Z).	Optional
end_date	The ISO 8601 date to include submissions created on or before (for example, 2020-01-01T00:11:22Z).	Optional
private	Whether to filter by privacy status. Possible values are: true, false.	Optional
tags	The comma-separated tag filters.	Optional
sort	The field used to sort results, such as createdAt.	Optional
order	The sort order. Possible values are: asc, desc.	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.List	Unknown	The paginated ThreatZone submission results.

tz-search-submissions-by-sha256

Searches ThreatZone submissions by SHA256 hash.

Base Command

tz-search-submissions-by-sha256

Input

Argument Name	Description	Required
sha256	The SHA256 hash to search for.	Required

Context Output

Path	Type	Description
ThreatZone.SubmissionSearch.Data	Unknown	The matching submissions.

tz-get-overview-summary

Retrieves aggregate analysis counts for a submission.

Base Command

tz-get-overview-summary

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.OverviewSummary.UUID	String	The UUID of the submission.
ThreatZone.Submission.OverviewSummary.Data	Unknown	The aggregate analysis summary.

tz-get-eml-analysis

Retrieves parsed EML analysis results.

Base Command

tz-get-eml-analysis

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.EMLAnalysis.UUID	String	The UUID of the submission.
ThreatZone.Submission.EMLAnalysis.Data	Unknown	The parsed EML analysis data.

tz-get-mitre-techniques

Retrieves MITRE ATT&CK techniques matched during analysis.

Base Command

tz-get-mitre-techniques

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.MITRE.UUID	String	The UUID of the submission.
ThreatZone.Submission.MITRE.Data	Unknown	The matched MITRE ATT&CK techniques.

tz-get-static-scan-result

Retrieves the static scan result for a submission.

Base Command

tz-get-static-scan-result

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.StaticScan.UUID	String	The UUID of the submission.
ThreatZone.Submission.StaticScan.Data	Unknown	The static scan result.

tz-get-cdr-result

Retrieves the CDR transformation result for a submission.

Base Command

tz-get-cdr-result

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.CDRResult.UUID	String	The UUID of the submission.
ThreatZone.Submission.CDRResult.Data	Unknown	The CDR transformation result.

tz-get-signature-check-result

Retrieves authenticode and signature-check results.

Base Command

tz-get-signature-check-result

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.SignatureCheck.UUID	String	The UUID of the submission.
ThreatZone.Submission.SignatureCheck.Data	Unknown	The signature-check result.

tz-get-processes

Retrieves processes captured during dynamic analysis.

Base Command

tz-get-processes

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.Processes.UUID	String	The UUID of the submission.
ThreatZone.Submission.Processes.Data	Unknown	The captured processes.

tz-get-process-tree

Retrieves the process tree captured during dynamic analysis.

Base Command

tz-get-process-tree

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.ProcessTree.UUID	String	The UUID of the submission.
ThreatZone.Submission.ProcessTree.Data	Unknown	The captured process tree.

tz-get-url-analysis-result

Retrieves the full URL analysis report.

Base Command

tz-get-url-analysis-result

Input

Argument Name	Description	Required
uuid	The UUID of the URL or open-in-browser submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.URLAnalysis.UUID	String	The UUID of the submission.
ThreatZone.Submission.URLAnalysis.Data	Unknown	The URL analysis report.

tz-get-behaviours

Retrieves one bounded page of behaviour telemetry.

Base Command

tz-get-behaviours

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
type	The behaviour event type filter.	Optional
pid	The process ID filter.	Optional
operation	The operation-name filter.	Optional
process_name	The exact process-name filter.	Optional
page	The page number, starting at 1. Default is 1.	Optional
limit	The number of events to return (1-500). Default is 100.	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.Behaviours.UUID	String	The UUID of the submission.
ThreatZone.Submission.Behaviours.Data	Unknown	The behaviour events and pagination metadata.

tz-get-syscalls

Retrieves one bounded page of syscall telemetry.

Base Command

tz-get-syscalls

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
page	The page number, starting at 1. Default is 1.	Optional
limit	The number of syscall lines to return (1-2000). Default is 500.	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.Syscalls.UUID	String	The UUID of the submission.
ThreatZone.Submission.Syscalls.Data	Unknown	The syscall lines and pagination metadata.

tz-get-network-summary

Retrieves aggregate network activity counts.

Base Command

tz-get-network-summary

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.NetworkSummary.UUID	String	The UUID of the submission.
ThreatZone.Submission.NetworkSummary.Data	Unknown	The network activity summary.

tz-get-dns-queries

Retrieves a bounded window of DNS queries.

Base Command

tz-get-dns-queries

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
limit	The maximum items to return (0-1000).	Optional
skip	The number of items to skip (0-1000).	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.DNSQueries.UUID	String	The UUID of the submission.
ThreatZone.Submission.DNSQueries.Data	Unknown	The captured DNS queries.

tz-get-http-requests

Retrieves a bounded window of HTTP request hosts.

Base Command

tz-get-http-requests

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
limit	The maximum items to return (0-1000).	Optional
skip	The number of items to skip (0-1000).	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.HTTPRequests.UUID	String	The UUID of the submission.
ThreatZone.Submission.HTTPRequests.Data	Unknown	The captured HTTP request hosts.

tz-get-tcp-connections

Retrieves a bounded window of TCP connections.

Base Command

tz-get-tcp-connections

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
limit	The maximum items to return (0-1000).	Optional
skip	The number of items to skip (0-1000).	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.TCPConnections.UUID	String	The UUID of the submission.
ThreatZone.Submission.TCPConnections.Data	Unknown	The captured TCP connections.

tz-get-udp-connections

Retrieves a bounded window of UDP connections.

Base Command

tz-get-udp-connections

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
limit	The maximum items to return (0-1000).	Optional
skip	The number of items to skip (0-1000).	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.UDPConnections.UUID	String	The UUID of the submission.
ThreatZone.Submission.UDPConnections.Data	Unknown	The captured UDP connections.

tz-get-network-threats

Retrieves a bounded window of Suricata network threats.

Base Command

tz-get-network-threats

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
limit	The maximum items to return (0-1000).	Optional
skip	The number of items to skip (0-1000).	Optional

Context Output

Path	Type	Description
ThreatZone.Submission.NetworkThreats.UUID	String	The UUID of the submission.
ThreatZone.Submission.NetworkThreats.Data	Unknown	The detected network threats.

tz-download-static-scan-strings

Downloads the static scan strings JSON to the War Room.

Base Command

tz-download-static-scan-strings

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
InfoFile.EntryID	String	The entry ID of the downloaded file.
InfoFile.Name	String	The name of the downloaded file.

tz-download-sample

Downloads the original submitted sample to the War Room.

Base Command

tz-download-sample

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
InfoFile.EntryID	String	The entry ID of the downloaded file.
InfoFile.Name	String	The name of the downloaded file.

tz-download-artifact

Downloads an extracted artifact to the War Room.

Base Command

tz-download-artifact

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
artifact_id	The artifact ID returned by tz-get-artifact-result.	Required

Context Output

Path	Type	Description
InfoFile.EntryID	String	The entry ID of the downloaded file.
InfoFile.Name	String	The name of the downloaded file.

tz-download-pcap

Downloads the network capture to the War Room.

Base Command

tz-download-pcap

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
InfoFile.EntryID	String	The entry ID of the downloaded file.
InfoFile.Name	String	The name of the downloaded file.

tz-download-yara-rule

Polls for and downloads the generated YARA rule file to the War Room.

Base Command

tz-download-yara-rule

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
timeout	The maximum seconds to poll for generated YARA rule readiness (1-3600). Default is 120.	Optional

Context Output

Path	Type	Description
InfoFile.EntryID	String	The entry ID of the downloaded file.
InfoFile.Name	String	The name of the downloaded file.

tz-download-url-screenshot

Downloads the URL analysis screenshot to the War Room.

Base Command

tz-download-url-screenshot

Input

Argument Name	Description	Required
uuid	The UUID of the URL analysis submission.	Required

Context Output

Path	Type	Description
InfoFile.EntryID	String	The entry ID of the downloaded file.
InfoFile.Name	String	The name of the downloaded file.

tz-list-media-files

Lists screenshots and videos available for a submission.

Base Command

tz-list-media-files

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required

Context Output

Path	Type	Description
ThreatZone.Submission.MediaFiles.UUID	String	The UUID of the submission.
ThreatZone.Submission.MediaFiles.Data	Unknown	The available media file metadata.

tz-download-media-file

Downloads a submission media file to the War Room.

Base Command

tz-download-media-file

Input

Argument Name	Description	Required
uuid	The UUID of the submission.	Required
file_id	The media file ID returned by tz-list-media-files.	Required

Context Output

Path	Type	Description
InfoFile.EntryID	String	The entry ID of the downloaded file.
InfoFile.Name	String	The name of the downloaded file.

tz-check-limits

Check the plan limits from ThreatZone API.

Base Command

tz-check-limits

Input

Argument Name	Description	Required
detailed	Whether to include plan file limits, enabled modules, and account metadata.	Optional

Context Output

Path	Type	Description
ThreatZone.Limits.E_Mail	String	The owner e-mail of current plan.
ThreatZone.Limits.API_Limit	String	The remaining/total API request limits of the current plan.
ThreatZone.Limits.Concurrent_Limit	String	The remaining/total concurrent analysis limits of the current plan.
ThreatZone.Limits.Daily_Submission_Limit	String	The remaining/total daily submission limits of the current plan.
ThreatZone.Plan.File_Size_Limit_MiB	Number	The maximum upload size for the workspace plan (MiB).
ThreatZone.Plan.Allowed_Extensions	List	The list of permitted file extensions for uploads.
ThreatZone.Plan.Modules	List	The enabled ThreatZone modules for the workspace.
ThreatZone.Metadata.Full_Name	String	The full name of the authenticated user.
ThreatZone.Metadata.Workspace	String	The workspace identifier or name associated with the account.
ThreatZone.Metadata.Plan_Name	String	The name of the active ThreatZone plan.
ThreatZone.Metadata.Plan_Status	String	The status of the active ThreatZone plan.

Configuration parameters

url — Server URL (e.g. https://app.threat.zone) (required)
apikey — (required)
integrationReliability — Source Reliability
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (44)

tz-cdr-upload-sample
Submits a sample to ThreatZone for CDR.
tz-check-limits
Check the plan limits from ThreatZone API.
tz-download-artifact
Downloads an extracted artifact to the War Room.
tz-download-html-report
Downloads the HTML report for a submission and uploads it to the War Room.
tz-download-media-file
Downloads a submission media file to the War Room.
tz-download-pcap
Downloads the network capture to the War Room.
tz-download-sample
Downloads the original submitted sample to the War Room.
tz-download-static-scan-strings
Downloads the static scan strings JSON to the War Room.
tz-download-url-screenshot
Downloads the URL analysis screenshot to the War Room.
tz-download-yara-rule
Polls for and downloads the generated YARA rule file to the War Room.
tz-get-artifact-result
Retrieves analysis artifacts for a submission from ThreatZone.
tz-get-behaviours
Retrieves one bounded page of behaviour telemetry.
tz-get-cdr-result
Retrieves the CDR transformation result for a submission.
tz-get-config-result
Retrieves configuration extractor results for a submission from ThreatZone.
tz-get-dns-queries
Retrieves a bounded window of DNS queries.
tz-get-eml-analysis
Retrieves parsed EML analysis results.
tz-get-environments
Retrieves available ThreatZone sandbox environments.
tz-get-http-requests
Retrieves a bounded window of HTTP request hosts.
tz-get-indicator-result
Retrieves dynamic behaviour indicators for a submission from ThreatZone.
tz-get-ioc-result
Retrieves Indicators of Compromise for a submission from ThreatZone.
tz-get-metafields
Retrieves available ThreatZone metafields, optionally filtered by scan type.
tz-get-mitre-techniques
Retrieves MITRE ATT&CK techniques matched during analysis.
tz-get-network-summary
Retrieves aggregate network activity counts.
tz-get-network-threats
Retrieves a bounded window of Suricata network threats.
tz-get-overview-summary
Retrieves aggregate analysis counts for a submission.
tz-get-process-tree
Retrieves the process tree captured during dynamic analysis.
tz-get-processes
Retrieves processes captured during dynamic analysis.
tz-get-result
Retrieve the analysis result from ThreatZone.
tz-get-sanitized
Downloads a sanitized file from the ThreatZone API and uploads it to the War Room.
tz-get-signature-check-result
Retrieves authenticode and signature-check results.
tz-get-static-scan-result
Retrieves the static scan result for a submission.
tz-get-syscalls
Retrieves one bounded page of syscall telemetry.
tz-get-tcp-connections
Retrieves a bounded window of TCP connections.
tz-get-udp-connections
Retrieves a bounded window of UDP connections.
tz-get-url-analysis-result
Retrieves the full URL analysis report.
tz-get-yara-result
Retrieves YARA rules matched during analysis. Use tz-download-yara-rule for the generated rule file.
tz-list-media-files
Lists screenshots and videos available for a submission.
tz-list-network-configs
Lists network configurations available to the current ThreatZone workspace.
tz-list-submissions
Lists ThreatZone submissions with optional filters.
tz-open-in-browser
Creates a ThreatZone open-in-browser submission.
tz-sandbox-upload-sample
Submits a sample to ThreatZone for sandbox analysis.
tz-search-submissions-by-sha256
Searches ThreatZone submissions by SHA256 hash.
tz-static-upload-sample
Submits a sample to ThreatZone for static analysis.
tz-url-analysis
Submits a URL to ThreatZone for analysis.

Source

ThreatZone.py ThreatZone_test.py ThreatZone.yml ThreatZone_description.md

Download History Raw

commonfields:
  id: ThreatZone
  version: -1
name: ThreatZone
display: ThreatZone
category: Forensics & Malware Analysis
provider: Malwation
description: ThreatZone malware analysis sandboxing.
configuration:
- display: Server URL (e.g. https://app.threat.zone)
  name: url
  type: 0
  required: true
  section: Connect
  additionalinfo: The ThreatZone instance root or /public-api URL. The integration appends the suffix exactly once.
- name: apikey
  type: 9
  required: true
  section: Connect
  displaypassword: ThreatZone API Key
  hiddenusername: true
  additionalinfo: The API key generated for the ThreatZone workspace.
- display: Source Reliability
  name: integrationReliability
  type: 15
  additionalinfo: The reliability of the source providing the intelligence data.
  defaultvalue: A - Completely reliable
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
  additionalinfo: Whether to trust any certificate (not secure) by disabling TLS certificate validation.
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
  additionalinfo: Whether to use the system proxy settings for SDK requests.
script:
  script: "-"
  type: python
  commands:
  - name: tz-sandbox-upload-sample
    arguments:
    - name: entry_id
      description: The entry ID of the file to submit.
      required: true
    - name: environment
      required: false
      auto: PREDEFINED
      predefined:
      - w7_x64
      - w10_x64
      - w11_x64
      - linux-ubuntu_2204
      - macos-ventura
      - android9
      description: The environment to run the submission in.
      defaultValue: w7_x64
    - name: private
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether the submission is private. If omitted, the current ThreatZone API-provided default is used.
    - name: extension_check
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enforce MIME-based extension correction before sandbox execution. If omitted, the current ThreatZone API-provided default is used.
      required: false
    - name: auto
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to automatically select a sandbox environment based on the uploaded file type, ignoring the environment argument.
      defaultValue: "false"
      required: false
    - name: modules
      description: The legacy compatibility argument. ThreatZone v3.2 does not support per-submission module selection, so this value is validated but not forwarded.
      required: false
    - name: analyze_config
      description: The raw analyzeConfig JSON used to override or add sandbox metafields.
      required: false
    - name: timeout
      auto: PREDEFINED
      predefined:
      - "60"
      - "120"
      - "180"
      - "300"
      description: The duration of the submission analysis. If omitted, the current ThreatZone API-provided default is used.
    - name: work_path
      auto: PREDEFINED
      predefined:
      - "desktop"
      - "root"
      - appdata
      - windows
      - temp
      description: The working path of the submission. If omitted, the current ThreatZone API-provided default is used.
    - name: mouse_simulation
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enable mouse simulation. If omitted, the current ThreatZone API-provided default is used.
    - name: https_inspection
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enable HTTPS inspection for encrypted traffic. If omitted, the current ThreatZone API-provided default is used.
    - name: internet_connection
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enable internet connection. If omitted, the current ThreatZone API-provided default is used.
    - name: raw_logs
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to request raw logs. This legacy compatibility argument is not forwarded because ThreatZone v3.2 does not accept the metafield.
    - name: snapshot
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enable Fast Bootup. If omitted, the current ThreatZone API-provided default is used.
    - name: entrypoint
      required: false
      description: The filename inside the archive to execute (for archives).
    - name: password
      required: false
      description: The password for password-protected archives.
    - name: configurations
      required: false
      description: The advanced execution configuration as a JSON object (for example preScript, startArguments, or networkConfig).
    outputs:
    - contextPath: ThreatZone.Submission.Sandbox.UUID
      description: The UUID of the sample.
      type: String
    - contextPath: ThreatZone.Limits.E_Mail
      description: The owner e-mail of current plan.
      type: String
    - contextPath: ThreatZone.Limits.API_Limit
      description: The remaining/total API request limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Concurrent_Limit
      description: The remaining/total concurrent analysis limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Daily_Submission_Limit
      description: The remaining/total daily submission limits of the current plan.
      type: String
    description: Submits a sample to ThreatZone for sandbox analysis.
  - name: tz-static-upload-sample
    arguments:
    - name: entry_id
      description: The entry ID of the file to submit.
      required: true
    - name: private
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether the submission is visible only to members of your workspace. When false, the submission is visible to everyone.
      defaultValue: "true"
    - name: extension_check
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enforce MIME-based extension correction before static scan.
      defaultValue: "false"
    - name: entrypoint
      required: false
      description: The filename inside the archive to analyze (for archives).
    - name: password
      required: false
      description: The password for password-protected archives.
    outputs:
    - contextPath: ThreatZone.Submission.Static.UUID
      description: The UUID of the sample.
      type: String
    - contextPath: ThreatZone.Limits.E_Mail
      description: The owner e-mail of current plan.
      type: String
    - contextPath: ThreatZone.Limits.API_Limit
      description: The remaining/total API request limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Concurrent_Limit
      description: The remaining/total concurrent analysis limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Daily_Submission_Limit
      description: The remaining/total daily submission limits of the current plan.
      type: String
    description: Submits a sample to ThreatZone for static analysis.
  - name: tz-cdr-upload-sample
    arguments:
    - name: entry_id
      description: The entry ID of the file to submit.
      required: true
    - name: private
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether the submission is visible only to members of your workspace. When false, the submission is visible to everyone.
      defaultValue: "true"
    - name: extension_check
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enforce MIME-based extension correction before sanitization.
      defaultValue: "true"
    - name: entrypoint
      required: false
      description: The filename inside the archive to sanitize (for archives).
    - name: password
      required: false
      description: The password for password-protected archives.
    outputs:
    - contextPath: ThreatZone.Submission.CDR.UUID
      description: The UUID of the sample.
      type: String
    - contextPath: ThreatZone.Limits.E_Mail
      description: The owner e-mail of current plan.
      type: String
    - contextPath: ThreatZone.Limits.API_Limit
      description: The remaining/total API request limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Concurrent_Limit
      description: The remaining/total concurrent analysis limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Daily_Submission_Limit
      description: The remaining/total daily submission limits of the current plan.
      type: String
    description: Submits a sample to ThreatZone for CDR.
  - name: tz-url-analysis
    compliantpolicies:
    - Domain Blockage
    arguments:
    - name: url
      required: true
      description: The URL to analyze.
    - name: private
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to mark the submission as workspace-private.
      defaultValue: "true"
    - name: safe_browsing
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to start an isolated safe-browsing session alongside URL analysis.
      defaultValue: "false"
    outputs:
    - contextPath: ThreatZone.Submission.URL.UUID
      description: The UUID of the URL submission.
      type: String
    - contextPath: ThreatZone.Submission.URL.URL
      description: The URL submitted for analysis.
      type: String
    - contextPath: ThreatZone.Limits.E_Mail
      description: The owner e-mail of current plan.
      type: String
    - contextPath: ThreatZone.Limits.API_Limit
      description: The remaining/total API request limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Concurrent_Limit
      description: The remaining/total concurrent analysis limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Daily_Submission_Limit
      description: The remaining/total daily submission limits of the current plan.
      type: String
    description: Submits a URL to ThreatZone for analysis.
  - name: tz-get-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: details
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to include inline Indicators, IOCs, YARA matches, artifacts, and configuration data in the readable output.
      defaultValue: "false"
    - name: download_sanitized
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to download the sanitized file after a CDR analysis completes.
      defaultValue: "false"
    description: Retrieve the analysis result from ThreatZone.
    outputs:
    - contextPath: ThreatZone.Submission
      type: Unknown
      description: The raw submission data returned by ThreatZone.
    - contextPath: ThreatZone.Analysis.STATUS
      type: Number
      description: The status of the submission scanning process as an integer code (0=declined, 1=file received, 2=accepted, 3=running, 4=VM ready, 5=finished).
    - contextPath: ThreatZone.Analysis.LEVEL
      type: Number
      description: The threat level of the scanned file as an integer code (0=not measured, 1=informative, 2=suspicious, 3=malicious).
    - contextPath: ThreatZone.Analysis.INFO
      type: String
      description: The submission metadata such as file name/URL and privacy status.
    - contextPath: ThreatZone.Analysis.REPORT
      type: String
      description: The analysis report of the submission.
    - contextPath: ThreatZone.Analysis.URL
      type: String
      description: The result page url of the submission.
    - contextPath: ThreatZone.Analysis.MD5
      type: String
      description: The md5 hash of the submission.
    - contextPath: ThreatZone.Analysis.SHA1
      type: String
      description: The sha1 hash of the submission.
    - contextPath: ThreatZone.Analysis.SHA256
      type: String
      description: The sha256 hash of the submission.
    - contextPath: ThreatZone.Analysis.UUID
      type: String
      description: The UUID of the submission.
    - contextPath: ThreatZone.Analysis.SANITIZED
      description: The url of the sanitized file.
      type: String
    - contextPath: ThreatZone.IOC.URL
      description: The URL data extracted from IOC.
      type: List
    - contextPath: ThreatZone.IOC.IP
      description: The IP data extracted from IOC.
      type: List
    - contextPath: ThreatZone.IOC.DOMAIN
      description: The DOMAIN data extracted from IOC.
      type: List
    - contextPath: ThreatZone.IOC.EMAIL
      description: The EMAIL data extracted from IOC.
      type: List
    - contextPath: DBotScore.Indicator
      type: String
      description: The indicator that was tested.
    - contextPath: DBotScore.Reliability
      type: String
      description: The reliability of the source providing the intelligence data.
    - contextPath: DBotScore.Score
      type: Number
      description: The actual score.
    - contextPath: DBotScore.Type
      type: String
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
  - name: tz-get-indicator-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: level
      required: false
      auto: PREDEFINED
      predefined:
      - benign
      - suspicious
      - malicious
      description: The indicator severity to filter by.
    - name: category
      required: false
      description: The indicator category to filter by.
    - name: pid
      required: false
      description: The process ID to filter by.
    - name: attack_code
      required: false
      description: The MITRE ATT&CK technique code to filter by.
    description: Retrieves dynamic behaviour indicators for a submission from ThreatZone.
    outputs:
    - contextPath: ThreatZone.Submission.Indicators.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.Indicators.Data
      description: The dynamic behaviour indicators returned by ThreatZone.
      type: Unknown
  - name: tz-get-ioc-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: type
      required: false
      description: The IOC type to filter by.
    outputs:
    - contextPath: ThreatZone.Submission.IOCs.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.IOCs.Data
      description: The Indicators of Compromise returned by ThreatZone.
      type: Unknown
    description: Retrieves Indicators of Compromise for a submission from ThreatZone.
  - name: tz-get-yara-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: category
      required: false
      description: The matched YARA rule category to filter by.
    outputs:
    - contextPath: ThreatZone.Submission.YaraMatches.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.YaraMatches.Data
      description: The matched YARA rules returned by ThreatZone.
      type: Unknown
    description: Retrieves YARA rules matched during analysis. Use tz-download-yara-rule for the generated rule file.
  - name: tz-get-artifact-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    outputs:
    - contextPath: ThreatZone.Submission.Artifacts.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.Artifacts.Data
      description: The analysis artifacts returned by ThreatZone.
      type: Unknown
    description: Retrieves analysis artifacts for a submission from ThreatZone.
  - name: tz-get-config-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    outputs:
    - contextPath: ThreatZone.Submission.Config.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.Config.Data
      description: The configuration extractor results returned by ThreatZone.
      type: Unknown
    description: Retrieves configuration extractor results for a submission from ThreatZone.
  - name: tz-get-sanitized
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Downloads a sanitized file from the ThreatZone API and uploads it to the War Room.
    outputs:
    - contextPath: InfoFile.Extension
      type: String
      description: The extension of the file sanitized by CDR.
    - contextPath: InfoFile.Name
      type: String
      description: The name of the file sanitized by CDR.
    - contextPath: InfoFile.Size
      type: Number
      description: The size of the file sanitized by CDR.
    - contextPath: InfoFile.EntryID
      type: String
      description: The entry ID of the file sanitized by CDR.
    - contextPath: InfoFile.Info
      type: String
      description: The info of the file sanitized by CDR.
    - contextPath: InfoFile.MD5
      type: String
      description: The MD5 hash of the file sanitized by CDR.
    - contextPath: InfoFile.SHA1
      type: String
      description: The SHA1 hash of the file sanitized by CDR.
    - contextPath: InfoFile.SHA256
      type: String
      description: The SHA256 hash of the file sanitized by CDR.
    - contextPath: InfoFile.SHA512
      type: String
      description: The SHA512 hash of the file sanitized by CDR.
    - contextPath: InfoFile.SSDeep
      type: String
      description: The SSDeep hash of the file sanitized by CDR.
  - name: tz-download-html-report
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Downloads the HTML report for a submission and uploads it to the War Room.
    outputs:
    - contextPath: InfoFile.Extension
      type: String
      description: The extension of the HTML report.
    - contextPath: InfoFile.Name
      type: String
      description: The name of the downloaded HTML report.
    - contextPath: InfoFile.Size
      type: Number
      description: The size of the downloaded HTML report.
    - contextPath: InfoFile.EntryID
      type: String
      description: The entry ID of the downloaded HTML report.
    - contextPath: InfoFile.Info
      type: String
      description: The info for the downloaded HTML report.
    - contextPath: InfoFile.MD5
      type: String
      description: The MD5 hash of the downloaded HTML report.
    - contextPath: InfoFile.SHA1
      type: String
      description: The SHA1 hash of the downloaded HTML report.
    - contextPath: InfoFile.SHA256
      type: String
      description: The SHA256 hash of the downloaded HTML report.
    - contextPath: InfoFile.SHA512
      type: String
      description: The SHA512 hash of the downloaded HTML report.
    - contextPath: InfoFile.SSDeep
      type: String
      description: The SSDeep hash of the downloaded HTML report.
  - name: tz-get-metafields
    arguments:
    - name: scan_type
      description: The scan type to filter metafields.
      required: false
      auto: PREDEFINED
      predefined:
      - sandbox
      - static
      - cdr
      - url
      - open_in_browser
    description: Retrieves available ThreatZone metafields, optionally filtered by scan type.
    outputs:
    - contextPath: ThreatZone.Configuration.Metafields.ScanType
      description: The scan type used to filter the metafields.
      type: String
    - contextPath: ThreatZone.Configuration.Metafields.Data
      description: The metafield definitions returned by ThreatZone.
      type: Unknown
  - name: tz-get-environments
    description: Retrieves available ThreatZone sandbox environments.
    outputs:
    - contextPath: ThreatZone.Configuration.Environments.Data
      description: The sandbox environment definitions returned by ThreatZone.
      type: Unknown
  - name: tz-list-network-configs
    description: Lists network configurations available to the current ThreatZone workspace.
    outputs:
    - contextPath: ThreatZone.Configuration.NetworkConfigurations.Data
      description: The network configuration summaries returned by ThreatZone.
      type: Unknown
  - name: tz-open-in-browser
    arguments:
    - name: url
      required: true
      description: The URL to open in an isolated browser environment.
    - name: environment
      required: false
      description: The sandbox environment key for browser execution.
    - name: auto
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "false"
      description: Whether to let ThreatZone select the browser environment.
    - name: metafields
      required: false
      description: The open-in-browser metafields as a JSON object.
    - name: private
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "true"
      description: Whether to mark the submission as workspace-private.
    - name: configurations
      required: false
      description: The advanced execution configuration as a JSON object.
    description: Creates a ThreatZone open-in-browser submission.
    outputs:
    - contextPath: ThreatZone.Submission.OpenInBrowser.UUID
      description: The UUID of the open-in-browser submission.
      type: String
    - contextPath: ThreatZone.Submission.OpenInBrowser.URL
      description: The URL submitted to ThreatZone.
      type: String
  - name: tz-list-submissions
    arguments:
    - name: page
      required: false
      defaultValue: "1"
      description: The page number, starting at 1.
    - name: limit
      required: false
      defaultValue: "20"
      description: The number of submissions per page (1-100).
    - name: level
      required: false
      description: The comma-separated threat levels.
    - name: type
      required: false
      auto: PREDEFINED
      predefined:
      - file
      - url
      description: The submission type.
    - name: sha256
      required: false
      description: The SHA256 hash filter.
    - name: filename
      required: false
      description: The partial filename filter.
    - name: start_date
      required: false
      description: The ISO 8601 date to include submissions created on or after (for example, 2020-01-01T00:11:22Z).
    - name: end_date
      required: false
      description: The ISO 8601 date to include submissions created on or before (for example, 2020-01-01T00:11:22Z).
    - name: private
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to filter by privacy status.
    - name: tags
      required: false
      description: The comma-separated tag filters.
    - name: sort
      required: false
      description: The field used to sort results, such as createdAt.
    - name: order
      required: false
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: The sort order.
    description: Lists ThreatZone submissions with optional filters.
    outputs:
    - contextPath: ThreatZone.Submission.List
      description: The paginated ThreatZone submission results.
      type: Unknown
  - name: tz-search-submissions-by-sha256
    arguments:
    - name: sha256
      required: true
      description: The SHA256 hash to search for.
    description: Searches ThreatZone submissions by SHA256 hash.
    outputs:
    - contextPath: ThreatZone.SubmissionSearch.Data
      description: The matching submissions.
      type: Unknown
  - name: tz-get-overview-summary
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves aggregate analysis counts for a submission.
    outputs:
    - contextPath: ThreatZone.Submission.OverviewSummary.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.OverviewSummary.Data
      description: The aggregate analysis summary.
      type: Unknown
  - name: tz-get-eml-analysis
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves parsed EML analysis results.
    outputs:
    - contextPath: ThreatZone.Submission.EMLAnalysis.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.EMLAnalysis.Data
      description: The parsed EML analysis data.
      type: Unknown
  - name: tz-get-mitre-techniques
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves MITRE ATT&CK techniques matched during analysis.
    outputs:
    - contextPath: ThreatZone.Submission.MITRE.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.MITRE.Data
      description: The matched MITRE ATT&CK techniques.
      type: Unknown
  - name: tz-get-static-scan-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves the static scan result for a submission.
    outputs:
    - contextPath: ThreatZone.Submission.StaticScan.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.StaticScan.Data
      description: The static scan result.
      type: Unknown
  - name: tz-get-cdr-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves the CDR transformation result for a submission.
    outputs:
    - contextPath: ThreatZone.Submission.CDRResult.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.CDRResult.Data
      description: The CDR transformation result.
      type: Unknown
  - name: tz-get-signature-check-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves authenticode and signature-check results.
    outputs:
    - contextPath: ThreatZone.Submission.SignatureCheck.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.SignatureCheck.Data
      description: The signature-check result.
      type: Unknown
  - name: tz-get-processes
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves processes captured during dynamic analysis.
    outputs:
    - contextPath: ThreatZone.Submission.Processes.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.Processes.Data
      description: The captured processes.
      type: Unknown
  - name: tz-get-process-tree
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves the process tree captured during dynamic analysis.
    outputs:
    - contextPath: ThreatZone.Submission.ProcessTree.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.ProcessTree.Data
      description: The captured process tree.
      type: Unknown
  - name: tz-get-url-analysis-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the URL or open-in-browser submission.
    description: Retrieves the full URL analysis report.
    outputs:
    - contextPath: ThreatZone.Submission.URLAnalysis.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.URLAnalysis.Data
      description: The URL analysis report.
      type: Unknown
  - name: tz-get-behaviours
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: type
      required: false
      description: The behaviour event type filter.
    - name: pid
      required: false
      description: The process ID filter.
    - name: operation
      required: false
      description: The operation-name filter.
    - name: process_name
      required: false
      description: The exact process-name filter.
    - name: page
      required: false
      defaultValue: "1"
      description: The page number, starting at 1.
    - name: limit
      required: false
      defaultValue: "100"
      description: The number of events to return (1-500).
    description: Retrieves one bounded page of behaviour telemetry.
    outputs:
    - contextPath: ThreatZone.Submission.Behaviours.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.Behaviours.Data
      description: The behaviour events and pagination metadata.
      type: Unknown
  - name: tz-get-syscalls
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: page
      required: false
      defaultValue: "1"
      description: The page number, starting at 1.
    - name: limit
      required: false
      defaultValue: "500"
      description: The number of syscall lines to return (1-2000).
    description: Retrieves one bounded page of syscall telemetry.
    outputs:
    - contextPath: ThreatZone.Submission.Syscalls.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.Syscalls.Data
      description: The syscall lines and pagination metadata.
      type: Unknown
  - name: tz-get-network-summary
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves aggregate network activity counts.
    outputs:
    - contextPath: ThreatZone.Submission.NetworkSummary.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.NetworkSummary.Data
      description: The network activity summary.
      type: Unknown
  - name: tz-get-dns-queries
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: limit
      required: false
      description: The maximum items to return (0-1000).
    - name: skip
      required: false
      description: The number of items to skip (0-1000).
    description: Retrieves a bounded window of DNS queries.
    outputs:
    - contextPath: ThreatZone.Submission.DNSQueries.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.DNSQueries.Data
      description: The captured DNS queries.
      type: Unknown
  - name: tz-get-http-requests
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: limit
      required: false
      description: The maximum items to return (0-1000).
    - name: skip
      required: false
      description: The number of items to skip (0-1000).
    description: Retrieves a bounded window of HTTP request hosts.
    outputs:
    - contextPath: ThreatZone.Submission.HTTPRequests.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.HTTPRequests.Data
      description: The captured HTTP request hosts.
      type: Unknown
  - name: tz-get-tcp-connections
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: limit
      required: false
      description: The maximum items to return (0-1000).
    - name: skip
      required: false
      description: The number of items to skip (0-1000).
    description: Retrieves a bounded window of TCP connections.
    outputs:
    - contextPath: ThreatZone.Submission.TCPConnections.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.TCPConnections.Data
      description: The captured TCP connections.
      type: Unknown
  - name: tz-get-udp-connections
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: limit
      required: false
      description: The maximum items to return (0-1000).
    - name: skip
      required: false
      description: The number of items to skip (0-1000).
    description: Retrieves a bounded window of UDP connections.
    outputs:
    - contextPath: ThreatZone.Submission.UDPConnections.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.UDPConnections.Data
      description: The captured UDP connections.
      type: Unknown
  - name: tz-get-network-threats
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: limit
      required: false
      description: The maximum items to return (0-1000).
    - name: skip
      required: false
      description: The number of items to skip (0-1000).
    description: Retrieves a bounded window of Suricata network threats.
    outputs:
    - contextPath: ThreatZone.Submission.NetworkThreats.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.NetworkThreats.Data
      description: The detected network threats.
      type: Unknown
  - name: tz-download-static-scan-strings
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Downloads the static scan strings JSON to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-download-sample
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Downloads the original submitted sample to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-download-artifact
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: artifact_id
      required: true
      description: The artifact ID returned by tz-get-artifact-result.
    description: Downloads an extracted artifact to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-download-pcap
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Downloads the network capture to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-download-yara-rule
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: timeout
      required: false
      defaultValue: "120"
      description: The maximum seconds to poll for generated YARA rule readiness (1-3600).
    description: Polls for and downloads the generated YARA rule file to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-download-url-screenshot
    arguments:
    - name: uuid
      required: true
      description: The UUID of the URL analysis submission.
    description: Downloads the URL analysis screenshot to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-list-media-files
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Lists screenshots and videos available for a submission.
    outputs:
    - contextPath: ThreatZone.Submission.MediaFiles.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.MediaFiles.Data
      description: The available media file metadata.
      type: Unknown
  - name: tz-download-media-file
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: file_id
      required: true
      description: The media file ID returned by tz-list-media-files.
    description: Downloads a submission media file to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-check-limits
    arguments:
    - name: detailed
      description: Whether to include plan file limits, enabled modules, and account metadata.
      default: false
    description: Check the plan limits from ThreatZone API.
    outputs:
    - contextPath: ThreatZone.Limits.E_Mail
      description: The owner e-mail of current plan.
      type: String
    - contextPath: ThreatZone.Limits.API_Limit
      description: The remaining/total API request limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Concurrent_Limit
      description: The remaining/total concurrent analysis limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Daily_Submission_Limit
      description: The remaining/total daily submission limits of the current plan.
      type: String
    - contextPath: ThreatZone.Plan.File_Size_Limit_MiB
      description: The maximum upload size for the workspace plan (MiB).
      type: Number
    - contextPath: ThreatZone.Plan.Allowed_Extensions
      description: The list of permitted file extensions for uploads.
      type: List
    - contextPath: ThreatZone.Plan.Modules
      description: The enabled ThreatZone modules for the workspace.
      type: List
    - contextPath: ThreatZone.Metadata.Full_Name
      description: The full name of the authenticated user.
      type: String
    - contextPath: ThreatZone.Metadata.Workspace
      description: The workspace identifier or name associated with the account.
      type: String
    - contextPath: ThreatZone.Metadata.Plan_Name
      description: The name of the active ThreatZone plan.
      type: String
    - contextPath: ThreatZone.Metadata.Plan_Status
      description: The status of the active ThreatZone plan.
      type: String
  dockerimage: demisto/threatzone-sdk:1.1.1.12287331
  runonce: false
  subtype: python3
fromversion: 6.9.0
sectionorder:
- Connect
- Collect
tests:
- ThreatZone Test