category: Forensics & Malware Analysis provider: CrowdStrike sectionorder: - Connect - Collect commonfields: id: CrowdStrike Falcon X version: -1 configuration: - defaultvalue: https://api.crowdstrike.com display: Cloud Base URL (e.g., https://api.crowdstrike.com) name: base_url type: 0 section: Connect required: false - display: Client ID name: credentials required: true type: 9 section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false - additionalinfo: Reliability of the source providing the intelligence data defaultvalue: B - Usually reliable display: Source Reliability name: reliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 section: Collect required: false description: Use the CrowdStrike Falcon Intelligence Sandbox integration to submit files, file hashes, URLs, and FTPs for sandbox analysis, and to retrieve reports. display: CrowdStrike Falcon Intelligence Sandbox name: CrowdStrike Falcon X script: commands: - arguments: - description: Name of the file to upload for sandbox analysis. name: file_name - description: This ia an internal argument used for the polling process, not to be used by the user. isArray: true name: ids - description: A descriptive comment to identify the file for other users. name: comment - auto: PREDEFINED description: Determines the visibility of this file in Falcon MalQuery. Can be "true" or "false". If "true", the file is confidential. name: is_confidential predefined: - 'true' - 'false' - description: Content of the uploaded sample in binary format, This arg can also receive entry ID from war room. name: file - auto: PREDEFINED description: Whether to use Cortex XSOAR's built-in polling to retrieve the result when it's ready. name: polling predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: 'false' description: If set to true, the report will return extended data which includes mitre attacks and signature information. name: extended_data predefined: - 'true' - 'false' - defaultValue: '600' description: Interval in seconds between each poll. name: interval_in_seconds - auto: PREDEFINED default: defaultValue: no description: Whether to submit the given file to the sandbox. Can be "yes" or "no". Default is "no". name: submit_file predefined: - no - yes - auto: PREDEFINED defaultValue: "160: Windows 10 (64-bit)" description: Sandbox environment used for analysis. Relevant if the submit_file parameter is set to true. name: environment_id predefined: - "400: MacOS Catalina 10.15" - "310: Linux Ubuntu 20 (64-bit)" - "200: Android (static analysis)" - "160: Windows 10 (64-bit)" - "140: Windows 11 (64-bit)" - "110: Windows 7 (64-bit)" - "100: Windows 7 (32-bit)" - auto: PREDEFINED description: Runtime script for sandbox analysis. Relevant if the submit_file parameter is set to true. name: action_script predefined: - default - default_maxantievasion - default_randomfiles - default_randomtheme - default_openie - description: 'Command line script passed to the submitted file at runtime. Max length: 2048 characters. Relevant if the submit_file parameter is set to true.' name: command_line - description: 'Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters. Relevant if the submit_file parameter is set to true.' name: document_password - auto: PREDEFINED description: Deprecated, please use network_settings instead. hidden: true name: enable_tor predefined: - 'true' - 'false' - description: Name of the malware sample that is used for file type detection and analysis. Relevant if the submit_file parameter is set to true. name: submit_name - description: Set a custom date for the sandbox environment in the format yyyy-MM-dd. Relevant if the submit_file parameter is set to true. name: system_date - description: Sets a custom time for the sandbox environment in the format HH:mm. Relevant if the submit_file parameter is set to true. name: system_time - name: network_settings required: false description: | Specifies the sandbox network configuration used for analysis. Possible values are: - default: Fully operating network (default behavior if not specified). - tor: Route network traffic via TOR. - simulated: Simulate network traffic. - offline: Disable all network traffic. auto: PREDEFINED predefined: - default - tor - simulated - offline description: Uploads a file for sandbox analysis. name: cs-fx-upload-file polling: true outputs: - contextPath: csfalconx.resource.tags description: Analysis tags. type: String - contextPath: csfalconx.resource.sandbox.http_requests.header description: The header of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.Accept description: The accept of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.host_ip description: The host ip of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.host_port description: The host port of the http request. type: Number - contextPath: csfalconx.resource.sandbox.http_requests.method description: The method of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.url description: The URL of the http request. type: String - contextPath: csfalconx.resource.sandbox.User-Agent description: The user agent of the http request. type: String - contextPath: csfalconx.resource.sandbox.processes.command_line description: The sandbox process command line. type: String - contextPath: csfalconx.resource.sandbox.processes.handles.id description: The sandbox handled ID. type: String - contextPath: csfalconx.resource.sandbox.processes.handles.type description: The sandbox handled type. type: String - contextPath: csfalconx.resource.sandbox.processes.handles.path description: The sandbox handled path. type: String - contextPath: csfalconx.resource.sandbox.processes.name description: The sandbox process name. type: String - contextPath: csfalconx.resource.sandbox.processes.normalized_path description: The sandbox process normalized path. type: String - contextPath: csfalconx.resource.sandbox.processes.pid description: The sandbox process pid. type: Number - contextPath: csfalconx.resource.sandbox.processes.sha256 description: The sandbox process sha256. type: String - contextPath: csfalconx.resource.sandbox.architecture description: The sandbox architecture. type: String - contextPath: csfalconx.resource.sandbox.classification description: The sandbox classification. type: String - contextPath: csfalconx.resource.sandbox.classification_tags description: The sandbox classification tags. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.name description: The sandbox extracted file name. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.file_size description: The sandbox extracted file size. type: Number - contextPath: csfalconx.resource.sandbox.extracted_files.sha256 description: The sandbox extracted file sha256. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.md5 description: The sandbox extracted file md5. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.sha1 description: The sandbox extracted file sha1. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.runtime_process description: The sandbox extracted file runtime process. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.type_tags description: The sandbox extracted file tags type. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.threat_level_readable description: The sandbox extracted file threat level readable. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.description description: The sandbox extracted file description. type: String - contextPath: csfalconx.resource.sandbox.file_metadata.file_compositions description: The sandbox file metadata compositions. type: Unknown - contextPath: csfalconx.resource.sandbox.file_metadata.imported_objects description: The sandbox file metadata imported objects. type: Unknown - contextPath: csfalconx.resource.sandbox.file_metadata.file_analysis description: The sandbox file metadata analysis. type: Unknown - contextPath: csfalconx.resource.sandbox.file_size description: The sandbox file size. type: Number - contextPath: csfalconx.resource.sandbox.file_type description: The sandbox file type. type: String - contextPath: csfalconx.resource.sandbox.file_type_short description: The sandbox file type short. type: String - contextPath: csfalconx.resource.sandbox.packer description: The sandbox packer. type: String - contextPath: csfalconx.resource.sandbox.screenshots_artifact_ids description: The sandbox screenshots artifact ids. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.address description: The sandbox dns requests address. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.country description: The sandbox dns requests country. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.domain description: The sandbox dns requests domain. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.registrar_creation_timestamp description: The sandbox dns requests registrar creation timestamp. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.registrar_name description: The sandbox dns requests registrar name. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.registrar_organization description: The sandbox dns requests registrar organization. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.address description: The sandbox contacted hosts address. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.country description: The sandbox contacted hosts country. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.port description: The sandbox contacted hosts port. type: Number - contextPath: csfalconx.resource.sandbox.contacted_hosts.protocol description: The sandbox contacted hosts protocol. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.associated_runtime.name description: The sandbox contacted hosts associated runtime name. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.associated_runtime.pid description: The sandbox contacted hosts associated runtime pid. type: String - contextPath: csfalconx.resource.sandbox.incidents description: The sandbox incidents. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.tactic description: The sandbox MITRE tactic name. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.technique description: The sandbox MITRE technique name. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.attack_id description: The sandbox MITRE technique ID. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.malicious_identifiers description: The sandbox MITRE malicious identifiers. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.parent.technique description: The sandbox MITRE parent technique name. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.parent.attack_id description: The sandbox MITRE parent technique ID. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.parent.attack_id_wiki description: The sandbox MITRE parent technique wiki URL link. type: String - contextPath: csfalconx.resource.sandbox.signatures.threat_level_human description: The sandbox signatures threat level. type: String - contextPath: csfalconx.resource.sandbox.signatures.category description: The sandbox signatures category. type: String - contextPath: csfalconx.resource.sandbox.signatures.identifier description: The sandbox signatures identifier. type: String - contextPath: csfalconx.resource.sandbox.signatures.type description: The sandbox signatures type. type: Number - contextPath: csfalconx.resource.sandbox.signatures.relevance description: The sandbox signatures relevance. type: Number - contextPath: csfalconx.resource.sandbox.signatures.name description: The sandbox signatures name. type: String - contextPath: csfalconx.resource.sandbox.signatures.description description: The sandbox signatures description. type: String - contextPath: csfalconx.resource.sandbox.signatures.origin description: The sandbox signatures origin. type: String - contextPath: csfalconx.resource.intel.malware_families description: The malware families of the resource. type: Unknown - contextPath: csfalconx.resource.sha256 description: SHA256 hash of the uploaded file. type: String - contextPath: csfalconx.resource.file_name description: 'Name of the uploaded file. ' type: String - arguments: - description: SHA256 ID of the sample, which is a SHA256 hash value. Find the sample ID from the response when uploading a malware sample or search with the cs-fx-upload-file command. name: sha256 - auto: PREDEFINED description: Sandbox environment used for analysis. name: environment_id predefined: - "400: MacOS Catalina 10.15" - "310: Linux Ubuntu 20 (64-bit)" - "200: Android (static analysis)" - "160: Windows 10 (64-bit)" - "140: Windows 11 (64-bit)" - "110: Windows 7 (64-bit)" - "100: Windows 7 (32-bit)" - auto: PREDEFINED description: Runtime script for sandbox analysis. name: action_script predefined: - default - default_maxantievasion - default_randomfiles - default_randomtheme - default_openie - description: 'Command line script passed to the submitted file at runtime. Max length: 2048 characters.' name: command_line - description: 'Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters.' name: document_password - auto: PREDEFINED description: Deprecated, please use network_settings instead. name: enable_tor deprecated: true hidden: true predefined: - 'true' - 'false' - description: Name of the malware sample that’s used for file type detection. and analysis. name: submit_name - description: Set a custom date for the sandbox environment in the format yyyy-MM-dd. name: system_date - auto: PREDEFINED description: Whether to use Cortex XSOAR's built-in polling to retrieve the result when it's ready, Note - This command counts against the submission quota. name: polling predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: 'false' description: If set to true, the report will return extended data which includes mitre attacks and signature information. name: extended_data predefined: - 'true' - 'false' - description: This ia an internal argument used for the polling process, not to be used by the user. isArray: true name: ids - defaultValue: '600' description: Interval in seconds between each poll. name: interval_in_seconds - description: Sets a custom time for the sandbox environment in the format HH:mm. name: system_time - name: network_settings required: false description: | Specifies the sandbox network configuration used for analysis. Possible values are: - default: Fully operating network (default behavior if not specified). - tor: Route network traffic via TOR. - simulated: Simulate network traffic. - offline: Disable all network traffic. auto: PREDEFINED predefined: - default - tor - simulated - offline polling: true description: Submits a sample SHA256 hash for sandbox analysis. name: cs-fx-submit-uploaded-file outputs: - contextPath: csfalconx.resource.uploaded_id description: Analysis ID received after uploading the file. type: String - contextPath: csfalconx.resource.file_name description: 'Name of the uploaded file. ' type: String - contextPath: csfalconx.resource.tags description: Analysis tags. type: String - contextPath: csfalconx.resource.sandbox.http_requests.header description: The header of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.Accept description: The accept of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.host_ip description: The host ip of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.host_port description: The host port of the http request. type: Number - contextPath: csfalconx.resource.sandbox.http_requests.method description: The method of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.url description: The URL of the http request. type: String - contextPath: csfalconx.resource.sandbox.User-Agent description: The user agent of the http request. type: String - contextPath: csfalconx.resource.sandbox.processes.command_line description: The sandbox process command line. type: String - contextPath: csfalconx.resource.sandbox.processes.handles.id description: The sandbox handled ID. type: String - contextPath: csfalconx.resource.sandbox.processes.handles.type description: The sandbox handled type. type: String - contextPath: csfalconx.resource.sandbox.processes.handles.path description: The sandbox handled path. type: String - contextPath: csfalconx.resource.sandbox.processes.name description: The sandbox process name. type: String - contextPath: csfalconx.resource.sandbox.processes.normalized_path description: The sandbox process normalized path. type: String - contextPath: csfalconx.resource.sandbox.processes.pid description: The sandbox process pid. type: Number - contextPath: csfalconx.resource.sandbox.processes.sha256 description: The sandbox process sha256. type: String - contextPath: csfalconx.resource.sandbox.architecture description: The sandbox architecture. type: String - contextPath: csfalconx.resource.sandbox.classification description: The sandbox classification. type: String - contextPath: csfalconx.resource.sandbox.classification_tags description: The sandbox classification tags. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.name description: The sandbox extracted file name. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.file_size description: The sandbox extracted file size. type: Number - contextPath: csfalconx.resource.sandbox.extracted_files.sha256 description: The sandbox extracted file sha256. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.md5 description: The sandbox extracted file md5. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.sha1 description: The sandbox extracted file sha1. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.runtime_process description: The sandbox extracted file runtime process. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.type_tags description: The sandbox extracted file tags type. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.threat_level_readable description: The sandbox extracted file threat level readable. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.description description: The sandbox extracted file description. type: String - contextPath: csfalconx.resource.sandbox.file_metadata.file_compositions description: The sandbox file metadata compositions. type: Unknown - contextPath: csfalconx.resource.sandbox.file_metadata.imported_objects description: The sandbox file metadata imported objects. type: Unknown - contextPath: csfalconx.resource.sandbox.file_metadata.file_analysis description: The sandbox file metadata analysis. type: Unknown - contextPath: csfalconx.resource.sandbox.file_size description: The sandbox file size. type: Number - contextPath: csfalconx.resource.sandbox.file_type description: The sandbox file type. type: String - contextPath: csfalconx.resource.sandbox.file_type_short description: The sandbox file type short. type: String - contextPath: csfalconx.resource.sandbox.packer description: The sandbox packer. type: String - contextPath: csfalconx.resource.sandbox.screenshots_artifact_ids description: The sandbox screenshots artifact ids. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.address description: The sandbox dns requests address. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.country description: The sandbox dns requests country. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.domain description: The sandbox dns requests domain. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.registrar_creation_timestamp description: The sandbox dns requests registrar creation timestamp. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.registrar_name description: The sandbox dns requests registrar name. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.registrar_organization description: The sandbox dns requests registrar organization. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.address description: The sandbox contacted hosts address. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.country description: The sandbox contacted hosts country. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.port description: The sandbox contacted hosts port. type: Number - contextPath: csfalconx.resource.sandbox.contacted_hosts.protocol description: The sandbox contacted hosts protocol. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.associated_runtime.name description: The sandbox contacted hosts associated runtime name. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.associated_runtime.pid description: The sandbox contacted hosts associated runtime pid. type: String - contextPath: csfalconx.resource.sandbox.incidents description: The sandbox incidents. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.tactic description: The sandbox MITRE tactic name. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.technique description: The sandbox MITRE technique name. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.attack_id description: The sandbox MITRE technique ID. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.malicious_identifiers description: The sandbox MITRE malicious identifiers. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.parent.technique description: The sandbox MITRE parent technique name. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.parent.attack_id description: The sandbox MITRE parent technique ID. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.parent.attack_id_wiki description: The sandbox MITRE parent technique wiki URL link. type: String - contextPath: csfalconx.resource.sandbox.signatures.threat_level_human description: The sandbox signatures threat level. type: String - contextPath: csfalconx.resource.sandbox.signatures.category description: The sandbox signatures category. type: String - contextPath: csfalconx.resource.sandbox.signatures.identifier description: The sandbox signatures identifier. type: String - contextPath: csfalconx.resource.sandbox.signatures.type description: The sandbox signatures type. type: Number - contextPath: csfalconx.resource.sandbox.signatures.relevance description: The sandbox signatures relevance. type: Number - contextPath: csfalconx.resource.sandbox.signatures.name description: The sandbox signatures name. type: String - contextPath: csfalconx.resource.sandbox.signatures.description description: The sandbox signatures description. type: String - contextPath: csfalconx.resource.sandbox.signatures.origin description: The sandbox signatures origin. type: String - contextPath: csfalconx.resource.intel.malware_families description: The malware families of the resource. type: Unknown - contextPath: csfalconx.resource.state description: Analysis state. type: String - contextPath: csfalconx.resource.created_timestamp description: Analysis start time. type: String - contextPath: csfalconx.resource.sha256 description: SHA256 hash of the scanned file. type: Unknown - contextPath: csfalconx.resource.environment_id description: 'Environment ID of the analysis. ' type: Unknown - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: File.Name description: The name of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: File.Malicious.Description description: For malicious files, the full description. type: String - contextPath: csfalconx.resource.submitted_id description: Analysis ID received after submitting the file. type: String - arguments: - description: ID of a submitted malware sample. Find a submission ID from the response when submitting a malware sample or search with the cs-fx-submit-uploaded-file command. isArray: true name: ids required: true - auto: PREDEFINED defaultValue: 'false' description: If set to true, the report will return extended data which includes mitre attacks and signature information. name: extended_data predefined: - 'true' - 'false' description: Gets a full version of a sandbox report. name: cs-fx-get-full-report outputs: - contextPath: csfalconx.resource.tags description: Analysis tags. type: String - contextPath: csfalconx.resource.file_name description: 'Name of the uploaded file. ' type: String - contextPath: csfalconx.resource.sandbox.http_requests.header description: The header of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.Accept description: The accept of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.host_ip description: The host ip of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.host_port description: The host port of the http request. type: Number - contextPath: csfalconx.resource.sandbox.http_requests.method description: The method of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.url description: The URL of the http request. type: String - contextPath: csfalconx.resource.sandbox.User-Agent description: The user agent of the http request. type: String - contextPath: csfalconx.resource.sandbox.processes.command_line description: The sandbox process command line. type: String - contextPath: csfalconx.resource.sandbox.processes.handles.id description: The sandbox handled ID. type: String - contextPath: csfalconx.resource.sandbox.processes.handles.type description: The sandbox handled type. type: String - contextPath: csfalconx.resource.sandbox.processes.handles.path description: The sandbox handled path. type: String - contextPath: csfalconx.resource.sandbox.processes.name description: The sandbox process name. type: String - contextPath: csfalconx.resource.sandbox.processes.normalized_path description: The sandbox process normalized path. type: String - contextPath: csfalconx.resource.sandbox.processes.pid description: The sandbox process pid. type: Number - contextPath: csfalconx.resource.sandbox.processes.sha256 description: The sandbox process sha256. type: String - contextPath: csfalconx.resource.sandbox.architecture description: The sandbox architecture. type: String - contextPath: csfalconx.resource.sandbox.classification description: The sandbox classification. type: String - contextPath: csfalconx.resource.sandbox.classification_tags description: The sandbox classification tags. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.name description: The sandbox extracted file name. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.file_size description: The sandbox extracted file size. type: Number - contextPath: csfalconx.resource.sandbox.extracted_files.sha256 description: The sandbox extracted file sha256. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.md5 description: The sandbox extracted file md5. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.sha1 description: The sandbox extracted file sha1. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.runtime_process description: The sandbox extracted file runtime process. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.type_tags description: The sandbox extracted file tags type. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.threat_level_readable description: The sandbox extracted file threat level readable. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.description description: The sandbox extracted file description. type: String - contextPath: csfalconx.resource.sandbox.file_metadata.file_compositions description: The sandbox file metadata compositions. type: Unknown - contextPath: csfalconx.resource.sandbox.file_metadata.imported_objects description: The sandbox file metadata imported objects. type: Unknown - contextPath: csfalconx.resource.sandbox.file_metadata.file_analysis description: The sandbox file metadata analysis. type: Unknown - contextPath: csfalconx.resource.sandbox.file_size description: The sandbox file size. type: Number - contextPath: csfalconx.resource.sandbox.file_type description: The sandbox file type. type: String - contextPath: csfalconx.resource.sandbox.file_type_short description: The sandbox file type short. type: String - contextPath: csfalconx.resource.sandbox.packer description: The sandbox packer. type: String - contextPath: csfalconx.resource.sandbox.screenshots_artifact_ids description: The sandbox screenshots artifact ids. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.address description: The sandbox dns requests address. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.country description: The sandbox dns requests country. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.domain description: The sandbox dns requests domain. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.registrar_creation_timestamp description: The sandbox dns requests registrar creation timestamp. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.registrar_name description: The sandbox dns requests registrar name. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.registrar_organization description: The sandbox dns requests registrar organization. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.address description: The sandbox contacted hosts address. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.country description: The sandbox contacted hosts country. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.port description: The sandbox contacted hosts port. type: Number - contextPath: csfalconx.resource.sandbox.contacted_hosts.protocol description: The sandbox contacted hosts protocol. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.associated_runtime.name description: The sandbox contacted hosts associated runtime name. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.associated_runtime.pid description: The sandbox contacted hosts associated runtime pid. type: String - contextPath: csfalconx.resource.sandbox.incidents description: The sandbox incidents. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.tactic description: The sandbox MITRE tactic name. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.technique description: The sandbox MITRE technique name. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.attack_id description: The sandbox MITRE technique ID. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.malicious_identifiers description: The sandbox MITRE malicious identifiers. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.parent.technique description: The sandbox MITRE parent technique name. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.parent.attack_id description: The sandbox MITRE parent technique ID. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.parent.attack_id_wiki description: The sandbox MITRE parent technique wiki URL link. type: String - contextPath: csfalconx.resource.sandbox.signatures.threat_level_human description: The sandbox signatures threat level. type: String - contextPath: csfalconx.resource.sandbox.signatures.category description: The sandbox signatures category. type: String - contextPath: csfalconx.resource.sandbox.signatures.identifier description: The sandbox signatures identifier. type: String - contextPath: csfalconx.resource.sandbox.signatures.type description: The sandbox signatures type. type: Number - contextPath: csfalconx.resource.sandbox.signatures.relevance description: The sandbox signatures relevance. type: Number - contextPath: csfalconx.resource.sandbox.signatures.name description: The sandbox signatures name. type: String - contextPath: csfalconx.resource.sandbox.signatures.description description: The sandbox signatures description. type: String - contextPath: csfalconx.resource.sandbox.signatures.origin description: The sandbox signatures origin. type: String - contextPath: csfalconx.resource.intel.malware_families description: The malware families of the resource. type: Unknown - contextPath: csfalconx.resource.submitted_id description: Analysis ID received after submitting the file. type: String - contextPath: csfalconx.resource.verdict description: Analysis verdict. type: String - contextPath: csfalconx.resource.created_timestamp description: Analysis start time. type: String - contextPath: csfalconx.resource.environment_id description: Environment ID. type: String - contextPath: csfalconx.resource.sandbox.environment_description description: Environment description. type: String - contextPath: csfalconx.resource.threat_score description: Score of the threat. type: Int - contextPath: csfalconx.resource.submit_url description: URL submitted for analysis. type: String - contextPath: csfalconx.resource.submission_type description: Type of submitted artifact, for example file, URL, etc. type: String - contextPath: csfalconx.resource.file_type description: File type. type: String - contextPath: csfalconx.resource.file_size description: File size. type: Int - contextPath: csfalconx.resource.sha256 description: SHA256 hash of the submitted file. type: String - contextPath: csfalconx.resource.ioc_report_strict_csv_artifact_id description: ID of the IOC pack to download (CSV). type: String - contextPath: csfalconx.resource.ioc_report_broad_csv_artifact_id description: ID of the IOC pack to download (CSV). type: String - contextPath: csfalconx.resource.ioc_report_strict_json_artifact_id description: ID of the IOC pack to download (JSON). type: Int - contextPath: csfalconx.resource.ioc_report_broad_json_artifact_id description: ID of the IOC pack to download (JSON). type: String - contextPath: csfalconx.resource.ioc_report_strict_stix_artifact_id description: ID of the IOC pack to download (STIX). type: String - contextPath: csfalconx.resource.ioc_report_broad_stix_artifact_id description: ID of the IOC pack to download (STIX). type: Int - contextPath: csfalconx.resource.ioc_report_strict_maec_artifact_id description: ID of the IOC pack to download (MAEC). type: String - contextPath: csfalconx.resource.ioc_report_broad_maec_artifact_id description: ID of the IOC pack to download (MAEC). type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: File.Malicious.Description description: A description explaining why the file was determined to be malicious. type: String - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: File.Name description: The name of the file. type: String - contextPath: File.Relationships.EntityA description: The source of the relationship. type: String - contextPath: File.Relationships.EntityAType description: The type of the source of the relationship. type: String - contextPath: File.Relationships.EntityB description: The destination of the relationship. type: String - contextPath: File.Relationships.EntityBType description: The type of the destination of the relationship. type: String - contextPath: File.Relationships.Relationship description: The name of the relationship. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Size description: The size of the file. type: Number - contextPath: File.Type description: The type of the file. type: String - contextPath: csfalconx.resource.architecture description: The architecture of the machine on which the report was created. type: String - contextPath: csfalconx.resource.classification description: Classification. type: String - contextPath: csfalconx.resource.classification_tags description: Tags related to the classification. type: String - contextPath: csfalconx.resource.contacted_hosts.address description: Address of a contacted host. type: String - contextPath: csfalconx.resource.contacted_hosts.associated_runtime.name description: The sandbox contacted hosts associated runtime name. type: String - contextPath: csfalconx.resource.contacted_hosts.associated_runtime.pid description: The sandbox contacted hosts associated runtime pid. type: Number - contextPath: csfalconx.resource.contacted_hosts.country description: The sandbox contacted hosts country. type: String - contextPath: csfalconx.resource.contacted_hosts.port description: The sandbox contacted hosts port. type: Number - contextPath: csfalconx.resource.contacted_hosts.protocol description: The sandbox contacted hosts protocol. type: String - contextPath: csfalconx.resource.created_timestamp description: Analysis start time. type: Date - contextPath: csfalconx.resource.dns_requests.country description: Country the DNS request was sent to. type: String - contextPath: csfalconx.resource.dns_requests.domain description: Domain the DNS request was sent to. type: String - contextPath: csfalconx.resource.dns_requests.address description: Address the DNS request was sent to. type: String - contextPath: csfalconx.resource.environment_description description: Environment description. type: String - contextPath: csfalconx.resource.extracted_files.description description: Description of an extracted file. type: String - contextPath: csfalconx.resource.extracted_files.file_size description: Size of an extracted file. type: Number - contextPath: csfalconx.resource.extracted_files.md5 description: MD5 of an extracted file. type: String - contextPath: csfalconx.resource.extracted_files.name description: Name of an extracted file. type: String - contextPath: csfalconx.resource.extracted_files.sha1 description: SHA1 of an extracted file. type: String - contextPath: csfalconx.resource.extracted_files.sha256 description: SHA256 of an extracted file. type: String - contextPath: csfalconx.resource.extracted_files.threat_level_readable description: Threat level of an extracted file. type: String - contextPath: csfalconx.resource.extracted_files.type_tags description: Type tags of an extracted file. type: String - contextPath: csfalconx.resource.file_size description: File size. type: Number - contextPath: csfalconx.resource.file_type description: File type. type: String - contextPath: csfalconx.resource.file_type_short description: File type (short). type: String - contextPath: csfalconx.resource.http_requests.header description: HTTP request header. type: String - contextPath: csfalconx.resource.http_requests.host description: HTTP request host. type: String - contextPath: csfalconx.resource.http_requests.host_ip description: HTTP request host IP. type: String - contextPath: csfalconx.resource.http_requests.host_port description: HTTP request host IP. type: Number - contextPath: csfalconx.resource.http_requests.method description: HTTP request method. type: String - contextPath: csfalconx.resource.http_requests.url description: HTTP request URL. type: String - contextPath: csfalconx.resource.id description: Analysis ID. type: String - contextPath: csfalconx.resource.incidents.details description: Incident details. type: String - contextPath: csfalconx.resource.incidents.name description: Incident name. type: String - contextPath: csfalconx.resource.processes.command_line description: Process command line. type: String - contextPath: csfalconx.resource.processes.file_accesses.mask description: File access mask. type: String - contextPath: csfalconx.resource.processes.file_accesses.path description: File access path. type: String - contextPath: csfalconx.resource.processes.file_accesses.type description: File access type. type: String - contextPath: csfalconx.resource.processes.handles.id description: Process handle ID. type: Number - contextPath: csfalconx.resource.processes.handles.path description: Process handle path. type: String - contextPath: csfalconx.resource.processes.handles.type description: Process handle type. type: String - contextPath: csfalconx.resource.processes.icon_artifact_id description: Process icon artifact ID. type: String - contextPath: csfalconx.resource.processes.mutants description: Process mutants. type: String - contextPath: csfalconx.resource.processes.name description: Process name. type: String - contextPath: csfalconx.resource.processes.normalized_path description: Process normalized path. type: String - contextPath: csfalconx.resource.processes.pid description: Process ID (PID). type: Number - contextPath: csfalconx.resource.processes.sha256 description: Process SHA256. type: String - contextPath: csfalconx.resource.processes.uid description: Process UID. type: String - contextPath: csfalconx.resource.processes.parent_uid description: Process parent UID. type: String - contextPath: csfalconx.resource.processes.process_flags.name description: Process flag name. type: String - contextPath: csfalconx.resource.sandbox.http_requests.header description: Sandbox HTTP request header. type: String - contextPath: csfalconx.resource.sandbox.http_requests.host description: Sandbox HTTP request host. type: String - contextPath: csfalconx.resource.sandbox.http_requests.host_ip description: Sandbox HTTP request host IP. type: String - contextPath: csfalconx.resource.sandbox.http_requests.host_port description: Sandbox HTTP request host port. type: Number - contextPath: csfalconx.resource.sandbox.http_requests.method description: Sandbox HTTP request method. type: String - contextPath: csfalconx.resource.sandbox.http_requests.url description: Sandbox HTTP request URL. type: String - contextPath: csfalconx.resource.sandbox.incidents.details description: Sandbox incident details. type: String - contextPath: csfalconx.resource.sandbox.incidents.name description: Sandbox incident name. type: String - contextPath: csfalconx.resource.sandbox.processes.file_accesses.mask description: Sandbox process file access mask. type: String - contextPath: csfalconx.resource.sandbox.processes.file_accesses.path description: Sandbox process file access path. type: String - contextPath: csfalconx.resource.sandbox.processes.file_accesses.type description: Sandbox process file access type. type: String - contextPath: csfalconx.resource.sandbox.processes.icon_artifact_id description: Sandbox process file access icon artifact ID. type: String - contextPath: csfalconx.resource.sandbox.processes.mutants description: Sandbox process file access process mutants. type: String - contextPath: csfalconx.resource.sandbox.processes.uid description: Sandbox process file access process UID. type: String - contextPath: csfalconx.resource.sandbox.processes.parent_uid description: Sandbox process file access process parent UID. type: String - contextPath: csfalconx.resource.sandbox.processes.process_flags.name description: Sandbox process file access process flag name. type: String - contextPath: csfalconx.resource.sandbox.submit_name description: Sandbox submit name. type: String - contextPath: csfalconx.resource.screenshots_artifact_ids description: Screenshot artifact IDs. type: String - contextPath: csfalconx.resource.submit_name description: Submit name. type: String - arguments: - description: ID of a submitted malware sample. Find a submission ID from the response when submitting a malware sample or search with the cs-fx-submit-uploaded-file command. isArray: true name: ids required: true description: Gets a short summary version of a sandbox report. name: cs-fx-get-report-summary outputs: - contextPath: csfalconx.resource.id description: Analysis ID. type: String - contextPath: csfalconx.resource.tag description: Analysis tags. type: String - contextPath: csfalconx.resource.tags description: Analysis tags. type: String - contextPath: csfalconx.resource.verdict description: Analysis verdict. type: String - contextPath: csfalconx.resource.created_timestamp description: Analysis start time. type: String - contextPath: csfalconx.resource.environment_id description: Environment ID. type: String - contextPath: csfalconx.resource.environment_description description: Environment description. type: String - contextPath: csfalconx.resource.threat_score description: Score of the threat. type: Int - contextPath: csfalconx.resource.submit_url description: URL submitted for analysis. type: String - contextPath: csfalconx.resource.submission_type description: Type of submitted artifact. For example, file, URL, etc. type: String - contextPath: csfalconx.resource.file_type description: File type. type: String - contextPath: csfalconx.resource.file_size description: File size. type: Int - contextPath: csfalconx.resource.sha256 description: SHA256 hash of the submitted file. type: String - contextPath: csfalconx.resource.ioc_report_strict_csv_artifact_id description: ID of the IOC pack to download (CSV). type: String - contextPath: csfalconx.resource.ioc_report_broad_csv_artifact_id description: ID of the IOC pack to download (CSV). type: String - contextPath: csfalconx.resource.ioc_report_strict_json_artifact_id description: ID of the IOC pack to download (JSON). type: Int - contextPath: csfalconx.resource.ioc_report_broad_json_artifact_id description: ID of the IOC pack to download (JSON). type: String - contextPath: csfalconx.resource.ioc_report_strict_stix_artifact_id description: ID of the IOC pack to download (STIX). type: String - contextPath: csfalconx.resource.ioc_report_broad_stix_artifact_id description: ID of the IOC pack to download (STIX). type: Int - contextPath: csfalconx.resource.ioc_report_strict_maec_artifact_id description: ID of the IOC pack to download (MAEC). type: String - contextPath: csfalconx.resource.ioc_report_broad_maec_artifact_id description: ID of the IOC pack to download (MAEC). type: String - arguments: - description: ID of a submitted malware sample. Find a submission ID from the response when submitting a malware sample or search with the cs-fx-submit-uploaded-file/url command. isArray: true name: ids required: true description: Checks the status of a sandbox analysis. name: cs-fx-get-analysis-status outputs: - contextPath: csfalconx.resource.id description: Analysis ID. type: String - contextPath: csfalconx.resource.verdict description: Analysis verdict. type: String - contextPath: csfalconx.resource.created_timestamp description: Analysis start time. type: String - contextPath: csfalconx.resource.environment_id description: Environment ID. type: String - contextPath: csfalconx.resource.environment_description description: Environment description. type: String - contextPath: csfalconx.resource.threat_score description: Score of the threat. type: Int - contextPath: csfalconx.resource.submit_url description: URL submitted for analysis. type: String - contextPath: csfalconx.resource.submission_type description: Type of submitted artifact. For example, file, URL, etc. type: String - contextPath: csfalconx.resource.file_type description: File type. type: String - contextPath: csfalconx.resource.file_size description: File size. type: Int - contextPath: csfalconx.resource.sha256 description: SHA256 hash of the submitted file. type: String - contextPath: csfalconx.resource.ioc_report_strict_csv_artifact_id description: ID of the IOC pack to download (CSV). type: String - contextPath: csfalconx.resource.ioc_report_broad_csv_artifact_id description: ID of the IOC pack to download (CSV). type: String - contextPath: csfalconx.resource.ioc_report_strict_json_artifact_id description: ID of the IOC pack to download (JSON). type: Int - contextPath: csfalconx.resource.ioc_report_broad_json_artifact_id description: ID of the IOC pack to download (JSON). type: String - contextPath: csfalconx.resource.ioc_report_strict_stix_artifact_id description: ID of the IOC pack to download (STIX). type: String - contextPath: csfalconx.resource.ioc_report_broad_stix_artifact_id description: ID of the IOC pack to download (STIX). type: Int - contextPath: csfalconx.resource.ioc_report_strict_maec_artifact_id description: ID of the IOC pack to download (MAEC). type: String - contextPath: csfalconx.resource.ioc_report_broad_maec_artifact_id description: ID of the IOC pack to download (MAEC). type: String - description: Returns the total quota number and the in use quota number. name: cs-fx-check-quota outputs: - contextPath: csfalconx.resource.total description: Total quota number. type: Number - contextPath: csfalconx.resource.used description: Used quota number. type: Number - contextPath: csfalconx.resource.in_progress description: The number of calls in progress. type: Number - arguments: - description: Optional filter and sort criteria in the form of an FQL query. Takes precedence over the *hash* argument (if provided). name: filter - description: The offset from which to start retrieving reports. name: offset - description: SHA256 hashes to search for. Overridden by the *filter* argument (if provided). isArray: true name: hashes - description: Maximum number of report IDs to return. Maximum is 5000. Default is 50. name: limit - auto: PREDEFINED description: Sort order. Can be "asc" or "desc". name: sort predefined: - asc - desc description: Finds sandbox reports by providing an FQL filter and paging details. name: cs-fx-find-reports outputs: - contextPath: csfalconx.resource.resources description: Set of report IDs that match the search criteria. type: Number - contextPath: csfalconx.resource.FindReport.sha256 description: queried SHA256 value (when applicable). type: Number - contextPath: csfalconx.resource.FindReport.foundIds description: Set of report ids that match this queried SHA256 value. type: Number - arguments: - description: Optional filter and sort criteria in the form of an FQL query. name: filter - description: The offset from which to start retrieving reports. name: offset - description: Maximum number of report IDs to return. Maximum is 5000. name: limit - auto: PREDEFINED description: Sort order. Can be "asc" or "desc". name: sort predefined: - asc - desc description: Finds submission IDs for uploaded files by providing an FQL filter and paging details. Returns a set of submission IDs that match the search criteria. name: cs-fx-find-submission-id outputs: - contextPath: csfalconx.resource.resources description: 'Set of report IDs that match the search criteria. ' type: Number - arguments: - default: true description: |- The file hash(es) to search for. isArray: true name: file required: true description: Gets reputation data for one or more files, by sha256 hashes. name: file outputs: - contextPath: csfalconx.resource.id description: 'Set of report IDs that match the search criteria. ' type: Number - contextPath: csfalconx.resource.file_size description: The file size. type: Number - contextPath: csfalconx.resource.sha256 description: SHA256 hash of the uploaded file. type: String - contextPath: csfalconx.resource.threat_score description: Score of the threat. type: Number - contextPath: csfalconx.resource.verdict description: Analysis verdict. type: String - contextPath: File.MD5 description: MD5 found in the parsed file. type: String - contextPath: File.SHA1 description: SHA1 found in the parsed file. type: String - contextPath: File.SHA256 description: SHA256 found in the parsed file. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: File.Name description: The name of the file. type: String - contextPath: File.Type description: The type of the file. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: File.Malicious.Description description: For malicious files, the full description. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: File.Size description: The size of the file. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - arguments: - description: |- A web page or file URL. It can be HTTP(S) or FTP. For example: “https://url.com”,“ftp://ftp.com”. name: url - description: Sandbox environment used for analysis. name: environment_id auto: PREDEFINED predefined: - "400: MacOS Catalina 10.15" - "310: Linux Ubuntu 20 (64-bit)" - "200: Android (static analysis)" - "160: Windows 10 (64-bit)" - "140: Windows 11 (64-bit)" - "110: Windows 7 (64-bit)" - "100: Windows 7 (32-bit)" - description: |- Runtime script for sandbox analysis. Values: default default_maxantievasion default_randomfiles default_randomtheme default_openie. name: action_script - description: 'Command line script passed to the submitted file at runtime. Max length: 2048 characters.' name: command_line - description: 'Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters.' name: document_password - auto: PREDEFINED description: Deprecated, please use network_settings instead. deprecated: true hidden: true name: enable_tor predefined: - 'false' - ' true' - description: Name of the malware sample that is used for file type detection and analysis. name: submit_name - description: Sets a custom date for the sandbox environment in the format yyyy-MM-dd. name: system_date - auto: PREDEFINED description: Whether to use Cortex XSOAR's built-in polling to retrieve the result when it's ready, Note - This command counts against the submission quota. name: polling predefined: - 'true' - 'false' - defaultValue: '600' description: Interval in seconds between each poll. name: interval_in_seconds - auto: PREDEFINED defaultValue: 'false' description: If set to true, the report will return extended data which includes mitre attacks and signature information. name: extended_data predefined: - 'true' - 'false' - description: This ia an internal argument used for the polling process, not to be used by the user. isArray: true name: ids - description: Sets a custom time for the sandbox environment in the format HH:mm. name: system_time - name: network_settings required: false description: | Specifies the sandbox network configuration used for analysis. Possible values are: - default: Fully operating network (default behavior if not specified). - tor: Route network traffic via TOR. - simulated: Simulate network traffic. - offline: Disable all network traffic. auto: PREDEFINED predefined: - default - tor - simulated - offline description: Submits a URL or FTP for sandbox analysis. name: cs-fx-submit-url polling: true outputs: - contextPath: csfalconx.resource.submitted_id description: Analysis ID received after submitting the file. type: String - contextPath: csfalconx.resource.file_name description: Analysis file_name. type: String - contextPath: csfalconx.resource.tags description: Analysis tags. type: String - contextPath: csfalconx.resource.sandbox.http_requests.header description: The header of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.Accept description: The accept of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.host_ip description: The host ip of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.host_port description: The host port of the http request. type: Number - contextPath: csfalconx.resource.sandbox.http_requests.method description: The method of the http request. type: String - contextPath: csfalconx.resource.sandbox.http_requests.url description: The URL of the http request. type: String - contextPath: csfalconx.resource.sandbox.User-Agent description: The user agent of the http request. type: String - contextPath: csfalconx.resource.sandbox.processes.command_line description: The sandbox process command line. type: String - contextPath: csfalconx.resource.sandbox.processes.handles.id description: The sandbox handled ID. type: String - contextPath: csfalconx.resource.sandbox.processes.handles.type description: The sandbox handled type. type: String - contextPath: csfalconx.resource.sandbox.processes.handles.path description: The sandbox handled path. type: String - contextPath: csfalconx.resource.sandbox.processes.name description: The sandbox process name. type: String - contextPath: csfalconx.resource.sandbox.processes.normalized_path description: The sandbox process normalized path. type: String - contextPath: csfalconx.resource.sandbox.processes.pid description: The sandbox process pid. type: Number - contextPath: csfalconx.resource.sandbox.processes.sha256 description: The sandbox process sha256. type: String - contextPath: csfalconx.resource.sandbox.architecture description: The sandbox architecture. type: String - contextPath: csfalconx.resource.sandbox.classification description: The sandbox classification. type: String - contextPath: csfalconx.resource.sandbox.classification_tags description: The sandbox classification tags. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.name description: The sandbox extracted file name. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.file_size description: The sandbox extracted file size. type: Number - contextPath: csfalconx.resource.sandbox.extracted_files.sha256 description: The sandbox extracted file sha256. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.md5 description: The sandbox extracted file md5. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.sha1 description: The sandbox extracted file sha1. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.runtime_process description: The sandbox extracted file runtime process. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.type_tags description: The sandbox extracted file tags type. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.threat_level_readable description: The sandbox extracted file threat level readable. type: String - contextPath: csfalconx.resource.sandbox.extracted_files.description description: The sandbox extracted file description. type: String - contextPath: csfalconx.resource.sandbox.file_metadata.file_compositions description: The sandbox file metadata compositions. type: Unknown - contextPath: csfalconx.resource.sandbox.file_metadata.imported_objects description: The sandbox file metadata imported objects. type: Unknown - contextPath: csfalconx.resource.sandbox.file_metadata.file_analysis description: The sandbox file metadata analysis. type: Unknown - contextPath: csfalconx.resource.sandbox.file_size description: The sandbox file size. type: Number - contextPath: csfalconx.resource.sandbox.file_type description: The sandbox file type. type: String - contextPath: csfalconx.resource.sandbox.file_type_short description: The sandbox file type short. type: String - contextPath: csfalconx.resource.sandbox.packer description: The sandbox packer. type: String - contextPath: csfalconx.resource.sandbox.screenshots_artifact_ids description: The sandbox screenshots artifact ids. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.address description: The sandbox dns requests address. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.country description: The sandbox dns requests country. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.domain description: The sandbox dns requests domain. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.registrar_creation_timestamp description: The sandbox dns requests registrar creation timestamp. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.registrar_name description: The sandbox dns requests registrar name. type: String - contextPath: csfalconx.resource.sandbox.dns_requests.registrar_organization description: The sandbox dns requests registrar organization. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.address description: The sandbox contacted hosts address. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.country description: The sandbox contacted hosts country. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.port description: The sandbox contacted hosts port. type: Number - contextPath: csfalconx.resource.sandbox.contacted_hosts.protocol description: The sandbox contacted hosts protocol. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.associated_runtime.name description: The sandbox contacted hosts associated runtime name. type: String - contextPath: csfalconx.resource.sandbox.contacted_hosts.associated_runtime.pid description: The sandbox contacted hosts associated runtime pid. type: String - contextPath: csfalconx.resource.sandbox.incidents description: The sandbox incidents. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.tactic description: The sandbox MITRE tactic name. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.technique description: The sandbox MITRE technique name. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.attack_id description: The sandbox MITRE technique ID. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.malicious_identifiers description: The sandbox MITRE malicious identifiers. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.parent.technique description: The sandbox MITRE parent technique name. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.parent.attack_id description: The sandbox MITRE parent technique ID. type: String - contextPath: csfalconx.resource.sandbox.mitre_attacks.parent.attack_id_wiki description: The sandbox MITRE parent technique wiki URL link. type: String - contextPath: csfalconx.resource.sandbox.signatures.threat_level_human description: The sandbox signatures threat level. type: String - contextPath: csfalconx.resource.sandbox.signatures.category description: The sandbox signatures category. type: String - contextPath: csfalconx.resource.sandbox.signatures.identifier description: The sandbox signatures identifier. type: String - contextPath: csfalconx.resource.sandbox.signatures.type description: The sandbox signatures type. type: Number - contextPath: csfalconx.resource.sandbox.signatures.relevance description: The sandbox signatures relevance. type: Number - contextPath: csfalconx.resource.sandbox.signatures.name description: The sandbox signatures name. type: String - contextPath: csfalconx.resource.sandbox.signatures.description description: The sandbox signatures description. type: String - contextPath: csfalconx.resource.sandbox.signatures.origin description: The sandbox signatures origin. type: String - contextPath: csfalconx.resource.intel.malware_families description: The malware families of the resource. type: Unknown - contextPath: csfalconx.resource.state description: Analysis state. type: String - contextPath: csfalconx.resource.sha256 description: SHA256 hash of the scanned file. type: Unknown - contextPath: csfalconx.resource.environment_id description: Environment ID of the analysis. type: Unknown - contextPath: csfalconx.resource.created_timestamp description: Analysis start time. type: Date - contextPath: csfalconx.resource.url_name description: Submitted URL. type: String - arguments: - description: ID of an artifact, such as an IOC pack, PCAP file, or actor image. Find an artifact ID in a report or summary. name: id required: true - description: The name given to then downloaded file. name: name - defaultValue: gzip description: Format used to compress the downloaded file. Currently, you must provide the value of the GZIP file. name: accept_encoding description: Downloads IOC packs, PCAP files, and other analysis artifacts. name: cs-fx-download-ioc dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' subtype: python3 type: python fromversion: 5.0.0 tests: - CrowdStrike_FalconX_Test - CrowdStrike_Falcon_X_-Test-Detonate_File - CrowdStrike_Falcon_X_-Test-Detonate_URL