commonfields: id: SNDBOX version: -1 name: SNDBOX display: SNDBOX (Deprecated) deprecated: true category: Forensics & Malware Analysis provider: Palo Alto Networks description: Deprecated. No available replacement. configuration: - display: 'Use Public API Key. (By approving SNDBOX public API you are accepting SNDBOX TOS @ https://app.sndbox.com/tos). Public submissions are shared with the community' name: public_api_key defaultvalue: '' type: 8 required: false - display: 'Private API Key' name: api_key defaultvalue: '' type: 4 required: true - display: Use system proxy settings name: proxy type: 8 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: 'Max. Polling Time (in seconds):' name: maxpolls defaultvalue: '300' type: 0 required: false - display: 'Verbose (show log in case of error) ' name: verbose defaultvalue: '' type: 8 required: false script: script: '' type: python subtype: python2 commands: - name: sndbox-is-online arguments: [] description: Check if SNDBOX is online or in maintenance mode. - name: sndbox-analysis-info arguments: - name: analysis_id required: true default: true description: Analysis IDs, supports comma-seperated arrays. isArray: true outputs: - contextPath: SNDBOX.Analysis.ID description: Analysis ID type: string - contextPath: SNDBOX.Analysis.SampleName description: Sample Data type: string - contextPath: SNDBOX.Analysis.Status description: Analysis Status type: string - contextPath: SNDBOX.Analysis.Time description: Submitted Time type: date - contextPath: SNDBOX.Analysis.Score description: Analysis Score type: float - contextPath: SNDBOX.Analysis.Result description: Analysis Results type: string - contextPath: SNDBOX.Analysis.Errors description: Raised errors during sampling - contextPath: SNDBOX.Analysis.Link description: Analysis Link type: string - contextPath: SNDBOX.Analysis.MD5 description: MD5 of analysis sample type: string - contextPath: SNDBOX.Analysis.SHA1 description: SHA1 of analysis sample type: string - contextPath: SNDBOX.Analysis.SHA256 description: SHA256 of analysis sample type: string - contextPath: DBotScore.Vendor description: 'The name of the vendor: SNDBOX' type: string - contextPath: DBotScore.Indicator description: The name of the sample file - contextPath: DBotScore.Type description: file type: string - contextPath: DBotScore.Score description: The actual score type: number - contextPath: DBotScore.Malicious.Vendor description: 'The name of the vendor: SNDBOX' type: string - contextPath: DBotScore.Malicious.Detections description: The sub analysis detection statuses type: string - contextPath: DBotScore.Malicious.SHA1 description: The SHA1 of the file type: string description: Show information about an analysis. - name: sndbox-analysis-submit-sample arguments: - name: file_id default: true description: War Room entry of a file (for example, 3245@4) - name: should_wait auto: PREDEFINED predefined: - 'True' - 'False' description: Should the command poll for the result of the analysis defaultValue: 'False' outputs: - contextPath: SNDBOX.Analysis.ID description: Analysis ID type: string - contextPath: SNDBOX.Analysis.SampleName description: Sample Data, could be a file name or URL type: string - contextPath: SNDBOX.Analysis.Status description: Analysis Status type: string - contextPath: SNDBOX.Analysis.Time description: Submitted Time type: date - contextPath: SNDBOX.Analysis.Result description: Analysis Results type: string - contextPath: SNDBOX.Analysis.Errors description: Raised errors during sampling - contextPath: SNDBOX.Analysis.Link description: Analysis Link type: string - contextPath: SNDBOX.Analysis.MD5 description: MD5 of analysis sample type: string - contextPath: SNDBOX.Analysis.SHA1 description: SHA1 of analysis sample type: string - contextPath: SNDBOX.Analysis.SHA256 description: SHA256 of analysis sample type: string - contextPath: DBotScore.Vendor description: 'The name of the vendor: SNDBOX' type: string - contextPath: DBotScore.Indicator description: The name of the sample file or URL - contextPath: DBotScore.Type description: "'url' for url samples, otherwise 'file'" type: string - contextPath: DBotScore.Score description: The actual score type: number - contextPath: DBotScore.Malicious.Vendor description: 'The name of the vendor: SNDBOX' type: string - contextPath: DBotScore.Malicious.SHA1 description: The SHA1 of the file type: string description: Submit a sample for analysis. - name: sndbox-download-report arguments: - name: analysis_id required: true default: true description: Analysis ID - name: type auto: PREDEFINED predefined: - json - pcap description: The resource type to download. Defaults to json. defaultValue: json outputs: - contextPath: InfoFile.Name description: FileName type: string - contextPath: InfoFile.EntryID description: The EntryID of the report type: string - contextPath: InfoFile.Size description: File Size type: number - contextPath: InfoFile.Type description: File type e.g. "PE" type: string - contextPath: InfoFile.Info description: Basic information of the file type: string - contextPath: InfoFile.Extension description: File Extension type: string description: Download a resource belonging to a report. This can be the full report, dropped binaries, etc. - name: sndbox-download-sample arguments: - name: analysis_id required: true default: true description: Analysis ID outputs: - contextPath: File.Size description: File Size type: number - contextPath: File.SHA1 description: SHA1 hash of the file type: string - contextPath: File.SHA256 description: SHA256 hash of the file type: string - contextPath: File.Name description: The sample name type: string - contextPath: File.SSDeep description: SSDeep hash of the file type: string - contextPath: File.EntryID description: War-Room Entry ID of the file type: string - contextPath: File.Info description: Basic information of the file type: string - contextPath: File.Type description: File type e.g. "PE" type: string - contextPath: File MD5 description: MD5 hash of the file type: string - contextPath: File.Extension description: File Extension type: string description: Download the sample file of an analysis. for security reasons, the extension will be "dontrun" dockerimage: demisto/python:2.7.18.24398 tests: - SNDBOX_Test fromversion: 5.0.0