commonfields:
  id: ThreatZone
  version: -1
name: ThreatZone
display: ThreatZone
category: Forensics & Malware Analysis
provider: Malwation
description: ThreatZone malware analysis sandboxing.
configuration:
- display: Server URL (e.g. https://app.threat.zone)
  name: url
  type: 0
  required: true
  section: Connect
  additionalinfo: The ThreatZone instance root or /public-api URL. The integration appends the suffix exactly once.
- name: apikey
  type: 9
  required: true
  section: Connect
  displaypassword: ThreatZone API Key
  hiddenusername: true
  additionalinfo: The API key generated for the ThreatZone workspace.
- display: Source Reliability
  name: integrationReliability
  type: 15
  additionalinfo: The reliability of the source providing the intelligence data.
  defaultvalue: A - Completely reliable
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
  additionalinfo: Whether to trust any certificate (not secure) by disabling TLS certificate validation.
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
  additionalinfo: Whether to use the system proxy settings for SDK requests.
script:
  script: "-"
  type: python
  commands:
  - name: tz-sandbox-upload-sample
    arguments:
    - name: entry_id
      description: The entry ID of the file to submit.
      required: true
    - name: environment
      required: false
      auto: PREDEFINED
      predefined:
      - w7_x64
      - w10_x64
      - w11_x64
      - linux-ubuntu_2204
      - macos-ventura
      - android9
      description: The environment to run the submission in.
      defaultValue: w7_x64
    - name: private
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether the submission is private. If omitted, the current ThreatZone API-provided default is used.
    - name: extension_check
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enforce MIME-based extension correction before sandbox execution. If omitted, the current ThreatZone API-provided default is used.
      required: false
    - name: auto
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to automatically select a sandbox environment based on the uploaded file type, ignoring the environment argument.
      defaultValue: "false"
      required: false
    - name: modules
      description: The legacy compatibility argument. ThreatZone v3.2 does not support per-submission module selection, so this value is validated but not forwarded.
      required: false
    - name: analyze_config
      description: The raw analyzeConfig JSON used to override or add sandbox metafields.
      required: false
    - name: timeout
      auto: PREDEFINED
      predefined:
      - "60"
      - "120"
      - "180"
      - "300"
      description: The duration of the submission analysis. If omitted, the current ThreatZone API-provided default is used.
    - name: work_path
      auto: PREDEFINED
      predefined:
      - "desktop"
      - "root"
      - appdata
      - windows
      - temp
      description: The working path of the submission. If omitted, the current ThreatZone API-provided default is used.
    - name: mouse_simulation
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enable mouse simulation. If omitted, the current ThreatZone API-provided default is used.
    - name: https_inspection
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enable HTTPS inspection for encrypted traffic. If omitted, the current ThreatZone API-provided default is used.
    - name: internet_connection
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enable internet connection. If omitted, the current ThreatZone API-provided default is used.
    - name: raw_logs
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to request raw logs. This legacy compatibility argument is not forwarded because ThreatZone v3.2 does not accept the metafield.
    - name: snapshot
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enable Fast Bootup. If omitted, the current ThreatZone API-provided default is used.
    - name: entrypoint
      required: false
      description: The filename inside the archive to execute (for archives).
    - name: password
      required: false
      description: The password for password-protected archives.
    - name: configurations
      required: false
      description: The advanced execution configuration as a JSON object (for example preScript, startArguments, or networkConfig).
    outputs:
    - contextPath: ThreatZone.Submission.Sandbox.UUID
      description: The UUID of the sample.
      type: String
    - contextPath: ThreatZone.Limits.E_Mail
      description: The owner e-mail of current plan.
      type: String
    - contextPath: ThreatZone.Limits.API_Limit
      description: The remaining/total API request limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Concurrent_Limit
      description: The remaining/total concurrent analysis limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Daily_Submission_Limit
      description: The remaining/total daily submission limits of the current plan.
      type: String
    description: Submits a sample to ThreatZone for sandbox analysis.
  - name: tz-static-upload-sample
    arguments:
    - name: entry_id
      description: The entry ID of the file to submit.
      required: true
    - name: private
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether the submission is visible only to members of your workspace. When false, the submission is visible to everyone.
      defaultValue: "true"
    - name: extension_check
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enforce MIME-based extension correction before static scan.
      defaultValue: "false"
    - name: entrypoint
      required: false
      description: The filename inside the archive to analyze (for archives).
    - name: password
      required: false
      description: The password for password-protected archives.
    outputs:
    - contextPath: ThreatZone.Submission.Static.UUID
      description: The UUID of the sample.
      type: String
    - contextPath: ThreatZone.Limits.E_Mail
      description: The owner e-mail of current plan.
      type: String
    - contextPath: ThreatZone.Limits.API_Limit
      description: The remaining/total API request limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Concurrent_Limit
      description: The remaining/total concurrent analysis limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Daily_Submission_Limit
      description: The remaining/total daily submission limits of the current plan.
      type: String
    description: Submits a sample to ThreatZone for static analysis.
  - name: tz-cdr-upload-sample
    arguments:
    - name: entry_id
      description: The entry ID of the file to submit.
      required: true
    - name: private
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether the submission is visible only to members of your workspace. When false, the submission is visible to everyone.
      defaultValue: "true"
    - name: extension_check
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to enforce MIME-based extension correction before sanitization.
      defaultValue: "true"
    - name: entrypoint
      required: false
      description: The filename inside the archive to sanitize (for archives).
    - name: password
      required: false
      description: The password for password-protected archives.
    outputs:
    - contextPath: ThreatZone.Submission.CDR.UUID
      description: The UUID of the sample.
      type: String
    - contextPath: ThreatZone.Limits.E_Mail
      description: The owner e-mail of current plan.
      type: String
    - contextPath: ThreatZone.Limits.API_Limit
      description: The remaining/total API request limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Concurrent_Limit
      description: The remaining/total concurrent analysis limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Daily_Submission_Limit
      description: The remaining/total daily submission limits of the current plan.
      type: String
    description: Submits a sample to ThreatZone for CDR.
  - name: tz-url-analysis
    compliantpolicies:
    - Domain Blockage
    arguments:
    - name: url
      required: true
      description: The URL to analyze.
    - name: private
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to mark the submission as workspace-private.
      defaultValue: "true"
    - name: safe_browsing
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to start an isolated safe-browsing session alongside URL analysis.
      defaultValue: "false"
    outputs:
    - contextPath: ThreatZone.Submission.URL.UUID
      description: The UUID of the URL submission.
      type: String
    - contextPath: ThreatZone.Submission.URL.URL
      description: The URL submitted for analysis.
      type: String
    - contextPath: ThreatZone.Limits.E_Mail
      description: The owner e-mail of current plan.
      type: String
    - contextPath: ThreatZone.Limits.API_Limit
      description: The remaining/total API request limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Concurrent_Limit
      description: The remaining/total concurrent analysis limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Daily_Submission_Limit
      description: The remaining/total daily submission limits of the current plan.
      type: String
    description: Submits a URL to ThreatZone for analysis.
  - name: tz-get-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: details
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to include inline Indicators, IOCs, YARA matches, artifacts, and configuration data in the readable output.
      defaultValue: "false"
    - name: download_sanitized
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to download the sanitized file after a CDR analysis completes.
      defaultValue: "false"
    description: Retrieve the analysis result from ThreatZone.
    outputs:
    - contextPath: ThreatZone.Submission
      type: Unknown
      description: The raw submission data returned by ThreatZone.
    - contextPath: ThreatZone.Analysis.STATUS
      type: Number
      description: The status of the submission scanning process as an integer code (0=declined, 1=file received, 2=accepted, 3=running, 4=VM ready, 5=finished).
    - contextPath: ThreatZone.Analysis.LEVEL
      type: Number
      description: The threat level of the scanned file as an integer code (0=not measured, 1=informative, 2=suspicious, 3=malicious).
    - contextPath: ThreatZone.Analysis.INFO
      type: String
      description: The submission metadata such as file name/URL and privacy status.
    - contextPath: ThreatZone.Analysis.REPORT
      type: String
      description: The analysis report of the submission.
    - contextPath: ThreatZone.Analysis.URL
      type: String
      description: The result page url of the submission.
    - contextPath: ThreatZone.Analysis.MD5
      type: String
      description: The md5 hash of the submission.
    - contextPath: ThreatZone.Analysis.SHA1
      type: String
      description: The sha1 hash of the submission.
    - contextPath: ThreatZone.Analysis.SHA256
      type: String
      description: The sha256 hash of the submission.
    - contextPath: ThreatZone.Analysis.UUID
      type: String
      description: The UUID of the submission.
    - contextPath: ThreatZone.Analysis.SANITIZED
      description: The url of the sanitized file.
      type: String
    - contextPath: ThreatZone.IOC.URL
      description: The URL data extracted from IOC.
      type: List
    - contextPath: ThreatZone.IOC.IP
      description: The IP data extracted from IOC.
      type: List
    - contextPath: ThreatZone.IOC.DOMAIN
      description: The DOMAIN data extracted from IOC.
      type: List
    - contextPath: ThreatZone.IOC.EMAIL
      description: The EMAIL data extracted from IOC.
      type: List
    - contextPath: DBotScore.Indicator
      type: String
      description: The indicator that was tested.
    - contextPath: DBotScore.Reliability
      type: String
      description: The reliability of the source providing the intelligence data.
    - contextPath: DBotScore.Score
      type: Number
      description: The actual score.
    - contextPath: DBotScore.Type
      type: String
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
  - name: tz-get-indicator-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: level
      required: false
      auto: PREDEFINED
      predefined:
      - benign
      - suspicious
      - malicious
      description: The indicator severity to filter by.
    - name: category
      required: false
      description: The indicator category to filter by.
    - name: pid
      required: false
      description: The process ID to filter by.
    - name: attack_code
      required: false
      description: The MITRE ATT&CK technique code to filter by.
    description: Retrieves dynamic behaviour indicators for a submission from ThreatZone.
    outputs:
    - contextPath: ThreatZone.Submission.Indicators.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.Indicators.Data
      description: The dynamic behaviour indicators returned by ThreatZone.
      type: Unknown
  - name: tz-get-ioc-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: type
      required: false
      description: The IOC type to filter by.
    outputs:
    - contextPath: ThreatZone.Submission.IOCs.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.IOCs.Data
      description: The Indicators of Compromise returned by ThreatZone.
      type: Unknown
    description: Retrieves Indicators of Compromise for a submission from ThreatZone.
  - name: tz-get-yara-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: category
      required: false
      description: The matched YARA rule category to filter by.
    outputs:
    - contextPath: ThreatZone.Submission.YaraMatches.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.YaraMatches.Data
      description: The matched YARA rules returned by ThreatZone.
      type: Unknown
    description: Retrieves YARA rules matched during analysis. Use tz-download-yara-rule for the generated rule file.
  - name: tz-get-artifact-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    outputs:
    - contextPath: ThreatZone.Submission.Artifacts.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.Artifacts.Data
      description: The analysis artifacts returned by ThreatZone.
      type: Unknown
    description: Retrieves analysis artifacts for a submission from ThreatZone.
  - name: tz-get-config-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    outputs:
    - contextPath: ThreatZone.Submission.Config.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.Config.Data
      description: The configuration extractor results returned by ThreatZone.
      type: Unknown
    description: Retrieves configuration extractor results for a submission from ThreatZone.
  - name: tz-get-sanitized
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Downloads a sanitized file from the ThreatZone API and uploads it to the War Room.
    outputs:
    - contextPath: InfoFile.Extension
      type: String
      description: The extension of the file sanitized by CDR.
    - contextPath: InfoFile.Name
      type: String
      description: The name of the file sanitized by CDR.
    - contextPath: InfoFile.Size
      type: Number
      description: The size of the file sanitized by CDR.
    - contextPath: InfoFile.EntryID
      type: String
      description: The entry ID of the file sanitized by CDR.
    - contextPath: InfoFile.Info
      type: String
      description: The info of the file sanitized by CDR.
    - contextPath: InfoFile.MD5
      type: String
      description: The MD5 hash of the file sanitized by CDR.
    - contextPath: InfoFile.SHA1
      type: String
      description: The SHA1 hash of the file sanitized by CDR.
    - contextPath: InfoFile.SHA256
      type: String
      description: The SHA256 hash of the file sanitized by CDR.
    - contextPath: InfoFile.SHA512
      type: String
      description: The SHA512 hash of the file sanitized by CDR.
    - contextPath: InfoFile.SSDeep
      type: String
      description: The SSDeep hash of the file sanitized by CDR.
  - name: tz-download-html-report
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Downloads the HTML report for a submission and uploads it to the War Room.
    outputs:
    - contextPath: InfoFile.Extension
      type: String
      description: The extension of the HTML report.
    - contextPath: InfoFile.Name
      type: String
      description: The name of the downloaded HTML report.
    - contextPath: InfoFile.Size
      type: Number
      description: The size of the downloaded HTML report.
    - contextPath: InfoFile.EntryID
      type: String
      description: The entry ID of the downloaded HTML report.
    - contextPath: InfoFile.Info
      type: String
      description: The info for the downloaded HTML report.
    - contextPath: InfoFile.MD5
      type: String
      description: The MD5 hash of the downloaded HTML report.
    - contextPath: InfoFile.SHA1
      type: String
      description: The SHA1 hash of the downloaded HTML report.
    - contextPath: InfoFile.SHA256
      type: String
      description: The SHA256 hash of the downloaded HTML report.
    - contextPath: InfoFile.SHA512
      type: String
      description: The SHA512 hash of the downloaded HTML report.
    - contextPath: InfoFile.SSDeep
      type: String
      description: The SSDeep hash of the downloaded HTML report.
  - name: tz-get-metafields
    arguments:
    - name: scan_type
      description: The scan type to filter metafields.
      required: false
      auto: PREDEFINED
      predefined:
      - sandbox
      - static
      - cdr
      - url
      - open_in_browser
    description: Retrieves available ThreatZone metafields, optionally filtered by scan type.
    outputs:
    - contextPath: ThreatZone.Configuration.Metafields.ScanType
      description: The scan type used to filter the metafields.
      type: String
    - contextPath: ThreatZone.Configuration.Metafields.Data
      description: The metafield definitions returned by ThreatZone.
      type: Unknown
  - name: tz-get-environments
    description: Retrieves available ThreatZone sandbox environments.
    outputs:
    - contextPath: ThreatZone.Configuration.Environments.Data
      description: The sandbox environment definitions returned by ThreatZone.
      type: Unknown
  - name: tz-list-network-configs
    description: Lists network configurations available to the current ThreatZone workspace.
    outputs:
    - contextPath: ThreatZone.Configuration.NetworkConfigurations.Data
      description: The network configuration summaries returned by ThreatZone.
      type: Unknown
  - name: tz-open-in-browser
    arguments:
    - name: url
      required: true
      description: The URL to open in an isolated browser environment.
    - name: environment
      required: false
      description: The sandbox environment key for browser execution.
    - name: auto
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "false"
      description: Whether to let ThreatZone select the browser environment.
    - name: metafields
      required: false
      description: The open-in-browser metafields as a JSON object.
    - name: private
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "true"
      description: Whether to mark the submission as workspace-private.
    - name: configurations
      required: false
      description: The advanced execution configuration as a JSON object.
    description: Creates a ThreatZone open-in-browser submission.
    outputs:
    - contextPath: ThreatZone.Submission.OpenInBrowser.UUID
      description: The UUID of the open-in-browser submission.
      type: String
    - contextPath: ThreatZone.Submission.OpenInBrowser.URL
      description: The URL submitted to ThreatZone.
      type: String
  - name: tz-list-submissions
    arguments:
    - name: page
      required: false
      defaultValue: "1"
      description: The page number, starting at 1.
    - name: limit
      required: false
      defaultValue: "20"
      description: The number of submissions per page (1-100).
    - name: level
      required: false
      description: The comma-separated threat levels.
    - name: type
      required: false
      auto: PREDEFINED
      predefined:
      - file
      - url
      description: The submission type.
    - name: sha256
      required: false
      description: The SHA256 hash filter.
    - name: filename
      required: false
      description: The partial filename filter.
    - name: start_date
      required: false
      description: The ISO 8601 date to include submissions created on or after (for example, 2020-01-01T00:11:22Z).
    - name: end_date
      required: false
      description: The ISO 8601 date to include submissions created on or before (for example, 2020-01-01T00:11:22Z).
    - name: private
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to filter by privacy status.
    - name: tags
      required: false
      description: The comma-separated tag filters.
    - name: sort
      required: false
      description: The field used to sort results, such as createdAt.
    - name: order
      required: false
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: The sort order.
    description: Lists ThreatZone submissions with optional filters.
    outputs:
    - contextPath: ThreatZone.Submission.List
      description: The paginated ThreatZone submission results.
      type: Unknown
  - name: tz-search-submissions-by-sha256
    arguments:
    - name: sha256
      required: true
      description: The SHA256 hash to search for.
    description: Searches ThreatZone submissions by SHA256 hash.
    outputs:
    - contextPath: ThreatZone.SubmissionSearch.Data
      description: The matching submissions.
      type: Unknown
  - name: tz-get-overview-summary
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves aggregate analysis counts for a submission.
    outputs:
    - contextPath: ThreatZone.Submission.OverviewSummary.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.OverviewSummary.Data
      description: The aggregate analysis summary.
      type: Unknown
  - name: tz-get-eml-analysis
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves parsed EML analysis results.
    outputs:
    - contextPath: ThreatZone.Submission.EMLAnalysis.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.EMLAnalysis.Data
      description: The parsed EML analysis data.
      type: Unknown
  - name: tz-get-mitre-techniques
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves MITRE ATT&CK techniques matched during analysis.
    outputs:
    - contextPath: ThreatZone.Submission.MITRE.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.MITRE.Data
      description: The matched MITRE ATT&CK techniques.
      type: Unknown
  - name: tz-get-static-scan-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves the static scan result for a submission.
    outputs:
    - contextPath: ThreatZone.Submission.StaticScan.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.StaticScan.Data
      description: The static scan result.
      type: Unknown
  - name: tz-get-cdr-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves the CDR transformation result for a submission.
    outputs:
    - contextPath: ThreatZone.Submission.CDRResult.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.CDRResult.Data
      description: The CDR transformation result.
      type: Unknown
  - name: tz-get-signature-check-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves authenticode and signature-check results.
    outputs:
    - contextPath: ThreatZone.Submission.SignatureCheck.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.SignatureCheck.Data
      description: The signature-check result.
      type: Unknown
  - name: tz-get-processes
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves processes captured during dynamic analysis.
    outputs:
    - contextPath: ThreatZone.Submission.Processes.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.Processes.Data
      description: The captured processes.
      type: Unknown
  - name: tz-get-process-tree
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves the process tree captured during dynamic analysis.
    outputs:
    - contextPath: ThreatZone.Submission.ProcessTree.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.ProcessTree.Data
      description: The captured process tree.
      type: Unknown
  - name: tz-get-url-analysis-result
    arguments:
    - name: uuid
      required: true
      description: The UUID of the URL or open-in-browser submission.
    description: Retrieves the full URL analysis report.
    outputs:
    - contextPath: ThreatZone.Submission.URLAnalysis.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.URLAnalysis.Data
      description: The URL analysis report.
      type: Unknown
  - name: tz-get-behaviours
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: type
      required: false
      description: The behaviour event type filter.
    - name: pid
      required: false
      description: The process ID filter.
    - name: operation
      required: false
      description: The operation-name filter.
    - name: process_name
      required: false
      description: The exact process-name filter.
    - name: page
      required: false
      defaultValue: "1"
      description: The page number, starting at 1.
    - name: limit
      required: false
      defaultValue: "100"
      description: The number of events to return (1-500).
    description: Retrieves one bounded page of behaviour telemetry.
    outputs:
    - contextPath: ThreatZone.Submission.Behaviours.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.Behaviours.Data
      description: The behaviour events and pagination metadata.
      type: Unknown
  - name: tz-get-syscalls
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: page
      required: false
      defaultValue: "1"
      description: The page number, starting at 1.
    - name: limit
      required: false
      defaultValue: "500"
      description: The number of syscall lines to return (1-2000).
    description: Retrieves one bounded page of syscall telemetry.
    outputs:
    - contextPath: ThreatZone.Submission.Syscalls.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.Syscalls.Data
      description: The syscall lines and pagination metadata.
      type: Unknown
  - name: tz-get-network-summary
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Retrieves aggregate network activity counts.
    outputs:
    - contextPath: ThreatZone.Submission.NetworkSummary.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.NetworkSummary.Data
      description: The network activity summary.
      type: Unknown
  - name: tz-get-dns-queries
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: limit
      required: false
      description: The maximum items to return (0-1000).
    - name: skip
      required: false
      description: The number of items to skip (0-1000).
    description: Retrieves a bounded window of DNS queries.
    outputs:
    - contextPath: ThreatZone.Submission.DNSQueries.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.DNSQueries.Data
      description: The captured DNS queries.
      type: Unknown
  - name: tz-get-http-requests
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: limit
      required: false
      description: The maximum items to return (0-1000).
    - name: skip
      required: false
      description: The number of items to skip (0-1000).
    description: Retrieves a bounded window of HTTP request hosts.
    outputs:
    - contextPath: ThreatZone.Submission.HTTPRequests.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.HTTPRequests.Data
      description: The captured HTTP request hosts.
      type: Unknown
  - name: tz-get-tcp-connections
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: limit
      required: false
      description: The maximum items to return (0-1000).
    - name: skip
      required: false
      description: The number of items to skip (0-1000).
    description: Retrieves a bounded window of TCP connections.
    outputs:
    - contextPath: ThreatZone.Submission.TCPConnections.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.TCPConnections.Data
      description: The captured TCP connections.
      type: Unknown
  - name: tz-get-udp-connections
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: limit
      required: false
      description: The maximum items to return (0-1000).
    - name: skip
      required: false
      description: The number of items to skip (0-1000).
    description: Retrieves a bounded window of UDP connections.
    outputs:
    - contextPath: ThreatZone.Submission.UDPConnections.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.UDPConnections.Data
      description: The captured UDP connections.
      type: Unknown
  - name: tz-get-network-threats
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: limit
      required: false
      description: The maximum items to return (0-1000).
    - name: skip
      required: false
      description: The number of items to skip (0-1000).
    description: Retrieves a bounded window of Suricata network threats.
    outputs:
    - contextPath: ThreatZone.Submission.NetworkThreats.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.NetworkThreats.Data
      description: The detected network threats.
      type: Unknown
  - name: tz-download-static-scan-strings
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Downloads the static scan strings JSON to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-download-sample
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Downloads the original submitted sample to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-download-artifact
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: artifact_id
      required: true
      description: The artifact ID returned by tz-get-artifact-result.
    description: Downloads an extracted artifact to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-download-pcap
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Downloads the network capture to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-download-yara-rule
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: timeout
      required: false
      defaultValue: "120"
      description: The maximum seconds to poll for generated YARA rule readiness (1-3600).
    description: Polls for and downloads the generated YARA rule file to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-download-url-screenshot
    arguments:
    - name: uuid
      required: true
      description: The UUID of the URL analysis submission.
    description: Downloads the URL analysis screenshot to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-list-media-files
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    description: Lists screenshots and videos available for a submission.
    outputs:
    - contextPath: ThreatZone.Submission.MediaFiles.UUID
      description: The UUID of the submission.
      type: String
    - contextPath: ThreatZone.Submission.MediaFiles.Data
      description: The available media file metadata.
      type: Unknown
  - name: tz-download-media-file
    arguments:
    - name: uuid
      required: true
      description: The UUID of the submission.
    - name: file_id
      required: true
      description: The media file ID returned by tz-list-media-files.
    description: Downloads a submission media file to the War Room.
    outputs:
    - contextPath: InfoFile.EntryID
      description: The entry ID of the downloaded file.
      type: String
    - contextPath: InfoFile.Name
      description: The name of the downloaded file.
      type: String
  - name: tz-check-limits
    arguments:
    - name: detailed
      description: Whether to include plan file limits, enabled modules, and account metadata.
      default: false
    description: Check the plan limits from ThreatZone API.
    outputs:
    - contextPath: ThreatZone.Limits.E_Mail
      description: The owner e-mail of current plan.
      type: String
    - contextPath: ThreatZone.Limits.API_Limit
      description: The remaining/total API request limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Concurrent_Limit
      description: The remaining/total concurrent analysis limits of the current plan.
      type: String
    - contextPath: ThreatZone.Limits.Daily_Submission_Limit
      description: The remaining/total daily submission limits of the current plan.
      type: String
    - contextPath: ThreatZone.Plan.File_Size_Limit_MiB
      description: The maximum upload size for the workspace plan (MiB).
      type: Number
    - contextPath: ThreatZone.Plan.Allowed_Extensions
      description: The list of permitted file extensions for uploads.
      type: List
    - contextPath: ThreatZone.Plan.Modules
      description: The enabled ThreatZone modules for the workspace.
      type: List
    - contextPath: ThreatZone.Metadata.Full_Name
      description: The full name of the authenticated user.
      type: String
    - contextPath: ThreatZone.Metadata.Workspace
      description: The workspace identifier or name associated with the account.
      type: String
    - contextPath: ThreatZone.Metadata.Plan_Name
      description: The name of the active ThreatZone plan.
      type: String
    - contextPath: ThreatZone.Metadata.Plan_Status
      description: The status of the active ThreatZone plan.
      type: String
  dockerimage: demisto/threatzone-sdk:1.1.1.12287331
  runonce: false
  subtype: python3
fromversion: 6.9.0
sectionorder:
- Connect
- Collect
tests:
- ThreatZone Test