CrowdStrike Falcon Sandbox 3.0.0
App Vendor: CrowdStrike
App Category: Analytics & SIEM
Connector Version: 3.0.0
API Version: 2.0.0
Note
This app is currently released as a beta version.
About App
The CrowdStrike Falcon Sandbox app allows security teams to perform in-depth analysis of evasive and unknown threats, enrich findings with threat intelligence, and obtain actionable indicators of compromise (IOCs) to strengthen defenses against sophisticated malware attacks.
The CrowdStrike Falcon Sandbox app is configured with Cyware Orchestrate to perform the following actions:
Action Name | Description |
|---|---|
Check Analysis Status | This action checks the progress of the specified analysis. |
Check Submission Quota | This action checks the current status of your submission quota. |
Download Artifacts | This action downloads IOCs, PCAP files, and other analysis artifacts. |
Find Malware Samples | This action finds malware samples. |
Find Sandbox Reports | This action finds the sandbox report by providing an FQL filter and paging details. |
Get Full Report | This action retrieves the specified reports. |
Get Report Summary | This action retrieves the summary of a sandbox report. |
Submit File or URL | This action submits an uploaded file or URL for analysis. |
Upload File | This action uploads a file for sandbox analysis. |
Generic Action | This is a generic action used to make requests to any CrowdStrike Falcon Sandbox endpoint. |
Configuration Parameters
The following configuration parameters are required for the CrowdStrike Falcon Sandbox app to communicate with the CrowdStrike Falcon Sandbox enterprise application. The parameters can be configured by creating instances in the app.
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Base URL | Enter the base URL to access the CrowdStrike Falcon Sandbox. Example: https://falcon.us-2.crowdstrike.com | Text | Required | |
Client ID | Enter the client ID of the application. | Text | Required | |
Client Secret | Enter the client secret of your application. | Password | Required | |
Verify | Choose your preference to verify SSL while making requests. It is recommended to set this option to yes. Passing no may result in incorrectly establishing the connection. | Boolean | Optional | By default, verification is not enabled. |
Timeout | Enter the timeout value in seconds. This is the number of seconds that requests will wait to establish a connection with CrowdStrike Falcon Sandbox. | Integer | Optional | Allowed range: 15-120 Default value: 15 |
Action: Check Analysis Status
This action checks the progress of the specified analysis.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
IDs | Enter one or more IDs of the submitted malware sample. Example: 5ddb0407bef249c19c7a975f17979a1f_eecd9a8f319940dfb0255e5d436822d9 | List | Required | You can retrieve the ID using the action Find Malware Samples. |
Action: Check Submission Quota
This action checks the current status of your submission quota.
Action Input Parameters
No input parameters are required for this action.
Action: Download Artifacts
This action downloads IOCs, PCAP files, and other analysis artifacts.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
ID | Enter the ID of the artifact to download. Example: 9a24ffdfe64bc885dc023a43ced533fd90c4187ffe4800e266d54b79c3e1b198 | Text | Required | You can retrieve the ID using the action Get Full Report. |
Name | Enter the name of the file you are downloading. | Text | Optional | |
Encoding | Enter the format to compress the downloaded file. | Text | Optional | Allowed format: gzip |
Action: Find Malware Samples
This action finds malware samples.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Filter | Enter the FQL query to filter the response. | Text | Required | For more information on FQL query, see CrowdStrike Falcon Sandbox API Documentation. |
Offset | Enter the offset value to start retrieving reports from. | Text | Required | |
Limit | Enter the maximum number of submission IDs to return. | Integer | Required | Maximum allowed value: 5000 |
Sort | Enter the order to sort the response. | Text | Required | Allowed values: asc, desc |
Action: Find Sandbox Reports
This action finds the sandbox report by providing an FQL filter and paging details.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Filter | Enter the FQL query to filter the response. | Text | Required | For more information on FQL query, see CrowdStrike Falcon Sandbox API Documentation. |
Offset | Enter the offset value to start retrieving reports from. | Text | Required | |
Limit | Enter the maximum number of report IDs to return. | Integer | Required | Maximum allowed value: 5000 |
Sort | Enter the order to sort the response. | Text | Required | Allowed values: asc, desc |
Action: Get Full Report
This action retrieves the specified reports.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
IDs | Enter one or more report IDs to retrieve the report details. Example: 5ddb0407bef249c19c7a975f17979a1f_eecd9a8f319940dfb0255e5d436822d9 | List | Required | You can retrieve report IDs using the action Find Sandbox Reports. |
Action: Get Report Summary
This action retrieves the summary of a sandbox report.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
IDs | Enter one or more report IDs to retrieve the summary details. Example: 5ddb0407bef249c19c7a975f17979a1f_eecd9a8f319940dfb0255e5d436822d9 | List | Required | You can retrieve report IDs using the action Find Sandbox Reports. |
Action: Submit File or URL
This action submits an uploaded file or URL for analysis.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Environment ID | Enter the ID of the sandbox environment to be used for analysis. | Text | Required | Allowed values: 400, 410, 300, 200, 160, 140, 110, 100 |
URL | Enter the URL of the web page or file, which can be HTTP(S) or FTP. | Text | Optional | NoteYou can provide either the SHA-256 parameter or the URL, but not both simultaneously. |
SHA-256 | Enter the SHA256 hash ID of the sample. | Text | Optional | NoteYou can provide either the SHA-256 parameter or the URL, but not both simultaneously. |
Send Email Notification | Enter true to send email notification. | Boolean | Optional | |
User Tags | Enter the user tags. Example: ['tag1', 'tag2', 'tag3'] | List | Optional | |
Extra Params | Enter the extra parameters to make the request. | Key Value | Optional | Allowed keys: action_script, command_line, document_password, network_settings, submit_name, system_date, system_time |
Action: Upload File
This action uploads a file for sandbox analysis.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
File Path | Enter the path of the file to be uploaded. | Text | Required | Allowed file formats: .exe, .scr, .pif, .dll, .com, .cpl, .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub, PDF, APK, Executable JAR, .sct, .lnk, .chm, .hta, .wsf, .js, .vbs, .vbe, .swf, .pl, .ps1, .psd1, .psm1, .svg, .py, Linux ELF executables, .eml, .msg |
File Name | Enter the name of the file to be uploaded. | Text | Required | |
Comment | Enter the comment for the file. | Text | Optional | |
Is Confidential | Enter true to display this file to users within your customer account. | Boolean | Optional | Default value: True |
Action: Generic Action
This is a generic action used to make requests to any CrowdStrike Falcon Sandbox endpoint.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Method | Enter the HTTP method to make the request. | Text | Required | Allowed values: GET, PUT, POST, DELETE |
Endpoint | Enter the endpoint to make the request. Example: falconx/queries/submissions/v1 | Text | Required | |
Payload | Enter the payload to make the request. | Key Value | Optional | |
Query Params | Enter the query parameters to make the request. | Key Value | Optional | |
Extra Fields | Enter the extra fields to make the request. | Key Value | Optional | Allowed keys: payload_data, custom_output, download, files, retry_wait, retry_count, response_type. |