Falcon Sandbox performs deep analysis of evasive and unknown threats, enriches the results with threat intelligence and delivers actionable indicators of compromise (IOCs), enabling your security team to better understand sophisticated malware attacks and strengthen their defenses.

Connect Falcon Sandbox with Devo SOAR

1. Navigate to Automations > Integrations.

2. Search for Falcon Sandbox.

3. Click Details, then the + icon. Enter the required information in the following fields.

4. Label: Enter a connection name.

5. Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.

6. Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).

7. Remote Agent: Run this integration using the Devo SOAR Remote Agent.

8. Falcon Host Sandbox URL: URL of Falcon Host Sandbox.

9. API Key: API key for Falcon Host Sandbox.

10. After you've entered all the details, click Connect.

Actions for Falcon Sandbox

Analyze and Wait

Analyze and wait submits a file and waits for the analysis to be completed.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

• has_error: True/False

• error: message/null

• result: Analysis details.

Analyze

Analyze submits a file and immediately returns the job description, which can later be used to retrieve the report.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

• has_error: True/False

• error: message/null

• result: Analysis details.

Submit URL and Wait

Submit an URL and wait for the analysis to be completed.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

• has_error: True/False

• error: message/null

• result: Analysis details.

Submit URL

Submits an URL and returns the corresponding job description.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

• has_error: True/False

• error: message/null

• result: URL details.

Get Report

Takes a job ID and fetches its report. Works with either File or URL jobs.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

• has_error: True/False

• error: message/null

• result: Job details.

URL Quick Scan

Quickly check if there are any historical reports for a URL, return report IDs (if there are any), and a sha256 hash for the lookup.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: Scan details.

Get Report with sha256 hashes

Returns a list of reports, given a list of hashes as an input.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: Report details.