Joe Sandbox is a multi technology platform which uses instrumentation, simulation, hardware virtualization, hybrid and graph - static and dynamic analysis. Rather than focus on one technology Joe Sandbox combines the best parts of multiple techniques. This enables deep analysis, excellent detection and big evasion resistance.

Connect Joe Security Sandbox with Devo SOAR

Navigate to Automations > Integrations.
Search for Joe Security Sandbox.
Click Details, then the + icon. Enter the required information in the following fields.
Label: Enter a connection name.
Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
Remote Agent: Run this integration using the Devo SOAR Remote Agent.
API Key: API key for Joe Security Sandbox
URL (Optional. Leave Empty For Default): URL to your Joe Security Sandbox instance. Default is https://jbxcloud.joesecurity.org/api.
ACCEPT JOE SANDBOX CLOUD TERMS AND CONDITIONS: Accept the Terms and Conditions of Joe Sandbox Cloud (https://jbxcloud.joesecurity.org/download/termsandconditions.pdf). This is required if you are using 'Joe Sandbox Cloud'.
After you've entered all the details, click Connect.

Actions for JoeSecurity Sandbox

Analysis Info

Show information about analysis.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
WEB ID COLUMN NAME	Column name from parent table that contains web id. This ID is identified as an analysis.	Required

Output

The analysis results in JSON format.

Submit File

Submit a file to JoeSecurity Sandbox for analysis.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
File ID Column Name	Column name from parent table that contains file id to be submitted.	Required
Comment Column Name	Column name from parent table that contains comment for the analysis.	Required
System	Select Server System to run analysis on.	Required
Should Wait	Should the command wait for the result of the analysis.	Required
Internet Access	Enable full internet access. Default is True.	Optional
Additional Parameters	Enter jinja-templated JSON of additional parameters (optional or otherwise). Note: This will override values (if provided) for the above input fields like System, Comment, and Internet-Access.
For more information on parameters, refer to https://jbxcloud.joesecurity.org/userguide?sphinxurl=usage/webapi.html#apiv2-submission-new.
Example:	Optional

``` {json}{ "systems": null, "fast-mode": true, "export-to-jbxview": true }


### Output

Result in JSON format when should_wait is false.

![](https://files.readme.io/15f2729-Screenshot_2019-10-22_at_10.10.49_PM.png "Screenshot 2019-10-22 at 10.10.49 PM.png")

## Submit URL

Submit a URL to JoeSecurity Sandbox for analysis.

### Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

| Input Name | Description | Required |
| : --------  | : --------  | : --------  |
| URL Column Name | Column name from parent table that contains URL to be analyzed. | Required |
| Comment Column Name | Column name from parent table that contains comment for the analysis. | Required |
| System | Select Server System to run analysis on. | Required |
| Should Wait | Should the command wait for the result of the analysis. | Required |
| Internet Access | Enable full internet access. Default is True. | Optional |
| Additional Parameters | Enter [jinja-templated](doc:jinja-template) JSON of additional parameters (optional or otherwise). Note: This will override values (if provided) for the above input fields like System, Comment, Internet-Access.  
For more information on parameters, refer to &lt;https://jbxcloud.joesecurity.org/userguide?sphinxurl=usage/webapi.html#apiv2-submission-new&gt;.  
Example: | Optional |



``` {json}{
  "systems": null,
  "fast-mode": true,
  "export-to-jbxview": true
}

Output

Result in JSON format when should wait is false.

Download Report

Download a resource belonging to a report. This can be the full report, dropped binaries, and so on.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Web ID Column Name	Column name from parent table that contains web ID.	Required
Report Type	The resource type to download. Defaults to HTML.	Optional

Output

File ID of the downloaded report in JSON format.

Download Sample

Download the sample file of analysis. for security reasons, the extension will be "dontrun".

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Web ID Column Name	Column name from parent table that contains web ID.	Required

Output

File ID of the downloaded JSON sample.

Is Online

Check if Joe Sandbox is online or in maintenance mode.

Input Field

Choose a connection that you have previously created to complete the connection.

Output

Status data in JSON format.

List Analyses

List all analyses that are present on JoeSecurity Sandbox.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Explode Results	Select whether to return separate rows for each result or a single row containing all results. Default is Separate Rows.	Optional

Output

Results in JSON format.

Search Analyses

Search through all analyses.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Query Column Name	Column name from parent table that contains a query string. The query string will be used to search. The server considers the following fields: md5, sha1, sha256, filename, URL, comments.	Required

Output

Search Results in JSON format.

Delete Analysis

Delete analysis by webID.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Web ID	Jinja-templated text containing webID.	Required

Output

Results in JSON format.

``` {json}{

"has_error":false, "result":{"deleted":true}, "error":null

} ```

Release Notes

v2.0.0 - Updated architecture to support IO via filesystem