Falcon Sandbox

Version: 2.0.0

Falcon Sandbox performs deep analysis of evasive and unknown threats, enriches the results with threat intelligence and delivers actionable indicators of compromise (IOCs), enabling your security team to better understand sophisticated malware attacks and strengthen their defenses.

Connect Falcon Sandbox with LogicHub

  1. Navigate to Automations > Integrations.
  2. Search for Falcon Sandbox.
  3. Click Details, then the + icon. Enter the required information in the following fields.
    • Label: Enter a connection name.
    • Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
    • Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
    • Remote Agent: Run this integration using the LogicHub Remote Agent.
    • Falcon Host Sandbox URL: URL of Falcon Host Sandbox.
    • API Key: API key for Falcon Host Sandbox.
  4. After you've entered all the details, click Connect.

Actions for Falcon Sandbox

Analyze and Wait

Analyze and wait submits a file and waits for the analysis to be completed.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Filename Column nameColumn name from the parent table to lookup filename values.Required
Correlation ID Column nameColumn name from the parent table with the correlation IDs.Optional
Environment IDThe environment relevant to the files being analyzed.Required

Output

JSON containing the following items:

  • has_error: True/False
  • error: message/null
  • result: Analysis details.
3360

Analyze

Analyze submits a file and immediately returns the job description, which can later be used to retrieve the report.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Filename Column nameColumn name from the parent table to lookup filename values.Required
Environment IDThe environment relevant to the files being analyzed.Required

Output

JSON containing the following items:

  • has_error: True/False
  • error: message/null
  • result: Analysis details.
3360

Submit URL and Wait

Submit an URL and wait for the analysis to be completed.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
URL Column nameColumn name from the parent table with the URLs to analyze.Required
Correlation ID Column nameColumn name from the parent table with the correlation IDs.Optional
Environment IDThe environment relevant to the files being analyzed.Required

Output

JSON containing the following items:

  • has_error: True/False
  • error: message/null
  • result: Analysis details.
3360

Submit URL

Submits an URL and returns the corresponding job description.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
URL Column nameColumn name from the parent table with the URLs to analyze.Required
Environment IDThe environment relevant to the files being analyzed.Required

Output

JSON containing the following items:

  • has_error: True/False
  • error: message/null
  • result: URL details.
3360

Get Report

Takes a job ID and fetches its report. Works with either File or URL jobs.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Job ID Column nameTakes a job ID and fetches its report. Works with either File or URL jobs.Required

Output

JSON containing the following items:

  • has_error: True/False
  • error: message/null
  • result: Job details.
3360

URL Quick Scan

Quickly check if there are any historical reports for a URL, return report IDs (if there are any), and a sha256 hash for the lookup.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
URL Column nameColumn name from parent table to lookup URL values.Required
Scan TypeThe Falcon Host Sandbox scan type (example: "lookup_ha" or "all").Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Scan details.
3360

Get Report with sha256 hashes

Returns a list of reports, given a list of hashes as an input.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Hash (sha256) Column nameColumn name from the parent table to lookup hash values.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Report details.
3360

Release Notes

  • v2.0.0 - Updated architecture to support IO via filesystem

© 2017-2021 LogicHub®. All Rights Reserved.