Trellix Sandbox (formerly FireEye Detection on Demand) is a cloud-based malware analysis service that provides automated threat detection and analysis capabilities.

Connect Trellix Sandbox

1. Navigate to Automations > Integrations.
2. Search for Trellix Sandbox.
3. Click Details, then the + icon. Enter the required information in the following fields.
   • Label: Enter a connection name.
   • Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
   • Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
   • Remote Agent: Run this integration using the LogicHub Remote Agent.
   • API Key: API key for Trellix Sandbox. It should have all the necessary permissions.
   • Base URL: Base URL for Trellix Sandbox API (Example: 'https://feapi.marketplace.apps.fireeye.com' without quotes).
4. After you've entered all the details, click Connect.

Actions for Trellix Sandbox

Submit File for Analysis

Submit a single file for malware analysis. Files must be less than 50 MB.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{
"result": {},
"error": null,
"has_error":false,
}

Submit URLs for Analysis

Submit one or more URLs for analysis. The limit is 5 URLs in a single call.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{
"result": {},
"error": null,
"has_error":false,
}

Get Report by Connector and File ID

Get a single report by connector and file ID. Used as an alternate way to find a report that was submitted by a configured connector.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{
"result": {},
"error": null,
"has_error":false,
}

Get Report by ID

Get a single report by its report ID.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{
"result": {},
"error": null,
"has_error":false,
}

Get Report by Hash

Get a single report by MD5 or SHA256 hash.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{
"result": {},
"error": null,
"has_error":false,
}

Get Presigned URL

Get a presigned URL link to a browser viewable report.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{
"result": {},
"error": null,
"has_error":false,
}

Get Hash Analysis Results

Get hash analysis results by MD5 hash.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{
"result": {},
"error": null,
"has_error":false,
}

Get Extended Hash Analysis Results

Get hash analysis results by MD5 or SHA256 hash.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{
"result": {},
"error": null,
"has_error":false,
}

Get Artifacts

Get artifacts for a given report ID.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{
"result": {},
"error": null,
"has_error":false,
}

Get Telemetry Data

Pull results metadata in batches for given time interval.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{
"result": {},
"error": null,
"has_error":false,
}

Get Health Status

Get health status of service, subscription and API key.

Input Field

Choose a connection that you have previously created.

Output

JSON containing the following items:

{
"result": {},
"error": null,
"has_error":false,
}

Release Notes

• v1.0.0 - Initial release