Skip to main content

Detonate URL - CrowdStrike Falcon Intelligence Sandbox

This Playbook is part of the CrowdStrike Falcon Intelligence Sandbox Pack.#

Detonate one or more files using the CrowdStrike Falcon Intelligence Sandbox integration. This playbook returns relevant reports to the War Room and file reputations to the context data.

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

This playbook does not use any sub-playbooks.

Integrations#

  • CrowdStrikeFalconIntelligenceSandbox
  • CrowdStrike Falcon Intelligence Sandbox

Scripts#

This playbook does not use any scripts.

Commands#

  • cs-fx-get-full-report
  • cs-fx-submit-url

Playbook Inputs#


NameDescriptionDefault ValueRequired
URLURL to detonate.URL.DataOptional
EnvironmentIDEnvironment ID to submit the file to. To get all IDs run the crowdstrike-get-environments command.100Optional
IntervalPolling frequency - how often the polling command should run (minutes)5Optional
TimeoutHow much time to wait before a timeout occurs (minutes)30Optional

Playbook Outputs#


PathDescriptionType
csfalconx.resource.idAnalysis ID.String
csfalconx.resource.verdictAnalysis verdict.String
csfalconx.resource.created_timestampAnalysis start time.String
csfalconx.resource.environment_idEnvironment ID.String
csfalconx.resource.environment_descriptionEnvironment description.String
csfalconx.resource.threat_scoreScore of the threat.Int
csfalconx.resource.submit_urlURL submitted for analysis.String
csfalconx.resource.submission_typeType of submitted artifact, for example file, URL, etc.String
csfalconx.resource.sha256SHA256 hash of the submitted file.String
csfalconx.resource.ioc_report_strict_csv_artifact_idID of the IOC pack to download (CSV).String
csfalconx.resource.ioc_report_broad_csv_artifact_idID of the IOC pack to download (CSV).String
csfalconx.resource.ioc_report_strict_json_artifact_idID of the IOC pack to download (JSON).Int
csfalconx.resource.ioc_report_broad_json_artifact_idID of the IOC pack to download (JSON).String
csfalconx.resource.ioc_report_strict_stix_artifact_idID of the IOC pack to download (STIX).String
csfalconx.resource.ioc_report_broad_stix_artifact_idID of the IOC pack to download (STIX).Int
csfalconx.resource.ioc_report_strict_maec_artifact_idID of the IOC pack to download (MAEC).String
csfalconx.resource.ioc_report_broad_maec_artifact_idID of the IOC pack to download (MAEC).String