Skip to main content

Detonate URL - CrowdStrike Falcon X

This Playbook is part of the CrowdStrike FalconX Pack.#

Detonate one or more files using the CrowdStrike Falcon Sandbox integration. This playbook returns relevant reports to the War Room and file reputations to the context data.


This playbook uses the following sub-playbooks, integrations, and scripts.


This playbook does not use any sub-playbooks.


  • CrowdStrikeFalconX
  • CrowdStrike Falcon X


This playbook does not use any scripts.


  • cs-fx-get-full-report
  • cs-fx-submit-url

Playbook Inputs#

NameDescriptionDefault ValueRequired
URLURL to detonate.URL.DataOptional
EnvironmentIDEnvironment ID to submit the file to. To get all IDs run the crowdstrike-get-environments command.100Optional
IntervalPolling frequency - how often the polling command should run (minutes)5Optional
TimeoutHow much time to wait before a timeout occurs (minutes)30Optional

Playbook Outputs#

csfalconx.resource.idAnalysis ID.String
csfalconx.resource.verdictAnalysis verdict.String
csfalconx.resource.created_timestampAnalysis start time.String
csfalconx.resource.environment_idEnvironment ID.String
csfalconx.resource.environment_descriptionEnvironment description.String
csfalconx.resource.threat_scoreScore of the threat.Int
csfalconx.resource.submit_urlURL submitted for analysis.String
csfalconx.resource.submission_typeType of submitted artifact, for example file, URL, etc.String
csfalconx.resource.sha256SHA256 hash of the submitted file.String
csfalconx.resource.ioc_report_strict_csv_artifact_idID of the IOC pack to download (CSV).String
csfalconx.resource.ioc_report_broad_csv_artifact_idID of the IOC pack to download (CSV).String
csfalconx.resource.ioc_report_strict_json_artifact_idID of the IOC pack to download (JSON).Int
csfalconx.resource.ioc_report_broad_json_artifact_idID of the IOC pack to download (JSON).String
csfalconx.resource.ioc_report_strict_stix_artifact_idID of the IOC pack to download (STIX).String
csfalconx.resource.ioc_report_broad_stix_artifact_idID of the IOC pack to download (STIX).Int
csfalconx.resource.ioc_report_strict_maec_artifact_idID of the IOC pack to download (MAEC).String
csfalconx.resource.ioc_report_broad_maec_artifact_idID of the IOC pack to download (MAEC).String