Integrate with Cuckoo Sandbox

1. Configure Cuckoo Sandbox

For information about installing Cuckoo Sandbox, please see the product documentation.

1.1 Start Cuckoo Sandbox

Before starting Cuckoo Sandbox, ensure the guest machine (for example, Win 7 running in VirtualBox) has started. To start Cuckoo, use the command cuckoo_venv.

In this example, cuckoo is installed in the Python virtual environment. In this case, you will need to activate the virtual environment first.

1.2 Start cuckoo API server

To start the Cuckoo API server, use the following command:

cuckoo api --host 172.16.69.243 --port 1337

To access to the API, the api_token can be found in <cwd>/conf/cuckoo.cfg.

Troubleshooting:

If you see the following attribute error when requesting the API:

AttributeError: 'Request' object has no attribute 'is_xhr'

Open /flask/app.py and set JSONIFY_PRETTYPRINT_REGULAR to False.

The request.is_xhr property was deprecated since Werkzeug 0.13 and removed in Werkzeug 1.0.0. As a result, this error will occur when using Flask <= 0.12.4 and Werkzeug >=1.0.0 because Flask uses this property in the source before the 1.0.0 version.

2. Configure FortiDeceptor to integrate with Cuckoo Sandbox

1. In FortiDeceptor go to Fabric > Detection Devices.
2. Enable Cuckoo Sandbox.
3. Configure Cuckoo Sandbox.

   IP/URL	Set the IP the based on the command in step 1.2 Start cuckoo API server.
   Port	Set the Port the based on the command in step 1.2 Start cuckoo API server.
   API Token	API token information can be found on <cwd>/conf/cuckoo.cfg.

   

4. Click Test. You should see The Cuckoo device <IP> is accessible".

   

3. Verify the detection result from Cuckoo Sandbox

1. Copy a file from any endpoint to the decoy using SMB/FTP protocol and verify that the file is captured and analyzed by the Cuckoo sandbox.
2. To verify the result in FortiDeceptor:
   1. Go to Incident > Analysis.
   2. Expand the incident and verify Cuckoo-Sandbox Result is displayed.

      

3. To verify the result in Cuckoo Sandbox, go to WebUI > Recent. Open the Cuckoo report to verify result.