Joe Sandbox Cloud v1.2.0

About the connector

Joe Sandbox detects and analyzes potential malicious files and URLs on Windows, Android, Mac OS, Linux, and iOS for suspicious activities. It performs deep malware analysis and generates comprehensive and detailed analysis reports.

This document provides information about the Joe Sandbox Cloud connector, which facilitates automated interactions, with Joe Sandbox Cloud server using FortiSOAR™ playbooks. Add the Joe Sandbox Cloud connector as a step in FortiSOAR™ playbooks and perform automated operations, such as submitting files to the Joe Sandbox Cloud server for analyzes and searching for and retrieving reports from the Joe Sandbox Cloud server.

Version information

Connector Version: 1.2.0

FortiSOAR™ Version Tested on: 7.6.0-5012

Joe Sandbox Cloud Pro Version Tested on: 2.0

Authored By: Fortinet

Certified: Yes

Release Notes for version 1.2.0

Following enhancements have been made to the Joe Sandbox Cloud connector in version 1.2.0:

• Optimized the code that calculates the reputation of indicator types URL and File in the following playbooks:
  • File > JoeSandbox > Enrichment
  • URL > JoeSandbox > Enrichment

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-joe-sandbox-cloud

Prerequisites to configuring the connector

• You must have the URL of the Joe Sandbox Cloud server to which you will connect and perform the automated operations and the API Key configured for your account to access that Joe Sandbox Cloud server.
• To access the FortiSOAR™ UI, ensure that port 443 is open through the firewall for the FortiSOAR™ instance.

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Joe Sandbox Cloud connector row, and in the Configuration tab enter the required configuration details.

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 onwards:

operation: Get All System Information

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "result_data": {
        "webids": []
    }
}

operation: Submit File

Input parameters

Note: You can only upload files to the Joe Sandbox Cloud channels on your configured Joe Sandbox Cloud from the FortiSOAR™ Attachment module.

["w7x64", "w7", "w10"]

Output

The output contains the following populated JSON schema:

{
    "result_data": {
        "webids": []
    }
}

operation: Submit URL

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result_data": {
        "webids": []
    }
}

operation: Get Submission Status

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result_data": {
        "runs": [],
        "sha256": "",
        "analysisid": "",
        "filename": "",
        "tags": [],
        "sha1": "",
        "scriptname": "",
        "md5": "",
        "status": "",
        "webid": "",
        "time": "",
        "comments": ""
    }
}

operation: Search Report

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result_data": [
        {
            "webid": ""
        }
    ]
}

operation: Get Report

Input parameters

Output

The output contains the following populated JSON schema:

{
    "analysis": {
        "successnotices": {},
        "droppedinfo": {},
        "avhit": {},
        "context": {},
        "yara": {},
        "runtimemessages": "",
        "signaturedetections": {},
        "sigscore": {},
        "patches": {},
        "domaininfo": {},
        "signatureconfidence": {},
        "generalinfo": {},
        "patterninfo": {},
        "comments": {},
        "behavior": {},
        "fileinfo": {},
        "signatureclassifications": {},
        "analysistime": {},
        "errorinfo": {},
        "ipinfo": {},
        "behaviorgraph": {},
        "eventlog": {},
        "signatureinfo": {},
        "simulations": {},
        "warninginfo": {}
    }
}

operation: Get All Analysed Sample Details

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "result_data": [
        {
            "webid": ""
        }
    ]
}

operation: Get Account Information

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "result_data": {
        "quota": {
            "daily": {
                "current": "",
                "limit": "",
                "remaining": ""
            },
            "monthly": {
                "current": "",
                "limit": "",
                "remaining": ""
            }
        },
        "type": ""
    }
}

Included playbooks

The Sample - Joe Sandbox Cloud - 1.2.0 playbook collection comes bundled with the Joe Sandbox Cloud connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Joe Sandbox Cloud connector.

• Get Account Information
• Get All Analysed Sample Details
• Get All System Information
• Get Report
• Get Submission Status
• Search Report
• Submit File
• Submit URL
• File > JoeSandbox > Enrichment
• URL > JoeSandbox > Enrichment

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.

Pluggable Enrichment

The Sample - Joe Sandbox Cloud - 1.2.0 playbook collection contains pluggable enrichment playbooks that are used to provide verdicts for File Hash and URL indicator types. The pluggable enrichment playbooks are in the format: indicatorType > Joe Sandbox Cloud > Enrichment. For example, URL > Joe Sandbox Cloud > Enrichment.

The Configuration step in all the pluggable enrichment playbooks contains variables that have default values for calculating the Verdict for various indicator types.

The following table lists the variable names and their default values:

Based on the above default values, the Joe Sandbox Cloud integration API response returns the verdict, cti_score, and other variables.