Joe Security Sandbox

Joe Security Sandbox automates malware analysis, providing detailed insights into file and URL behavior to aid in threat detection and response.

Joe Security Sandbox is a robust malware analysis service that provides automated, deep analysis of suspicious files and URLs. This connector enables Swimlane Turbine users to submit files or URLs for analysis, retrieve detailed reports, and download specific resources such as full reports or dropped binaries. By integrating with Joe Security Sandbox, security teams can enhance their incident response capabilities with automated malware investigations, enriching their security playbooks with actionable intelligence and reducing manual analysis efforts.

Prerequisites

To effectively utilize the Joe Security Sandbox connector within Swimlane Turbine, ensure you have the following:

Joe Security Joe Sandbox API Authentication with the necessary parameter:

API Key: Your unique identifier to authenticate requests to Joe Security Sandbox.

Capabilities

The connector provides the following capabilities:

Submit File or URL

Get Analysis

Search Analyses

Download Resource Analysis

Capabilities Notes

Download Resource

The following table details all available values for the resource type according to the v2 API docs.

Report Category	Values
human readable reports	html, lighthtml, executive, pdf, classhtml,
xml	xml, lightxml, classxml, clusterxml, irxml
json	json, jsonfixed, lightjson, lightjsonfixed, irjson, irjsonfixed
other	shoots (screenshots), ishots (interesting screen shots), maec, misp, stix, graphreports, memstrings, binstrings, sample, cookbook, bins (dropped files), unpackpe (unpacked PE files), unpack, ida, pcap, pcapslim, memdumps, yara, functionlogs, powershelllogs, eventlogs, classsightml

Notes

The Submission ID is only available through the integration, the ID shown in the browser is not the Submission ID.

Additional Documentation

Joe Security Sandbox Connector Documentation

Joe Security Sandbox API Documentation

Joe Security Sandbox Authentication Guide

Configurations

Joe Security Joe Sandbox API Key Authentication

Joe Security Joe Sandbox API Authentication.

Configuration Parameters

Parameter	Description	Type	Required
api_key	Joe Security Joe Sandbox API Key	string	Required
host	The hostname of the Joe Sandbox instance if it is on-prem. Defaults to cloud URL.	string	Optional
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Download Report Resource

Retrieve a specific resource such as the full report or dropped binaries from a Joe Security Sandbox report, requiring webid and type.

Input

Argument Name	Type	Required	Description
webid	number	Required	Unique identifier
run	number	Optional	Parameter for Download Report Resource
type	string	Required	Type of the resource

Input Example

{"webid":179,"run":10,"type":"Resource Type"}

Output

Parameter	Type	Description
file	array	Output field: file
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"file":[]}

Get Analysis

Retrieve detailed analysis for a specific submission in Joe Security Sandbox using the submission ID.

Input

Argument Name	Type	Required	Description
submission_id	string	Required	Unique identifier

Input Example

{"submission_id":"140"}

Output

Parameter	Type	Description
submission_id	string	Unique identifier
name	string	Name of the resource
status	string	Status value
time	string	Time value
most_relevant_analysis	object	Output field: most_relevant_analysis
most_relevant_analysis.webid	string	Unique identifier
most_relevant_analysis.detection	string	Output field: most_relevant_analysis.detection
most_relevant_analysis.score	number	Score value
analyses	array	Output field: analyses
analyses.webid	string	Unique identifier
analyses.time	string	Time value
analyses.runs	array	Output field: analyses.runs
analyses.runs.detection	string	Output field: analyses.runs.detection
analyses.runs.error	object	Error message if any
analyses.runs.system	string	Output field: analyses.runs.system
analyses.runs.yara	boolean	Output field: analyses.runs.yara
analyses.tags	array	Output field: analyses.tags
analyses.tags.file_name	string	Name of the resource
analyses.tags.file	string	Output field: analyses.tags.file
analyses.analysisid	string	Unique identifier
analyses.duration	number	Output field: analyses.duration
analyses.md5	string	Output field: analyses.md5
analyses.sha1	string	Output field: analyses.sha1
analyses.sha256	string	Output field: analyses.sha256
analyses.filename	string	Name of the resource

Output Example

{"json_body":{"submission_id":"140","name":"Sample.exe","status":"finished","time":"2019-04-15T08:05:05+00:00","most_relevant_analysis":{"webid":"179","detection":"clean","score":30},"analyses":[{},{}]}}

Submit File

Submits a file sample to Joe Security Sandbox for analysis, requiring an attachment as input.

Input

Argument Name	Type	Required	Description
attachments	array	Required	File to be submitted.
attachments.file	string	Required	Parameter for Submit File
attachments.file_name	string	Required	Name of the resource
params	object	Optional	Customize the sandbox parameters. They are described in more detail in the default submission parameters.
cookbook	array	Optional	Cookbook to be used.
cookbook.file	string	Required	Parameter for Submit File
cookbook.file_name	string	Required	Name of the resource

Input Example

{"attachments":[{"file":"string","file_name":"Example Name"}],"params":{},"cookbook":[{"file":"string","file_name":"Example Name"}]}

Output

Parameter	Type	Description
submission_id	string	Unique identifier

Output Example

{"json_body":{"submission_id":"140"}}

Submit URL

Submits a URL to Joe Security Sandbox for comprehensive analysis and returns the analysis results.

Input

Argument Name	Type	Required	Description
url	string	Required	URL endpoint for the request
params	object	Optional	Customize the sandbox parameters. They are described in more detail in the default submission parameters.

Input Example

{"url":"https://google.com"}

Output

Parameter	Type	Description
submission_id	string	Unique identifier

Output Example

{"json_body":{"submission_id":"140"}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT