--- title: Joe Security Sandbox slug: connectors/joe-security-sandbox docTags: createdAt: 2026-06-09T16:29:42.014Z --- Joe Security Sandbox automates malware analysis, providing detailed insights into file and URL behavior to aid in threat detection and response. Joe Security Sandbox is a robust malware analysis service that provides automated, deep analysis of suspicious files and URLs. This connector enables Swimlane Turbine users to submit files or URLs for analysis, retrieve detailed reports, and download specific resources such as full reports or dropped binaries. By integrating with Joe Security Sandbox, security teams can enhance their incident response capabilities with automated malware investigations, enriching their security playbooks with actionable intelligence and reducing manual analysis efforts. ## Prerequisites To effectively utilize the Joe Security Sandbox connector within Swimlane Turbine, ensure you have the following: - Joe Security Joe Sandbox API Authentication with the necessary parameter: - API Key: Your unique identifier to authenticate requests to Joe Security Sandbox. ## Capabilities The connector provides the following capabilities: - Submit File or URL - Get Analysis - Search Analyses - Download Resource Analysis ## Capabilities Notes ### Download Resource The following table details all available values for the resource type according to the v2 [API docs](https://jbxcloud.joesecurity.org/userguide?sphinxurl=usage/webapi.html#v2-analysis-download). | Report Category | Values | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | human readable reports | html, lighthtml, executive, pdf, classhtml, | | xml | xml, lightxml, classxml, clusterxml, irxml | | json | json, jsonfixed, lightjson, lightjsonfixed, irjson, irjsonfixed | | other | shoots (screenshots), ishots (interesting screen shots), maec, misp, stix, graphreports, memstrings, binstrings, sample, cookbook, bins (dropped files), unpackpe (unpacked PE files), unpack, ida, pcap, pcapslim, memdumps, yara, functionlogs, powershelllogs, eventlogs, classsightml | ## Notes - The `Submission ID` is only available through the integration, the `ID` shown in the browser is not the `Submission ID`. ## Additional Documentation - [Joe Security Sandbox Connector Documentation](https://docs.swimlane.com/connectors/joe-security-sandbox) - [Joe Security Sandbox API Documentation](https://jbxcloud.joesecurity.org/userguide?subsection=apilink) - [Joe Security Sandbox Authentication Guide](https://docs.swimlane.com/authentication-guides/joe-security-sandbox) # Configurations ## Joe Security Joe Sandbox API Key Authentication Joe Security Joe Sandbox API Authentication. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | --------------------------------------------------------------------------------- | -------- | ------------ | | api\_key | Joe Security Joe Sandbox API Key | string | Required | | host | The hostname of the Joe Sandbox instance if it is on-prem. Defaults to cloud URL. | string | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Download Report Resource Retrieve a specific resource such as the full report or dropped binaries from a Joe Security Sandbox report, requiring webid and type. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------- | | `webid` | number | Required | Unique identifier | | `run` | number | Optional | Parameter for Download Report Resource | | `type` | string | Required | Type of the resource | ### Input Example `{"webid":179,"run":10,"type":"Resource Type"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | ----------------------- | | `file` | array | Output field: file | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"file":[]}` ## Get Analysis Retrieve detailed analysis for a specific submission in Joe Security Sandbox using the submission ID. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------- | | `submission_id` | string | Required | Unique identifier | ### Input Example `{"submission_id":"140"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | ------------------------------------------------ | | `submission_id` | string | Unique identifier | | `name` | string | Name of the resource | | `status` | string | Status value | | `time` | string | Time value | | `most_relevant_analysis` | object | Output field: most\_relevant\_analysis | | `most_relevant_analysis.webid` | string | Unique identifier | | `most_relevant_analysis.detection` | string | Output field: most\_relevant\_analysis.detection | | `most_relevant_analysis.score` | number | Score value | | `analyses` | array | Output field: analyses | | `analyses.webid` | string | Unique identifier | | `analyses.time` | string | Time value | | `analyses.runs` | array | Output field: analyses.runs | | `analyses.runs.detection` | string | Output field: analyses.runs.detection | | `analyses.runs.error` | object | Error message if any | | `analyses.runs.system` | string | Output field: analyses.runs.system | | `analyses.runs.yara` | boolean | Output field: analyses.runs.yara | | `analyses.tags` | array | Output field: analyses.tags | | `analyses.tags.file_name` | string | Name of the resource | | `analyses.tags.file` | string | Output field: analyses.tags.file | | `analyses.analysisid` | string | Unique identifier | | `analyses.duration` | number | Output field: analyses.duration | | `analyses.md5` | string | Output field: analyses.md5 | | `analyses.sha1` | string | Output field: analyses.sha1 | | `analyses.sha256` | string | Output field: analyses.sha256 | | `analyses.filename` | string | Name of the resource | ### Output Example `{"json_body":{"submission_id":"140","name":"Sample.exe","status":"finished","time":"2019-04-15T08:05:05+00:00","most_relevant_analysis":{"webid":"179","detection":"clean","score":30},"analyses":[{},{}]}}` ## Submit File Submits a file sample to Joe Security Sandbox for analysis, requiring an attachment as input. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------- | | `attachments` | array | Required | File to be submitted. | | `attachments.file` | string | Required | Parameter for Submit File | | `attachments.file_name` | string | Required | Name of the resource | | `params` | object | Optional | Customize the sandbox parameters. They are described in more detail in the default submission parameters. | | `cookbook` | array | Optional | Cookbook to be used. | | `cookbook.file` | string | Required | Parameter for Submit File | | `cookbook.file_name` | string | Required | Name of the resource | ### Input Example `{"attachments":[{"file":"string","file_name":"Example Name"}],"params":{},"cookbook":[{"file":"string","file_name":"Example Name"}]}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | ----------------- | | `submission_id` | string | Unique identifier | ### Output Example `{"json_body":{"submission_id":"140"}}` ## Submit URL Submits a URL to Joe Security Sandbox for comprehensive analysis and returns the analysis results. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------- | | `url` | string | Required | URL endpoint for the request | | `params` | object | Optional | Customize the sandbox parameters. They are described in more detail in the default submission parameters. | ### Input Example `{"url":"https://google.com"}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | ----------------- | | `submission_id` | string | Unique identifier | ### Output Example `{"json_body":{"submission_id":"140"}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |