Feedback:

sandbox

Use the sandbox operator to submit a URL to a ThreatStream sandbox.

Syntax

|sandbox <field or value> '<sandbox_type>'

<field or value>

Specify a field having a URL; or specify a URL.
<sandbox_type>

Specify the type of sandbox configured in ThreatStream for your organization:

  • ANOMALISANDBOX

  • VMRAY

  • JOESANDBOX

Usage

You can use the sandbox operator to submit a URL to a ThreatStream sandbox. In addition to submitting the URL, the operator adds the following fields to results:

  • sandbox_submission_success: 1 indicates submission successful; 0 indicates submission failed.

  • sandbox_error_message: String containing an error message (if any).

For information about sandboxes, refer to ThreatStream online help.

Examples

Example 1: Submit URL field to VMRAY sandbox for analysis.

Copy 
|sandbox url 'VMRAY'

Example 2: Submit hardcoded URL to Anomali sandbox for analysis.

Copy 
|sandbox 'https://www.fakeurl.com/img_1.png' 'ANOMAL