Fully automated malware analysis using Hybrid Analysis API.
CrowdStrike Falcon Sandbox
- Details
- Content
- Dependencies
- Version History
Fully automated malware analysis (formerly Payload Security VxStream).
Integrations
| Name | Description |
|---|---|
| CrowdStrike Falcon Sandbox v2 (Hybrid-Analysis) | |
| CrowdStrike Falcon Sandbox (Deprecated) | Deprecated. Use CrowdStrike Falcon Sandbox V2 instead. |
Playbooks
| Name | Description |
|---|---|
| Detonate URL - CrowdStrike | Deprecated. Use the cs-falcon-sandbox-submit-url command with polling=true instead. |
| Detonate file - CrowdStrike Falcon Sandbox v2 | Detonates a File using CrowdStrike Falcon sandbox. |
| CrowdStrike Falcon Sandbox - Detonate file | Deprecated. Use the cs-falcon-sandbox-submit-file command with polling=true instead. |
Required Content Packs (3)
| Pack Name | Pack By |
|---|---|
| Base | By: Cortex XSOAR |
| Common Playbooks | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
Optional Content Packs (0)
| Pack Name | Pack By |
|---|
All level dependencies (6)
| Pack Name | Pack By |
|---|---|
| Common Playbooks | By: Cortex XSOAR |
| Base | By: Cortex XSOAR |
| Rasterize | By: Cortex XSOAR |
| Filters And Transformers | By: Cortex XSOAR |
| Cortex REST API | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
2.0.27 - R5469292 (October 20, 2025)
- 40771
Download
Integrations
CrowdStrike Falcon Sandbox v2 (Hybrid-Analysis)
- Added the environmentID argument to the cs-falcon-sandbox-scan command.
- Fixed a bug that prevented the cs-falcon-sandbox-scan command from working properly.
- Updated the Docker image to: demisto/python3:3.12.11.4284848.
- 40771
Download
2.0.24 - 2628530 (March 3, 2025)
2.0.1 - 2784849 (April 19, 2022)
Integrations
CrowdStrike Falcon Sandbox v2
- Updated formatting of integration parameters.
2.0.0 - 2419785 (February 15, 2022)
Integrations
CrowdStrike Falcon Sandbox (Deprecated)
Use the CrowdStrike Falcon Sandbox v2 integration instead.
New: CrowdStrike Falcon Sandbox v2
Use the CrowdStrike Falcon Sandbox V2 integration to submit and analyze files and URLs. This integration is backwards compatible with the CrowdStrike Falcon Sandbox integration.
Playbooks
CrowdStrike Falcon Sandbox - Detonate file
- Deprecated. Use the cs-falcon-sandbox-submit-file command with polling=true instead.
Detonate URL - CrowdStrike
- Deprecated. Use the cs-falcon-sandbox-submit-url command with polling=true instead.
1.0.5 - R2330048 (January 30, 2022)
Integrations
CrowdStrike Falcon Sandbox
- Fixed an issue where no results were found when passing any file to the file argument in the crowdstrike-scan.
PUBLISHER
PLATFORMS
Cortex XSOAR
INFO
| Certification | Certified | Read more |
| Supported By | Cortex | |
| Created | September 23, 2020 | |
| Last Release | October 20, 2025 |
WORKS WITH THE FOLLOWING INTEGRATIONS:
