ThreatZone malware analysis sandboxing

ThreatZone Cortex Platform Integration Pack

Overview

ThreatZone enrichments integrate into sandbox, static-scan, CDR, URL-analysis, and open-in-browser workflows. The integration uses the official ThreatZone Python SDK for configuration discovery, submissions, granular report and bounded telemetry retrieval, and streamed file downloads.

Supported commands

Configuration: discover metafields, sandbox environments, and workspace network configurations.
Submission: submit sandbox, static, CDR, URL-analysis, and open-in-browser jobs; list submissions or search by SHA256.
Results: retain the existing summary, indicator, IOC, matched-YARA, artifact, and extracted-config commands, plus dedicated SDK report sections for overview, EML, MITRE ATT&CK, static scan, CDR, signatures, processes, process tree, and URL analysis.
Telemetry: retrieve bounded behaviour and syscall pages, network summaries, and bounded DNS, HTTP, TCP, UDP, and network-threat windows.
Files: stream HTML, CDR, strings, original sample, artifact, PCAP, and generated-YARA downloads; retrieve URL screenshots and analysis media.
Account: inspect current plan quotas, enabled modules, and workspace metadata.

Use tz-get-result details=true for the existing inline sections, or call the dedicated commands for the additional SDK reports and telemetry. Existing command names, polling semantics, and context paths remain compatible.

Ready-to-Use Playbooks

Analyze File - Sandbox - ThreatZone
Analyze File - Static Scan - ThreatZone
Sanitize File - CDR - ThreatZone
Analyze URL - ThreatZone

ThreatZone Cortex Platform Integration Pack

Overview

Supported commands

Configuration: discover metafields, sandbox environments, and workspace network configurations.
Submission: submit sandbox, static, CDR, URL-analysis, and open-in-browser jobs; list submissions or search by SHA256.
Results: retain the existing summary, indicator, IOC, matched-YARA, artifact, and extracted-config commands, plus dedicated SDK report sections for overview, EML, MITRE ATT&CK, static scan, CDR, signatures, processes, process tree, and URL analysis.
Telemetry: retrieve bounded behaviour and syscall pages, network summaries, and bounded DNS, HTTP, TCP, UDP, and network-threat windows.
Files: stream HTML, CDR, strings, original sample, artifact, PCAP, and generated-YARA downloads; retrieve URL screenshots and analysis media.
Account: inspect current plan quotas, enabled modules, and workspace metadata.

Ready-to-Use Playbooks

Analyze File - Sandbox - ThreatZone
Analyze File - Static Scan - ThreatZone
Sanitize File - CDR - ThreatZone
Analyze URL - ThreatZone

Integrations

Name	Description
ThreatZone (Partner Contribution)	ThreatZone malware analysis sandboxing.

Playbooks

Name	Description
Analyze File - Static Scan - ThreatZone v2	Analyzes one file using the ThreatZone static scan integration. Returns relevant reports to the War Room and file reputations to the context data. All file types are supported.
Analyze File - Sandbox - ThreatZone	Analyzes one file using the ThreatZone sandbox integration. Returns relevant reports to the War Room and file reputations to the context data. Dynamic Scan Extensions: exe, docx, dochtml, docm, doc, rtf, ps1, bat, cmd, xlw, xltx, xltm, xls, xlsx, odc, csv, xlshtml.
Sanitize File - CDR - ThreatZone v2	Sanitize one file using the ThreatZone CDR integration. Returns relevant reports to the War Room and file reputations to the context data. CDR Scan Extensions: doc, docm, docx, dotm, ppt, pptm, pptx, xls, xlsm, pdf, odc, odt, ott, odp, otp, ods, ots, rtf, tiff, jpeg, png, gif, bmp, webp, jpx, svg, zip, xml, ics, html, lnk, xlsx.
Sanitize File - CDR - ThreatZone	Sanitize one file using the ThreatZone CDR integration. Returns relevant reports to the War Room and file reputations to the context data. CDR Scan Extensions: doc, docm, docx, dotm, ppt, pptm, pptx, xls, xlsm, pdf, odc, odt, ott, odp, otp, ods, ots, rtf, tiff, jpeg, png, gif, bmp, webp, jpx, svg, zip, xml, ics, html, lnk, xlsx.
Analyze File - Sandbox - ThreatZone v2	Analyzes one file using the ThreatZone sandbox integration. Returns relevant reports to the War Room and file reputations to the context data. Dynamic Scan Extensions: exe, docx, dochtml, docm, doc, rtf, ps1, bat, cmd, xlw, xltx, xltm, xls, xlsx, odc, csv, xlshtml.
Analyze File - Static Scan - ThreatZone	Analyzes one file using the ThreatZone static scan integration. Returns relevant reports to the War Room and file reputations to the context data. All file types are supported.

Integrations

Name	Description
ThreatZone (Partner Contribution)	ThreatZone malware analysis sandboxing.

Playbooks

Name	Description
Analyze File - Static Scan - ThreatZone	Analyzes one file using the ThreatZone static scan integration. Returns relevant reports to the War Room and file reputations to the context data. All file types are supported.
Sanitize File - CDR - ThreatZone v2	Sanitize one file using the ThreatZone CDR integration. Returns relevant reports to the War Room and file reputations to the context data. CDR Scan Extensions: doc, docm, docx, dotm, ppt, pptm, pptx, xls, xlsm, pdf, odc, odt, ott, odp, otp, ods, ots, rtf, tiff, jpeg, png, gif, bmp, webp, jpx, svg, zip, xml, ics, html, lnk, xlsx.
Analyze File - Static Scan - ThreatZone v2	Analyzes one file using the ThreatZone static scan integration. Returns relevant reports to the War Room and file reputations to the context data. All file types are supported.
Analyze File - Sandbox - ThreatZone v2	Analyzes one file using the ThreatZone sandbox integration. Returns relevant reports to the War Room and file reputations to the context data. Dynamic Scan Extensions: exe, docx, dochtml, docm, doc, rtf, ps1, bat, cmd, xlw, xltx, xltm, xls, xlsx, odc, csv, xlshtml.
Sanitize File - CDR - ThreatZone	Sanitize one file using the ThreatZone CDR integration. Returns relevant reports to the War Room and file reputations to the context data. CDR Scan Extensions: doc, docm, docx, dotm, ppt, pptm, pptx, xls, xlsm, pdf, odc, odt, ott, odp, otp, ods, ots, rtf, tiff, jpeg, png, gif, bmp, webp, jpx, svg, zip, xml, ics, html, lnk, xlsx.
Analyze File - Sandbox - ThreatZone	Analyzes one file using the ThreatZone sandbox integration. Returns relevant reports to the War Room and file reputations to the context data. Dynamic Scan Extensions: exe, docx, dochtml, docm, doc, rtf, ps1, bat, cmd, xlw, xltx, xltm, xls, xlsx, odc, csv, xlshtml.

Required Content Packs (2)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

All level dependencies (6)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

3.0.1 - 12313702 (August 25, 2026)

Integrations

ThreatZone

Updated the Docker image to: demisto/threatzone-sdk:1.1.1.12287331.

Related pull requests:
- 45645

Download

3.0.0 - 12225079 (August 23, 2026)

Integrations

ThreatZone

Updated the integration to use version 1.1.1 of the official threatzone Python SDK for all API traffic, authentication, retry logic, and response parsing.
Updated the integration to target Threat.Zone platform v3.2.0+ and SDK 1.1.1.
Updated the credential parameter to an encrypted ThreatZone API Key (type 9) and made the Server URL parameter mandatory with normalization for instance-root and /public-api URLs, without a cloud fallback.
Updated the sandbox presets to the Threat.Zone v3.2 environment identifiers (linux-ubuntu_2204, macos-ventura, and android9), and now load sandbox defaults from the ThreatZone metafield configuration API. Active API defaults are applied unless overridden by a command argument or analyze_config.
Updated the Docker image to demisto/threatzone-sdk:1.1.1.11256202 and removed the obsolete os argument from tz-get-behaviours.
Updated the error handling so SDK-typed exceptions are translated into structured War Room messages instead of raw tracebacks, and improved Cortex XSOAR 6.x runtime compatibility.
Added support for expanded command coverage across the ThreatZone public API, including configuration discovery, open-in-browser and submission queries, detailed report sections, bounded telemetry, and file and media downloads.
Added support for sandbox execution configurations, URL safe-browsing, and indicator, IOC, and matched-YARA filters.
Added support for generated-YARA readiness polling and safe media filename validation, and restored streaming for SDK downloads to avoid buffering large files in memory.
Fixed an issue where report retrieval could omit later pages of filtered indicators, IOCs, and matched YARA rules, including the legacy ThreatZone.IOC output.
Updated the integration to preserve every existing command and top-level context path so existing playbooks continue to function. The legacy ThreatZone.Analysis.LEVEL and ThreatZone.Analysis.STATUS integer codes are retained by mapping the SDK enums back to the historical integers, the modules argument is kept as a validated compatibility no-op, and original War Room filenames are preserved for sandbox, static, and CDR uploads.
Note: Existing playbook YAMLs and external context references do not need changes. The internal shape of ThreatZone.Submission reflects the new public API schema because the upstream /public-api/submissions/{uuid} endpoint replaced the legacy /get/submission/{uuid} endpoint in Threat.Zone v3.2.0. Customers running against pre-v3.2.0 instances must pin to ThreatZone content pack 2.0.1 until they upgrade the platform.

Related pull requests:
- 45598
- 45214

Download

2.0.2 - 11856720 (August 12, 2026)

Integrations

ThreatZone

Updated the Docker image to: demisto/python3:3.12.13.10116658.

Related pull requests:
- 45487

Download

2.0.1 - 7843807 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43568

Download

2.0.0 - 6920594 (January 28, 2026)

Integrations

ThreatZone

Context outputs now include the ThreatZone.Submission.* structure while preserving legacy ThreatZone.Analysis.* and ThreatZone.IOC.* paths for backward compatibility also new v2 playbooks are available for the ThreatZone.Submission.* outputs.
Added URL detonation support via the tz-url-analysis command, including reporting helpers and HTML report download.
Expanded sandbox submission options with module toggles, analyze config overrides, archive entrypoint/password handling, and auto environment selection.
Introduced dedicated commands to retrieve submission sections (tz-get-indicator-result, tz-get-ioc-result, tz-get-yara-result, tz-get-artifact-result, tz-get-config-result) to fetch granular submission data.
Enhanced tz-get-result formatting: returns the raw submission payload by default, with an optional details=true flag to embed inline detail summaries.
Added a download_sanitized flag to tz-get-result so CDR runs can fetch sanitized files on demand, and ensured the standalone tz-get-sanitized command retrieves files directly.
Improved plan metadata returned by tz-check-limits (includes file size limits, modules, and account information).
Introduced the Analyze URL - ThreatZone playbook to automate URL detonation workflows.
Updated integration documentation, playbooks, and helper scripts to match the new API capabilities.

Playbooks

Analyze File - Sandbox - ThreatZone

Documentation and metadata improvements..

New: Analyze File - Sandbox - ThreatZone v2

Analyzes one file using the ThreatZone sandbox integration.
Returns relevant reports to the War Room and file reputations to the context data.
Dynamic Scan Extensions: exe, docx, dochtml, docm, doc, rtf, ps1, bat, cmd, xlw, xltx, xltm, xls, xlsx, odc, csv, xlshtml.

Analyze File - Static Scan - ThreatZone

Documentation and metadata improvements.

New: Analyze File - Static Scan - ThreatZone v2

Analyzes one file using the ThreatZone static scan integration.
Returns relevant reports to the War Room and file reputations to the context data.
All file types are supported.

Sanitize File - CDR - ThreatZone

Documentation and metadata improvements..

New: Sanitize File - CDR - ThreatZone v2

Sanitize one file using the ThreatZone CDR integration.
Returns relevant reports to the War Room and file reputations to the context data.
CDR Scan Extensions: doc, docm, docx, dotm, ppt, pptm, pptx, xls, xlsm, pdf, odc, odt, ott, odp, otp, ods, ots, rtf, tiff, jpeg, png, gif, bmp, webp, jpx, svg, zip, xml, ics, html, lnk, xlsx.

Documentation and metadata improvements.

Related pull requests:
- 42826
- 41998

Download

1.0.8 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

1.0.7 - 4770511 (September 4, 2025)

Integrations

ThreatZone

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41158

Download

3.0.1 - 12313702 (August 25, 2026)

Integrations

ThreatZone

Updated the Docker image to: demisto/threatzone-sdk:1.1.1.12287331.

Related pull requests:
- 45645

Download

3.0.0 - 12267446 (August 24, 2026)

Integrations

ThreatZone

Updated the integration to use version 1.1.1 of the official threatzone Python SDK for all API traffic, authentication, retry logic, and response parsing.
Updated the integration to target Threat.Zone platform v3.2.0+ and SDK 1.1.1.
Updated the credential parameter to an encrypted ThreatZone API Key (type 9) and made the Server URL parameter mandatory with normalization for instance-root and /public-api URLs, without a cloud fallback.
Updated the sandbox presets to the Threat.Zone v3.2 environment identifiers (linux-ubuntu_2204, macos-ventura, and android9), and now load sandbox defaults from the ThreatZone metafield configuration API. Active API defaults are applied unless overridden by a command argument or analyze_config.
Updated the Docker image to demisto/threatzone-sdk:1.1.1.11256202 and removed the obsolete os argument from tz-get-behaviours.
Updated the error handling so SDK-typed exceptions are translated into structured War Room messages instead of raw tracebacks, and improved Cortex XSOAR 6.x runtime compatibility.
Added support for expanded command coverage across the ThreatZone public API, including configuration discovery, open-in-browser and submission queries, detailed report sections, bounded telemetry, and file and media downloads.
Added support for sandbox execution configurations, URL safe-browsing, and indicator, IOC, and matched-YARA filters.
Added support for generated-YARA readiness polling and safe media filename validation, and restored streaming for SDK downloads to avoid buffering large files in memory.
Fixed an issue where report retrieval could omit later pages of filtered indicators, IOCs, and matched YARA rules, including the legacy ThreatZone.IOC output.
Updated the integration to preserve every existing command and top-level context path so existing playbooks continue to function. The legacy ThreatZone.Analysis.LEVEL and ThreatZone.Analysis.STATUS integer codes are retained by mapping the SDK enums back to the historical integers, the modules argument is kept as a validated compatibility no-op, and original War Room filenames are preserved for sandbox, static, and CDR uploads.
Note: Existing playbook YAMLs and external context references do not need changes. The internal shape of ThreatZone.Submission reflects the new public API schema because the upstream /public-api/submissions/{uuid} endpoint replaced the legacy /get/submission/{uuid} endpoint in Threat.Zone v3.2.0. Customers running against pre-v3.2.0 instances must pin to ThreatZone content pack 2.0.1 until they upgrade the platform.

Related pull requests:
- 45598
- 45214

Download

2.0.2 - 11856720 (August 12, 2026)

Integrations

ThreatZone

Updated the Docker image to: demisto/python3:3.12.13.10116658.

Related pull requests:
- 45487

Download

2.0.1 - 7850318 (March 23, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43568

Download

2.0.0 - 6920581 (January 28, 2026)

Integrations

ThreatZone

Context outputs now include the ThreatZone.Submission.* structure while preserving legacy ThreatZone.Analysis.* and ThreatZone.IOC.* paths for backward compatibility also new v2 playbooks are available for the ThreatZone.Submission.* outputs.
Added URL detonation support via the tz-url-analysis command, including reporting helpers and HTML report download.
Expanded sandbox submission options with module toggles, analyze config overrides, archive entrypoint/password handling, and auto environment selection.
Introduced dedicated commands to retrieve submission sections (tz-get-indicator-result, tz-get-ioc-result, tz-get-yara-result, tz-get-artifact-result, tz-get-config-result) to fetch granular submission data.
Enhanced tz-get-result formatting: returns the raw submission payload by default, with an optional details=true flag to embed inline detail summaries.
Added a download_sanitized flag to tz-get-result so CDR runs can fetch sanitized files on demand, and ensured the standalone tz-get-sanitized command retrieves files directly.
Improved plan metadata returned by tz-check-limits (includes file size limits, modules, and account information).
Introduced the Analyze URL - ThreatZone playbook to automate URL detonation workflows.
Updated integration documentation, playbooks, and helper scripts to match the new API capabilities.

Playbooks

Analyze File - Sandbox - ThreatZone

Documentation and metadata improvements..

New: Analyze File - Sandbox - ThreatZone v2

Analyze File - Static Scan - ThreatZone

Documentation and metadata improvements.

New: Analyze File - Static Scan - ThreatZone v2

Analyzes one file using the ThreatZone static scan integration.
Returns relevant reports to the War Room and file reputations to the context data.
All file types are supported.

Sanitize File - CDR - ThreatZone

Documentation and metadata improvements..

New: Sanitize File - CDR - ThreatZone v2

Documentation and metadata improvements.

Related pull requests:
- 42826
- 41998

Download

1.0.8 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

1.0.7 - 4761438 (September 4, 2025)

Integrations

ThreatZone

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41158

Download

Certification	Certified	Read more
Supported By	Partner
Created	October 23, 2023
Last Release	August 25, 2026

ThreatZone

ThreatZone Cortex Platform Integration Pack

Overview

Supported commands

Ready-to-Use Playbooks

ThreatZone Cortex Platform Integration Pack

Overview

Supported commands

Ready-to-Use Playbooks

Integrations

ThreatZone

Integrations

ThreatZone

Integrations

ThreatZone

Integrations

ThreatZone

Playbooks

Analyze File - Sandbox - ThreatZone

New: Analyze File - Sandbox - ThreatZone v2

Analyze File - Static Scan - ThreatZone

New: Analyze File - Static Scan - ThreatZone v2

Sanitize File - CDR - ThreatZone

New: Sanitize File - CDR - ThreatZone v2

Integrations

ThreatZone

Integrations

ThreatZone

Integrations

ThreatZone

Integrations

ThreatZone

Integrations

ThreatZone

Playbooks

Analyze File - Sandbox - ThreatZone

New: Analyze File - Sandbox - ThreatZone v2

Analyze File - Static Scan - ThreatZone

New: Analyze File - Static Scan - ThreatZone v2

Sanitize File - CDR - ThreatZone

New: Sanitize File - CDR - ThreatZone v2

Integrations

ThreatZone

PUBLISHER

PLATFORMS

INFO

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER