get_url_info
Extract URLs and their detection indicators from completed Joe Sandbox analyses to identify malicious web activity, IP addresses, and threat classification data.
Instructions
Retrieve urls in a completed analysis, along with their associated detection indicators.
This tool extracts urls gathered by the sandbox engine and returns relevant context such as ip address, source, and detection metadata.
Optional filtering parameters allow control over the inclusion of urls and indicators based on their assessed severity.
Args:
webid (required): The submission ID of the analysis.
run (default: 0): Index of the sandbox run to inspect (from the `runs` array in analysis info).
only_malicious_elements (default: True): If True, returns only urls explicitly classified as malicious by the sandbox engine.
only_malicious_indicators (default: True): If True, limits the returned indicators to those considered clearly malicious by the detection logic.
This excludes low-impact behavioral signals and focuses on indicators with a high likelihood of malicious intent or confirmed threat classification.
If False, all observed indicators are included regardless of their severity.
Returns:
A dictionary containing a list of malicious URLs. Each entry includes:
- url: The observed URL (may be truncated if extremely long).
- ip: The resolved IP address associated with the URL (if available).
- fromMemory: Whether the URL was extracted from memory.
- source: Subsystem or extraction context (e.g., browser, process).
- malicious: 'true' for urls classified as malicious
- indicators: List of triggered detection rules, if any. Each entry includes:
- desc: Description of the matched detection rule.
- data: Matched content or signature.
- source: The detection subsystem responsible (e.g. Suricata, Sigma, global traffic etc.).
- impact: Either "high" or "low", indicating the severity or confidence of the detection.
High-impact indicators are strongly associated with malicious behavior or confirmed threats.
Low-impact indicators reflect general behavior or environmental traits that may not be malicious on their own.
Notes:
- Very long URLs are truncated for readability but include their original length as a hint.
- Empty Array returned if no url was gathered during the analysis
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| webid | Yes | ||
| run | No | ||
| only_malicious_elements | No | ||
| only_malicious_indicators | No |