submit_analysis_job
Submit files, URLs, websites, or command lines for sandbox analysis to detect malware and suspicious behavior in a controlled environment.
Instructions
Submit a file, URL, website, or command line for sandbox analysis using Joe Sandbox.
This tool analyzes one of the following:
- A local file (`sample_path`)
- A remote file URL (`sample_url`)
- A website to visit (`website_url`)
- A raw command line to execute (`command_line`)
Only one input type must be provided. The rest of the arguments configure how the analysis is performed.
For URL and website analysis, make sure `internet_access=True` to allow downloads or navigation.
Args:
wait_for_analysis_end: If True, the tool will block and wait until the sandbox analysis is complete before returning. If False, the tool returns immediately after submission.
timeout (default: 1200): Max number of seconds to wait for analysis completion, this is only relevant if wait_for_analysis_end is True.
File to Upload (required — provide exactly one):
sample_path: Path to a local file to upload and analyze.
sample_url: Direct download URL for a file to analyze.
website_url: Website to visit and analyze in a browser.
command_line: Command line string to execute in the sandbox.
Sandbox configuration parameters (optional):
tags (default: null): Optional tags for the submission.
analysis_time (default: 120): Time in seconds to run the analysis.
internet_access (default: True): Enable internet during analysis.
report_cache (default: False): Use cached results if available.
powershell_logging (default: False): Enable PowerShell script logging.
ssl_inspection (default: True): Enable HTTPS inspection.
vba_instrumentation (default: True): Instrument VBA macros.
hybrid_code_analysis (default: True): Enable Hybrid Code Analysis (HCA).
js_instrumentation (default: True): Instrument JavaScript.
java_jar_tracing (default: True): Enable Java tracing.
start_as_normal_user (default: False): Run the sample without admin privileges.
email_notification (default: False): Send notification when complete.
secondary_results (default: False): Generate post-analysis artifacts.
archive_password (default: None): This password will be used to decrypt submitted archives (zip, 7z, rar etc.).
command_line_argument (default: null): Startup arguments for the sample.
Returns:
A dictionary containing:
- analyses: A list of extracted analysis entries, each with:
- webid: Unique identifier for the individual analysis which can be used to retrieve results.
- sha256: SHA-256 hash of the analyzed file or object.
- filename: Name of the submitted file or artifact.
- status: status of the analysis, either finished or running/submitted/accepted
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| wait_for_analysis_end | Yes | ||
| timeout | No | ||
| sample_path | No | ||
| sample_url | No | ||
| website_url | No | ||
| command_line | No | ||
| tags | No | ||
| analysis_time | No | ||
| internet_access | No | ||
| hybrid_code_analysis | No | ||
| report_cache | No | ||
| powershell_logging | No | ||
| ssl_inspection | No | ||
| vba_instrumentation | No | ||
| js_instrumentation | No | ||
| java_jar_tracing | No | ||
| start_as_normal_user | No | ||
| email_notification | No | ||
| secondary_results | No | ||
| archive_password | No | ||
| command_line_argument | No |