Purpose
This guide explains how to configure the Falcon Sandbox (Hybrid Analysis) Response integration in Logsign USO, so that an analyst (or an action rule) can submit a URL or file for sandbox detonation, run a quick multi-engine URL scan, and retrieve analysis reports directly from a Logsign Incident. This is a query/submission integration, not a containment integration.
This is not the same product as CrowdStrike Falcon (the endpoint detection and response platform, documented separately). Falcon Sandbox, also known as Hybrid Analysis, is CrowdStrike's malware-analysis sandbox product; the shared "Falcon" name is a coincidence of branding, not a shared API or account.
Prerequisites
- A Falcon Sandbox / Hybrid Analysis account with an API key.
Step 1: Obtain Your Falcon Sandbox API Key
- Log in to your Falcon Sandbox / Hybrid Analysis account.
- Open your account/API settings and copy your API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Falcon Sandbox, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Falcon Sandbox device in Logsign. |
| Api Key | Yes | Your Falcon Sandbox API key from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- submit_url — submits a URL for full sandbox detonation. Args: url, environment (a VM image identifier).
- submit_file — submits a file for full sandbox detonation. Args: file_path, environment, network_settings (default, tor, or simulated).
- quick_scan_url — runs a lightweight multi-engine scan of a URL (faster, less thorough than full detonation). Args: url, scan_type (for example all, lookup_ha, scan_metadefender, scan_urlscanio).
- search_hash — searches for prior analyses by file hash. Arg: hash.
- overview / overview_summary — get an analysis overview (or condensed summary) by hash.
- report_state — polls a report/job's state by ID. Arg: id. Polls asynchronously (default every 60 seconds) until ready.
- report_summary — gets the full report summary by ID once ready. Arg: id. Also polls asynchronously.
Typical usage: submit_url or submit_file to start an analysis, then report_state / report_summary to retrieve the result once processing finishes.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued in your Falcon Sandbox account. |
| 429 Too Many Requests | Falcon Sandbox enforces rate limits based on your account tier. | Reduce the frequency of automated submissions. |
| report_state stays "not ready" for a long time | Full sandbox detonation (submit_url/submit_file) can take several minutes depending on load and environment. | Wait longer before assuming failure; use quick_scan_url instead if you need a faster (if less thorough) result. |
Notes and Limits
- This integration only submits/reads sandbox analyses; it does not block or quarantine anything based on the results. Use a separate response integration for any containment action you want to trigger from a Falcon Sandbox verdict.