Joe Sandbox Analyser Issue

[bullerdude]

Request Type

Question

Work Environment

Cortex 1.0.2
Ubuntu 16.04

Problem Description

We are attempting to setup the Joe Sandbox analyser to connect our Online Joe Sandbox cloud account. Can you please confirm that the analyser supports a Joe Sandbox Cloud instance?

We are seeing numerous JSON decoding / structure errors.

[saadkadhi]

Hi @bullerdude, as stated on the blog:
Joe Sandbox, by Joe Security LLC, is a very powerful malware analysis platform that has been around for many years and comes in two flavors: cloud and on-premises. The Joe Sandbox Cortex analyzer has been tested using an on-prem Joe Sandbox Ultimate version and can process URLs and files. The analyzer can process files with or without Internet access.

We haven't tested the analyzer with Joe Sandbox Cloud. We will try to support that version as well. We are going to get in touch with Joe Security LLC. In the meantime, it could help if you can share the (anonymized) log errors either here or by sending us an email to [email protected].

[bullerdude]

Hi @saadkadhi, we have been looking into the error this afternoon and discovered that the error was actually the result of a missing field in the POST data when a file/url for analysis. It seems that Cloud version has a 'Terms and Conditions' field that must be set to '1' otherwise the analysis to fail. It took a while to find due to the way Cortex reports error messages.

I would suggest the analyser be updated which this additional POST parameter that is triggered via a new configuration option that specifies whether the Analyser is connecting to an onprem or cloud instance.

[saadkadhi]

Thanks for your troubleshooting @bullerdude. Would you be able to submit a PR to fix the missing POST data? We will review it to make sure it doesn't break things for on-prem users and release an updated analyzer.

Also, if you have any suggestions on how to improve Cortex error reporting, please submit an issue on the Cortex repository.

[ant1]

Please try 84937e2

[saadkadhi]

@bullerdude The Joe Sandbox analyzer now supports the Cloud version. Check out hotfix/1.4.1.

[js2n8]

Hello my company has been trying to register for joes sandbox for over a month now, but until this time we have not heard back from them, are we doing something wrong in the registration or its just that joes do not take any more registration