id: joe_sandbox
name: Joe Sandbox
version: 1.0.0
description: "Joe Sandbox Cloud (Web API v2) — detonate files and URLs, poll submission/analysis status, search analyses, download reports and read the account quota. API-key authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: file/URL submission, submission and analysis info, search, report download and account quota."
category: enrichment

# Per-instance configuration. The default server is Joe Sandbox Cloud Pro; set
# server_url for an on-prem Joe Sandbox appliance. The API key is sent as a form
# field on every request.
config_schema:
  properties:
    api_key:
      type: string
      description: "Joe Sandbox API key"
      x-soar-sensitive: true
    server_url:
      type: string
      description: "Joe Sandbox base URL (default https://jbxcloud.joesecurity.org)"
      default: https://jbxcloud.joesecurity.org
  required:
    - api_key

commands:
  - id: submit_sample
    name: joe-sandbox-submit-sample
    description: "Submit a file (base64) for analysis. Returns a submission_id; poll it with joe-sandbox-submission-info."
    inputs_schema:
      properties:
        file_name: { type: string, description: "File name" }
        content_base64: { type: string, description: "File content, base64-encoded" }
        systems: { type: string, description: "Comma-separated analysis systems (e.g. w10x64). Omit for the account default." }
        internet_access: { type: boolean, description: "Allow internet access during analysis (default true)" }
      required: [file_name, content_base64]
    outputs_schema: { properties: {} }
  - id: submit_url
    name: joe-sandbox-submit-url
    description: "Submit a URL for analysis. Returns a submission_id."
    inputs_schema:
      properties:
        url: { type: string, description: "URL to detonate" }
        systems: { type: string, description: "Comma-separated analysis systems. Omit for the account default." }
        internet_access: { type: boolean, description: "Allow internet access during analysis (default true)" }
      required: [url]
    outputs_schema: { properties: {} }
  - id: submission_info
    name: joe-sandbox-submission-info
    description: "Get the status and details of a submission by submission_id."
    risk: read
    inputs_schema:
      properties:
        submission_id: { type: string, description: "Submission ID (from submit)" }
      required: [submission_id]
    outputs_schema: { properties: {} }
  - id: analysis_info
    name: joe-sandbox-analysis-info
    description: "Get the details and verdict of an analysis by its web ID."
    risk: read
    inputs_schema:
      properties:
        web_id: { type: string, description: "Analysis web ID" }
      required: [web_id]
    outputs_schema: { properties: {} }
  - id: search
    name: joe-sandbox-search
    description: "Search analyses by term (hash, URL, filename, …)."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "Search term" }
      required: [query]
    outputs_schema: { properties: {} }
  - id: download_report
    name: joe-sandbox-download-report
    description: "Download an analysis report in a given format (returned as base64)."
    risk: read
    inputs_schema:
      properties:
        web_id: { type: string, description: "Analysis web ID" }
        report_type: { type: string, description: "Report type: json, html, pdf, xml or misp (default json)" }
      required: [web_id]
    outputs_schema: { properties: {} }
  - id: account_quota
    name: joe-sandbox-account-quota
    description: "Read the account's analysis quota."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: joe-sandbox-test-connection
    description: "Verify the API key and server availability (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }