The Threat Analysis report is an executive brief detailing key behaviors of the sample file.
Intelligent Sandbox allows you to download the Threat Analysis report in these file types:
HTML
Text
PDF
XML
JSON
OpenIOC
STIX
The XML and JSON formats provides well-known malware behavior tags for high-level programming script to extract key information. Trellix IPS and Web Gateway use the JSON formats to display the report details in their user interfaces.
Intelligent Sandbox also supports OpenIOC and STIX formats, which you can use to share threat information. With the OpenIOC and STIX formats, you can share the Analysis Summary reports with other security applications for a better understanding, detection, and containment of malware. For example, you can manually submit the OpenIOC and STIX reports to an application, which query hosts for the indicators in the report. This way you can detect the infected hosts, and then take the needed remedial actions to contain and remove the malware.
The Threat Analysis reports in the OpenIOC and STIX formats are available in the sample Complete Results file.
Formats | Severity -6 | Severity -2 | Severity -1 | Severity 0 | Severity 1 | Severity 2 | Severity 3 | Severity 4 | Severity 5 |
|---|---|---|---|---|---|---|---|---|---|
HTML | X | X | X | X | X | X | X | X | X |
Text | X | X | X | X | X | X | |||
X | X | X | X | X | X | ||||
XML | X | X | X | X | X | X | |||
JSON | X | X | X | X | X | X | X | X | X |
OpenIOC | X | X | X | ||||||
STIX | X | X | X |
Threat Level | Engine Analysis Severity |
|---|---|
5 - Very High | 5 - Very High |
4 - High | 4 - High |
3 - Medium | 3 - Medium |
2 - Low | 2 - Low |
1 - Very Low | 1 - Informational |
0 - Informational | 0 - Unverified |
-1 - Clean | -1 - Clean |
-2 - Failure | -2 - Fail/Unverified |
What the severity translates to:
Severity -6 – Incomplete. The submitted file analysis failed or incomplete.
Severity -2 – Failed. Intelligent Sandbox is unable to analyze the submitted file.
Severity -1 – Clean. The submitted file is not a malware.
Severity 0 – Informational. The submitted file has insufficient or invalid information for analysis.
Severity 1 – Very low activity. The submitted file hasn't shown signs of a malware.
Severity 2 – Low activities. The submitted file shows signs of a malware that pose low risk.
Severity 3 – Likely to be malicious. The submitted file shows signs of a malware that pose medium risk.
Severity 4 – Malicious. The submitted file shows signs of a malware that pose high risk.
Severity 5 – Very high. The submitted file shows signs of a malware that pose high risk.
The report also provides errors in simple terms. Here are some examples:
Analysis report description | Error description |
|---|---|
Invalid Archive content | The archive sample has files that are corrupt or file with multibyte unicode characters file names. This cause the archive extraction to fail. |
Archive is empty | The archive sample is empty. There are no files to be extracted and analyzed. |
Unsupported Archive | This error appears due to the following reasons:
|
Analysis report description | Error description |
|---|---|
File type not supported | Intelligent Sandbox does not support this file type for analysis. |
Below minimum file size | The sample submitted for analysis does not meet the minimum file size configured for its type in the Global settings page. |
The Submitted Time and Completed Time in the Analysis Reports page displays the time stamp with the local timezone in its suffix.
The HTML or PDF reports for a sample displays the Submitted time stamp mentioned in UTC time zone.
Previously the HTML or PDF reports displayed the time stamp in the local timezone.
The JSON report sent to managed products will have time stamp in UTC timezone.
The Instances column in the Analysis Report displays the total number of times a sample was analyzed by a specific user. For more details such as the list of samples, click on the number.
For admin users, the column displays the number of times a sample was submitted by all users.
For example, when logged in using the nsp username, the column displays the number times a sample was submitted using this username.
Note
The updated time might take few minutes to reflect in the reports page post migration. This is dependent on the size of the reports database.
The Instances column is not included when exporting the report to CSV.
Search queries on the number of instances are not supported.
Timeline view
The Timeline view in the report displays a timeline activity graph and timeline activity details table detailing the order and time of events for a submitted sample. This view is available in both HTML and PDF versions of the report.
The Timeline Activity section provides a graphical representation of the events for the submitted sample. The event logged for each file sample includes:
Process activity - Activities such as creation or termination of a process.
File activity - Activities such as read, write, or closing of files.
Registry keys - Creation, change, or deletion of registry keys.
Network operations - Suspicions network activities.
The graph on an HTML report is dynamic, allowing you to perform the following actions:
Hover over the event – Provides detailed information about the number and type of events with the time-offset.
Zoom-in – Allows you to zoom into the timeline, which provides precise offset between closely occurring events.
The graph on a PDF report is a static image of the graph.
Apart from the graphical representation of events, the timeline view provides more details about the event through the Timeline Activity Details table. The table contains the following details for an event:
Time offset of the event
The event itself
The description details of the event.
MITRE ATT&CK™ Matrix
This section displays the list of techniques, its respective IDs and corresponding tactics used by the sample. On expanding each technique, you can also see an overview of the technique followed by a severity rating. If a technique contains sub-techniques, upon expanding the technique, you can see the list of detected sub-techniques which you can further expand to see the overview of the sub-techniques followed by a severity rating.
Machine Learning Prediction
The Intelligent Sandbox Machine Learning Prediction section displays the verdict and probability factor of the analysis through machine learning. This section does not appear in the report if you have not enabled Machine Learning in your analyzer profile. To enable, edit your analyzer profile, and select Machine Learning Prediction under Dynamic Analysis. You can also enable Machine Learning when you create an analyzer profile.
Note
Machine Learning analysis only scans PE files.
Family Classification
The Family Classification section displays the category of malware present in the file submitted.
Note
If the parent file generates other files with malicious content, it shows categories of malware in the subordinate files too.
To use the Family Classification option, you must have enabled the Disassembly Results option in the corresponding analyzer profile.
Network Analysis result
This section displays the classification and threat details executed by the PCAP file of an analyzed sample. The classification and threat details are displayed from customer's classification.conf and .rule files respectively.
This section is not displayed in the report in the following scenarios:
If you have not enabled Custom Network Attack Rules in analyzer profile.
Even after enabling Custom Network Attack Rules, there is no network attack rule applied on the PCAP file of an analyzed sample.
Understanding the fields in the Intelligent Sandbox JSON Report
MISversion – Intelligent Sandbox software version.
SUMversion – Deprecate field. Intelligent Sandbox software version.
DETversion – Shows the version of the current detection package installed.
OSversion – Operating system name and version of the sandbox that processed the sample.
JSONversion – Version of the JSON package used to generate the report.
StaticAnalysis – If sample was not sent to sandbox for analysis then this flag will be True.
hasDynamicAnalysis – If sample was sent to sandbox for analysis then this flag will be True.