Joe Sandbox

Updated 5 months ago by Elvis Hovor

This document explains how to set up and use the intel feed from Joe Sandbox.

Joe Sandbox executes files and URLs fully automated in a controlled environment and monitors the behavior of applications and the operating system for suspicious activities and compiles it in an extensive analysis report.

  • Source Type: Premium Intel
  • Update Type: Feed-based
  • Update Frequency: 15 minutes
  • Time to Install: 10 minutes

Data Types

The integration pulls all observables supported by TruSTAR.


  • Registered customer of Joe Security
  • Joe Sandbox Cloud API key
TruSTAR Admin rights are required to activate this Premium Intel feed.

Getting Started

  1. Log into TruSTAR Station.
  2. Click the Marketplace icon on the left side menu.
  3. Choose Premium Intel.
  4. Click Subscribe in the Joe Sandbox icon.
  5. Enter your Joe Sandbox API key, then click Save Credentials & Request Subscription.

TruSTAR will validate the integration within 48 hours and send an email when the integration has been enabled.

Report Mapping



Report Title

Sample field of target block of json response if available, else url field  

Example: WbPmrTtnkw

External ID

Encoded value of (webid) field of first json response

Example: encoded value of (752112)

Report Body

Full JSON response from Joe Sandbox

Time Begun

Combined start_date and start_time field of second json response

Example: 20/12/2019 19:48:25


Score and malicious field of signature detections field of json response

Example: [“confidence:64”, “Maliciousness:true”]


Example: XXXX

Client Type


Client Meta Tag


Known Issues

None reported.

Please reach out to if you have issues with this integration.

How Did We Do?