Views:

When you open an analyzed object in Sandbox Analysis, a tabbed profile view displays overview details, static and dynamic analysis, file content, associated alerts and threats, and third-party insights.

When you open an analyzed object in Sandbox Analysis, TrendAI Vision One™ displays a tabbed profile view.

File and URL submissions

Tab
Description
File submissions
URL submissions
Overview
Key object details
Provides hash values (SHA-1, SHA-256, MD5), detection name, malware family, and first/last seen. For submitter source details refer to Consolidated analysis results.
For bundled files, lists up to five files from the bundle.
For URL submissions, the Overview displays both the normalized URL that the sandbox analyzed and the original URL as submitted.
Static analysis
Structural indicators like imports and macros
Only available to objects submitted to Sandbox Analysis
Displays indicators like imports, strings, macros, and MITRE ATT&CK®. When the static scan is not performed on an object, the MITRE ATT&CK® row displays Not analyzed.
For archive files, the static scan analyzes the outer archive file only, not the files inside it, so the MITRE ATT&CK® row displays Contents not analyzed regardless of submission path. Imports, strings, and macros are reported for each file in the archive.
Unavailable for objects submitted automatically or through Service Gateway.
Unavailable
Dynamic analysis
Sandbox execution report
Offers the same sandbox execution details previously available in an HTML report. You can still download the full report as a PDF from this tab when analysis is complete.
File content
File content preview or download
Only available to objects submitted to Sandbox Analysis
For files 5MB or less, an inline hex viewer allows quick inspection.
For files over 5MB, you can download a password-protected ZIP file.
For archive files, displays content for the archive file only, not individual files within it.
Unavailable for objects submitted automatically or through Service Gateway.
Unavailable
Associated Workbench alerts
Related alerts from Workbench
Displays alerts related to the submitted object within the last 30 days including status, severity, score, and impacted entities. For archive files, queries the file SHA-1 of the archive file itself, not its contents.
Associated threats
Emerging threats and threat actors linked to the object
Displays the emerging threats and threat actors associated with the object when its indicators match known threat intelligence.
  • Associated emerging threats: Lists emerging threats whose profiles match the object's indicators.
  • Associated threat actors: Lists threat actors whose profiles match the object's indicators.
Select a threat or threat actor name to open the threat report in Threat Intelligence Hub.
Third-party insights
VirusTotal threat intelligence
After configuring a VirusTotal API key in Third-Party Integrations, displays VirusTotal threat intelligence. For archive files, queries the file SHA-1 of the archive file itself, not its contents.
  • Select Refresh icon to retrieve the latest data from VirusTotal.
  • Select Go to VirusTotal to open the VirusTotal website in a new tab.

AI skill submissions

When you open an analyzed AI skill in Sandbox Analysis, the object profile has only two tabs:
  • Overview: Shows the sandbox analysis result for the skill, including the risk level, object name, skill name, skill author, skill description, submitter, analyzer, submission ID, and the SHA-1, SHA-256, and MD5 hash values.
  • Analysis report: Shows the analysis details for the skill, including the AI analysis summary, the actions instructed by the skill, the threat taxonomy summary, the findings with their evidence, the reputation of detected domains, URLs, and packages, sandbox system events, and prompt sessions. The sandbox runs the skill with distinct prompts, and each prompt starts a separate session.