---
title: CrowdStrike Falcon Sandbox
description: ''
slug: /help/docs/integrations/automation-integrations/crowdstrike-falcon-sandbox/
canonical: https://www.sumologic.com/help/docs/integrations/automation-integrations/crowdstrike-falcon-sandbox/
---
import useBaseUrl from '@docusaurus/useBaseUrl';
***Version: 1.6
Updated: September 2, 2026***
[CrowdStrike Falcon® Sandbox](https://www.crowdstrike.com/en-gb/resources/data-sheets/falcon-sandbox/) defeats even the most evasive malware by running in the kernel and using sophisticated sandbox techniques that make it nearly undetectable. It exposes the most advanced targeted attacks, going beyond common static and dynamic file analysis to monitor all malicious behavior and system interaction. This allows Falcon Sandbox to deliver the most extensive set of indicators of compromise (IOCs) in the industry.
## Actions
:::note
For improved polling reliability, use the **Check Submission Status** (*Scheduled*) action.
:::
* **Submit File** (*Enrichment*) - Submit a file for analysis.
* **Submit URL** (*Enrichment*) - Submit a website's URL or URL with a file for analysis.
* **Submission Status Polling** (*Enrichment*) - Return the state of submission, this action will polling until the File/URL analyzation are finished, Once this action completed, we will be able to Download Report or Get Summary of Submission.
* **Check Submission Status** (*Scheduled*) - Check the status of a submission and return the current state. This scheduled action polls at regular intervals until the analysis reaches a success or partial success state.
* **Download Report** (*Enrichment*) - Download a report (Full CSOAR only).
* **Search Into Database** (*Enrichment*) - Search the database using the search terms like tag, host, domain, URL, filename; this similar to Advanced Search.
* **Get Submission Summary** (*Enrichment*) - Return summary of a submission.
* **Get Hash Summary** (*Enrichment*) - Summary for given hash.
* **Download Sample** (*Enrichment*) - Download sample file (Full CSOAR only).
* **List Feed** (*Enrichment*) - Access a JSON feed (summary information) of last 250 reports from 24h.
* **Get Hash Analysis Overview** (*Enrichment*) - Return overview for the hash related information [report, parent, children, scanners].
* **List Environments** (*Enrichment*) - List system environments.
## Configure CrowdStrike Falcon Sandbox in Automation Service and Cloud SOAR
import IntegrationsAuth from '../../reuse/integrations-authentication.md';
import IntegrationCertificate from '../../reuse/automation-service/integration-certificate.md';
import IntegrationEngine from '../../reuse/automation-service/integration-engine.md';
import IntegrationLabel from '../../reuse/automation-service/integration-label.md';
import IntegrationProxy from '../../reuse/automation-service/integration-proxy.md';
import IntegrationTimeout from '../../reuse/automation-service/integration-timeout.md';
*
* **Server URL**. Enter the URL of your CrowdStrike instance, for example, `https://your-host-falcon-sandbox.com`. The default value is `https://api.crowdstrike.com`.
* **Authentication Type**. Select the authentication method: **API Key** or **OAuth 2.0 (Client Credentials)**.
* **API Key**. Enter the API key for CrowdStrike Falcon Sandbox. Required when **Authentication Type** is set to **API Key**.
* **Client ID**. Enter the OAuth 2.0 Client ID. Required when **Authentication Type** is set to **OAuth 2.0 (Client Credentials)**.
* **Client Secret**. Enter the OAuth 2.0 Client Secret. Required when **Authentication Type** is set to **OAuth 2.0 (Client Credentials)**.
* **User Agent**. Enter a user agent for your instance of CrowdStrike Falcon Sandbox.
*
*
*
*
For information about CrowdStrike Falcon Sandbox, see [CrowdStrike documentation](https://www.crowdstrike.com/en-us/resources/guides/?lang=1).
## Change Log
| Version | Date | Description |
|:--|:--|:--|
| v1.6 | September 2, 2026 | Added OAuth 2.0 (Client Credentials) authentication support and new Check Submission Status action. |
| v1.4 | March 31, 2026 | Upgraded the `python3_generic` Docker image (Python 3.8) to `python3_12_generic` (Python 3.12) to address Python 3.8 end-of-life and improve security and performance. |
| v1.3 | July 14, 2023 | Changed fields visibility. |
| v1.2 | June 27, 2023 | Updated the integration with Environmental Variables. |
| v1.1 | March 21, 2023 | Updated the logo in CrowdStrike Falcon Sandbox integration. |
| v1.0 | October 26, 2020 | Initial release of the CrowdStrike Falcon Sandbox integration. |