Qualys Endpoint Detection and Response

1. Hover the mouse over an Object to view the Quick Actions menu. 
2. Click Event Details.
3. On the Summary page, click Submit File from the Actions drop-down menu.
   
4. On the Confirmation window, click Yes. You will be notified once the request is successfully submitted. 

1. From the Forensics tab, go to Sandbox Analyzer.
2. Click Submit Sample. 
3. In the Submit New: Sample window, from the Sample Type option, choose the type as File or URL. For the File type option, the maximum file size is 5 MB. 
   
4. Click Submit. You will be notified once the request is successfully submitted.

1. Go to the Detections tab and under the Incidents tab, click an incident number or description. 
2. In the Incident Details page, click Timeline.
3. In the Timeline of Detected Events, click View More for an event.
4. Click Submit File in the File section. 
   
5. Click Yes to confirm your action.

After you submit the sample, you can view the analysis report from the Sandbox Analyzer page under the Forensics tab.

• The Analysis Result column displays the status as Clean if no issues are found in the submitted file.
• The column displays the status as Malicious if a file is not clean. 

Click the tooltip next to Malicious results to view a message indicating that the report has been retrieved from the cache. This means the file or URL was previously analyzed, and its results are being reused instead of undergoing a fresh analysis.

Use the Force Submit option from the Quick Actions menu to view updated results. The Force Submit option ensures the file or URL is re-analyzed and the updated data is displayed.

This section provides a high-level summary of the behavior observed during Sandbox Analysis.

• Summary – A brief overview of the detected malware, Mime and object type, file size, and SHA-256 and MD5 details.
• Verdict – The overall classification of the file/sample based on its behavior, typically labeled as:
  • Malicious – Confirms the presence of harmful activity.
  • Clean – No detected threats; appears safe.

This section provides structured threat insights:

• Name: The process or application performing the action (e.g., explorer.exe, cmd.exe).
• Severity: Risk level (Low, Medium, High, Critical) based on potential impact.
• Indicator: A numerical value indicating the strength of malicious behavior association; higher scores reflect greater risk.

Drill-Down Structure

• Behavior: Lists different actions or techniques observed.
• Description: Specific actions taken by the process.
• Behavior Level: Indicates a score against each detected action or technique.
  The Behavior Level score corresponds to the following severity levels:
   
  0–19 → Safe | 20–49 → Very Low | 50–59 → Low | 60–69 → Medium | 70–89 → High | 90 and above → Very High

Key Benefits of this Section

• Transparency: View how the Indicator Score is calculated.
• Drill-Down Analysis: Understand behaviors contributing to risk scores.
• Prioritization: Higher scores indicate critical threats for investigation.

This section breaks down the specific indicators that contributed to the report’s verdict.

• Malicious – Strong evidence of harmful intent (e.g., ransomware behavior).
• Suspicious – Activity that is unusual but not definitively harmful (e.g., modifying system files, encrypting data).
• Informative – General observations that do not indicate a threat but may provide useful context (e.g., system calls, software execution paths).

This section covers the different methods used to evaluate the sample.

• Static Analysis – Examines a file without running it. It checks for suspicious signatures, embedded scripts, known malware patterns, or unusual metadata. 
• Dynamic Analysis – Runs the file in a controlled sandbox environment to see how it behaves in real-time. This includes monitoring process execution, file changes, registry modifications, and network activity.

This section provides information about the test setup for executing and analyzing the file. These details help security analysts in understanding the conditions under which the analysis was conducted, ensuring accurate interpretation of the results.

Why this Information Matters

• Ensures transparency – Analysts can verify that the test environment is suitable  for the malware being analyzed.
• Helps detect environment-specific threats – Certain malware only executes under specific conditions, such as targeting outdated versions of Java or Office.
• Assists in forensic investigations – Understanding the details of the sandbox allows for the reproduction and verification of findings.

Use this token to retrieve the result of a Sandbox Analysis. Choose from:

Analysing, Clean, Error_Processing_File, In Queue, In Progress, Malicious, Queued, Submitted_to_Sandbox

Examples
To see the Sandbox Analysis result as malicious, see the following example:
sandbox.analysis.result:MALICIOUS

To see the Sandbox Analysis result in analysis, see the following example:
sandbox.analysis.result:ANALYSING

Use this token to identify the asset being analyzed in the sandbox environment. The asset could be a file, application, or other item under investigation.

Example
To show all events having this asset name
sandbox.assetname:Desktopas1

Use this token to identify the user linked to the Sandbox Analysis. It helps track who initiated the analysis, owns the asset, or monitors operations, ensuring accountability and simplifying reporting in multi-user environments.

Example
To show all events having this username
sandbox.user:JOHN DOE

Use this token to capture remarks or additional details about the Sandbox Analysis. It provides insights not covered in the primary result, including special conditions, limitations, or analyst observations.

Example
To show all events having this remark
sandbox.analysis.remarks"Analysis performed with restricted permissions."

Use this token to identify the sample file path for Sandbox Analysis, ensuring accurate tracking and association with the results.

Example
To show all events having this file path
sandbox.filepath.sample:C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData

Use this token to specify the sample's URL (file, web page, or resource) being analyzed in the sandbox. It helps track the sample's location, ensuring accurate association with the analysis results.

Example
To show all events having this URL
sandbox.url.sample:"https://example.sharepoint/sites.com"