get_domain_info
Extract domains and their detection indicators from completed Joe Sandbox analyses to identify malicious activity, including resolved IP addresses, activity status, and threat classification metadata.
Instructions
Retrieve domains in a completed analysis, along with their associated detection indicators.
This tool extracts domains gathered by the sandbox engine and returns relevant context such as resolved IP address, activity status, and detection metadata.
Optional filtering parameters allow control over the inclusion of domains and indicators based on their assessed severity.
Args:
webid (required): The submission ID of the analysis.
run (default: 0): Index of the sandbox run to inspect (from the `runs` array in analysis info).
only_malicious_elements (default: True): If True, returns only domains explicitly classified as malicious by the sandbox engine.
only_malicious_indicators (default: True): If True, limits the returned indicators to those considered clearly malicious by the detection logic.
This excludes low-impact behavioral signals and focuses on indicators with a high likelihood of malicious intent or confirmed threat classification.
If False, all observed indicators are included regardless of their severity.
Returns:
A dictionary containing a list of malicious domains. Each entry includes:
- name: The domain name.
- ip: The resolved IP address, if available.
- active: Whether the domain was reachable during analysis.
- malicious: 'true' for domains classified as malicious
- indicators: List of triggered detection rules, if any. Each entry includes:
- desc: Description of the matched detection rule.
- data: Matched content or signature.
- source: The detection subsystem responsible (e.g. Suricata, Sigma, global traffic etc.).
- impact: Either "high" or "low", indicating the severity or confidence of the detection.
High-impact indicators are strongly associated with malicious behavior or confirmed threats.
Low-impact indicators reflect general behavior or environmental traits that may not be malicious on their own.
Notes:
- Empty Array returned if no domain was gathered during the analysis
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| webid | Yes | ||
| run | No | ||
| only_malicious_elements | No | ||
| only_malicious_indicators | No |
Input Schema (JSON Schema)
{
"properties": {
"only_malicious_elements": {
"default": true,
"title": "Only Malicious Elements",
"type": "boolean"
},
"only_malicious_indicators": {
"default": true,
"title": "Only Malicious Indicators",
"type": "boolean"
},
"run": {
"default": 0,
"title": "Run",
"type": "integer"
},
"webid": {
"title": "Webid",
"type": "string"
}
},
"required": [
"webid"
],
"type": "object"
}