Joe Sandbox - BlinkOps Documentation

Overview

Joe Sandbox is a malware analysis platform for detonating and analyzing files and URLs. This guide walks through how to create a Joe Sandbox connection and the access it requires to be used in Blink’s Automated Case Management, primarily for Enrichment workflows (file hash and related threat lookups).

Joe Sandbox does not use OAuth scopes. The connection authenticates with a single API key. See Required Access.

Creating a Connection

Joe Sandbox Connection Guide

Follow this guide to create a Joe Sandbox connection

Required Access

Joe Sandbox has no OAuth scope selection. Access is granted by the API key, and available capabilities depend on your account tier.

Setting	Value	Notes
Authentication	API key	Joe Sandbox does not use OAuth scopes
Endpoint access	Read/search access to analysis results	Required for file hash / indicator lookups

Which stage of Alert Processing need this connection?

Source	Requires this connection?	Notes
Ingestion	✗ No	Not applicable
Enrichment	✓ Yes	File hash and related threat lookups
Response	✗ No	Not applicable