Repository navigation
[ANY.RUN pack update] Add Cortex XDR playbooks, fix the Using input, and improve IOC handling for Sandbox - #46291
Merged
lironcohen272 merged 7 commits intoOct 24, 2026
Conversation
…and improve IOC handling for Sandbox (#45770) * feat(general): update integrations and playbooks * fix pre-commit issues * feat: add Using parameter to playbooks * add new xdr playbooks and fix get_analysis_report * feat(sandbox): add opt_automated_interactivity parameter for actions * feat: add opt_automated_interactivity, adjust playbooks, fix no iocs message * fix: delete opt_automated_interactivity for linux and android * fix: final adjustments and add release notes * fix: address pre-commit issues * fix: address after-review comments * fix: address pre-commit issues * fix: address pre-commit issues * fix: address review comment issues * fix: address review comment issues
content-bot
added
Contribution
Contributor
Author
🤖 AI-Powered Code Review AvailableHi @lironcohen272, you can leverage AI-powered code review to assist with this PR! Available Commands:
|
Contributor
Author
🤖 AI-Powered Code Review AvailableYou can leverage AI-powered code review to assist with this PR! Available Commands:
|
Coverage Report
|
||||||||||||||||||||||||||||||||||||||||||||||||||
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
This comment has been minimized.
This comment has been minimized.
JuliaH-TW
reviewed
Oct 19, 2026
JuliaH-TW
left a comment
JuliaH-TW
left a comment
Contributor
There was a problem hiding this comment.
Doc review complete. Please check the comments and regenerate the integration README file. Someone else has already added the docs-approved label.
JuliaH-TW
reviewed
Oct 19, 2026
JuliaH-TW
left a comment
JuliaH-TW
left a comment
Contributor
There was a problem hiding this comment.
Doc review complete. Please check the comments and regenerate the integration README file. Someone else has already added the docs-approved label.
added 2 commits
October 19, 2026 17:49
…-using-and-add-xdr
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
lironcohen272
added
the
ForceMerge
lironcohen272
removed
the
ForceMerge
…-using-and-add-xdr
lironcohen272
approved these changes
Oct 22, 2026
Contributor
Author
|
Validate summary Verdict: PR can be force merged from validate perspective? ✅ |
Contributor
Author
🔍 AI Triage Report AvailableAn automated triage report has been generated for this pipeline. Status:
|
lironcohen272
deleted the
contrib/anyrun-integrations_fix/dev-02-fix-using-and-add-xdr
branch
October 24, 2026 14:02
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related PRs
Original External PR: #45770
Contributor
@anyrun-integrations
Status
Related Issues
No issues
Description
Playbooks
New: ANYRUN Detonate File Windows for XDR
New: ANYRUN Detonate File Linux for XDR
New: ANYRUN Detonate File Android for XDR
New: ANYRUN Detonate URL Windows for XDR
New: ANYRUN Detonate URL Linux for XDR
New: ANYRUN Detonate URL Android for XDR
core-add-indicator-rule.ANYRUN Detonate File Windows, ANYRUN Detonate Url Windows
Usingplaybook input to select which ANY.RUN Cloud Sandbox integration instance to run the playbook against. If left empty, the first active instance is used automatically.opt_automated_interactivityplaybook input (defaultTrue) to control whether the sandbox automatically interacts with the sample during analysis. This option is only supported on Windows, so it is not exposed on the Linux/Android playbooks below.ANYRUN Detonate File Linux, ANYRUN Detonate Url Linux, ANYRUN Detonate File Android, ANYRUN Detonate Url Android
Usingplaybook input to select which ANY.RUN Cloud Sandbox integration instance to run the playbook against. If left empty, the first active instance is used automatically.Integrations
ANY.RUN Cloud Sandbox
opt_automated_interactivityargument (defaultTrue) to theanyrun-detonate-file-windowsandanyrun-detonate-url-windowscommands, to control whether the sandbox automatically interacts with the sample during analysis. This option is not supported on Linux or Android, so it remains hidden and defaults toFalsefor theanyrun-detonate-file-linux,anyrun-detonate-url-linux,anyrun-detonate-file-android, andanyrun-detonate-url-androidcommands.anyrun-get-analysis-reportcommand withreport_format=iocnow also returns indicator details formatted for ingestion as Cortex XDR IOCs (ANYRUN.IOCDetails), in addition to the existingANYRUN.IOCsoutput.anyrun-get-analysis-reportfailed when thereport_formatargument was not provided. It now defaults tosummary.anyrun-get-analysis-reportwithreport_format=iocreturned no result when the analysis report contained no IOCs, leaving the command output empty. It now returns a "No IOCs found" message.ANYRUN.IOCDetailsoutput sent an invalid reliability code (A - Completely reliableinstead of the expectedA) and a hardcoded vendor reputation (GOOD) instead of the indicator's actual reputation.predefinedTrue/False values to all boolean-like arguments and configuration parameters (e.g.opt_network_connect,opt_network_fakenet,obj_force_elevation,team, and others) so they render as a dropdown instead of free text.teamargument's default value (False.→False).Root URLconfiguration parameter display name toBase domainfor clarity, and documented theanyrun.usspecial-access domain option.detonate_file_widows/detonate_url_widowsfunction names (widows→windows); no user-facing impact.Must have
fixes: https://jira-dc.paloaltonetworks.com/browse/CIAC-17909