Set up the CrowdStrike Falcon Sandbox integration

Prerequisites

• An active CrowdStrike Falcon subscription that includes the Sandbox module
• Permission to create a new API client in CrowdStrike Falcon
• Your Falcon cloud / tenant URL (e.g., https://api.crowdstrike.com, https://api.us-2.crowdstrike.com, https://api.eu-1.crowdstrike.com)

Step 1: Create an API client in CrowdStrike

1. Sign in to your CrowdStrike Falcon console.
2. Go search bar and look for API clients and keys.
3. Create a new API client. Give it a descriptive name (e.g., Sublime Sandbox Integration).
4. Grant the new client access to the Sandbox (Falcon Intelligence) module — read + write scopes required to submit samples and retrieve verdicts.
5. After creating the client, copy and save the Client ID and Client Secret somewhere secure — the secret is shown only once.
6. Note your Falcon tenant URL (visible in the API client setup screen).

Step 2: Configure the integration in Sublime

Prerequisite: permission to access set_external_api_keys; by default applied to the admins role

1. In Sublime, go to Account, scroll to Sandbox Integrations.

   

2. Enter:

   • Client ID — from Step 1
   • Client Secret — from Step 1
   • Cloud Regions — select your Falcon cloud region
   • Tenant URL — enter API base URL

3. Click Apply.

Step 3: Verify the integration

Prerequisite: permission to access UseCrowdstrikeSandbox

1. Open any flagged message in the message detail view (MDV).
2. Send sample via the Send EML to CrowdStrike Sandbox action in the right-side action panel.

If the action button doesn't appear or submissions fail, see Troubleshooting the CrowdStrike Sandbox integration.