Set up the CrowdStrike Falcon Sandbox integration

Prerequisites

• An active CrowdStrike Falcon subscription that includes the Sandbox module
• Permission to create a new API client in CrowdStrike Falcon
• Your Falcon cloud / tenant URL (e.g., https://api.crowdstrike.com, https://api.us-2.crowdstrike.com, https://api.eu-1.crowdstrike.com)

Step 1: Create an API client in CrowdStrike

1. Sign in to your CrowdStrike Falcon console.
2. Go search bar and look for API clients and keys.
3. Create a new API client. Give it a descriptive name (e.g., Sublime Sandbox Integration).
4. Grant the new client access to the Sandbox (Falcon Intelligence) module: read + write scopes required to submit samples and retrieve verdicts.
5. After creating the client, copy and save the Client ID and Client Secret somewhere secure. The secret is shown only once.
6. Note your Falcon tenant URL (visible in the API client setup screen).

Step 2: Configure the integration in Sublime

Prerequisite: permission to access set_external_api_keys; by default applied to the admins role

1. In Sublime, go to Admin > Account, scroll to Sandbox Integrations.

   

2. Enter:

   • Client ID: from Step 1
   • Client Secret: from Step 1
   • Cloud Regions: select your Falcon cloud region
   • Tenant URL: enter API base URL

3. Click Apply.

Step 3: Verify the integration

Prerequisite: permission to access UseCrowdstrikeSandbox

1. Open any flagged message in the message detail view (MDV).
2. Send sample via the Send EML to CrowdStrike Sandbox action in the right-side action panel.

If the action button doesn't appear or submissions fail, see Troubleshooting the CrowdStrike Sandbox integration.