Troubleshoot the CrowdStrike Sandbox integration

If the CrowdStrike Falcon Sandbox integration isn't working as expected, work through the symptoms below.

The "Send EML to CrowdStrike Sandbox" action doesn't appear in the MDV

The integration isn't configured, or its credentials are invalid.

Go to Account → CrowdStrike Sandbox.
Confirm a CrowdStrike Falcon Sandbox entry exists and is enabled.
If credentials are missing or expired, re-run setup to enter a fresh Client ID and Client Secret.

Submission fails immediately

Most commonly: invalid Client ID, Client Secret, or environment URL.

Verify all three fields under Account → CrowdStrike Sandbox.
The Client Secret can only be viewed once at creation. If you've lost it, generate a new API client in Falcon and update the integration in Sublime.
Confirm the Tenant URL matches your Falcon cloud region.

The Sandbox Analysis row shows an Error state

Expand the row to see a link to the Falcon error page.

Common causes:

Quota exhausted — daily Falcon Sandbox quota is used up. Wait for the quota to reset, or upgrade your Falcon plan.
Transient Falcon outage — re-submit after a few minutes.
Permissions — the API client may be missing required Sandbox scopes. Confirm the client has Sandbox read + write access in Falcon.

Submissions never complete

If a submission stays in In Progress for an extended period:

Check Falcon directly to confirm the submission landed there (use the original submission timestamp).

Audit log entries

Actions taken through the CrowdStrike Sandbox integration are recorded in the Sublime audit log. Each submission is logged as the event crowdstrike_sandbox.sample.submitted, capturing the user who submitted the message and the time of submission. Use these entries to confirm a submission was made and to reconcile activity against your Falcon Sandbox quota.