CrowdStrike Falcon Sandbox

See for yourself how CrowdStrike Falcon® Sandbox automated malware analysis can help you get more out of malware analysis

The world's most powerful malware sandbox

Falcon Sandbox performs deep analysis of evasive and unknown threats, enriches the results with threat intelligence and delivers actionable indicators of compromise (IOCs), enabling your security team to better understand sophisticated malware attacks and strengthen their defenses.

Why Falcon Sandbox


Detect unknown threats

Unique hybrid analysis technology detects unknown and zero-day exploits while defeating evasive malware.

Achieve complete visibility

Uncover the full attack lifecycle with in-depth insight into all file, network, memory and process activity.

Respond faster

Save time and make all security teams more effective with easy-to-understand reports, actionable IOCs and seamless integration.

“It’s really nice to have the capability to safely ‘detonate’ suspects in the CrowdStrike Falcon Sandbox to quickly gain insight into any malicious intentions and, if needed, use that context to optimise our remediation strategies.”

- Jason Waits, Director of Cybersecurity, Inductive Automation

Read all customer stories >

Find answers to frequently
asked questions

Falcon Sandbox FAQ

Visibility into unknown and advanced threats

The most sophisticated analysis is required to uncover today's evasive and advanced malware. Falcon Sandbox's Hybrid Analysis technology exposes hidden behaviour, defeats evasive malware and delivers more IOCs, to improve the effectiveness of the entire security infrastructure.

Analysis is expanded to include the entire threat

Gain insight on who might be targeting you and how to defend against them. Instantly know if malware is related to a larger campaign, malware family or threat actor and automatically expand analysis to include all related malware.

Security teams are empowered

Falcon Sandbox analysis reports provide a new level of visibility into real-world threats, enabling teams to make faster, better decisions, elevating the capability of all members.

Flexible deployment finds the right balance

Be fully operational in seconds – no need for costly infrastructure or setup with Falcon Sandbox. CrowdStrike Falcon platform customers have the option to select CrowdStrike Falcon® Intelligence with Falcon Sandbox technology built-into the daily workflow.

Easily integrate into your workflow

Easily integrate into SIEMs, TIPs and orchestration systems with an easy-to-use REST API, pre-built integrations, and support for indicator sharing formats including STIX, OpenIOC, MAEC, MISP, and XML/JSON.

Take Falcon Sandbox for a test drive

The No. 1 online malware analysis community is powered by Falcon Sandbox - which means it's field tested by thousands of users every day.

Falcon Sandbox demo