[ANY.RUN] Add new Sandbox playbooks

[semayellow]

No description provided.

[semayellow]

Hi @kelby-shelton , @ljstella
Is there anything required from our side to start the review process?

[kelby-shelton]

I've included @mark Girguis ***@***.***> who can help with the review. He is current on PTO but will respond as soon as he's available.

…

________________________________ From: Semen Shalnev ***@***.***> Sent: Monday, March 16, 2026 9:18 AM To: phantomcyber/playbooks ***@***.***> Cc: Kelby Shelton ***@***.***>; Mention ***@***.***> Subject: Re: [phantomcyber/playbooks] [ANY.RUN] Add new Sandbox playbooks (PR #229) [https://avatars.githubusercontent.com/u/85073445?s=20&v=4]semayellow left a comment (phantomcyber/playbooks#229)<#229 (comment)> Hi @kelby-shelton<https://github.com/kelby-shelton> , @ljstella<https://github.com/ljstella> Is there anything required from our side to start the review process? — Reply to this email directly, view it on GitHub<#229 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AQRED7H25ZG2GABMFYH3BRD4RAEJRAVCNFSM6AAAAACVR6V6R2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DANRXHE4TIOBVG4>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[semayellow]

Hi, @kelby-shelton
Are there any changes?

[rollehfoh]

Hi, @mark @kelby-shelton
Could you please let me know the status of the PR?

[gdollasigns]

Hi @semayellow & @rollehfoh,

Thank you for the patience here. I'm in the process of reviewing the playbooks, which includes getting access to an instance and testing. I've hit a couple of snags along the way -- mainly adding my IP address to the allowlist in Any.Run to be able to interact with the API endpoints. If this is something you're able to help out with, please let me know.

[rollehfoh]

Hi @gdollasigns,

I'm not quite sure what you need. Perhaps you mean that you need an ANY.RUN API key to configure the instance?

[gdollasigns]

Thanks for contributing these ANY.RUN sandbox playbooks! The overall workflow structure is solid, but there are several issues that need to be addressed before this can be merged.

1. Hardcoded personal test asset names (Critical)
Every phantom.act() call uses developer-specific asset names ("test_5" and "fkravtsov-test-2"). Any user installing these playbooks would need to manually edit every action call. Please use a consistent, documented asset name (e.g. "anyrun") that matches the installed connector asset.

2. on_finish key name mismatch (High) — affects all 6 sandbox playbooks
on_finish reads from keys build_output and build_output_1, but the blocks that actually write data are named build_output_malicious and build_output_safe. These keys never match, so output["results"] will always be empty at runtime.

3. Stale get_report_1 datapath reference (High)
In ANYRUN_Sandbox_File_Windows_Analysis.py and ANYRUN_Sandbox_URL_Windows_Analysis.py, build_output_safe collects from get_report_1:action_result.data.*, but no block named get_report_1 exists in either playbook — the block is just get_report. This will silently produce empty data on the safe (no threats) path.

4. KeyError crash in ANYRUN_Detonate_URL_on_Windows.py (High)
on_finish declares output = {"result": []} (singular key) but then calls output["results"].extend(...) (plural). This will crash every execution of that playbook.

5. Empty build_output_* custom code sections (High)
All build_output_malicious and build_output_safe blocks leave anyrun_analysis_results = None with empty custom code bodies. The logic to assemble the output dictionary was never written, so the saved result is always null.

6. Unused import (Minor)
from datetime import datetime, timedelta appears in every file but is never used.

Please address items 1–5 before this is ready to merge. Happy to re-review once updated!

[gdollasigns]

Hi @semayellow and @rollehfoh — just wanted to gently nudge on the review feedback left above. When you get a chance, could you take a look at the issues flagged and let us know if you have any questions? Happy to help clarify anything. Thanks!

[semayellow]

Hi @gdollasigns!
Apologize for the delay. We are ready to continue the review process.

[rollehfoh]

Hi @gdollasigns,
Are there any updates, or are any changes required on our end?

[gdollasigns]

Great progress, @semayellow and @rollehfoh — all of the originally flagged issues have been addressed. Just one remaining item before this is ready to merge:

python_version: "3.9" in all 6 JSON files (Medium)
All playbook JSON files still declare "python_version": "3.9". Please update these to "python_version": "3.13" to match the rest of the repo. Python 3.9 is being deprecated in the next release of Splunk SOAR, so all new content should target 3.13.

Additionally, could you please retarget this PR from 8.4 to 8.6, which is the current default branch?

Once those two changes are made, this is good to go!

[anyrun-integrations]

Hey @gdollasigns , we reopened this PR as a new one - #240. This is due to organizational changes on our end.
The new PR is a full copy of this one, with the fixes you mentioned. Let's continue the process there, please.