Dropzone URL Sandbox

Dropzone URL Sandbox is a tooling integration and a Threat Intelligence (TI) integration. Tooling and TI Data Source integrations are used during investigations to improve analysis and in interactive chat to help answer questions. They are optional, but enabling more integrations enhances Dropzone analysis.

Dropzone AI's URL Sandbox connects to a web-scanning service powered by Playwright to visit websites for customers in order to do page scans, pdf analyses, etc. It has a provided built-in proxy layer to make it more reliable when accessing sites which is completely managed by Dropzone, so no setup is required by the customer.

To set up on-prem or self-managed deployments, contact your Dropzone support representative.

Enable Dropzone URL Sandbox

The Dropzone URL Sandbox integration does not require any API keys or credentials.

To enable the Data Source integration, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app

• In the bottom left hand corner, click Settings > Integrations

Integrations Dropdown

• Click "Configured"

Click Configured

• In the Search bar, search Dropzone URL Sandbox, then click the kebab on the right

Select Dropzone URL Sandbox

• Click "Enable data source" to enable Dropzone URL Sandbox

Enable data source

• To review or adjust how scans run, click on "Dropzone URL Sandbox" to open its configuration

Configuration options

The Dropzone URL Sandbox has the following settings. The defaults preserve standard proxied scanning behavior, so no changes are required to get started.

Feature	Default State	Details
Render email screenshots	On	Allows the integration to renders the HTML body of phishing emails and capture a screenshot for investigations. The browser may then fetch embedded resources such as images and tracking pixels from external servers; these requests are routed through the proxy.
Scan URLs in alerts	On	Allows the integration to navigate through URLs found in alerts. It may then retrieve page content, screenshots, and other forms of threat intelligence
Anonymous scanning only	Off	Ordinarily, scans fall back to a direct connection if the proxy is unavailable, which may expose your instance's IP to the destinations or email senders the AI investigates. If this feature is enabled, your scans will be halted if your information is at risk
Use a custom outbound proxy	Off	Route URL scans through your own proxy server instead of the Dropzone residential proxy. If you choose to enable this, you will need a proxy server address, e.g. proxy.corp.example.com:8080, username and password. Only HTTP Basic authentication is supported. Contact your Dropzone support representative for more information.
Use sticky sessions	Off	Request the same proxy exit node for consecutive scans. Useful for sites that track sessions. Only applies to the Dropzone residential proxy; ignored for custom outbound proxies.
Scan timeout (in seconds)	60 seconds	Maximum time to wait for a URL to load during a scan.

Adjust your settings as desired, then click "Test & Save" to finish.

The Dropzone URL Sandbox configuration

Notes on scanning behavior

• The integration ships with a built-in, fully-managed proxy (the "Dropzone residential proxy"). No customer setup is required to get proxied scanning — the custom outbound (bring-your-own) proxy is opt-in for customers who want egress through their own infrastructure.

• Anonymous scanning only is a fail-closed control: when on, anything that can't go through the proxy (URL scans and email-screenshot resource fetches) is skipped rather than connecting directly.

• Render email screenshots and Scan URLs in alerts are independent. You can disable outbound URL navigation while keeping email screenshots (and vice versa) without disabling the whole integration.

• Click "Test & Save" to finish

If you have any errors engage your Dropzone AI support representative.