Sandbox with your own ANY.RUN access

Have suspicious attachments analysed in your own ANY.RUN account after delivery: entering the key, what gets checked, what happens on a finding.

If you have your own ANY.RUN access, you can connect it to MailGuard. Suspicious attachments then run in your ANY.RUN account after delivery. If ANY.RUN detects malware, MailGuard reports it right away.

The check comes on top of delivery. It does not hold back any message: the mail is already in the mailbox while the analysis runs.

Requirements

  • An ANY.RUN plan with API access. You find the key in ANY.RUN under Profile → API and limits.
  • MailGuard for the account and, in Conbool, the right to change the MailGuard settings.

Entering the key

  1. Open the MailGuard settings, tab In the mailbox.
  2. Enter the API key in the card Sandbox with your own ANY.RUN access.
  3. Click Check and save.

MailGuard asks ANY.RUN whether the key is valid. This question uses no submission. MailGuard stores only an accepted key. The card then shows Connected, the last four characters of the key, your monthly quota and how many analyses may run at the same time.

Use Replace key to enter a new one and Remove to disconnect. MailGuard stops submitting within five minutes.

What gets checked

Only attachments that can execute something when opened:

  • programs, scripts and shortcuts, such as exe, dll, js, vbs, ps1, hta, lnk, iso,
  • Office files in the old format (doc, xls, ppt) and RTF,
  • Office files in the new format only with macros or with external content,
  • PDF with active content,
  • HTML attachments and archives. Not encrypted ZIP archives, they cannot be opened.

The decision is made on the file content, not on the extension alone. Images, calendar entries, signatures, ordinary PDF and Office files without macros are not sent to ANY.RUN. Up to five files per message are submitted, each up to 20 MB. A file already checked in the last seven days is not submitted again.

What happens on a finding

  • Malware: MailGuard records the finding in message tracing and notifies the alert recipients. If automatic remediation is switched on, it removes the message from the mailboxes.
  • Suspicious: record and notification, the message stays delivered. A suspicion is not proof.

Data protection

Every analysis runs privately in your ANY.RUN account and is deleted after one day. You conclude the data processing agreement directly with ANY.RUN.

Conbool stores the key encrypted. It never appears in the portal in plain text, not even for Conbool staff.

If ANY.RUN rejects the key

If the key expires or is blocked at ANY.RUN, the card shows Rejected. MailGuard then submits nothing until you save a valid key. If your quota is used up, MailGuard waits and submits later; other accounts are not affected.