For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to page URLs; this page is available as Markdown.

Dropzone URL Sandbox

Dropzone URL Sandbox is a tooling integration and a Threat Intelligence (TI) integration. Tooling and TI Data Source integrations are used during investigations to improve analysis and in interactive chat to help answer questions. They are optional, but enabling more integrations enhances Dropzone analysis.

Dropzone AI's URL Sandbox connects to a web-scanning service powered by Playwright to visit websites for customers in order to do page scans, pdf analyses, etc. It has a provided built-in proxy layer to make it more reliable when accessing sites which is completely managed by Dropzone, so no setup is required by the customer.

To set up on-prem or self-managed deployments, contact your Dropzone support representative.

Enable Dropzone URL Sandbox

The Dropzone URL Sandbox integration does not require any API keys or credentials.

To enable the Data Source integration, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app
• In the bottom left hand corner, click Settings > Integrations

• Click "Provided"

• In the Search bar, search Dropzone URL Sandbox, then click the kebab on the right

• Click "Enable data source" to enable Dropzone URL Sandbox

• To review or adjust how scans run, click on "Dropzone URL Sandbox" to open its configuration

Configuration options

The Dropzone URL Sandbox exposes the following settings. The defaults preserve standard proxied scanning behavior, so no changes are required to get started.

• Render email screenshots (default: on) — Renders the HTML body of phishing emails to capture a screenshot for investigations. The browser may fetch embedded resources such as images and tracking pixels from external servers; these requests are routed through the proxy.

• Scan URLs in alerts (default: on) — Navigates to URLs found in alerts to retrieve page content, screenshots, and threat intelligence.

• Anonymous scanning only (default: off) — Skips a scan rather than connecting directly when the proxy is unavailable, guaranteeing your instance's IP is never exposed to scanned destinations or email senders. When off, scans fall back to a direct connection if the proxy is down, recovering more data at the cost of occasional direct connections.

• Use a custom outbound proxy (default: off) — Route URL scans through your own proxy server instead of the Dropzone residential proxy. When enabled, three additional fields appear:

• Proxy server (host:port) — Address of your proxy, e.g. proxy.corp.example.com:8080

  • Proxy username
  • Proxy password

Only HTTP Basic authentication is supported.

• Use sticky sessions (default: off) — Request the same proxy exit node for consecutive scans. Useful for sites that track sessions. Only applies to the Dropzone residential proxy; ignored for custom outbound proxies.
• Scan timeout (seconds) (default: 60; min 1, max 300) — Maximum time to wait for a URL to load during a scan.

Notes on scanning behavior

• The integration ships with a built-in, fully-managed proxy (the "Dropzone residential proxy"). No customer setup is required to get proxied scanning — the custom outbound (bring-your-own) proxy is opt-in for customers who want egress through their own infrastructure.
• Anonymous scanning only is a fail-closed control: when on, anything that can't go through the proxy (URL scans and email-screenshot resource fetches) is skipped rather than connecting directly.
• Render email screenshots and Scan URLs in alerts are independent. You can disable outbound URL navigation while keeping email screenshots (and vice versa) without disabling the whole integration.
• Click "Test & Save" to finish

If you have any errors engage your Dropzone AI support representative.