Subsistem analisis dinamis terisolasi — handoff terkondisi dari Apex Engine, korelasi reputasi via Private Threat Intelligence, dan pengembalian laporan ke Mega Lake.
Isolated dynamic analysis subsystem — conditional Apex Engine handoff, Private Threat Intelligence reputation correlation, and analyst-grade report return to Mega Lake.
Product Identification
PRODUCT
NOGTUS Sandbox Platform
TYPE
Isolated dynamic analysis subsystem
What This Module Is
The architectural role and engineering thesis.
The Sandbox Platform operates as a conditional dynamic analysis substrate — invoked under policy by Apex decision analysis when evidentiary thresholds for deep file inspection have been met, or directly by the analyst through manual submission via Web UI or RESTful API. This conditional invocation is the central economic insight of the architecture: dynamic analysis is expensive; routing every artefact to the sandbox is wasteful; routing the right artefacts under cost-aware execution arbitration preserves both throughput and analytical depth.
Each sandbox detonation produces a structured report — sequence visualization, behavioral artefact extraction, IOC enumeration — and the report is returned to Mega Lake under the schema governance contract, enabling downstream correlation, retroactive hunting, and cross-incident pattern reconstruction. Reputation is enriched via Private Threat Intelligence Network integration before the verdict is finalized.
Operational scale: ribuan file analyzed concurrently with manual upload ceiling at 200 MB and broad multi-extension coverage — calibrated for SOC-grade throughput rather than research-lab depth.
Sistem digunakan untuk analisis sampel/file/objek pada lingkungan terisolasi yang bekerja dengan menerima objek hasil keputusan otomatis dari Apex Static Engine untuk proses analisis lanjutan atau upload file manual.