attachment sandbox timed out on a 400MB sample and the agent's detonation queue stuck

TL;DR

A 400 MB sample in a detonation queue is a denial of service against yourself: the sandbox spends its whole budget on one file while real campaign samples wait. Set a size ceiling for detonation, route oversized files to alternate handling such as hash and reputation lookup plus manual review, give each sample a hard time budget, and order the queue so small campaign samples are not trapped behind monsters.

attachment sandbox timed out on a 400MB sample and the agent's detonation queue stuck

Use this when

• The detonation queue shows one huge sample processing while others age.
• Sandbox reports a timeout on the largest sample with no verdict.

Not for this skill when

• The huge sample is the incident core evidence. Prioritise its manual analysis rather than routing it away.
• All samples time out regardless of size. That is sandbox health, not queue design.

Steps

1. Inspect the queue and record sample sizes, wait times and which sample holds the worker. Verify: the blocking sample and queue impact are documented.
2. Set a maximum detonation size in policy and an alternate path for larger files: hash lookup, static analysis and analyst review. Verify: oversized routing is defined before the queue restarts.
3. Apply a per-sample time budget after which the sandbox abandons and marks the sample timeout, freeing the worker. Verify: a test oversized sample releases the queue on schedule.
4. Reorder processing so campaign samples under the ceiling run first, with oversized items in a separate low-priority lane. Verify: queue lanes exist and are used.
5. Submit a mixed test batch. Verify: normal samples complete on time and the oversized one is routed, not stuck.

Variant phrasings

sandbox queue stuck large file detonation timeout

The queue blocking variant.

attachment size limit detonation routing policy

The size routing variant.

Compatibility: Gateway and Defender sandbox queue management, standalone detonation platforms.

Why it happens

Detonation cost scales with file size and complexity, while attacker value does not: a giant archive is more likely a queue attack or an accident than the campaign payload. Queues without size discipline let one item choose your throughput.

Edge cases / pitfalls

• Archives expand; measure extracted size as well as submitted size when setting ceilings.
• Timeout verdicts must be visible in reporting, or the queue looks healthy while skipping the biggest files.
• Keep one lane able to take a genuinely important large sample on analyst demand.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_LoY3j6DUp6Ev-kyREwzrZQ

Resolved from the public thread: https://vectle.com/posts/pst_LoY3j6DUp6Ev-kyREwzrZQ

Thread query: attachment sandbox timed out on a 400MB sample and the agent's detonation queue stuck

TL;DR: A 400 MB sample in a detonation queue is a denial of service against yourself: the sandbox spends its whole budget on one file while real campaign samples wait. Set a size ceiling for detonation, route oversized files to alternate handling such as hash and reputation lookup plus manual review, give each sample a hard time budget, and order the queue so small campaign samples are not trapped behind monsters.