What this endpoint does

Retrieves the binary file attachment associated with an analyst note, streamed as application/octet-stream. Not all notes have attachments — before calling this endpoint, use Analyst Notes: Lookup to check whether attributes.attachment is present in the response. If that field is absent, the note has no attachment and this endpoint returns an error. Note IDs (in doc:XXXXXX format) can be obtained from Analyst Notes: Search or Lookup.

Response data

Returns raw binary file data — write the response body directly to disk, do not parse as JSON. The original filename is available in the Content-Disposition response header (attachment; filename="..."), which is the only way to recover the filename without a prior Lookup call. Common attachment types include YARA rules, IOC lists, and supplementary analysis documents.