What this endpoint does

This endpoint downloads a bulk file of file hashes matching a specified risk rule, designed for integration into SIEMs, EDR platforms, and threat intelligence systems. Only hashes with a risk score of 25 or above are included. You can filter by risk rules such as positive malware verdicts, malware sandbox detonations, active malware, or links to known malware families—use the Hash Risk Rules endpoint to retrieve the full list of valid rule names. The output is available in CSV/Splunk (default), STIX 1.1.1, STIX 1.2, or STIX 2.1 formats. Use the companion HEAD Hash Risk List endpoint to check file metadata and ETags before downloading.

Response data

The response is a binary file download (not JSON). In the default CSV/Splunk format, each row contains a hash value, its algorithm type (MD5, SHA-1, or SHA-256), composite risk score, risk string showing triggered vs total rules, and JSON-encoded evidence details. The Algorithm column is specific to hash risk lists and identifies the hash type, which is important for ingestion into systems that require algorithm identification. When using STIX formats, the same intelligence is structured as STIX indicators and observables.