What this endpoint does

Queries Recorded Future's malware sandbox analysis database to find and aggregate artifacts observed across analyzed samples. You provide a query using the Malware Intelligence query language to filter sandbox results (e.g., dynamic.network.flows.dst_port == 5353 to find samples communicating on a specific port) and specify a field parameter to choose which artifact type to aggregate — such as sha256, ip_address, domain, url, ttp, command_line, or other behavioral indicators. The query language references fields from sandbox analysis reports including dynamic behavior (network flows, process activity) and static analysis attributes. The start_date parameter is required and cannot precede 2023-11-01. For querying by known indicators of compromise instead of the query language, use the Malware Intelligence: Query by IOCs endpoint; for natural language queries, use the Malware Intelligence: Query Natural Language endpoint. To retrieve full sandbox reports for specific samples, use the Malware Intelligence: Get Sandbox Reports endpoint.

Response data

The response returns a paginated list of matching artifacts, each with its value (name), the number of sandbox samples it was observed in (count), and a Recorded Future risk score. When querying with field set to sha256, additional per-result data is available: file extension types, MITRE ATT&CK tactic tags, a sandbox-specific score (when sandbox_score is true), and links to the universal sandbox report and intelligence card in the Recorded Future portal (when links is true). For other field types like ip_address, domain, or url, only the name, count, and risk_score are returned. The counts object provides the total number of matching results and the current page size, along with total_pages for pagination.