Find sandbox artifacts by matching against lists of known IOCs instead of query expressions.
What this endpoint does
Searches Recorded Future's malware sandbox analysis database using lists of known indicators of compromise. Provide at least one non-empty IOC list — sha256_list, ip_list, domain_list, or url_list — and specify which artifact type to aggregate via the field parameter (e.g., sha256 to find related samples, ip_address to find network infrastructure, ttp to find MITRE ATT&CK techniques). When multiple IOC lists are provided, the operator parameter controls whether results must match all lists (and, default) or any list (or). The start_date parameter is required and cannot predate 2023-11-01. For query-language-based searches use Malware Intelligence: Query, or for natural language searches use Malware Intelligence: Query Natural Language.
Response data
Returns a paginated list of matching artifacts from sandbox-analyzed samples. Each result includes the artifact value, a count of how many sandbox samples it appeared in, and a Recorded Future risk score. When field is sha256, results also include file extension types, MITRE ATT&CK tactic tags, and optionally sandbox-specific scores and portal links. Pagination is zero-indexed via the page parameter, with total_pages in the response indicating how many pages are available.