Find sandbox artifacts using plain English instead of structured query syntax.
What this endpoint does
Searches Recorded Future's malware sandbox analysis database using plain English instead of structured query syntax. The API translates your natural language description into a query expression and executes it, returning the same paginated artifact list as Malware Intelligence: Query. Use this to explore sandbox data without learning the query syntax — the response includes the generated query so you can refine it using the structured endpoint. For specific IOC lookups, use Malware Intelligence: Query by IOCs instead.
Response data
Returns matching sandbox artifacts with the auto-generated structured query that was executed. Fields use camelCase (executedQuery, totalPages). Paginated; use totalPages to determine iteration bounds.