What this endpoint does

Queries Recorded Future's malware sandbox analysis database using plain English descriptions instead of the Malware Intelligence query language. The system translates your natural language query (e.g., "Find all samples that talked to port 5353" or "Show me ransomware samples that modify registry keys") into a structured query and executes it against the sandbox database. Like the Malware Intelligence: Query endpoint, you specify a field parameter to choose which artifact type to aggregate from matching samples. This is ideal when you don't know the exact query language syntax — the response includes an executedQuery field showing the translated query, which can also serve as a way to learn the query language for use with the Malware Intelligence: Query endpoint directly. For querying with known IOC values, use the Malware Intelligence: Query by IOCs endpoint instead.

Response data

The response returns the same paginated artifact list as the Malware Intelligence: Query endpoint, plus an executedQuery field containing the Malware Intelligence query language expression that the system generated from your natural language input. Each result includes the artifact value, occurrence count, and risk score; when querying with field set to sha256, results also include file extensions, MITRE ATT&CK tactic tags, an optional sandbox score, and links to the sandbox report and intelligence card. Pagination uses totalPages and counts (with returned and total sub-fields).