What this endpoint does

Downloads the raw network traffic capture (PCAP format) from a behavioral analysis task. Only behavioral tasks (behavioral1, behavioral2, etc.) produce captures — static or URL scan tasks return 404. Use Sandbox: Get Sample to see which tasks exist for a sample. For HTTPS traffic with TLS decryption, use Sandbox: Download PCAPNG instead — PCAPNG includes the TLS key log needed to decrypt captured sessions. Correlate network indicators with behavioral findings from Sandbox: Get Dynamic Report.

Response data

Returns raw binary PCAP data (libpcap format) with Content-Type application/octet-stream. Suitable for Wireshark, tcpdump, or any tool that reads standard PCAP. Files can be ~1.6 MB for a typical analysis but vary with network activity. Note: this is legacy PCAP format — for decrypted HTTPS and extended metadata, prefer the PCAPNG endpoint.