Download the PCAPNG network capture from a behavioral task, including decrypted HTTPS via embedded TLS key logs.
What this endpoint does
Downloads the network traffic capture in PCAPNG format from a behavioral analysis task, including decrypted HTTPS traffic with embedded TLS key logs. Only behavioral tasks (behavioral1, behavioral2, etc.) produce captures — static or URL scan tasks return 404. Requires Wireshark v3+ or TShark v3+ to open. Use Sandbox: Get Sample to see which tasks exist for a sample. For compatibility with older tools, use Sandbox: Download PCAP instead (without TLS decryption). Correlate network indicators with behavioral findings from Sandbox: Get Dynamic Report.
Response data
Returns raw binary PCAPNG data with Content-Type application/octet-stream. This is the preferred format for network forensics because it includes decrypted HTTPS sessions — you can inspect the full HTTP request/response content of TLS-encrypted connections without needing external key material. Save with a .pcapng extension.