What this endpoint does

Retrieves the full behavioral analysis report for a sandbox task — the core intelligence output showing what happened when the sample executed. Contains the process tree, network flows (DNS, HTTP, TLS), triggered detection signatures with MITRE ATT&CK mappings, extracted malware configurations, and dropped file references. The sample must be in reported status — check via Sandbox: Get Sample. Use behavioral1, behavioral2, etc. as the taskID (multiple behavioral tasks exist when the sandbox re-executes with different configurations). To download files listed in the dumped array, use Sandbox: Download Task File. For raw network captures, use Sandbox: Download PCAP or Sandbox: Download PCAPNG.

Response data

Returns the complete behavioral analysis as a single JSON document — this is where the sandbox's intelligence lives. The analysis.score (0–10) is the overall maliciousness verdict. The signatures array contains triggered detection rules, each with a score, description, and MITRE ATT&CK technique IDs (ttp) — use these for threat classification and MITRE mapping. The network.flows and network.requests sections contain every connection the sample made, with DNS lookups, HTTP requests, and TLS handshakes correlated to specific processes. The extracted array holds decoded malware configurations (C2 addresses, encryption keys) and ransom notes when applicable — this is often the highest-value intelligence. The dumped array lists files created during execution that can be downloaded individually. The processes array is the full execution tree with command lines and parent-child relationships.