What this endpoint does

Returns the high-level analysis overview for a completed sample — the primary intelligence summary combining results across all analysis tasks. This is the best starting point for understanding what a sample does: it includes the overall threat score, malware family identification, behavioral signatures with MITRE ATT&CK mappings, extracted malware configurations (C2 URLs, botnet IDs, encryption keys), per-target IOCs, and ransom note content when applicable. The sample must be in reported status — check via Sandbox: Get Sample or Sandbox: Stream Sample Events. For task-level behavioral detail (process trees, network flows), use Sandbox: Get Dynamic Report.

Response data

Returns the consolidated intelligence verdict for a sample. The analysis.score (0–10) is the maliciousness rating, and analysis.family identifies the malware family. The signatures array contains all triggered detections with MITRE ATT&CK technique IDs — these drive threat classification and detection rule creation. The targets array breaks down results per analyzed target, each with its own IOCs (domains, URLs, IPs) — feed these directly into blocklists or enrichment queries against Recorded Future's core API. The extracted array is often the highest-value section: decoded malware configurations with C2 addresses, botnet identifiers, encryption keys, and ransom notes. Check the errors array for tasks that failed to execute (e.g., wrong OS architecture).