What this endpoint does

Returns the high-level analysis overview for a completed sample — the primary intelligence summary combining results across all analysis tasks. This is the best starting point for understanding what a sample does: it includes the overall threat score, malware family identification, behavioral signatures with MITRE ATT&CK mappings, extracted malware configurations (C2 URLs, botnet IDs, encryption keys), per-target IOCs, and ransom note content when applicable. The sample must be in reported status — check via Sandbox: Get Sample or Sandbox: Stream Sample Events. For task-level behavioral detail (process trees, network flows), use Sandbox: Get Dynamic Report.

Response data

Returns the consolidated intelligence verdict for a sample. The analysis.score (0–10) is the maliciousness rating, and analysis.family identifies the malware family. The signatures array contains all triggered detections with MITRE ATT&CK technique IDs — these drive threat classification and detection rule creation. The targets array breaks down results per analyzed target, each with its own IOCs (domains, URLs, IPs) — feed these directly into blocklists or enrichment queries against Recorded Future's core API. The extracted array is often the highest-value section: decoded malware configurations with C2 addresses, botnet identifiers, encryption keys, and ransom notes. Check the errors array for tasks that failed to execute (e.g., wrong OS architecture).

200Overview report.

404Sample not found or report not available.