What this endpoint does

Returns a mid-level analysis summary for a completed sample — per-task execution metadata including which OS and sandbox backend each task ran on, per-task threat scores, signature counts, and behavior tags. This is the middle ground between Sandbox: Get Sample (just status) and Sandbox: Get Sample Overview (full IOCs and configs). Use this when you need to compare task-level results without pulling full reports — for example, to see if a sample scored differently on Windows vs Linux, or to find which task triggered the most signatures. The sample must be in reported status. For detailed behavioral analysis per task, use Sandbox: Get Dynamic Report.

Response data

Returns the sample's overall verdict alongside a breakdown of every analysis task the sandbox ran. Each task in the tasks map shows what environment it executed in (OS, backend, timeout), its individual threat score, behavior tags (malware families, TTPs), and how many signatures fired. The task keys use a composite format {sampleID}-{taskName} — strip the sample ID prefix to get the taskID for other endpoints. Failed tasks include a failure reason explaining why execution didn't complete. The meta.channel field reveals how the sample was submitted (API, web UI, automated feed).