What this endpoint does

Retrieves a concise summary of a malware sample's analysis results from Recorded Future Sandbox, including per-task scoring and platform details. This endpoint provides more detail than the Sandbox: Get Sample endpoint (which only returns basic status) but less than the Sandbox: Get Sample Overview endpoint (which returns full IOCs, signatures, and extracted malware configurations). Use this endpoint when you need to quickly assess a sample's threat score and check which analysis tasks succeeded or failed, without fetching the complete analysis report.

Response data

Returns the sample's overall threat score (0-10), analysis status, SHA-256 hash, and submission/completion timestamps. The tasks object is keyed by composite task IDs and contains each analysis task's kind (behavioral or static), individual score, classification tags (e.g., ransomware, discovery), target file, analysis platform and OS (e.g., windows11-21h2-x64, redhat-9.3-amd64), timeout duration, and signature count. Failed tasks include a failure reason explaining why the analysis did not complete.