What this endpoint does

Downloads the raw kernel/system monitor logs from a behavioral analysis task — the lowest-level behavioral data showing every process creation, file operation, registry change, and network event the sandbox observed. Choose the logType based on the task's OS: onemon for Windows, stahp for Linux, bigmac for macOS, droidy for Android. Check which OS a task ran on via Sandbox: Get Sample Summary (the os field on each task). For a processed, higher-level view of this same activity, use Sandbox: Get Dynamic Report instead — it aggregates these raw logs into process trees, network flows, and signature matches.

Response data

Returns NDJSON (newline-delimited JSON) — one JSON object per line, not a JSON array. Each line has a kind field (e.g., onemon.Process, onemon.File, onemon.Registry, onemon.NetworkFlow) and an event object with the details. Parse line-by-line, not with a standard JSON parser. These logs can be very large for active samples. This is the raw telemetry — useful for custom detection rule development, forensic deep-dives, or when the dynamic report's aggregated view doesn't have enough detail.