What this endpoint does

Searches across all sandbox analyses using a structured query language — the primary way to find existing analyses by hash, malware family, behavioral tag, or network indicator. Unlike Sandbox: List Samples (which only shows your own or org submissions), search queries all available sandbox reports. Common use cases: check if a hash was already analyzed before submitting (sha256:abc123...), find all samples tagged with a malware family (family:wannacry), locate samples communicating with a C2 domain (domain:evil.com), or find ransomware samples from a date range (tag:ransomware AND from:2024-01-01). Combine filters with AND, OR, NOT operators. Use sample IDs from results with Sandbox: Get Sample Overview for full analysis reports or Sandbox: Get Sample for status and task details.

Response data

Returns matching sample summaries — each entry identifies a sandbox analysis and its current state, giving you the sample ID needed to pull full reports. Search results span the entire public sandbox corpus, not just your submissions, so you'll often find that someone has already analyzed the hash you're investigating. Use the status field to confirm analysis is reported before requesting detailed results. The next cursor enables pagination — pass it as the offset query parameter for the next page. Note the next value is a composite string (timestamp plus sample ID), not a simple cursor — treat it as opaque and pass it through unchanged. Results are sorted by completion time, most recent first.