What this endpoint does

Searches across all Recorded Future Sandbox analysis reports using a structured query syntax. Supports searching by file hashes (MD5, SHA-1, SHA-256, SHA-512), malware family name, behavioral tags, botnet identifiers, extracted C2 data (URLs, domains, IP addresses), cryptocurrency wallet addresses, and date ranges. Unlike the Sandbox: List Samples endpoint which only returns the user's or organization's own submissions, search queries across all available sandbox reports. Use this endpoint to find existing analyses of a suspicious file hash before submitting it, or to discover samples related to a specific malware family or threat campaign.

Response data

Returns a paginated data array of matching sample summaries, each containing the sample ID, analysis status, submission kind (file or URL), filename, SHA-256 hash, and submission/completion timestamps. Pagination uses a next cursor — pass the cursor value as the offset query parameter to retrieve subsequent pages. Use the sample IDs from search results with the Sandbox: Get Sample Overview endpoint to retrieve full analysis reports for any matching sample.