---
title: "Get dynamic analysis report"
method: GET
path: "/samples/{sampleID}/{taskID}/report_triage.json"
---

# Get dynamic analysis report

`GET /samples/{sampleID}/{taskID}/report_triage.json`

Retrieve the full behavioral analysis report with process trees, network flows, signatures, and malware configurations.

## Path parameters

- `sampleID` string, required
- `taskID` string, required

## Response `200`

Triage behavioral report.

- object
  - `version` string — Report format version (e.g., 0.3.1)
  - `build` string
  - `sample` object
    - `id` string
    - `score` integer
    - `submitted` string, date-time
    - `target` string
    - `size` integer
    - `md5` string
    - `sha1` string
    - `sha256` string
    - `sha512` string
    - `ssdeep` string
  - `task` object
    - `target` string
    - `pick` string
    - `size` integer
    - `md5` string
    - `sha1` string
    - `sha256` string
    - `sha512` string
    - `ssdeep` string
    - `static_tags` string[]
  - `analysis` object
    - `score` integer
    - `tags` string[]
    - `ttp` string[] — MITRE ATT&CK technique IDs
    - `features` string[]
    - `submitted` string, date-time
    - `reported` string, date-time
    - `max_time_network` integer
    - `max_time_kernel` integer
    - `backend` string
    - `resource` string
    - `resource_tags` string[]
    - `platform` string
  - `processes` object[] — Process tree from behavioral analysis.
    - `procid` integer
    - `procid_parent` integer
    - `pid` integer
    - `ppid` integer
    - `cmd` string
    - `image` string
    - `orig` boolean
    - `started` integer
    - `terminated` integer
  - `signatures` object[]
    - `label` string
    - `name` string
    - `desc` string
    - `score` integer
    - `tags` string[]
    - `ttp` string[]
    - `indicators` object[]
    - `is_custom` boolean
  - `network` object — Network activity observed during analysis.
    - `flows` object[]
      - `id` integer
      - `src` string
      - `dst` string
      - `sport` integer
      - `dport` integer
      - `proto` string
      - `pid` integer
      - `procid` integer
      - `domain` string
      - `first_seen` integer
      - `last_seen` integer
    - `requests` object[]
      - `flow` integer
      - `dns_request` object
      - `http_request` object
      - `tls_request` object
  - `extracted` object[]
    - `dumped_file` string
    - `resource` string
    - `config` object
    - `ransom_note` object

## Other responses

- `404` — Sample/task not found or report not available.

---

[API](https://skmtc.dev/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.dev/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)