RErecordedfuture
Malware Intelligence

Fetch sandbox reports for a given sha256 hash and query

Retrieve detailed behavioral and static analysis reports for a specific sample, ranked by sandbox score.

post/v1/reports

Request

  • Base URL
    https://api.recordedfuture.com/malware-intelligence
  • URL
    https://api.recordedfuture.com/malware-intelligence/v1/reports
  • Auth
    • OAuth 2
      Authorization code: https://id.recordedfuture.com/authorize
      Token URL: https://id.recordedfuture.com/token
    • or API key in header X-RFToken

Request body

querystring required

Query in custom query language to filter the Malware Intelligence data with

sha256string required

The SHA256 hash of a file

start_datestring date required

Earliest date to include in the query (cannot be before 2023-11-01)

end_datestring date

Latest date to include in the query, defaults to today in UTC

my_enterpriseboolean

Only include samples submitted by your enterprise in the query (defaults to false)

limitinteger

Maximum number of reports to return. (Defaults to 1, cannot be below 1 or above 10)

sanitizeboolean

Whether to sanitize returned reports. When omitted the service will default to false.

Example request

{
  "query": "dynamic.network.flows.dst_port == 5353",
  "sha256": "dc2878d9bf6ef5fca45737536272a7a1877e0c6f89cb9578cb0f956781102986",
  "start_date": "2024-11-01",
  "end_date": "2024-11-30",
  "limit": 10
}

Response

List of sandboxreports for the given sha256 hash

Changes

No recorded changes to this operation across all 1 revision of this API.