Sign in

v1

latestOpenAPI 3.1.12026-07-242899061.7 MB
Malware Intelligence

Query Malware Intelligence data with natural language

Find sandbox artifacts using plain English instead of structured query syntax.

post/v1/query_nl

Request body

querystring required

Query in natural language to filter the Malware Intelligence data with

field'sha256' | 'ip_address' | 'domain' | 'url' | 'command_line' | 'ttp' | 'dst_port' | 'signature' | 'ioc' | 'tag' | 'score' | 'asn' | 'submitter_industry' | 'imported_dll' | 'dumped_file_sha256' | 'dumped_file_path' | 'registry_key_read' | 'registry_key_created' | 'pe_issuer' required

Field of Malware Intelligence data to return data for

start_datestring date required

Earliest date to include in the query (cannot be before 2023-11-01)

end_datestring date

Latest date to include in the query, defaults to today in UTC

my_enterpriseboolean

Only include samples submitted by your enterprise in the query (defaults to false)

pageinteger

Page number to return. Pages are zero-indexed. (Defaults to 0)

sandbox_scoreboolean

Include sandbox score in the response

linksboolean

Include universal report and intelligence card URLs in the response

sanitizeboolean

Whether to sanitize returned results. When omitted the service will default to false.

Example request

{
  "query": "Find all samples that talked to port 5353",
  "field": "sha256",
  "start_date": "2024-11-01",
  "end_date": "2024-11-30",
  "sandbox_score": true,
  "links": true
}

Response

List of 'field' values matching the query

totalPagesinteger

Total number of pages that can be returned by this query

executedQuerystring

The executed query language search

Example response

{
  "data": [
    {
      "name": "9211caf87f978d7761bfb267bb0a61e43d66f8dfdcfd1793654408d0bb15b54e",
      "count": 10,
      "risk_score": 50,
      "sandbox_score": 5,
      "file_extensions": [
        ".exe",
        ".dll"
      ],
      "tags": [
        "ransomware",
        "trojan"
      ],
      "links": {
        "universal_report": "https://app.recordedfuture.com/portal/intelligence-card/hash:9211caf87f978d7761bfb267bb0a61e43d66f8dfdcfd1793654408d0bb15b54e/sandbox-report",
        "intelligence_card": "https://app.recordedfuture.com/portal/intelligence-card/hash:9211caf87f978d7761bfb267bb0a61e43d66f8dfdcfd1793654408d0bb15b54e"
      }
    }
  ],
  "counts": {
    "returned": 1,
    "total": 1000
  },
  "totalPages": 100,
  "executedQuery": "dynamic.network.flows.dst_port == 5353"
}