Sign in

v1

latestOpenAPI 3.1.12026-07-242899061.7 MB
Malware Intelligence

Query Malware Intelligence data with query language

Find and aggregate sandbox artifacts using structured query language.

post/v1/query

Request body

querystring required

Query in custom query language to filter the Malware Intelligence data with

field'sha256' | 'ip_address' | 'domain' | 'url' | 'command_line' | 'ttp' | 'dst_port' | 'signature' | 'ioc' | 'tag' | 'score' | 'asn' | 'submitter_industry' | 'imported_dll' | 'dumped_file_sha256' | 'dumped_file_path' | 'registry_key_read' | 'registry_key_created' | 'pe_issuer' required

Field of Malware Intelligence data to return data for

start_datestring date required

Earliest date to include in the query (cannot be before 2023-11-01)

end_datestring date

Latest date to include in the query, defaults to today in UTC

my_enterpriseboolean

Only include samples submitted by your enterprise in the query (defaults to false)

pageinteger

Page number to return. Pages are zero-indexed. (Defaults to 0)

sandbox_scoreboolean

Include sandbox score in the response

linksboolean

Include universal report and intelligence card URLs in the response

sanitizeboolean

Whether to sanitize returned results. When omitted the service will default to false.

Example request

{
  "query": "dynamic.network.flows.dst_port == 5353",
  "field": "sha256",
  "start_date": "2024-11-01",
  "end_date": "2024-11-30",
  "sandbox_score": true,
  "links": true
}

Response

List of 'field' values matching the query

total_pagesinteger

Total number of pages that can be returned by this query

Example response

{
  "data": [
    {
      "name": "9211caf87f978d7761bfb267bb0a61e43d66f8dfdcfd1793654408d0bb15b54e",
      "count": 10,
      "risk_score": 50,
      "sandbox_score": 5,
      "file_extensions": [
        ".exe",
        ".dll"
      ],
      "tags": [
        "ransomware",
        "trojan"
      ],
      "links": {
        "universal_report": "https://app.recordedfuture.com/portal/intelligence-card/hash:9211caf87f978d7761bfb267bb0a61e43d66f8dfdcfd1793654408d0bb15b54e/sandbox-report",
        "intelligence_card": "https://app.recordedfuture.com/portal/intelligence-card/hash:9211caf87f978d7761bfb267bb0a61e43d66f8dfdcfd1793654408d0bb15b54e"
      }
    }
  ],
  "counts": {
    "returned": 1,
    "total": 1000
  },
  "total_pages": 100
}