---
title: "Get overview report"
method: GET
path: "/samples/{sampleID}/overview.json"
---

# Get overview report

`GET /samples/{sampleID}/overview.json`

Retrieve the comprehensive overview report with malware config, signatures, IOCs, and MITRE ATT&CK mappings.

## Path parameters

- `sampleID` string, required

## Response `200`

Overview report.

- object
  - `version` string — Report format version (e.g., 0.2.2)
  - `build` string — Sandbox build identifier
  - `sample` object — Sample metadata and file hashes.
    - `id` string
    - `score` integer
    - `target` string
    - `size` integer
    - `md5` string
    - `sha1` string
    - `sha256` string
    - `sha512` string
    - `ssdeep` string
    - `created` string, date-time
    - `completed` string, date-time
  - `analysis` object — High-level analysis results.
    - `score` integer — Overall threat score (0-10)
    - `family` string[] — Identified malware families
    - `tags` string[] — Behavior tags (e.g., family:formbook, discovery, ransomware)
  - `tasks` object — Analysis tasks keyed by composite ID.
  - `signatures` object[] — Triggered behavioral and YARA signatures.
    - `label` string — Machine-readable signature label
    - `name` string — Human-readable signature name
    - `desc` string — Signature description
    - `url` string — Reference URL for the malware family
    - `score` integer — Signature severity score (0-10)
    - `tags` string[] — Behavior and family tags
    - `ttp` string[] — MITRE ATT&CK technique IDs (e.g., T1082)
    - `indicators` object[] — Indicator evidence for the signature
      - `resource` string
      - `yara_rule` string
    - `is_custom` boolean — Whether this is a custom YARA rule match
  - `targets` object[] — Per-target analysis results.
    - `tasks` string[] — Task IDs that analyzed this target
    - `score` integer
    - `target` string
    - `family` string[] — Identified malware families
    - `tags` string[]
    - `signatures` object[]
    - `iocs` object — Indicators of compromise.
      - `domains` string[]
      - `urls` string[]
      - `ips` string[]
  - `extracted` object[] — Extracted malware artifacts (configs, ransom notes, C2 URLs).
    - `tasks` string[]
    - `resource` string
    - `dumped_file` string
    - `config` object — Extracted malware configuration.
      - `family` string
      - `rule` string
      - `c2` string[]
      - `version` string
      - `botnet` string
      - `keys` object[]
      - `attr` object
    - `ransom_note` object
      - `note` string
      - `urls` string[]
      - `emails` string[]
  - `errors` object[] — Analysis errors.
    - `task` string
    - `reason` string

## Other responses

- `404` — Sample not found or report not available.

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/versions/c8c2f68d8b60/schema)