---
title: "Query Malware Intelligence data with query language"
method: POST
path: "/v1/query"
tags: ["Malware Intelligence"]
---

# Query Malware Intelligence data with query language

`POST /v1/query`

Find and aggregate sandbox artifacts using structured query language.

## Request body

- object
  - `query` string, required — Query in custom query language to filter the Malware Intelligence data with
  - `field` 'sha256' | 'ip_address' | 'domain' | 'url' | 'command_line' | 'ttp' | 'dst_port' | 'signature' | 'ioc' | 'tag' | 'score' | 'asn' | 'submitter_industry' | 'imported_dll' | 'dumped_file_sha256' | 'dumped_file_path' | 'registry_key_read' | 'registry_key_created' | 'pe_issuer', required — Field of Malware Intelligence data to return data for
  - `start_date` string, date, required — Earliest date to include in the query (cannot be before 2023-11-01)
  - `end_date` string, date — Latest date to include in the query, defaults to today in UTC
  - `my_enterprise` boolean — Only include samples submitted by your enterprise in the query (defaults to false)
  - `page` integer — Page number to return. Pages are zero-indexed. (Defaults to 0)
  - `sandbox_score` boolean — Include sandbox score in the response
  - `links` boolean — Include universal report and intelligence card URLs in the response
  - `sanitize` boolean — Whether to sanitize returned results. When omitted the service will default to false.

## Response `200`

List of 'field' values matching the query

- QueryResponse — Malware intelligence query results with matching records and field values.
  - `data` QueryHit[]
    - `name` string — Value matching the query
    - `count` integer — Number of times the value occurs in the result set
    - `risk_score` integer — Risk Score for this entity
    - `sandbox_score` integer — Sandbox score of a hash. Only present for hash entities
    - `file_extensions` string[] — List of file extensions for Hash. Only present for Hash entities
    - `tags` string[] — List of tags associated with Hash. Only present for Hash entities
    - `links` Links — Related links and references for a malware intelligence record.
      - `universal_report` string — URL to the universal report for this entity. Only present for hash entities
      - `intelligence_card` string — URL to the intelligence card for this entity.
  - `counts` QueryCount — Count of matching records for a query.
    - `returned` integer — Number of hits included in the response
    - `total` integer — Total number of hits
  - `total_pages` integer — Total number of pages that can be returned by this query

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/versions/c8c2f68d8b60/schema)