Get the EVTX file generated during a file’s behavior analysis

Each JSON object contained in the file behaviour feed packages include a URL to this API endpoint to download the extracted EVTX from the file's Windows sandbox execution. The link only works during the feed's lifetime. Check /feeds/file-behaviours/{time} for more information.

Click Try It! to start a request and see the response here!