Exporting task results

Kaspersky Research Sandbox enables you to export file execution and web address browsing results for further analysis.

You can export the following data:

• Results from all data groups available for the executed object.
• Specific execution results from a selected group.

The execution result structure may change after the Kaspersky Sandbox database update. In addition to the described fields, other fields may appear in the exported results.

To export all task results:

1. On the Sandbox page of Kaspersky Research Sandbox, do one of the following:
   • In the History table, click the (Export results) button in the section that contains a task execution result that you want to export.
   • In the History table, click the View details link in the section that contains a task execution result that you want to export. Then click the Export results link.
2. In the drop-down list, select the file format that you want to export investigation results to: STIX (available only for files), JSON archive, CSV archive, PDF, or PCAP.

   The Save As window opens.

   Preparing a file with all investigation results for download may take several minutes.

3. Select the location and click Save.

The file with execution results for the object is saved to the specified location.

Detailed information about exporting results in various formats is provided in the following sections in the Appendices: Exporting execution results to STIX, Exporting execution results to JSON archive, and Exporting execution results to CSV archive.

To export object execution results from a selected data group:

1. Click the Download data button next to the title of the table that contains data that you want to export. A link is available only if a table contains at least one item.

   For the Packed object content, Transferred files, and Dropped files sections, you can download results in the JSON format or as a .ZIP archive (container-files.json, transferred_files and dropped_files subfolders respectively).

   The Save As window opens.

   Kaspersky Research Sandbox exports up to 10,000 items from a data group.

2. Select the location and click Save.

   Default file names are represented in the table below. You can change the file name if necessary.

The file containing execution results from the data group will be saved to the specified location.

Default file names

Page top