get_behaviour_evtx: Get Behaviour EVTX File

In virustotal: R Client for the 'VirusTotal' API

Get Behaviour EVTX File

Description

Retrieves the EVTX (Windows Event Log) file from a sandbox analysis.

Usage

get_behaviour_evtx(sandbox_id = NULL, output_path = NULL, ...)

Arguments

sandbox_id	Sandbox report ID (character string). Required.
output_path	Local path to save the EVTX file. Optional.
...	Additional arguments passed to httr::GET.

Value

Raw EVTX content or saves to file if output_path specified

References

https://docs.virustotal.com/reference

See Also

set_key for setting the API key, get_behaviour_report for JSON report

Examples

## Not run: 

# Before calling the function, set the API key using set_key('api_key_here')

evtx <- get_behaviour_evtx(sandbox_id='hash_sandboxname')
get_behaviour_evtx(sandbox_id='hash_sandboxname',
                   output_path='/tmp/events.evtx')

## End(Not run)

virustotal documentation built on April 13, 2026, 9:07 a.m.