Security Endpoint Management API
Download a file
Spaces method and path for this operation:
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}/download</span></div>Refer to Spaces for more information.
Download a file associated with a response action. Files are downloaded in a password-protected .zip archive to prevent the file from running. Use password elastic to open the .zip in a safe environment.
info Files retrieved from third-party-protected hosts require a different password. Refer to Third-party response actions for your system's password.
get/api/endpoint/action/{action_id}/file/{file_id}/download
Path parameters
action_idstring required
The ID of the response action that generated the file.
file_idstring required
The file identifier is constructed in one of two ways:
- For Elastic Defend agents (agentType of endpoint): combine the action_id and agent_id values using a dot (.) separator: {file_id} = {action_id}.{agent_id}
- For all other agent types: the file_id is the agent_id for which the response action was sent to.
Response
Indicates a successful call.