Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Endpoint Management API

Get a file

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/get_file</span></div>

Refer to Spaces for more information.

Get a file from an endpoint.

post/api/endpoint/action/get_file

Request body

agent_type'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint'

List of agent types to retrieve. Defaults to endpoint.

alert_idsstring[]

If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.

case_idsstring[]

The IDs of cases where the action taken will be logged. Max of 50.

commentstring

Optional comment

endpoint_idsstring[] required

List of endpoint IDs (cannot contain empty strings). Max of 250.

Example request

{
  "agent_type": "endpoint",
  "alert_ids": [
    "alert-id-1",
    "alert-id-2"
  ],
  "case_ids": [
    "case-id-1",
    "case-id-2"
  ],
  "comment": "This is a comment",
  "endpoint_ids": [
    "endpoint-id-1",
    "endpoint-id-2"
  ]
}

Response

Indicates a successful call.

Example response

{
  "data": {
    "agents": [
      "ed518850-681a-4d60-bb98-e22640cae2a8"
    ],
    "agentState": {
      "ed518850-681a-4d60-bb98-e22640cae2a8": {
        "isCompleted": false,
        "wasSuccessful": false
      }
    },
    "agentType": "__agent__type__here_",
    "command": "__command__name__here__",
    "createdBy": "elastic",
    "hosts": {
      "ed518850-681a-4d60-bb98-e22640cae2a8": {
        "name": "gke-node-1235412"
      }
    },
    "id": "233db9ea-6733-4849-9226-5a7039c7161d",
    "isCompleted": false,
    "isExpired": false,
    "outputs": {},
    "parameters": {},
    "startedAt": "2022-07-29T19:08:49.126Z",
    "status": "pending",
    "wasSuccessful": false
  }
}