v1

latestOpenAPI 3.1.0Elastic 2.02026-07-179371211.2 KB

Cases

Create Case Artifact

Attach an observable to an existing case. Observables are considered "artifacts" in SOC internal terminology. If not creating a file artifact then only the artifact itself should be sent as the body, in JSON format. If creating a file artifact then two multipart-form values should be supplied: "json" (the artifact object), and "attachment" (the file bytes). The file size, hashes, mime type will be automatically generated and populated into the artifact object on the server.

post/connect/case/artifacts/

Request body

artifactTypestring required

The artifact type as set by the server. This is an internal, read-only field.

caseIdstring required

The case ID for which this artifact is to be attached, or is already attached.

createTimestring

The date and time that this object was created. This is a read-only field.

descriptionstring

A description that explains how this artifact relates to the case.

groupIdstring

The group ID as set by the server. This is an internal, read-only field.

groupTypestring

The group type as set by the server. This is an internal, read-only field.

idstring

The ID assigned to this object by the server. This is a read-only field.

iocboolean

A flag representing whether this artifact is an indicator of compromise (IoC).

kindstring

The kind of object. This is a read-only field.

md5string

An MD5 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.

mimeTypestring

The mime type of the artifact stream. This field is determined by the server upon file upload and is read-only.

operationstring

The operation that was applied to the object. This is a read-only field.

protectedboolean

A flag representing whether this file artifact is protected. A protected file will be automatically zipped by the server before being retrieved, to avoid accidentally executing a potentially harmful attachment.

sha1string

A SHA-1 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.

sha256string

A SHA-256 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.

streamIdstring

The stream ID of the artifact stream. This field is determined by the server upon file upload and is ready-only.

streamLengthinteger

The length of the artifact stream. This field is determined by the server upon file upload and is ready-only.

tagsstring[]

Tags to assign to this artifact.

tlpstring

The traffic light protocol value for this artifact.

updateTimestring

The date and time that this object was last modified. This is a read-only field.

userIdstring

The user ID (or API client ID) that initiated this event. This is a read-only field.

valuestring required

The value of this artifact. Essentially this is the content of the artifact itself, such as an IP address, a hostname, a filename, etc.

Example request

{
  "artifactType": "ip",
  "caseId": "PdFc-JIBLkNJ8-bDfz47",
  "createTime": "2024-11-14T15:03:22Z",
  "description": "Additional supporting evidence",
  "groupType": "evidence",
  "id": "PdFc-JIBLkNJ8-bDfz47",
  "kind": "case",
  "md5": "d9cca721a735dac4efe709e0f3518373",
  "mimeType": "application/json",
  "operation": "create",
  "sha1": "a0571c5b9493187adb5bd07ad0faf279a86251df",
  "sha256": "9c1f8398f5a92eee44aee58d000a4dc1705f9c25e29683f7730215bc1274cff1",
  "streamId": "f2fS-DajPqlMo-221Nmn",
  "streamLength": 4096,
  "tags": [
    "pending",
    "unconfirmed"
  ],
  "tlp": "red",
  "updateTime": "2024-11-14T15:33:02Z",
  "userId": "socl_my_new_client",
  "value": "1.2.3.4"
}

Response

Outputs the artifact object including its generated ID.