Sign in

v1

latestOpenAPI 3.1.0Elastic 2.02026-07-179371211.2 KB
Cases

Get Case Artifacts

Searches for all artifacts attached to the given case ID and returns the matching artifacts, if any. Observables are considered "artifacts" in SOC internal terminology. If the case does not exist, this method will respond with a 200 status and an empty list.

get/connect/case/artifacts/{groupType}/{groupId}/{id}

Path parameters

groupTypestring required

The type of artifacts to retrieve [attachments, evidence]

Query parameters

idstring required

The case ID to use for searching all artifacts

Response

The array of artifacts, or an empty array if no matching artifacts found

artifactTypestring required

The artifact type as set by the server. This is an internal, read-only field.

caseIdstring required

The case ID for which this artifact is to be attached, or is already attached.

createTimestring

The date and time that this object was created. This is a read-only field.

descriptionstring

A description that explains how this artifact relates to the case.

groupIdstring

The group ID as set by the server. This is an internal, read-only field.

groupTypestring

The group type as set by the server. This is an internal, read-only field.

idstring

The ID assigned to this object by the server. This is a read-only field.

iocboolean

A flag representing whether this artifact is an indicator of compromise (IoC).

kindstring

The kind of object. This is a read-only field.

md5string

An MD5 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.

mimeTypestring

The mime type of the artifact stream. This field is determined by the server upon file upload and is read-only.

operationstring

The operation that was applied to the object. This is a read-only field.

protectedboolean

A flag representing whether this file artifact is protected. A protected file will be automatically zipped by the server before being retrieved, to avoid accidentally executing a potentially harmful attachment.

sha1string

A SHA-1 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.

sha256string

A SHA-256 hash of the artifact stream. This field is determined by the server upon file upload and is ready-only.

streamIdstring

The stream ID of the artifact stream. This field is determined by the server upon file upload and is ready-only.

streamLengthinteger

The length of the artifact stream. This field is determined by the server upon file upload and is ready-only.

tagsstring[]

Tags to assign to this artifact.

tlpstring

The traffic light protocol value for this artifact.

updateTimestring

The date and time that this object was last modified. This is a read-only field.

userIdstring

The user ID (or API client ID) that initiated this event. This is a read-only field.

valuestring required

The value of this artifact. Essentially this is the content of the artifact itself, such as an IP address, a hostname, a filename, etc.

Example response

[
  {
    "artifactType": "ip",
    "caseId": "PdFc-JIBLkNJ8-bDfz47",
    "createTime": "2024-11-14T15:03:22Z",
    "description": "Additional supporting evidence",
    "groupType": "evidence",
    "id": "PdFc-JIBLkNJ8-bDfz47",
    "kind": "case",
    "md5": "d9cca721a735dac4efe709e0f3518373",
    "mimeType": "application/json",
    "operation": "create",
    "sha1": "a0571c5b9493187adb5bd07ad0faf279a86251df",
    "sha256": "9c1f8398f5a92eee44aee58d000a4dc1705f9c25e29683f7730215bc1274cff1",
    "streamId": "f2fS-DajPqlMo-221Nmn",
    "streamLength": 4096,
    "tags": [
      "pending",
      "unconfirmed"
    ],
    "tlp": "red",
    "updateTime": "2024-11-14T15:33:02Z",
    "userId": "socl_my_new_client",
    "value": "1.2.3.4"
  }
]