Extract Artifacts from Text File
POST /Command/ExtractArtifactsFromTextFile
Extracts artifacts from a text file with File ID. Artifacts include IP, Domain, URL, File Hash, Email Address etc.
Request
Authentication: API keys or JSON web tokens (JWT)
Body Parameters
|
Parameter Name
|
Type
|
Required/Optional
|
Description
|
|
Username
|
string
|
Required
|
The username of your D3 SOAR account.
|
|
Site
|
string
|
Required
|
The D3 SOAR site to run the remote command.
|
|
Files
|
array<JSON Object>
|
Required
|
The Text files
|
|
File Source
|
string
|
Required
|
File source.
|
Body Sample Data
application/json
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"Files": [
{
"FileName": "96296_20110218354000xx---art1.txt",
"FileId": 10742,
"FileType": "text/plain",
"FileExtension": ".txt",
"FileDescription": "This file contains artifacts from events"
}
],
"File Source": "Artifact File"
}
}
Response
application/json
Response Fields
|
Field Name
|
Type
|
Description
|
|
error
|
string
|
The error message if the API request has failed.
|
|
returnData
|
string
|
The return data from the API request.
|
|
contextData
|
JSON Object
|
The context data from the API request.
|
Sample Data
{
"error": "",
"returnData": "Succeed",
"contextData": {
"ip": [
"192.168.1.128"
],
"url": [
"http://192.168.1.128",
"https://www.d3security.com"
],
"domain": [
"www.d3security.com"
],
"md5": [],
"sha256": [
"2548884526E8FBC5781F5B3B2972E9B20CC16DD86BDE93D2E888023F6919F5xx"
],
"sha1": [],
"emailaddress": [
"mye@d3security.com"
]
}
}
application/json
Response Fields
|
Field Name
|
Type
|
Description
|
|
Error
|
string
|
A error message when the API request fails.
|
Sample Data
{"Error": "The body of the request must be a valid JSON object"}
application/json
Response Fields
|
Field Name
|
Type
|
Description
|
|
Error
|
string
|
A error message when the API request fails.
|
Sample Data
{"Error": "Invalid authentication key."}
application/json
Response Fields
|
Field Name
|
Type
|
Description
|
|
Error
|
string
|
A error message when the API request fails.
|
Sample Data
{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}
application/json
Response Fields
|
Field Name
|
Type
|
Description
|
|
Error
|
string
|
A error message when the API request fails.
|
Sample Data
{"Error": "Unexpected Error."}
