Extract Incident Artifact in STIX‎

POST /Command/ExploreArtifactbySIX

This command allows you to extract artifacts in STIX format.

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`string`	Required	The D3 SOAR site to run the remote command.
Incident Number	`string`	Required	Specify the incident number

Body Sample Data

application/json

JSON

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Incident Number": "20220407-x"
  }
}

Response

200 OK

application/json

Response Fields

Field Name	Type	Description
error	`string`	The error message if the API request has failed.
returnData	`string`	The return data from the API request.
contextData	`array<JSON Object>`	The context data from the API request.

Sample Data

JSON

{
    "error": "",
    "returnData": "Successful",
    "contextData": [
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--d3ac8ee0-6403-48af-b8a5-e0774b9872xx",
            "created": "04/07/2022 10:11 PM UTC",
            "modified": "04/07/2022 10:23 PM UTC",
            "indicator_types": "User",
            "name": "Frankye",
            "pattern": [
                {
                    "User Name": "Frankye"
                },
                {
                    "Event Count": "0"
                },
                {
                    "Incident Count": "3"
                },
                {
                    "First Seen": "04/07/2022 10:11 PM UTC"
                },
                {
                    "Last Seen": "04/07/2022 10:23 PM UTC"
                },
                {
                    "Artifact Name": "Frankye"
                },
                {
                    "Artifact Type": "User"
                },
                {
                    "Additional": ""
                },
                {
                    "Risk Level": "N/A"
                },
                {
                    "Is Key Asset": ""
                },
                {
                    "Technique": ""
                },
                {
                    "Tactic": ""
                }
            ],
            "valid_from": "10/15/2019 12:00 AM UTC"
        }
    ]
}

400 BadRequest

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "The body of the request must be a valid JSON object"}

401 Unauthorized

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "Unexpected Error."}