Breadcrumbs

Artifact Instantiations

last updated: January 15, 2026

Artifact Settings

The optional Artifact Settings section in the EFM Edit Field popover defines the basis for instantiating an artifact type from ingested data. Artifact instantiations underpin relationship modeling and drive subsequent behavioral analysis.

Artifact instances and their relationships together form a behavior graph. This graph is displayed in the Artifact Behavior tab of a D3 event's Event Details popover.

7a322cc7-9bb9-4c86-ad48-0b7836bff38c.png
Artifact Settings

Configurable Parameters

The Artifact Settings accordion includes two parameters:

  • Artifact Type: A dropdown menu that provides the full set of supported artifact types, including both built-in (non-legacy) and any user-defined custom types.

    • Users may add new custom types on-the-fly via the adjacent lab134.d3securityonline.net_d3_168_new_dev_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=8fcae5b31b884642b5b95235fb1efd3c4be340a250809a5bb22ddbf6d035ffa8 (19) 1-20250624-003750.png button.

Frame 25 (1)-20260115-223033.png
Artifact Types


  • Artifact Role: A label that clarifies the function of an artifact in relation to an event.

    • Each string entered and saved in this field becomes a selectable option in the Relationship popover for the chosen artifact type, within the Artifact module.

    • By default, the value of the artifact role is identical to the artifact type.

Frame 4-20250916-013516.png
Defining and Using Artifact Roles

Conditions for Artifact Instantiation

An artifact is instantiated after data ingestion, when the following conditions are met:

  1. The configured source field value for an EFM record matches a key in the raw data JSON.

    61241477-b420-491f-87be-95b01c9bacaa.png

  2. The value of the matched key is not:

    • an empty string

    • an empty list

    • null

  3. An artifact type for the EFM record is configured.

Example - Artifact Instantiation *

  1. Navigate to the Fetch Event command of the Zendesk integration.

    Frame 42 (5)-20250630-175639.png

  2. Enable webhook authentication, then select the API Key option.

    Frame 39 (1)-20250630-183146.png

  3. Create an API key, if one has not already been created. Record the selected site.

    Frame 8-20250916-172239.png

  4. Copy the request information to Postman, then select a preprocessing playbook under the Additional Settings accordion.

    Frame 46 (2)-20250630-185035.png

    In Postman:

    • Prepare the POST request URL.

      Frame 21 (1)-20250718-190151.png

    • Prepare the request header key and value.

      Frame 22 (1)-20250718-190210.png

  5. Prepare the following payload for ingestion:

    JSON
    {
    "results": [
        {
            "id": "1",
            "discriminator": "demo",
            "target1": "value1",
            "layer1": {
                "layer2": {
                    "layer3": {
                        "target2": "value2"
                    }
                }
            }
        }
    ]
}
    Component 1 1-20250916-174530.png

  6. Click on the Set Up Event Field Extraction Mapping button in D3 vSOC.

    Frame 41-20250630-175547.png

  7. Note the Main Event JSONPath expression.

    Frame 7 (1)-20250916-172631.png

  8. Create an event source called Demo Source using the following search string:

    {$.discriminator}=demo

  9. Ready two custom artifact types.

    Frame 12-20250916-201205.png

  10. Add the two EFM mapping records shown below.

    Frame 6-20250916-173141.png

  11. Send the POST request prepared in step 4 and step 5.

    Frame 10-20250916-174754.png

  12. Confirm that one event and two artifacts were created, in the Data Ingestion module.

    Frame 13-20250916-205953.png

  13. Note the eventId number.

    Frame 14-20250916-210748.png

  14. Navigate to the Investigation Dashboard module.

    Frame 49 (1)-20250630-190451.png

  15. Select the site in which the API key was generated in step 3b.

    Frame 9 (1)-20250630-190521.png

  16. Verify that the two artifact instances are visible in the Artifacts > All Artifacts section.

    Frame 15-20250916-212129.png

  17. Locate the event with an ID matching the one observed in step 13, then click on it.

    Frame 16-20250916-213441.png

  18. Verify that the two artifact instances are displayed within the Artifact Behavior tab.

    Frame 11-20250916-213552.png

  1. A general extraction field (GEF) has been configured.

Example - Artifact Instantiation with GEF *

  1. Configure two EFM records, one with the artifact settings filled and one without.

    Frame 21 (1)-20250924-231830.png

  2. Navigate to the Artifacts module.

    Frame 33-20250917-232545.png

  3. Add a GEF.

    Frame 23 (1)-20250924-231851.png

  4. Verify that the GEF has been added.

    Frame 24 (2)-20250924-231910.png

  5. Send the following POST request:

    JSON
    {
    "results": [
        {
            "id": "0105",
            "discriminator": "demo",
            "target1": "zeus.exe",
            "target2": "sqlsnake.py"
        }
    ]
}
    Frame 20 (1)-20250924-231928.png

  6. Verify that the GEF-defined artifact "sqlsnake.py" (Custom Type) has been instantiated.

    Frame 22 (1)-20250924-231947.png

READER NOTE

  • Criteria 1 and 2 are mandatory.

  • At least one of criteria 3 or 4 must be true.

FAQs

What do different artifact names of the same type suggest?

Frame 39-20250918-172535.png

Within the Investigation Dashboard > Artifacts > All Artifacts panel, when multiple artifact names share the same artifact type, each name represents a distinct piece of data collected.

For example, two different IP addresses may both appear as artifacts of type 'External IP,' or two separate file hashes may both appear as artifacts of type 'File Hash SHA256.'

RELATED ARTICLES