Breadcrumbs

Artifact Instantiations

Last Updated: October 23, 2026

Artifact Settings

The optional Artifact Settings section in the EFM Add Mapping window (shown when Enable artifact extraction is switched on) defines the basis for instantiating an artifact type from ingested data. Artifact instantiations underpin relationship modeling and drive subsequent behavioral analysis.

Artifact instances and their relationships together form a behavior graph. This graph is displayed in the Artifact Behavior tab of a D3 event's Event Details popover.

The Add Mapping window with the source field, the destination field, Refine mapped value with Regex, Enable artifact extraction and Show in Incident Details

Configurable Parameters

Switching on Enable artifact extraction shows two fields:

  • Artifact Type: A dropdown menu that provides the full set of supported artifact types, including both built-in (non-legacy) and any user-defined custom types.

    • Users may add new custom types on-the-fly via the adjacent + button, which opens Create New Artifact Type.

Frame 25 (1)-20260115-223033.png
Artifact Types


  • Artifact Role: A label that clarifies the function of an artifact in relation to an event.

    • Each string entered and saved in this field becomes a selectable option in the relationship dialog for the chosen artifact type, within the Artifact module.

    • By default, the value of the artifact role is identical to the artifact type.

Frame 4-20250916-013516.png
Defining and Using Artifact Roles

Conditions for Artifact Instantiation

An artifact is instantiated after data ingestion, when the following conditions are met:

  1. The configured source field value for an EFM record matches a key in the raw data JSON.

    61241477-b420-491f-87be-95b01c9bacaa.png

  2. The value of the matched key is not:

    • an empty string

    • an empty list

    • null

  3. An artifact type for the EFM record is configured.

Example - Artifact Instantiation *

  1. Navigate to the Fetch Event command of the Zendesk integration.

    Frame 42 (5)-20250630-175639.png

  2. Enable webhook authentication, then select the API Key option.

    Frame 39 (1)-20250630-183146.png

  3. Create an API key, if one has not already been created. Record the selected site.

    Frame 8-20250916-172239.png

  4. Copy the request information to Postman, then select a preprocessing playbook under the Additional Settings accordion.

    Frame 46 (2)-20250630-185035.png

    In Postman:

    • Prepare the POST request URL.

      Frame 21 (1)-20250718-190151.png

    • Prepare the request header key and value.

      Frame 22 (1)-20250718-190210.png

  5. Prepare the following payload for ingestion:

    JSON
    {
    "results": [
        {
            "id": "1",
            "discriminator": "demo",
            "target1": "value1",
            "layer1": {
                "layer2": {
                    "layer3": {
                        "target2": "value2"
                    }
                }
            }
        }
    ]
}

    Component 1 1-20250916-174530.png

  6. On the command's Settings sub-tab, under EVENT FIELD MAPPING, select Setup Event Field Mapping.

    A Fetch Event command's Settings sub-tab, ending with EVENT FIELD MAPPING and the Setup Event Field Mapping button

  7. Note the Event Root Path at the top of the Event Field Mapping window.

    02-event-field-mapping.png

  8. Create an event source called Demo Source using the following search string:

    {$.discriminator}=demo

  9. Ready two custom artifact types.

    Frame 12-20250916-201205.png

  10. Add the two EFM mapping records shown below.

    Frame 6-20250916-173141.png

  11. Send the POST request prepared in step 4 and step 5.

    Frame 10-20250916-174754.png

  12. Confirm that one event and two artifacts were created, on the Data Ingestion page.

    Frame 13-20250916-205953.png

  13. Note the eventId number.

    Frame 14-20250916-210748.png

  14. In the sidebar, select Artifacts.

    Frame 49 (1)-20250630-190451.png

  15. Select the site in which the API key was generated in step 3b.

    Frame 9 (1)-20250630-190521.png

  16. Verify that the two artifact instances are visible in the Artifacts list (All Artifacts).

    Frame 15-20250916-212129.png

  17. Locate the event with an ID matching the one observed in step 13, then click on it.

    Frame 16-20250916-213441.png

  18. Verify that the two artifact instances are displayed within the Artifact Behavior tab.

    Frame 11-20250916-213552.png

  1. A general extraction field (GEF) has been configured.

Example - Artifact Instantiation with GEF *

  1. Configure two EFM records, one with the artifact settings filled and one without.

    Frame 21 (1)-20250924-231830.png

  2. Select Configuration > Artifacts, then the artifact type.

    Frame 33-20250917-232545.png

  3. Add a GEF: in the artifact type's Fields for Extracting Artifacts section, on the GENERAL tab, add a field.

    Frame 23 (1)-20250924-231851.png

  4. Verify that the GEF has been added.

    Frame 24 (2)-20250924-231910.png

  5. Send the following POST request:

    JSON
    {
    "results": [
        {
            "id": "0105",
            "discriminator": "demo",
            "target1": "zeus.exe",
            "target2": "sqlsnake.py"
        }
    ]
}

    Frame 20 (1)-20250924-231928.png

  6. Verify that the GEF-defined artifact "sqlsnake.py" (Custom Type) has been instantiated.

    Frame 22 (1)-20250924-231947.png

READER NOTE

  • Criteria 1 and 2 are mandatory.

  • At least one of criteria 3 or 4 must be true.

FAQs

What do different artifact names of the same type suggest?

Frame 39-20250918-172535.png

On the Artifacts page (sidebar), with All Artifacts selected, when multiple artifact names share the same artifact type, each name represents a distinct piece of data collected.

For example, two different IP addresses may both appear as artifacts of type 'External IP,' or two separate file hashes may both appear as artifacts of type 'File Hash SHA256.'

RELATED ARTICLES