Extract Incident Artifact
LAST UPDATED: SEPT 09, 2024
Extracts incident artifacts.
Implementation | System |
Command Category | System Utility |
Tags | ARTIFACT INCIDENT |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
Incident Number | Required | The incident number corresponding to an incident for which to extract incident artifacts. | 20220407-3 |
Output
Remote Command API
The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.
Request
POST
https:/{base_url}/{api_namespace}/api/Command/ExtractIncidentArtifact
Headers
Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.
Request Body
{
"Username": <Username here>,
"Site": <Site here>,
"CommandParams": {
"Incident Number": <Input here>
}
}
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
Incident Number |
| Required | The incident number corresponding to an incident for which to extract incident artifacts. |
Sample Request
SAMPLE DATA
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"Incident Number": "20220407-3"
}
}
Response
Response Fields
Field Name | Type | Description |
---|---|---|
result |
| The result message of the API request. |
error |
| The error message if the API request has failed. |
returnData |
| The return data from the API request. |
rawData |
| The raw data from the API request. |
Sample Response
{
"result": "Successfully list all available artifacts to the specific incident number: 20220407-3.",
"error": "",
"returnData": "Successful",
"rawData": [
{
"EmailAddress": [
{
"EmailAddress": "mxu@d3securityonline.net"
}
],
"File": [
{
"FileId": "5921DC0E-A4B8-4A36-913B-11685BF81FD4",
"FileName": "D3Cyber(Debug).xlsm",
"FileSize": "15519",
"RiskLevel": "N/A",
"RiskLevelID": "4",
"SHA256": "0627ECF11A0E9CEFDBEFAE70A093928D39245D9A445CFC270F1267285B4A80B8"
},
{
"FileId": "F9DE6E86-EACF-4083-AE98-5B001F4555F6",
"FileName": "D3CyberReport.eml",
"FileSize": "29355",
"RiskLevel": "N/A",
"RiskLevelID": "4",
"SHA256": "560D6D837DFDEED728CF4DEE5D2E6F12C3E9974A89FCB446C552DB17755058E1"
}
],
"URLAddress": [
{
"RiskLevel": "N/A",
"RiskLevelID": "4",
"Url": "xmr.pool.minergate.com"
}
]
}
]
}