Extract Incident Artifact in STIX
This utility command allows you to extract artifacts in STIX format.
Implementation | System |
Command Category | System Utility |
Tags | ARTIFACT |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
Incident Number | Required | Specify the incident number |
|
Output
Remote Command API
The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.
Request
POST
https:/{base_url}/{api_namespace}/api/Command/ExploreArtifactbySIX
Headers
Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.
Request Body
{
"Username": <Username here>,
"Site": <Site here>,
"CommandParams": {
"Incident Number": <Incident Number here>
}
}
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
Incident Number |
| Required | Specify the incident number |
Sample Request
SAMPLE DATA
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"Incident Number": "20220407-3"
}
}
Response
Response Fields
Field Name | Type | Description |
---|---|---|
error |
| The error message if the API request has failed. |
returnData |
| The return data from the API request. |
contextData |
| The context data from the API request. |
Sample Response
{
"error": "",
"returnData": "Successful",
"contextData": [
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--d3ac8ee0-6403-48af-b8a5-e0774b987212",
"created": "04/07/2022 10:11 PM UTC",
"modified": "04/07/2022 10:23 PM UTC",
"indicator_types": "User",
"name": "Frankye",
"pattern": [
{
"User Name": "Frankye"
},
{
"Event Count": "0"
},
{
"Incident Count": "3"
},
{
"First Seen": "04/07/2022 10:11 PM UTC"
},
{
"Last Seen": "04/07/2022 10:23 PM UTC"
},
{
"Artifact Name": "Frankye"
},
{
"Artifact Type": "User"
},
{
"Additional": ""
},
{
"Risk Level": "N/A"
},
{
"Is Key Asset": ""
},
{
"Technique": ""
},
{
"Tactic": ""
}
],
"valid_from": "10/15/2019 12:00 AM UTC"
}
]
}