Download PCAP file of an riskware alert in zip format. Alert ID can be found in the response body of the riskware summary API.
POST https://<etp-instance>/api/v1/alerts/riskware/<id>/downloadpcap
Required headers:
Content-Type: "application/json"—Content type of the request body.
If the domain you use you use to access the Trellix UI ends in fireeye.com:
x-fireeye-api-key: <key>—Specifies your personal API key.
If the domain you use to access the Trellix UI ends in trellix.com:
authorization: bearer <access_token>—Specifies your personal access token.
Important
Use
authorization: bearer <access_token>in place ofx-fireeye-api-key: <key>in the following examples.
Example request
https://<APIURI>/alerts/3yPzj5K-123458258-0f8cfc44-9996-44c8-87b7-2dc55cdd9338/downloadmalware --output pcap.zip -H 'x-fireeye-api-key: <APIKEY>' -H "Content-Type: application/json" -d '{}'
Example response
Zip File (Binary) pcap.zip