IOC for an alert request

Retrieves the IOC in XML format for a specific alert.

GET https://<address>/wsapis/v2.0.0/openioc?{alert_id=<alert_id> | alert_uuid=<alert_uuid>}

Availability

This command is available on the following appliances:

Central Management System

Request headers:

X-FeApi-Token: [API-Token]
X-FeClient-Token: [Client-Token]
Content-Type: application/xml

Parameters

address—The IP address of the appliance running the Web Services API.
API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.
Client-Token—(Optional) This client token is provided by Trellix. For more information about the client token, contact your sales representative.
alert_id or alert_uuid—Specifies the alert.

Example request

GET https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/openioc?alert_id=894375894357

Request headers:

X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-FeClient-Token: BigDataInc

IOC for an alert response

After the request is received, the Central Management System appliance validates the API token and returns a JSON object containing metadata for all feeds.

HTTP/1.1 [Response Code] [Response Message]
Date: [Date]
Content-Type: application/xml

Response fields

Response Code—A standard HTML response code.
- 200—Request successful.
- 400—Invalid or missing parameter.
- 404—Alert not found or IOC cannot be generated.

Example

HTTP/1.1 200 OK
Date: Fri, 04 Oct 2019 09:00:00 GMT
Content-Type: application/xml

cURL code sample: IOC for an alert using alert ID

The following code sample can be copied and executed from any command-line interface that includes the cURL library. This sample builds on the authentication cURL code sample.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

curl -qgsSk --no-progress-bar --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" --header "Accept: application/json" "https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/openioc?alert_id=25894378924375"

This cURL sample includes the following options:

-q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.
-g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.
-s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.
-S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.
--no-progress-bar—This option suppresses the cURL download progress bar, which can interfere with the request.
--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header includes the API-Token that was returned by your appliance during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token in the sample with the token received in the response to your authentication request.
-H 'Accept: application/xml'—This header specifies that the serverʼs response body is expected to be in XML format.
"https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/openioc?alert_id=25894378924375"—The IOC request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance, and 25894378924375 with your alert ID.

Results

This example returns an XML file containing the IOC for the specified alert.

cURL code sample: IOC for an alert using alert UUID

The following code sample can be copied and executed from any command-line interface that includes the cURL library. This sample builds on the authentication cURL code sample.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

This cURL sample includes the following options:

-q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.
-g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.
-s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.
-S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.
--no-progress-bar—This option suppresses the cURL download progress bar, which can interfere with the request.
--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header includes the API-Token that was returned by your appliance during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token in the sample with the token received in the response to your authentication request.
-H 'Accept: application/xml'—This header specifies that the serverʼs response body is expected to be in XML format.
"https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/openioc?alert_uuid=c9391258-1a79-4b54-be8e-144dab5f118f"—The IOC request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance, and c9391258-1a79-4b54-be8e-144dab5f118f with your alert UUID.

Results

This example returns an XML file containing the IOC for the specified alert.