List artifacts data by UUID

Downloads malware artifacts data for the specified UUID as a zip file.

GET https://<address>/wsapis/{v1.2.0|v2.0.0}/artifacts/<uuid>

Availability

This command is available on the following appliances:

Central Management System
Malware Analysis
Email Security — Server
File Protect
Network Security

Required header:

X-FeApi-Token: [API-Token]

Request content-type:

application/octet-stream (v1.2.0)
application/zip (v2.0.0)

Options

address—This is the IP address of the appliance running the Web Services API.
uuid—Universally unique ID of the alert.
API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.

Example request

GET https://<address>/wsapis/v2.0.0/artifacts/<uuid>

List artifacts data by UUID response

Response Code—A standard HTML response code.
- 200—Request successful.
- 500—Request unsuccessful because the server encountered a problem.
Response Message—A standard HTML response message.
- OK—Request successful.
- Internal Server Error—Request unsuccessful because the server encountered a problem.

cURL code sample: list artifacts data by UUID

The following code sample can be copied and executed from any command-line interface that includes the cURL library.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

curl -qgsSk --header "FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxx=" --header "Accept:application/zip" https://xxx.xxx.xxx.xxx/wsapis/v2.0.0/artifacts/dce3d3d0-c362-4780-8c16-cc44ab776XXX -o file.zip

This cURL sample includes the following options:

-q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.
-g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.
-s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.
-S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.
https://xxx.xxx.xxx.xxx/wsapis/v2.0.0/artifacts/dce3d3d0-c362-4780-8c16-cc44ab776XXX—The fetch request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance.
-o file.zip—This option specifies the name of the output file.

Results

The specified alert's data is returned as a zip file called file.zip. It contains files which have details of malware artifacts as well as a screen capture video file.