List artifacts metadata by ID

Gets malware artifacts metadata for the specified alert ID.

GET https://<address>/wsapis/v1.2.0/artifacts/<alert_type>/<alert_id>/meta

Availability

This command is available on the following appliances:

Central Management System
Malware Analysis
Email Security — Server
File Protect
Network Security

Required header:

X-FeApi-Token: [API-Token]

Request content-type:

application/xml
application/json

Parameters

address—This is the IP address of the appliance running the Web Services API.
API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.
alert_type—Type of alert, for example, malwareobject.
alert_id—ID of the alert.

Example request

GET https://<address>/wsapis/v1.2.0/artifacts/<alert_type>/<alert_id>/meta

List artifacts metadata by ID response

Response Code—A standard HTML response code.
- 200—Request successful.
- 500—Request unsuccessful because the server encountered a problem.
Response Message—A standard HTML response message.
- OK—Request successful.
- Internal Server Error—Request unsuccessful because the server encountered a problem.

Metadata in XML:

<artifactsMetaData>
  <artifactsInfoList>
    <artifactsInfo>
      <artifactName>1.malware</artifactName>
      <artifactSize>26.19 KB</artifactSize>
      <artifactType>malware</artifactType>
    </artifactsInfo>
    <artifactsInfo>
      <artifactName>M1-1-2017-08-01-215227.pvna.pcap</artifactName>
      <artifactSize>109.67 KB</artifactSize>
      <artifactType>pcap</artifactType>
    </artifactsInfo>
    <artifactsInfo>
      <artifactName>M1-1-2017-08-01-215227.flv</artifactName>
      <artifactSize>1414.70 KB</artifactSize>
      <artifactType>flv</artifactType>
    </artifactsInfo>
  </artifactsInfoList>
  <alertId>1</alertId>
  <alertType>Malware Object</alertType>
  <appliance>0025904E22AC</appliance>
  <applianceId>0025904E22AC</applianceId>
  <version>MAS (MAS) 8.1.0.394276</version>
</artifactsMetaData>

Metadata in JSON:

{
  "artifactsInfoList":[
    {
      "artifactType":"original_email",
      "artifactName":"429PgJ5HCRzY18vp",
       "artifactSize":"3950"
    },
    {
      "artifactType":"archived_object",
      "artifactName":"4567.malware",
      "artifactSize":"1982"
    },
    {
      "artifactType":"vm_capture",
      "artifactName":"M4528-128-2018-09-12-144413.pvna.pcap",
      "artifactSize":"4228"
    },
    {
      "artifactType":"vm_capture",
      "artifactName":"M4528-129-2018-09-12-144413.pvna.pcap",
      "artifactSize":"1048"
    }
  ]
}

cURL code Sample: list artifacts metadata by ID

The following code sample can be copied and executed from any command-line interface that includes the cURL library.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

curl -qgsSk --header "X-FeApi-Token: IHAT75KulvFZ2fz7NqMJRIRRCmNYQFXXX=" --header "Accept:application/json" "https://xxx.xxx.xxx.xxx/wsapis/v1.2.0/artifacts/malwareobject/1/meta"

This cURL sample includes the following options:

-q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.
-g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.
-s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.
-S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.
https://xxx.xxx.xxx.xxx/wsapis/v1.2.0/artifacts/malwareobject/1/meta—The fetch request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance.

Results

The specified alert's metadata is returned in JSON.