List artifacts metadata by UUID

Gets malware artifacts metadata for the specified UUID.

GET https://<address>/wsapis/{v1.2.0|v2.0.0}/artifacts/<uuid>/meta

Note

For v1.2.0, the schema for alerts is different than for notifications. For v2.0.0, schema compatibility is available but not enforced.

Availability

This command is available on the following appliances:

Central Management System
Malware Analysis
Email Security — Server
File Protect
Network Security

Required header:

X-FeApi-Token: [API-Token]

Request content-type:

application/xml (v1.2.0)
application/json (v1.2.0 and v2.0.0)

Parameters

address—This is the IP address of the appliance running the Web Services API.
API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.
uuid—Universally unique ID of the alert.

Options

schema_compatibility—(Boolean) Specify schema compatibility for alerts and notifications. Optional.

Example request

GET https://<address>/wsapis/v2.0.0/artifacts/0cbf1657-a031-48de-9139-3ad65404cd25/meta

List artifacts metadata by UUID response

{
  "artifactsInfoList":[
    {
      "artifactType":"video_clip",
      "artifactName":"M1-1-2018-02-02-094512.flv",
      "artifactSize":"1944577"
    },
    {
      "artifactType":"vm_capture",
      "artifactName":"M1-1-2018-02-02-094512.pvna.pcap",
      "artifactSize":"7032"
    },
    {
      "artifactType":"archived_object",
      "artifactName":"1.malware",
      "artifactSize":"640554"
    }  
  ]
}

Response Code—A standard HTML response code.
- 200—Request successful.
- 500—Request unsuccessful because the server encountered a problem.
Response Message—A standard HTML response message.
- OK—Request successful.
- Internal Server Error—Request unsuccessful because the server encountered a problem.

cURL code sample: list artifacts metadata by UUID

The following code sample can be copied and executed from any command-line interface that includes the cURL library.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

curl -qgsSk --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxx=" --header "Accept:application/json" https://xxx.xxx.xxx.xxx/wsapis/v2.0.0/artifacts/dce3d3d0-c362-4780-8c16-cc44ab77623b/meta

This cURL sample includes the following options:

-q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.
-g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.
-s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.
-S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.
--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxx="—This custom header includes the API-Token that was returned by your appliance during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token in the sample with the token received in the response to your authentication request.
--header "Accept:application/json"—Specifies JSON output.
https://xxx.xxx.xxx.xxx/wsapis/v2.0.0/artifacts/dce3d3d0-c362-4780-8c16-cc44ab77623b/meta—The fetch request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance.

Results

The specified alert's metadata is returned in JSON.