{ "openapi": "3.0.2", "x-hideTryItPanel": true, "info": { "contact": { "email": "docs-cortex@paloaltonetworks.com", "name": "Cortex Documentation Team", "url": "https://cortex-docs.paloaltonetworks.com/" }, "title": "Cortex Cloud Forensics REST API", "description": "Public API endpoints for browsing forensic investigations, their hunt and triage collections, and the artifact data collected for them.\n\nRequired licenses: All API endpoints require a Cortex Cloud Runtime Security license with endpoints and the Forensics add-on. \nRBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.", "version": "2.x" }, "servers": [ { "url": "https://api-{{fqdn}}" } ], "tags": [ { "name": "Forensics", "x-displayName": "Forensics", "description": "Public API endpoints for browsing forensic investigations, their hunt and triage collections, and the artifact data collected for them." } ], "paths": { "/public_api/v1/forensics/investigations": { "post": { "summary": "List forensic investigations", "description": "Returns all forensic investigations visible to the caller's scope.\n\nRequired licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on.\nRBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.", "operationId": "getForensicsInvestigations", "tags": [ "Forensics" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "description": "Empty object. No request parameters are accepted.", "additionalProperties": false } }, "required": [ "request_data" ] }, "example": { "request_data": {} } } } }, "responses": { "200": { "description": "List of investigations.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvestigationsResponse" }, "example": { "reply": { "data": [ { "id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f", "created_at": "2025-04-10T14:21:05Z", "updated_at": "2025-04-12T08:03:42Z", "created_by": "alice.smith@example.com", "updated_by": "alice.smith@example.com", "name": "Suspicious lateral movement - HR subnet", "description": "Investigation following SOC alert ALR-9821.", "status": "open", "expires_at": "2025-07-10T14:21:05Z", "total_collections": 4, "completed_collections": 3 } ], "total_count": 1 } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/public_api/v1/forensics/investigations/collections": { "post": { "summary": "List collections in an investigation", "description": "Returns all hunt (scheduled/on-demand artifact searches across multiple endpoints) and triage (targeted artifact collections from specific endpoints) collections that belong to a specific investigation, grouped by type.\n\nRequired licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on.\nRBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.", "operationId": "getForensicsInvestigationCollections", "tags": [ "Forensics" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "investigation_id" ], "properties": { "investigation_id": { "$ref": "#/components/schemas/InvestigationId" } } } }, "required": [ "request_data" ] }, "example": { "request_data": { "investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f" } } } } }, "responses": { "200": { "description": "Collections grouped by type.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CollectionsResponse" }, "example": { "reply": { "data": { "hunts": [ { "id": "8a1b2c3d-1111-4d2a-9c1a-aaaabbbbcccc", "type": "hunt", "investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f", "name": "Persistence hunt - all Windows endpoints", "os": "WINDOWS", "last_received_at": 1744459200000, "status": "COMPLETED", "total_searches": 2, "searches": [ "11111111-1111-4111-8111-111111111111", "22222222-2222-4222-8222-222222222222" ] } ], "triages": [ { "id": "9b1b2c3d-2222-4d2a-9c1a-aaaabbbbcccc", "type": "triage", "investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f", "name": "Targeted triage - HR endpoints", "os": "WINDOWS", "last_received_at": 1744462800000, "status": "IN_PROGRESS", "total_agents": 3, "agents": [ "aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa", "aaaaaaa2-aaaa-4aaa-8aaa-aaaaaaaaaaaa", "aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa" ] } ] }, "total_count": 2 } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/public_api/v1/forensics/investigations/collections/hunt": { "post": { "summary": "List results of a hunt search", "description": "Returns the summary results (one entry per artifact category, such as PERSISTENCE or EXECUTION, produced by the search) of a specific hunt search inside a hunt collection.\n\nRequired licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on.\nRBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.", "operationId": "getForensicsHuntResults", "tags": [ "Forensics" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "investigation_id", "collection_id", "search_id" ], "properties": { "investigation_id": { "$ref": "#/components/schemas/InvestigationId" }, "collection_id": { "allOf": [ { "$ref": "#/components/schemas/CollectionId" } ], "description": "Identifier of the hunt collection. Must reference a hunt-type collection that belongs to `investigation_id`." }, "search_id": { "allOf": [ { "$ref": "#/components/schemas/SearchId" } ], "description": "Identifier of the hunt search whose results should be returned. Must belong to `collection_id`." } } } }, "required": [ "request_data" ] }, "example": { "request_data": { "investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f", "collection_id": "8a1b2c3d-1111-4d2a-9c1a-aaaabbbbcccc", "search_id": "11111111-1111-4111-8111-111111111111" } } } } }, "responses": { "200": { "description": "Hunt result rows.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HuntResultsResponse" }, "example": { "reply": { "data": [ { "id": "d1e2f3a4-3333-4d2a-9c1a-aaaabbbbcccc", "created_at": "2025-04-12T07:55:01Z", "category": "PERSISTENCE", "artifact_type": "REGISTRY", "filters": { "key_path": "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" }, "status": "COMPLETED", "total_results": 42 } ], "total_count": 1 } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/public_api/v1/forensics/investigations/collections/triage": { "post": { "summary": "List triage results for an agent", "description": "Returns the artifact summaries collected from a specific endpoint agent inside a triage collection, separated into structured data artifacts (e.g., AMCACHE, REGISTRY) and collected-file artifacts (e.g., MFT, EVTX).\n\nRequired licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on.\nRBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.", "operationId": "getForensicsTriageResults", "tags": [ "Forensics" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "investigation_id", "collection_id", "agent_id" ], "properties": { "investigation_id": { "$ref": "#/components/schemas/InvestigationId" }, "collection_id": { "allOf": [ { "$ref": "#/components/schemas/CollectionId" } ], "description": "Identifier of the triage collection. Must reference a triage-type collection that belongs to `investigation_id`." }, "agent_id": { "allOf": [ { "$ref": "#/components/schemas/AgentId" } ], "description": "Identifier of the agent whose triage results should be returned. The agent must belong to `collection_id`." } } } }, "required": [ "request_data" ] }, "example": { "request_data": { "investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f", "collection_id": "9b1b2c3d-2222-4d2a-9c1a-aaaabbbbcccc", "agent_id": "aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa" } } } } }, "responses": { "200": { "description": "Triage artifact summaries grouped by type.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriageResultsResponse" }, "example": { "reply": { "data": { "data": [ { "id": "c0ffee01-3333-4d2a-9c1a-aaaabbbbcccc", "created_at": 1744462800000, "artifact_type": "AMCACHE", "status": "COMPLETED", "total_results": 318 } ], "files": [ { "id": "c0ffee02-3333-4d2a-9c1a-aaaabbbbcccc", "created_at": 1744462801000, "artifact_type": "MFT", "status": "COMPLETED", "successful_file_paths": [ "C:\\$MFT" ], "failed_file_paths": [], "total_files": 1, "total_results": 1 } ] }, "total_count": 2 } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/public_api/v1/forensics/investigations/collections/get_data": { "post": { "summary": "Get artifact data rows from a collection", "description": "Returns the actual collected artifact rows (records) for a hunt search or a triage agent.\n\nExactly one of `search_id` or `agent_id` must be provided, matching the type of `collection_id`:\n\n- For a **hunt** collection, send `search_id`.\n- For a **triage** collection, send `agent_id`.\n\nSending the wrong identifier for the collection type returns `400 Bad Request`.\n\nThe per-row schema depends on the requested `artifact_type` (e.g., registry keys, process execution logs) and is not enumerated in this document.\n\nRequired licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on.\nRBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.", "operationId": "getForensicsCollectionData", "tags": [ "Forensics" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "investigation_id", "collection_id", "artifact_type" ], "properties": { "investigation_id": { "$ref": "#/components/schemas/InvestigationId" }, "collection_id": { "$ref": "#/components/schemas/CollectionId" }, "artifact_type": { "$ref": "#/components/schemas/ArtifactType" }, "search_id": { "allOf": [ { "$ref": "#/components/schemas/SearchId" } ], "description": "Required when `collection_id` is a hunt collection. Must be omitted for triage collections." }, "agent_id": { "allOf": [ { "$ref": "#/components/schemas/AgentId" } ], "description": "Required when `collection_id` is a triage collection. Must be omitted for hunt collections." }, "search_from": { "$ref": "#/components/schemas/SearchFrom" }, "search_to": { "$ref": "#/components/schemas/SearchTo" } } } }, "required": [ "request_data" ] }, "example": { "request_data": { "investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f", "collection_id": "9b1b2c3d-2222-4d2a-9c1a-aaaabbbbcccc", "agent_id": "aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa", "artifact_type": "AMCACHE", "search_from": 0, "search_to": 100 } } } } }, "responses": { "200": { "description": "Artifact rows. The shape of each item depends on `artifact_type`.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RawRowsResponse" }, "example": { "reply": { "data": [ { "file_path": "C:\\Windows\\System32\\notepad.exe", "sha256": "5d8e6cf7e2d6e2f3b3a5e1d6c0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9", "last_modified": 1744451200000 } ], "total_count": 318 } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/public_api/v1/forensics/investigations/collections/triage/host_timeline": { "post": { "summary": "Get host timeline rows for an agent", "description": "Returns the chronological host-timeline events (such as process creation, file modifications, and network connections) collected from a specific endpoint agent inside a triage collection. Supports pagination.\n\nRequired licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on.\nRBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.", "operationId": "getForensicsHostTimeline", "tags": [ "Forensics" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "investigation_id", "collection_id", "agent_id" ], "properties": { "investigation_id": { "$ref": "#/components/schemas/InvestigationId" }, "collection_id": { "allOf": [ { "$ref": "#/components/schemas/CollectionId" } ], "description": "Identifier of the triage collection." }, "agent_id": { "$ref": "#/components/schemas/AgentId" }, "search_from": { "$ref": "#/components/schemas/SearchFrom" }, "search_to": { "$ref": "#/components/schemas/SearchTo" } } } }, "required": [ "request_data" ] }, "example": { "request_data": { "investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f", "collection_id": "9b1b2c3d-2222-4d2a-9c1a-aaaabbbbcccc", "agent_id": "aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa", "search_from": 0, "search_to": 500 } } } } }, "responses": { "200": { "description": "Host-timeline rows.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostTimelineResponse" }, "example": { "reply": { "data": [ { "uuid": "f1f1f1f1-4444-4d2a-9c1a-aaaabbbbcccc", "agent_id": "aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa", "timeline_id": "tl-001", "host_name": "HR-LAPTOP-07", "generated_time": 1744462900000, "timestamp": 1744462899000, "timestamp_partition": 20250412, "description": "Process created", "type": "PROCESS", "user": "DOMAIN\\\\hr.user", "data": { "process_name": "powershell.exe", "command_line": "powershell -enc ..." }, "tags": [ "suspicious" ], "source_row_uuid": "abcdef01-4444-4d2a-9c1a-aaaabbbbcccc", "os": "WINDOWS" } ], "total_count": 1 } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/public_api/v1/forensics/investigations/collections/triage/get_files": { "post": { "summary": "List files collected by a triage artifact", "description": "Returns the individual files collected for a given file-producing artifact type (such as raw event logs or system files) from a specific endpoint agent inside a triage collection. Each item references a single collected file path; `download_url` is populated with a secure, time-limited signed URL only when the file is available for download.\n\nRequired licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on.\nRBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.", "operationId": "getForensicsTriageFiles", "tags": [ "Forensics" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "investigation_id", "collection_id", "agent_id", "artifact_type" ], "properties": { "investigation_id": { "$ref": "#/components/schemas/InvestigationId" }, "collection_id": { "allOf": [ { "$ref": "#/components/schemas/CollectionId" } ], "description": "Identifier of the triage collection." }, "agent_id": { "$ref": "#/components/schemas/AgentId" }, "artifact_type": { "allOf": [ { "$ref": "#/components/schemas/ArtifactType" } ], "description": "Name of the file-collecting artifact (for example `MFT`)." } } } }, "required": [ "request_data" ] }, "example": { "request_data": { "investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f", "collection_id": "9b1b2c3d-2222-4d2a-9c1a-aaaabbbbcccc", "agent_id": "aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa", "artifact_type": "MFT" } } } } }, "responses": { "200": { "description": "Collected files for the requested artifact.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TriageFilesResponse" }, "example": { "reply": { "data": [ { "id": "c0ffee02-3333-4d2a-9c1a-aaaabbbbcccc", "file_path": "C:\\$MFT", "time_collected": 1744462801000, "available_for_download": true, "download_url": "https://storage.example.com/forensics/abc?sig=..." } ], "total_count": 1 } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } } }, "components": { "schemas": { "InvestigationId": { "type": "string", "format": "uuid", "description": "UUID v4 identifier of a forensic investigation.", "example": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f" }, "CollectionId": { "type": "string", "format": "uuid", "description": "UUID v4 identifier of a hunt or triage collection.", "example": "9b1b2c3d-2222-4d2a-9c1a-aaaabbbbcccc" }, "AgentId": { "type": "string", "format": "uuid", "description": "UUID v4 identifier of an endpoint agent.", "example": "aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa" }, "SearchId": { "type": "string", "format": "uuid", "description": "UUID v4 identifier of a hunt search.", "example": "11111111-1111-4111-8111-111111111111" }, "ArtifactType": { "type": "string", "minLength": 1, "description": "Name of the forensic artifact (table) to query. Must be a known artifact type registered in the forensic artifacts engine (for example `REGISTRY`, `AMCACHE`, `CHROME_HISTORY`, `MFT`, `EVTX`, `SHIMCACHE`).", "example": "AMCACHE" }, "SearchFrom": { "type": "integer", "minimum": 0, "default": 0, "description": "Zero-based start index for pagination." }, "SearchTo": { "type": "integer", "minimum": 0, "description": "Exclusive end index for pagination. Defaults to `search_from + 1000`. The page window (`search_to - search_from`) must be `<= 1000` to prevent query timeouts and ensure optimal performance.", "example": 1000 }, "Investigation": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "created_by": { "type": "string", "description": "Email or identifier of the user that created the investigation." }, "updated_by": { "type": "string", "description": "Email or identifier of the user that last updated the investigation." }, "name": { "type": "string" }, "description": { "type": "string" }, "status": { "type": "string", "enum": [ "open", "close_pending" ] }, "expires_at": { "type": "string", "format": "date-time", "nullable": true }, "total_collections": { "type": "integer", "nullable": true }, "completed_collections": { "type": "integer", "nullable": true } } }, "HuntCollection": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "hunt" ] }, "investigation_id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "os": { "type": "string", "description": "Operating system the collection targets (for example `WINDOWS`, `LINUX`, `MACOS`)." }, "last_received_at": { "type": "integer", "description": "Epoch-millisecond timestamp of the most recent result received for the collection." }, "status": { "type": "string", "nullable": true }, "total_searches": { "type": "integer" }, "searches": { "type": "array", "items": { "type": "string", "format": "uuid" }, "description": "Identifiers of the hunt searches belonging to this collection." } } }, "TriageCollection": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "triage" ] }, "investigation_id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "os": { "type": "string" }, "last_received_at": { "type": "integer", "description": "Epoch-millisecond timestamp of the most recent result received for the collection." }, "status": { "type": "string", "nullable": true }, "total_agents": { "type": "integer" }, "agents": { "type": "array", "items": { "type": "string", "format": "uuid" }, "description": "Identifiers of the agents that contributed data to this collection." } } }, "CollectionsByType": { "type": "object", "properties": { "hunts": { "type": "array", "items": { "$ref": "#/components/schemas/HuntCollection" } }, "triages": { "type": "array", "items": { "$ref": "#/components/schemas/TriageCollection" } } } }, "HuntResult": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "category": { "type": "string", "description": "Logical category of the artifact returned by the search." }, "artifact_type": { "type": "string", "description": "Public name of the forensic artifact table that holds the result rows. Use this value as `artifact_type` when calling `/get_data`." }, "filters": { "type": "object", "description": "Search parameters that were applied to produce the result.", "additionalProperties": true }, "status": { "type": "string" }, "total_results": { "type": "integer" } } }, "TriageDataArtifactSummary": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "created_at": { "type": "integer", "description": "Epoch-millisecond timestamp." }, "artifact_type": { "type": "string" }, "status": { "type": "string", "description": "Normalised upper-case status (for example `COMPLETED`, `FAILED`)." }, "total_results": { "type": "integer" } } }, "TriageFileArtifactSummary": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "created_at": { "type": "integer", "description": "Epoch-millisecond timestamp." }, "artifact_type": { "type": "string" }, "status": { "type": "string" }, "successful_file_paths": { "type": "array", "items": { "type": "string" }, "description": "File paths that were collected successfully. Populated only when the artifact succeeded." }, "failed_file_paths": { "type": "array", "items": { "type": "string" }, "description": "File paths that the agent failed to collect. Populated when the artifact did not succeed." }, "total_files": { "type": "integer" }, "total_results": { "type": "integer" } } }, "TriageResultsByType": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/TriageDataArtifactSummary" } }, "files": { "type": "array", "items": { "$ref": "#/components/schemas/TriageFileArtifactSummary" } } } }, "HostTimelineRow": { "type": "object", "properties": { "uuid": { "type": "string", "format": "uuid" }, "agent_id": { "type": "string", "format": "uuid" }, "timeline_id": { "type": "string" }, "host_name": { "type": "string" }, "generated_time": { "type": "integer", "description": "Epoch-millisecond timestamp at which the row was generated by the agent." }, "timestamp": { "type": "integer", "description": "Epoch-millisecond timestamp of the event itself." }, "timestamp_partition": { "type": "integer", "description": "Date partition (YYYYMMDD) the row belongs to." }, "description": { "type": "string" }, "type": { "type": "string", "description": "Event type (for example `PROCESS`, `FILE`, `REGISTRY`)." }, "user": { "type": "string" }, "data": { "type": "object", "description": "Event-type-specific payload.", "additionalProperties": true }, "tags": { "type": "array", "items": { "type": "string" } }, "source_row_uuid": { "type": "string", "format": "uuid" }, "os": { "type": "string" } } }, "TriageCollectedFile": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "description": "Identifier of the parent triage-result row." }, "file_path": { "type": "string" }, "time_collected": { "type": "integer", "description": "Epoch-millisecond timestamp at which the file was collected." }, "available_for_download": { "type": "boolean" }, "download_url": { "type": "string", "format": "uri", "nullable": true, "description": "Time-limited signed URL to download the file. Populated only when `available_for_download` is `true`." } } }, "InvestigationsResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Investigation" } }, "total_count": { "type": "integer" } } } } }, "CollectionsResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/CollectionsByType" }, "total_count": { "type": "integer" } } } } }, "HuntResultsResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/HuntResult" } }, "total_count": { "type": "integer" } } } } }, "TriageResultsResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/TriageResultsByType" }, "total_count": { "type": "integer" } } } } }, "RawRowsResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "data": { "type": "array", "items": { "type": "object", "additionalProperties": true, "description": "Artifact row whose shape depends on `artifact_type`." } }, "total_count": { "type": "integer" } } } } }, "HostTimelineResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/HostTimelineRow" } }, "total_count": { "type": "integer" } } } } }, "TriageFilesResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/TriageCollectedFile" } }, "total_count": { "type": "integer" } } } } } }, "responses": { "BadRequest": { "description": "Invalid or missing parameters. Returned for example when a required id is missing or not a valid UUID v4, `artifact_type` is missing, pagination is out of range or the wrong type-specific id (`search_id` vs `agent_id`) is sent for the collection type.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Invalid request data" } } } } } }, "Unauthorized": { "description": "Unauthorized access.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Unauthorized request" } } } } } }, "Forbidden": { "description": "The caller does not have access to the requested investigation (out-of-scope).", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Investigation out of scope" } } } } } }, "NotFound": { "description": "The referenced entity does not exist, or the relationship is invalid (collection not in investigation, agent not in triage, search not in collection).", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Entity not found" } } } } } }, "InternalError": { "description": "Internal server error.", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Internal server error" } } } } } } } } }