9. REST API Reference

Team Enterprise Servers can expose REST APIs to ingest and query data. See REST API Access.

These APIs were introduced in v4. Legacy versions still exist, but you should upgrade to the new and more powerful ones.

GET /api/incidents/{incidentId}

Get incident details by its id

Returns a single incident, including host and item-score aggregate counts.

Parameters:

  • incidentId (string) – The incident id.

Status Codes:

  • 200 OK – The incident.

  • 403 Forbidden – The caller does not have permission to view this incident. An incident id that does not exist is also reported as 403 rather than 404, so incident ids cannot be probed.

  • 404 Not Found – The caller is permitted to see the incident but it could not be read back — it was removed after the permission check, or the incident store could not be queried.

PUT /api/incidents/{incidentId}

Update an incident

Updates the name and/or description of an incident. Fields left null are unchanged. The fields are applied one at a time and not as a single transaction, so if the second field fails to persist the request reports 500 with the first field already applied.

Parameters:

  • incidentId (string) – The incident id.

Status Codes:

  • 200 OK – The updated incident.

  • 403 Forbidden – The caller does not have permission to edit this incident. An incident id that does not exist is also reported as 403 rather than 404, so incident ids cannot be probed.

  • 404 Not Found – The caller is permitted to edit the incident but it could not be read back — it was removed after the permission check, or the incident store could not be queried.

  • 500 Internal Server Error – A field could not be persisted. Any field applied before the failure remains applied.

DELETE /api/incidents/{incidentId}

Delete an incident

Marks an incident for deletion. The deletion runs in the background; the response reports whether it was accepted (202) or rejected because the incident is in use (409).

Parameters:

  • incidentId (string) – The incident id.

Query Parameters:

  • deleteCorrelationData (string) – When true, also delete this incident’s data from the correlation database.

Status Codes:

  • 202 Accepted – The incident was accepted for deletion.

  • 403 Forbidden – The caller does not have permission to delete this incident. An incident id that does not exist is also reported as 403 rather than 404, so incident ids cannot be probed.

GET /api/incidents

List or search incidents

Returns the incidents the caller is permitted to see, each with its host count. The bad and suspicious item counts are not included in the list; get them for one incident with “Get incident details by its id”. Optionally filter by a case-insensitive substring of the incident name and/or description.

Query Parameters:

  • name (string) – Case-insensitive substring to match against the incident name.

  • description (string) – Case-insensitive substring to match against the incident description.

Status Codes:

  • 200 OK – The list of accessible incidents.

  • 403 Forbidden – The caller does not have permission to list incidents.

POST /api/incidents

Create an incident

Creates a new incident. Returns 201 with the created incident and a Location header.

Status Codes:
POST /api/incidents/{incidentId}/reports/json_notable_v2

Generate an incident report

Queues generation of the canonical JSON export of the notable items, the ones scored Bad or Suspicious, covering every host in the incident. Returns 202 with a report id; poll “Get an incident report” on the same id to follow generation to completion.

Parameters:

  • incidentId (string) – The incident id.

Status Codes:

  • 202 Accepted – The report was queued.

  • 403 Forbidden – The caller does not have permission to generate a report for this incident. An incident id that does not exist is also reported as 403 rather than 404, so incident ids cannot be probed.

  • 409 Conflict – One or more of the incident’s hosts are still being processed, so a report would be missing items or carry scores that are about to change. Poll the hosts and ask again once each state is COMPLETED, CANCELED or ERROR and its processing has finished.

POST /api/incidents/{incidentId}/hosts/{hostId}/reports/json_notable_v2

Generate a host report

Queues generation of the canonical JSON export of this host’s notable items, the ones scored Bad or Suspicious. Returns 202 with a report id; poll “Get a host report” on the same id to follow generation to completion.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Status Codes:

  • 202 Accepted – The report was queued.

  • 403 Forbidden – The caller does not have permission to generate a report for this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

  • 409 Conflict – The host is still being processed, so a report would be missing items or carry scores that are about to change. Poll the host and ask again once its state is COMPLETED, CANCELED or ERROR and its processing has finished.

POST /api/incidents/{incidentId}/hosts/{hostId}/cancel

Cancel a host’s processing

Cancels a host that is queued or ingesting without removing it. A queued host is taken out of the processing queue; a running host is cancelled. A host that is not queued or ingesting (it has completed, failed or already been cancelled) has nothing to cancel and is refused with 409.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Status Codes:

  • 200 OK – The cancel request was processed.

  • 403 Forbidden – The caller does not have permission to cancel processing for this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

  • 409 Conflict – The host is not queued or ingesting, so there is nothing to cancel.

POST /api/incidents/{incidentId}/hosts/live-psexec

Ingest a host using the “Live-PsExec” method

Schedules a host to be collected using PsExec. The server pushes the Collector to the target, runs it with the supplied credentials, and adds the host to this incident. PsExec must be configured on the server and the account needs administrator rights on the target; see [Add Over The Network - PsExec Launch](https://docs.cybertriage.com/en/latest/chapters/importing/psexec.html) in the user manual.

Returns 202 with the new host as soon as the work is queued; the ingest itself runs in the background. Poll GET /api/incidents/{incidentId}/hosts/{hostId} for the host’s state, or GET /api/queue for the whole processing queue.

Parameters:

  • incidentId (string) – The incident id.

Status Codes:

  • 202 Accepted – The host was accepted and queued. The body is the newly created host.

  • 400 Bad Request – Invalid input, or this server cannot launch a PsExec collection: a missing or invalid hostName, more than one host in hostName, missing credentials, an unknown scanOptions id, an unparseable referenceDate, insufficient disk space, or PsExec or the Collector not configured on the server.

  • 403 Forbidden – The caller does not have permission to add a host to this incident. An incident id that does not exist is also reported as 403 rather than 404, so incident ids cannot be probed.

  • 404 Not Found – The incident was removed after the permission check passed.

  • 409 Conflict – The incident is in use by an operation that needs exclusive access (a deletion, or closing its database). Retryable — resubmit once the incident is no longer in use.

  • 422 Unprocessable Entity – The request is well formed but the host could not be resolved: the host is unreachable from the Cyber Triage server, the host is the server itself, or the host rejected the supplied credentials.

  • 500 Internal Server Error – Internal server error, such as a failure to queue the collection or to open the incident. When queueing fails the host record created for this request is removed again, so a failed request does not leave a host behind that will never be processed.

POST /api/incidents/{incidentId}/hosts/edr-telemetry

Ingest EDR telemetry for a host

Queues an ingest of one host’s telemetry, pulled from a configured EDR platform’s API (SentinelOne or Microsoft Defender), and adds the host to this incident. Vendor credentials are never sent in the request; they come from the saved EDR profile. See [Add EDR Telemetry Data](https://docs.cybertriage.com/en/latest/chapters/importing/edr_telemetry.html) in the user manual.

Returns 202 with the new host as soon as the work is queued; the ingest itself runs in the background. Poll GET /api/incidents/{incidentId}/hosts/{hostId} for the host’s state, or GET /api/queue for the whole processing queue.

Parameters:

  • incidentId (string) – The incident id.

Status Codes:

  • 202 Accepted – The ingest was accepted and queued for processing. The body is the newly created host.

  • 400 Bad Request – Invalid input: neither hostName nor deviceId supplied, a hostName with disallowed characters, a deviceId whose format is wrong for the platform (SentinelOne requires 32 hexadecimal digits; Defender allows letters, digits and hyphens), an unparseable date, a window whose start is after its end, or insufficient disk space.

  • 403 Forbidden – The caller does not have permission to add a host to this incident. An incident id that does not exist is also reported as 403 rather than 404, so incident ids cannot be probed.

  • 404 Not Found – No enabled EDR profile matches the supplied edrProfileId.

  • 409 Conflict – The incident is in use by an operation that needs exclusive access (a deletion, or closing its database). Retryable — resubmit once the incident is no longer in use.

  • 422 Unprocessable Entity – The request is well formed but could not be resolved against the EDR platform: no enabled profile is configured for this platform, more than one is (supply edrProfileId), or the host or device could not be matched to exactly one device.

  • 500 Internal Server Error – Internal server error, such as a failure to queue the ingest or to open the incident. When queueing fails the host record created for this request is removed again, so a failed request does not leave a host behind that will never be processed.

POST /api/incidents/{incidentId}/hosts/disk-image

Ingest a host from a disk image on the server

Schedules analysis of a disk image that the server can read at the given path. The server runs its own Collector against the image in place; nothing is uploaded or copied. The image must be inside the server’s data source folder, which an administrator must enable and configure (see the [Team Server documentation](https://docs.cybertriage.com/en/latest/chapters/team/index.html)). See [Add a Disk Image](https://docs.cybertriage.com/en/latest/chapters/importing/disk.html) in the user manual.

Returns 202 with the new host as soon as the work is queued; the ingest itself runs in the background. Poll GET /api/incidents/{incidentId}/hosts/{hostId} for the host’s state, or GET /api/queue for the whole processing queue.

Parameters:

  • incidentId (string) – The incident id.

Status Codes:

  • 202 Accepted – The ingest was accepted and queued. The body is the newly created host.

  • 400 Bad Request – Invalid input, or this server cannot analyze a disk image: a missing or unusable filePath, a missing or invalid hostDisplayName, an unknown scanOptions id, an unparseable referenceDate, insufficient disk space, or the Collector not present on the server.

  • 403 Forbidden – Insufficient permissions, or server data sources are not enabled. An incident id that does not exist is also reported as 403 rather than 404, so incident ids cannot be probed.

  • 404 Not Found – The incident was removed after the permission check passed.

  • 409 Conflict – The incident is in use by an operation that needs exclusive access (a deletion, or closing its database). Retryable — resubmit once the incident is no longer in use.

  • 500 Internal Server Error – Internal server error, such as a failure to queue the ingest. When queueing fails the host record created for this request is removed again.

POST /api/incidents/{incidentId}/hosts/collector-file

Ingest a host from a Collector file

Schedules ingestion of a Collector JSON file from a path on the server or from cloud storage (S3-compatible or Azure Blob). A server file is read in place, with nothing uploaded or copied; a cloud storage file is downloaded by the Team Server for processing. A server path must be inside the server’s data source folder, which an administrator must enable and configure (see the [Team Server documentation](https://docs.cybertriage.com/en/latest/chapters/team/index.html)). See [Add a Cyber Triage Collector File](https://docs.cybertriage.com/en/latest/chapters/importing/ctfile.html) in the user manual.

Returns 202 with the new host as soon as the work is queued; the ingest itself runs in the background. Poll GET /api/incidents/{incidentId}/hosts/{hostId} for the host’s state, or GET /api/queue for the whole processing queue.

Parameters:

  • incidentId (string) – The incident id.

Status Codes:

  • 202 Accepted – The ingest was accepted and queued. The body is the newly created host.

  • 400 Bad Request – Invalid input: a missing or unusable filePath, a file that cannot be opened or needs a password, an unparseable referenceDate, a hostDisplayName that could not be derived or is invalid, a cloudStorageProfileId given for a server path, or insufficient disk space.

  • 403 Forbidden – Insufficient permissions; for a server path, server data sources are not enabled; or (cloud storage only) the server does not have an Enterprise license. An incident id that does not exist is also reported as 403 rather than 404, so incident ids cannot be probed.

  • 404 Not Found – The incident was removed after the permission check passed.

  • 409 Conflict – The incident is in use by an operation that needs exclusive access (a deletion, or closing its database). Retryable — resubmit once the incident is no longer in use.

  • 422 Unprocessable Entity – Cloud storage only: no cloud storage profile matches the request (zero or more than one match).

  • 500 Internal Server Error – Internal server error, such as a failure to queue the ingest. When queueing fails the host record created for this request is removed again.

POST /api/auth/logon

Obtain an auth token

Authenticate with HTTP Basic credentials and obtain a bearer token to use with all other API calls. The token is valid for 1 hour. We recommend the api-user account (or a user in the API security group) for integrations. If a user account is used, that account cannot be used at the same time in an interactive session.

See the [IAM reference](https://docs.cybertriage.com/en/latest/chapters/team/index.html#create-and-manage-team-users) for creating and managing users.

Note: As of the 3.10 release, restApiKey is deprecated. Token-based auth is now required.

Query Parameters:

  • rememberMe (string) – When true, the session cookies are set with a longer max-age so the browser retains the session across restarts.

  • transferCode (string) – When true, the response includes a short-lived transfer code that a second client (e.g. a new browser tab) can exchange for the full bearer token without re-authenticating.

Status Codes:

  • 200 OK – Authentication successful. Returns a bearer token valid for 1 hour.

  • 401 Unauthorized – Authentication failed: invalid credentials, a disabled account, a required password reset, or (for a non-API user) another active session.

GET /api/queue

Get the processing queue

Returns the hosts that are pending or in progress across all accessible incidents, including the current processing steps for in-progress hosts.

Status Codes:

  • 200 OK – The processing queue.

  • 403 Forbidden – The caller does not have permission to list hosts. A caller with permission for only some incidents gets 200 with the queue filtered to those incidents.

GET /api/incidents/{incidentId}/reports/{reportId}

Get an incident report

Polls a report’s status. While generation is in progress, the response carries a Retry-After header. Once status is SUCCEEDED, downloadUrl points to the finished file.

Parameters:

  • incidentId (string) – The incident id.

  • reportId (string) – The report id, from “Generate an incident report”.

Status Codes:

  • 200 OK – The report’s current status.

  • 403 Forbidden – The caller does not have permission to view this incident. An incident id that does not exist is also reported as 403 rather than 404, so incident ids cannot be probed.

  • 404 Not Found – No such report, or it was not generated for this incident.

GET /api/incidents/{incidentId}/reports/{reportId}/download

Download an incident report

Downloads a finished report’s file.

Parameters:

  • incidentId (string) – The incident id.

  • reportId (string) – The report id.

Status Codes:

  • 200 OK – The report file.

  • 403 Forbidden – The caller does not have permission to view this incident. An incident id that does not exist is also reported as 403 rather than 404, so incident ids cannot be probed.

  • 404 Not Found – No such report, it was not generated for this incident, or it has no artifact.

  • 409 Conflict – The report has not finished successfully, so there is nothing to download yet.

GET /api/incidents/{incidentId}/items

List items across an incident

Returns the items found on every host in the incident. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of items.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view items in this incident. An incident id that does not exist is also reported as 403 rather than 404, so incident ids cannot be probed. Also returned when the server does not have an Enterprise license.

GET /api/incidents/{incidentId}/hosts

List hosts in an incident

Returns the hosts that belong to the incident.

Parameters:

  • incidentId (string) – The incident id.

Status Codes:

  • 200 OK – The list of hosts.

  • 403 Forbidden – The caller does not have permission to list hosts in this incident. An incident id that does not exist is also reported as 403 rather than 404, so incident ids cannot be probed.

GET /api/incidents/{incidentId}/hosts/{hostId}

Get a host by id

Returns a single host within the incident.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Status Codes:

  • 200 OK – The host.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

DELETE /api/incidents/{incidentId}/hosts/{hostId}

Delete or cancel a host

Removes a host from the incident. A host that has finished, failed or been cancelled is marked for deletion and the operation status (202) is returned; the deletion itself completes in the background.

A host that is still queued or ingesting cannot be deleted directly and is refused with 409. Set cancel=true to cancel it and remove it in one request, returning 204: a queued host is taken out of the processing queue, and a running host is cancelled and given up to 30 seconds to wind down before it is removed.

The delete is also refused with 409 while its incident is in use, that is when it is open by a client or another host in the incident is being processed. This is retryable.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • deleteCorrelationData (string) – When true, also delete this host’s data from the correlation database.

  • cancel (string) – When true, a queued or ingesting host is cancelled and then removed as one operation (returns 204). Without it, deleting a queued or ingesting host is refused with 409. Has no extra effect on a host that is not queued or ingesting.

Status Codes:

  • 202 Accepted – The host was accepted for deletion.

  • 204 No Content – The host job was cancelled and the host marked for removal (deletion completes in the background).

  • 403 Forbidden – The caller does not have permission to delete this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. With cancel=true, permission to cancel host processing is also required.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

  • 409 Conflict – The host was not deleted. Either it is queued or ingesting and cancel=true was not given (cancel it first, or resend with cancel=true), or its incident is in use because it is open by a client or another host in it is being processed. Retryable once the host or incident is no longer in use.

GET /api/incidents/{incidentId}/hosts/{hostId}/web-artifacts

List web artifacts on a host

Returns the host’s web artifacts, such as browser history, downloads, searches and cookies. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of web artifacts.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/triggered-tasks

List triggered tasks on a host

Returns the scheduled tasks and startup programs found on the host. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of triggered tasks.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/reports/{reportId}

Get a host report

Polls a report’s status. While generation is in progress, the response carries a Retry-After header. Once status is SUCCEEDED, downloadUrl points to the finished file.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

  • reportId (string) – The report id, from “Generate a host report”.

Status Codes:

  • 200 OK – The report’s current status.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed.

  • 404 Not Found – No such report, or it was not generated for this incident and host.

GET /api/incidents/{incidentId}/hosts/{hostId}/reports/{reportId}/download

Download a host report

Downloads a finished report’s file.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

  • reportId (string) – The report id.

Status Codes:

  • 200 OK – The report file.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed.

  • 404 Not Found – No such report, it was not generated for this incident and host, or it has no artifact.

  • 409 Conflict – The report has not finished successfully, so there is nothing to download yet.

GET /api/incidents/{incidentId}/hosts/{hostId}/processes

List processes on a host

Returns the individual process executions found on the host. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of processes.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/outbound-logons

List outbound logons on a host

Returns logon sessions where this host was the source. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of outbound logon sessions.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/os-config-settings

List operating system configuration settings on a host

Returns the operating system configuration settings collected from the host. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of configuration settings.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/network-shares

List network shares on a host

Returns the network shares found on the host. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of network shares.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/listening-ports

List listening ports on a host

Returns the ports the host was listening on. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of listening ports.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/items

List items on a host

Returns the items found on one host, across every artifact type. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of items.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/inbound-logons

List inbound logons on a host

Returns logon sessions where this host was the destination. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of inbound logon sessions.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/files

List files on a host

Returns the file system entries collected from the host, as a flat list rather than the folder tree the application shows. Directories are included alongside files; read fileMetaType to tell them apart. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of files.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/dns-cache

List DNS cache entries on a host

Returns the host names found in the host’s DNS cache. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of DNS cache entries.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/data-accessed

List data accessed on a host

Returns the documents and other data the host’s users opened. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of accessed data.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/connections

List network connections on a host

Returns the network connections found on the host. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of connections.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/attached-devices

List attached devices on a host

Returns each time a removable device was attached to the host. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of attached devices.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.

GET /api/incidents/{incidentId}/hosts/{hostId}/accounts

List user accounts on a host

Returns the user accounts found on the host. Unlike the application’s Accounts table, which hides service and OS-controlled accounts by default, this returns every account. Use score, offset and limit to filter and page. There is no total count, so keep paging until a page has fewer items than limit. Items use the canonical export JSON format, not the shape of the application’s item tables. Order within a page is not specified.

Parameters:

  • incidentId (string) – The incident id.

  • hostId (string) – The host id.

Query Parameters:

  • score (string) – Only return items with these scores. Repeat the parameter or supply a comma separated list; omit it to return items of every score. Accepted values: bad, suspicious, good, unknown.

  • offset (string) – Number of items to skip. Defaults to 0.

  • limit (string) – Maximum number of items to return, between 1 and 10000. Defaults to 1000.

Status Codes:

  • 200 OK – The page of user accounts.

  • 400 Bad Request – An unrecognized score, or an offset/limit outside the allowed range.

  • 403 Forbidden – The caller does not have permission to view this host. A host id that does not exist is also reported as 403 rather than 404, so host ids cannot be probed. Also returned when the server does not have an Enterprise license.

  • 404 Not Found – The host exists and is visible to the caller but belongs to a different incident than the one in the path.