Security Endpoint Management API

Download a file

Changed on

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}/download</span></div>

Refer to Spaces for more information.

Download a file associated with a response action. Files are downloaded in a password-protected .zip archive to prevent the file from running. Use password elastic to open the .zip in a safe environment.

info Files retrieved from third-party-protected hosts require a different password. Refer to Third-party response actions for your system's password.

get/api/endpoint/action/{action_id}/file/{file_id}/download

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/endpoint/action/{action_id}/file/{file_id}/download
  • Auth
    • API key in header Authorization
    • or HTTP basic

Path parameters

action_idstring required

The ID of the response action that generated the file.

file_idstring required

The file identifier is constructed in one of two ways:

  • For Elastic Defend agents (agentType of endpoint): combine the action_id and agent_id values using a dot (.) separator: {file_id} = {action_id}.{agent_id}
  • For all other agent types: the file_id is the agent_id for which the response action was sent to.

Response

Indicates a successful call.

Changes

  • 804740fca560Revision changes
    • breaking

      for the path request parameter action_id, the minLength was increased from 0 to 1

    • breaking

      for the path request parameter file_id, the minLength was increased from 0 to 1

    • warning

      for the path request parameter action_id, the maxLength was set to 256

    • warning

      for the path request parameter file_id, the maxLength was set to 256