Download all the artifacts (email.txt, alert.json, malware*, pcap* )of a riskware alert in zip format by passing alert id in the request URI. The alert ID can be found in the response body of Riskware summary API.
POST https://<etp_instance_addr>/api/v1/alerts/<alert_id>/downloadzip
Required headers:
Content-Type: "application/json"—Content type of the request body.
If the domain you use you use to access the Trellix UI ends in fireeye.com:
x-fireeye-api-key: <key>—Specifies your personal API key.
If the domain you use to access the Trellix UI ends in trellix.com:
authorization: bearer <access_token>—Specifies your personal access token.
Important
Use
authorization: bearer <access_token>in place ofx-fireeye-api-key: <key>in the following examples.
Example request
https://<APIURI>/alerts/3yPzj5K-123458258-0f8cfc44-9996-44c8-87b7-2dc55cdd9338/downloadzip --output case_file.zip -H 'x-fireeye-api-key: <APIKEY>' -H "Content-Type: application/json" -d '{}'
Example response
Zip File (Binary) case_file.zip