Forensics
Public API endpoints for browsing forensic investigations, their hunt and triage collections, and the artifact data collected for them.
Returns all forensic investigations visible to the caller's scope.
Required licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on. RBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.
Empty object. No request parameters are accepted.
List of investigations.
Invalid or missing parameters. Returned for example when a required id is missing or not a valid UUID v4, artifact_type is missing, pagination is out of range or the wrong type-specific id (search_id vs agent_id) is sent for the collection type.
Unauthorized access.
The caller does not have access to the requested investigation (out-of-scope).
Internal server error.
POST /public_api/v1/forensics/investigations HTTP/1.1
Host: api-{{fqdn}}
Content-Type: application/json
Accept: */*
Content-Length: 19
{
"request_data": {}
}{
"reply": {
"data": [
{
"id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f",
"created_at": "2025-04-10T14:21:05Z",
"updated_at": "2025-04-12T08:03:42Z",
"created_by": "alice.smith@example.com",
"updated_by": "alice.smith@example.com",
"name": "Suspicious lateral movement - HR subnet",
"description": "Investigation following SOC alert ALR-9821.",
"status": "open",
"expires_at": "2025-07-10T14:21:05Z",
"total_collections": 4,
"completed_collections": 3
}
],
"total_count": 1
}
}Returns all hunt (scheduled/on-demand artifact searches across multiple endpoints) and triage (targeted artifact collections from specific endpoints) collections that belong to a specific investigation, grouped by type.
Required licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on. RBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.
Collections grouped by type.
Invalid or missing parameters. Returned for example when a required id is missing or not a valid UUID v4, artifact_type is missing, pagination is out of range or the wrong type-specific id (search_id vs agent_id) is sent for the collection type.
Unauthorized access.
The caller does not have access to the requested investigation (out-of-scope).
The referenced entity does not exist, or the relationship is invalid (collection not in investigation, agent not in triage, search not in collection).
Internal server error.
POST /public_api/v1/forensics/investigations/collections HTTP/1.1
Host: api-{{fqdn}}
Content-Type: application/json
Accept: */*
Content-Length: 76
{
"request_data": {
"investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f"
}
}{
"reply": {
"data": {
"hunts": [
{
"id": "8a1b2c3d-1111-4d2a-9c1a-aaaabbbbcccc",
"type": "hunt",
"investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f",
"name": "Persistence hunt - all Windows endpoints",
"os": "WINDOWS",
"last_received_at": 1744459200000,
"status": "COMPLETED",
"total_searches": 2,
"searches": [
"11111111-1111-4111-8111-111111111111",
"22222222-2222-4222-8222-222222222222"
]
}
],
"triages": [
{
"id": "9b1b2c3d-2222-4d2a-9c1a-aaaabbbbcccc",
"type": "triage",
"investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f",
"name": "Targeted triage - HR endpoints",
"os": "WINDOWS",
"last_received_at": 1744462800000,
"status": "IN_PROGRESS",
"total_agents": 3,
"agents": [
"aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
"aaaaaaa2-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
"aaaaaaa3-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
]
}
]
},
"total_count": 2
}
}Returns the summary results (one entry per artifact category, such as PERSISTENCE or EXECUTION, produced by the search) of a specific hunt search inside a hunt collection.
Required licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on. RBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.
Hunt result rows.
Invalid or missing parameters. Returned for example when a required id is missing or not a valid UUID v4, artifact_type is missing, pagination is out of range or the wrong type-specific id (search_id vs agent_id) is sent for the collection type.
Unauthorized access.
The caller does not have access to the requested investigation (out-of-scope).
The referenced entity does not exist, or the relationship is invalid (collection not in investigation, agent not in triage, search not in collection).
Internal server error.
POST /public_api/v1/forensics/investigations/collections/hunt HTTP/1.1
Host: api-{{fqdn}}
Content-Type: application/json
Accept: */*
Content-Length: 182
{
"request_data": {
"investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f",
"collection_id": "8a1b2c3d-1111-4d2a-9c1a-aaaabbbbcccc",
"search_id": "11111111-1111-4111-8111-111111111111"
}
}{
"reply": {
"data": [
{
"id": "d1e2f3a4-3333-4d2a-9c1a-aaaabbbbcccc",
"created_at": "2025-04-12T07:55:01Z",
"category": "PERSISTENCE",
"artifact_type": "REGISTRY",
"filters": {
"key_path": "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
},
"status": "COMPLETED",
"total_results": 42
}
],
"total_count": 1
}
}Returns the artifact summaries collected from a specific endpoint agent inside a triage collection, separated into structured data artifacts (e.g., AMCACHE, REGISTRY) and collected-file artifacts (e.g., MFT, EVTX).
Required licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on. RBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.
Triage artifact summaries grouped by type.
Invalid or missing parameters. Returned for example when a required id is missing or not a valid UUID v4, artifact_type is missing, pagination is out of range or the wrong type-specific id (search_id vs agent_id) is sent for the collection type.
Unauthorized access.
The caller does not have access to the requested investigation (out-of-scope).
The referenced entity does not exist, or the relationship is invalid (collection not in investigation, agent not in triage, search not in collection).
Internal server error.
POST /public_api/v1/forensics/investigations/collections/triage HTTP/1.1
Host: api-{{fqdn}}
Content-Type: application/json
Accept: */*
Content-Length: 181
{
"request_data": {
"investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f",
"collection_id": "9b1b2c3d-2222-4d2a-9c1a-aaaabbbbcccc",
"agent_id": "aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
}
}{
"reply": {
"data": {
"data": [
{
"id": "c0ffee01-3333-4d2a-9c1a-aaaabbbbcccc",
"created_at": 1744462800000,
"artifact_type": "AMCACHE",
"status": "COMPLETED",
"total_results": 318
}
],
"files": [
{
"id": "c0ffee02-3333-4d2a-9c1a-aaaabbbbcccc",
"created_at": 1744462801000,
"artifact_type": "MFT",
"status": "COMPLETED",
"successful_file_paths": [
"C:\\$MFT"
],
"failed_file_paths": [],
"total_files": 1,
"total_results": 1
}
]
},
"total_count": 2
}
}Returns the actual collected artifact rows (records) for a hunt search or a triage agent.
Exactly one of search_id or agent_id must be provided, matching the type of collection_id:
For a hunt collection, send
search_id.For a triage collection, send
agent_id.
Sending the wrong identifier for the collection type returns 400 Bad Request.
The per-row schema depends on the requested artifact_type (e.g., registry keys, process execution logs) and is not enumerated in this document.
Required licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on. RBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.
Artifact rows. The shape of each item depends on artifact_type.
Invalid or missing parameters. Returned for example when a required id is missing or not a valid UUID v4, artifact_type is missing, pagination is out of range or the wrong type-specific id (search_id vs agent_id) is sent for the collection type.
Unauthorized access.
The caller does not have access to the requested investigation (out-of-scope).
The referenced entity does not exist, or the relationship is invalid (collection not in investigation, agent not in triage, search not in collection).
Internal server error.
POST /public_api/v1/forensics/investigations/collections/get_data HTTP/1.1
Host: api-{{fqdn}}
Content-Type: application/json
Accept: */*
Content-Length: 239
{
"request_data": {
"investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f",
"collection_id": "9b1b2c3d-2222-4d2a-9c1a-aaaabbbbcccc",
"agent_id": "aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
"artifact_type": "AMCACHE",
"search_from": 0,
"search_to": 100
}
}{
"reply": {
"data": [
{
"file_path": "C:\\Windows\\System32\\notepad.exe",
"sha256": "5d8e6cf7e2d6e2f3b3a5e1d6c0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9",
"last_modified": 1744451200000
}
],
"total_count": 318
}
}Returns the chronological host-timeline events (such as process creation, file modifications, and network connections) collected from a specific endpoint agent inside a triage collection. Supports pagination.
Required licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on. RBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.
Host-timeline rows.
Invalid or missing parameters. Returned for example when a required id is missing or not a valid UUID v4, artifact_type is missing, pagination is out of range or the wrong type-specific id (search_id vs agent_id) is sent for the collection type.
Unauthorized access.
The caller does not have access to the requested investigation (out-of-scope).
The referenced entity does not exist, or the relationship is invalid (collection not in investigation, agent not in triage, search not in collection).
Internal server error.
POST /public_api/v1/forensics/investigations/collections/triage/host_timeline HTTP/1.1
Host: api-{{fqdn}}
Content-Type: application/json
Accept: */*
Content-Length: 213
{
"request_data": {
"investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f",
"collection_id": "9b1b2c3d-2222-4d2a-9c1a-aaaabbbbcccc",
"agent_id": "aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
"search_from": 0,
"search_to": 500
}
}{
"reply": {
"data": [
{
"uuid": "f1f1f1f1-4444-4d2a-9c1a-aaaabbbbcccc",
"agent_id": "aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
"timeline_id": "tl-001",
"host_name": "HR-LAPTOP-07",
"generated_time": 1744462900000,
"timestamp": 1744462899000,
"timestamp_partition": 20250412,
"description": "Process created",
"type": "PROCESS",
"user": "DOMAIN\\\\hr.user",
"data": {
"process_name": "powershell.exe",
"command_line": "powershell -enc ..."
},
"tags": [
"suspicious"
],
"source_row_uuid": "abcdef01-4444-4d2a-9c1a-aaaabbbbcccc",
"os": "WINDOWS"
}
],
"total_count": 1
}
}Returns the individual files collected for a given file-producing artifact type (such as raw event logs or system files) from a specific endpoint agent inside a triage collection. Each item references a single collected file path; download_url is populated with a secure, time-limited signed URL only when the file is available for download.
Required licenses: Cortex Cloud Runtime Security with endpoints and the Forensics add-on. RBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.
Collected files for the requested artifact.
Invalid or missing parameters. Returned for example when a required id is missing or not a valid UUID v4, artifact_type is missing, pagination is out of range or the wrong type-specific id (search_id vs agent_id) is sent for the collection type.
Unauthorized access.
The caller does not have access to the requested investigation (out-of-scope).
The referenced entity does not exist, or the relationship is invalid (collection not in investigation, agent not in triage, search not in collection).
Internal server error.
POST /public_api/v1/forensics/investigations/collections/triage/get_files HTTP/1.1
Host: api-{{fqdn}}
Content-Type: application/json
Accept: */*
Content-Length: 203
{
"request_data": {
"investigation_id": "5f2c0a9e-9c1a-4b3a-8c0a-1a2b3c4d5e6f",
"collection_id": "9b1b2c3d-2222-4d2a-9c1a-aaaabbbbcccc",
"agent_id": "aaaaaaa1-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
"artifact_type": "MFT"
}
}{
"reply": {
"data": [
{
"id": "c0ffee02-3333-4d2a-9c1a-aaaabbbbcccc",
"file_path": "C:\\$MFT",
"time_collected": 1744462801000,
"available_for_download": true,
"download_url": "https://storage.example.com/forensics/abc?sig=..."
}
],
"total_count": 1
}
}Last updated
Was this helpful?