Triage Commands

• getTriagePresets
• triageEndpoints

getTriagePresets

---

Gets a list of available triage presets (collector configurations) for endpoint forensics. Use a preset's collector UUID with triageEndpoints to start a triage.

Arguments

There are no input arguments for this command.

Outputs

Core.EndpointTriagePreset.uuid string

The unique identifier of the triage preset.

Core.EndpointTriagePreset.name string

The name of the triage preset.

Core.EndpointTriagePreset.os string

The operating system the triage preset applies to.

Core.EndpointTriagePreset.description string

A description of the triage preset.

Core.EndpointTriagePreset.created_by string

The user who created the triage preset.

Core.EndpointTriagePreset.type string

The type of the triage preset.

triageEndpoints

---

Initiates a forensics triage on the specified endpoints. Note the following requirements: up to 10 triage actions may run concurrently; all specified agents must have the Forensics License enabled; all specified agents must run the same OS (either Windows or macOS, not a mix); and the specified triage configuration must be of type Online (Online = True).

Arguments

Argument Name	Description	Required
endpoint_ids	A comma-separated list of endpoint IDs to initiate triage on. Use the getEndpoints command to get the available endpoint IDs.	Required
collector_uuid	The collector UUID (preset) to use for the triage. Use the getTriagePresets command to get the available collector UUIDs.	Optional

Outputs

Core.EndpointTriage.TRIAGE_ID string

The unique identifier assigned to the created triage action.

Core.EndpointTriage.SUCCESSFUL_ENDPOINT_IDS string

A list of endpoint IDs where the triage action was successfully initiated.

Core.EndpointTriage.UNSUCCESSFUL_ENDPOINT_IDS string

A list of endpoint IDs where the triage action failed to initiate.