Entry
APIs for managing entries to the War Room
API to create an entry (markdown format) in existing investigation Body example: {"investigationId":"1234","data":"entry content…"}
Entry
Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined
The contents of the entry that is actually indexed - should not be used
ContentsSize the total size of the contents
Who has created this event - relevant only for manual incidents
EndingType holds the type of schedule Ending
Source of the error
Filename of associated content
FileID is the file name when saved in the server
Holds information on how content is formatted
Internal field to make queries on role faster
store the entry based on IncidentCreationTime
The id of the investigation it belongs to
IsTodo
Only used for outbound mirroring to mark that it is already mirrored to remote system
Note
ParentEntry content - for reference
ParentEntryTruncated - indicates weather entry content was truncated
ParentId is the ID of the parent entry
Mark entry as pinned = evidence
PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook
Only used for polling entries
Do not change this field manually
ReadOnly
ReputationSize the total size of the reputation
When retry took place
The role assigned to this investigation
is it scheduled
The name of the system associated with this entry
Tags
TagsRaw
TaskID - used if the entry is assigned as note to a playbook task
EntryType specifies the type of the entry
The user who created the entry
In case of closed investigation
POST /entry HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 552
{
"args": {
"ANY_ADDITIONAL_PROPERTY": {
"complex": {
"accessor": "text",
"filters": [
[
"[Circular Reference]"
]
],
"root": "text",
"transformers": [
{
"args": "[Circular Reference]",
"operator": "text"
}
]
},
"keyValue": [
{
"key": "text",
"value": {
"complex": {
"accessor": "text",
"filters": [
[
"[Circular Reference]"
]
],
"root": "text",
"transformers": [
{
"args": "[Circular Reference]",
"operator": "text"
}
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
}
}
],
"simple": "text"
}
},
"data": "text",
"id": "text",
"investigationId": "text",
"markdown": true,
"primaryTerm": 1,
"sequenceNumber": 1,
"version": 1
}{
"IndicatorTimeline": [
{
"Category": "text",
"Message": "text",
"Source": "text",
"Time": "2026-01-01T00:00:00.000Z",
"User": "text",
"Value": [
"text"
]
}
],
"InstanceID": "text",
"Relationships": [
{
"brand": "text",
"entityA": "text",
"entityAFamily": "text",
"entityAType": "text",
"entityB": "text",
"entityBFamily": "text",
"entityBType": "text",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"id": "text",
"instance": "text",
"name": "text",
"reliability": "text",
"reverseName": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"type": "text"
}
],
"ShardID": 1,
"allRead": true,
"allReadWrite": true,
"apiExecutionMetrics": [
{
"apiCallsCount": 1,
"type": "text"
}
],
"brand": "text",
"cacheVersn": 1,
"category": "text",
"contents": {},
"contentsSize": 1,
"created": "2026-01-01T00:00:00.000Z",
"cron": "text",
"cronView": true,
"dbotCreatedBy": "text",
"deleted": true,
"deletedBy": "text",
"deletedFromFS": true,
"endingDate": "2026-01-01T00:00:00.000Z",
"endingType": "text",
"entryTask": {
"playbookName": "text",
"quiet": true,
"taskId": "text",
"taskName": "text",
"taskStatus": "text"
},
"errorSource": "text",
"file": "text",
"fileID": "text",
"fileMetadata": {
"info": "text",
"isMediaFile": true,
"md5": "text",
"sha1": "text",
"sha256": "text",
"sha512": "text",
"size": 1,
"ssdeep": "text",
"type": "text"
},
"format": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"history": [
{
"contentDate": "2026-01-01T00:00:00.000Z",
"contents": "text",
"contentsFormat": "text",
"user": "text"
}
],
"humanCron": {
"atTimeHour": "text",
"atTimeMinute": "text",
"days": [
"text"
],
"schedulingType": "text",
"timePeriod": 1,
"timePeriodType": "text"
},
"id": "text",
"incidentCreationTime": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"instance": "text",
"investigationId": "text",
"isTodo": true,
"mirrored": true,
"modified": "2026-01-01T00:00:00.000Z",
"note": true,
"numericId": 1,
"parentContent": {},
"parentEntryTruncated": true,
"parentId": "text",
"pinned": true,
"playbookId": "text",
"polling": true,
"pollingArgs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"pollingCommand": "text",
"pollingItemsRemaining": 1,
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"readOnly": true,
"recurrent": true,
"reputationSize": 1,
"reputations": [
{
"highlights": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": [
{
"array_positions": [
1
],
"end": 1,
"pos": 1,
"start": 1
}
]
}
},
"reputationsData": [
{
"rawTerm": "text",
"reputation": 1,
"reputationId": "text",
"term": "text"
}
]
}
],
"retryTime": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"scheduled": true,
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"syncHash": "text",
"system": "text",
"tags": [
"text"
],
"tagsRaw": [
"text"
],
"taskId": "text",
"times": 1,
"timesRan": 1,
"timezone": "text",
"timezoneOffset": 1,
"type": 1,
"user": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}Download file from Cortex XSOAR by entry ID
Entry ID
Return the entry
No content
GET /entry/download/{entryid} HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Accept: */*
Return the entry
No content
API to create an entry (markdown format) in existing investigation Body example: {"investigationId":"1234","data":"entry content…"}
An array of the children entries of the executed entry.
Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined
The contents of the entry that is actually indexed - should not be used
ContentsSize the total size of the contents
Who has created this event - relevant only for manual incidents
EndingType holds the type of schedule Ending
Source of the error
Filename of associated content
FileID is the file name when saved in the server
Holds information on how content is formatted
Internal field to make queries on role faster
store the entry based on IncidentCreationTime
The id of the investigation it belongs to
IsTodo
Only used for outbound mirroring to mark that it is already mirrored to remote system
Note
ParentEntry content - for reference
ParentEntryTruncated - indicates weather entry content was truncated
ParentId is the ID of the parent entry
Mark entry as pinned = evidence
PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook
Only used for polling entries
Do not change this field manually
ReadOnly
ReputationSize the total size of the reputation
When retry took place
The role assigned to this investigation
is it scheduled
The name of the system associated with this entry
Tags
TagsRaw
TaskID - used if the entry is assigned as note to a playbook task
EntryType specifies the type of the entry
The user who created the entry
In case of closed investigation
POST /entry/execute/sync HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 552
{
"args": {
"ANY_ADDITIONAL_PROPERTY": {
"complex": {
"accessor": "text",
"filters": [
[
"[Circular Reference]"
]
],
"root": "text",
"transformers": [
{
"args": "[Circular Reference]",
"operator": "text"
}
]
},
"keyValue": [
{
"key": "text",
"value": {
"complex": {
"accessor": "text",
"filters": [
[
"[Circular Reference]"
]
],
"root": "text",
"transformers": [
{
"args": "[Circular Reference]",
"operator": "text"
}
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
}
}
],
"simple": "text"
}
},
"data": "text",
"id": "text",
"investigationId": "text",
"markdown": true,
"primaryTerm": 1,
"sequenceNumber": 1,
"version": 1
}[
{
"IndicatorTimeline": [
{
"Category": "text",
"Message": "text",
"Source": "text",
"Time": "2026-01-01T00:00:00.000Z",
"User": "text",
"Value": [
"text"
]
}
],
"InstanceID": "text",
"Relationships": [
{
"brand": "text",
"entityA": "text",
"entityAFamily": "text",
"entityAType": "text",
"entityB": "text",
"entityBFamily": "text",
"entityBType": "text",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"id": "text",
"instance": "text",
"name": "text",
"reliability": "text",
"reverseName": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"type": "text"
}
],
"ShardID": 1,
"allRead": true,
"allReadWrite": true,
"apiExecutionMetrics": [
{
"apiCallsCount": 1,
"type": "text"
}
],
"brand": "text",
"cacheVersn": 1,
"category": "text",
"contents": {},
"contentsSize": 1,
"created": "2026-01-01T00:00:00.000Z",
"cron": "text",
"cronView": true,
"dbotCreatedBy": "text",
"deleted": true,
"deletedBy": "text",
"deletedFromFS": true,
"endingDate": "2026-01-01T00:00:00.000Z",
"endingType": "text",
"entryTask": {
"playbookName": "text",
"quiet": true,
"taskId": "text",
"taskName": "text",
"taskStatus": "text"
},
"errorSource": "text",
"file": "text",
"fileID": "text",
"fileMetadata": {
"info": "text",
"isMediaFile": true,
"md5": "text",
"sha1": "text",
"sha256": "text",
"sha512": "text",
"size": 1,
"ssdeep": "text",
"type": "text"
},
"format": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"history": [
{
"contentDate": "2026-01-01T00:00:00.000Z",
"contents": "text",
"contentsFormat": "text",
"user": "text"
}
],
"humanCron": {
"atTimeHour": "text",
"atTimeMinute": "text",
"days": [
"text"
],
"schedulingType": "text",
"timePeriod": 1,
"timePeriodType": "text"
},
"id": "text",
"incidentCreationTime": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"instance": "text",
"investigationId": "text",
"isTodo": true,
"mirrored": true,
"modified": "2026-01-01T00:00:00.000Z",
"note": true,
"numericId": 1,
"parentContent": {},
"parentEntryTruncated": true,
"parentId": "text",
"pinned": true,
"playbookId": "text",
"polling": true,
"pollingArgs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"pollingCommand": "text",
"pollingItemsRemaining": 1,
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"readOnly": true,
"recurrent": true,
"reputationSize": 1,
"reputations": [
{
"highlights": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": [
{
"array_positions": [
1
],
"end": 1,
"pos": 1,
"start": 1
}
]
}
},
"reputationsData": [
{
"rawTerm": "text",
"reputation": 1,
"reputationId": "text",
"term": "text"
}
]
}
],
"retryTime": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"scheduled": true,
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"syncHash": "text",
"system": "text",
"tags": [
"text"
],
"tagsRaw": [
"text"
],
"taskId": "text",
"times": 1,
"timesRan": 1,
"timezone": "text",
"timezoneOffset": 1,
"type": 1,
"user": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}
]Export an entry artifact
created file name
No content
POST /entry/exportArtifact HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 38
{
"id": "text",
"investigationId": "text"
}created file name
No content
API to create a formatted entry (table/json/text/markdown/html) in existing investigation Body example: {"investigationId":"1234","format":"table/json/text/markdown/html","contents":"entry content…"}
Entry
Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined
The contents of the entry that is actually indexed - should not be used
ContentsSize the total size of the contents
Who has created this event - relevant only for manual incidents
EndingType holds the type of schedule Ending
Source of the error
Filename of associated content
FileID is the file name when saved in the server
Holds information on how content is formatted
Internal field to make queries on role faster
store the entry based on IncidentCreationTime
The id of the investigation it belongs to
IsTodo
Only used for outbound mirroring to mark that it is already mirrored to remote system
Note
ParentEntry content - for reference
ParentEntryTruncated - indicates weather entry content was truncated
ParentId is the ID of the parent entry
Mark entry as pinned = evidence
PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook
Only used for polling entries
Do not change this field manually
ReadOnly
ReputationSize the total size of the reputation
When retry took place
The role assigned to this investigation
is it scheduled
The name of the system associated with this entry
Tags
TagsRaw
TaskID - used if the entry is assigned as note to a playbook task
EntryType specifies the type of the entry
The user who created the entry
POST /entry/formatted HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 60
{
"contents": "text",
"format": "text",
"investigationId": "text"
}Entry
{
"IndicatorTimeline": [
{
"Category": "text",
"Message": "text",
"Source": "text",
"Time": "2026-01-01T00:00:00.000Z",
"User": "text",
"Value": [
"text"
]
}
],
"InstanceID": "text",
"Relationships": [
{
"brand": "text",
"entityA": "text",
"entityAFamily": "text",
"entityAType": "text",
"entityB": "text",
"entityBFamily": "text",
"entityBType": "text",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"id": "text",
"instance": "text",
"name": "text",
"reliability": "text",
"reverseName": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"type": "text"
}
],
"ShardID": 1,
"allRead": true,
"allReadWrite": true,
"apiExecutionMetrics": [
{
"apiCallsCount": 1,
"type": "text"
}
],
"brand": "text",
"cacheVersn": 1,
"category": "text",
"contents": {},
"contentsSize": 1,
"created": "2026-01-01T00:00:00.000Z",
"cron": "text",
"cronView": true,
"dbotCreatedBy": "text",
"deleted": true,
"deletedBy": "text",
"deletedFromFS": true,
"endingDate": "2026-01-01T00:00:00.000Z",
"endingType": "text",
"entryTask": {
"playbookName": "text",
"quiet": true,
"taskId": "text",
"taskName": "text",
"taskStatus": "text"
},
"errorSource": "text",
"file": "text",
"fileID": "text",
"fileMetadata": {
"info": "text",
"isMediaFile": true,
"md5": "text",
"sha1": "text",
"sha256": "text",
"sha512": "text",
"size": 1,
"ssdeep": "text",
"type": "text"
},
"format": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"history": [
{
"contentDate": "2026-01-01T00:00:00.000Z",
"contents": "text",
"contentsFormat": "text",
"user": "text"
}
],
"humanCron": {
"atTimeHour": "text",
"atTimeMinute": "text",
"days": [
"text"
],
"schedulingType": "text",
"timePeriod": 1,
"timePeriodType": "text"
},
"id": "text",
"incidentCreationTime": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"instance": "text",
"investigationId": "text",
"isTodo": true,
"mirrored": true,
"modified": "2026-01-01T00:00:00.000Z",
"note": true,
"numericId": 1,
"parentContent": {},
"parentEntryTruncated": true,
"parentId": "text",
"pinned": true,
"playbookId": "text",
"polling": true,
"pollingArgs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"pollingCommand": "text",
"pollingItemsRemaining": 1,
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"readOnly": true,
"recurrent": true,
"reputationSize": 1,
"reputations": [
{
"highlights": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": [
{
"array_positions": [
1
],
"end": 1,
"pos": 1,
"start": 1
}
]
}
},
"reputationsData": [
{
"rawTerm": "text",
"reputation": 1,
"reputationId": "text",
"term": "text"
}
]
}
],
"retryTime": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"scheduled": true,
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"syncHash": "text",
"system": "text",
"tags": [
"text"
],
"tagsRaw": [
"text"
],
"taskId": "text",
"times": 1,
"timesRan": 1,
"timezone": "text",
"timezoneOffset": 1,
"type": 1,
"user": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}API to mark entry as note, can be used also to remove the note Body example: {"id":1@1234","version":"-1","investigationId":"1234","data":"true/false"}
Entry
Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined
The contents of the entry that is actually indexed - should not be used
ContentsSize the total size of the contents
Who has created this event - relevant only for manual incidents
EndingType holds the type of schedule Ending
Source of the error
Filename of associated content
FileID is the file name when saved in the server
Holds information on how content is formatted
Internal field to make queries on role faster
store the entry based on IncidentCreationTime
The id of the investigation it belongs to
IsTodo
Only used for outbound mirroring to mark that it is already mirrored to remote system
Note
ParentEntry content - for reference
ParentEntryTruncated - indicates weather entry content was truncated
ParentId is the ID of the parent entry
Mark entry as pinned = evidence
PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook
Only used for polling entries
Do not change this field manually
ReadOnly
ReputationSize the total size of the reputation
When retry took place
The role assigned to this investigation
is it scheduled
The name of the system associated with this entry
Tags
TagsRaw
TaskID - used if the entry is assigned as note to a playbook task
EntryType specifies the type of the entry
The user who created the entry
POST /entry/note HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 552
{
"args": {
"ANY_ADDITIONAL_PROPERTY": {
"complex": {
"accessor": "text",
"filters": [
[
"[Circular Reference]"
]
],
"root": "text",
"transformers": [
{
"args": "[Circular Reference]",
"operator": "text"
}
]
},
"keyValue": [
{
"key": "text",
"value": {
"complex": {
"accessor": "text",
"filters": [
[
"[Circular Reference]"
]
],
"root": "text",
"transformers": [
{
"args": "[Circular Reference]",
"operator": "text"
}
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
}
}
],
"simple": "text"
}
},
"data": "text",
"id": "text",
"investigationId": "text",
"markdown": true,
"primaryTerm": 1,
"sequenceNumber": 1,
"version": 1
}Entry
{
"IndicatorTimeline": [
{
"Category": "text",
"Message": "text",
"Source": "text",
"Time": "2026-01-01T00:00:00.000Z",
"User": "text",
"Value": [
"text"
]
}
],
"InstanceID": "text",
"Relationships": [
{
"brand": "text",
"entityA": "text",
"entityAFamily": "text",
"entityAType": "text",
"entityB": "text",
"entityBFamily": "text",
"entityBType": "text",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"id": "text",
"instance": "text",
"name": "text",
"reliability": "text",
"reverseName": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"type": "text"
}
],
"ShardID": 1,
"allRead": true,
"allReadWrite": true,
"apiExecutionMetrics": [
{
"apiCallsCount": 1,
"type": "text"
}
],
"brand": "text",
"cacheVersn": 1,
"category": "text",
"contents": {},
"contentsSize": 1,
"created": "2026-01-01T00:00:00.000Z",
"cron": "text",
"cronView": true,
"dbotCreatedBy": "text",
"deleted": true,
"deletedBy": "text",
"deletedFromFS": true,
"endingDate": "2026-01-01T00:00:00.000Z",
"endingType": "text",
"entryTask": {
"playbookName": "text",
"quiet": true,
"taskId": "text",
"taskName": "text",
"taskStatus": "text"
},
"errorSource": "text",
"file": "text",
"fileID": "text",
"fileMetadata": {
"info": "text",
"isMediaFile": true,
"md5": "text",
"sha1": "text",
"sha256": "text",
"sha512": "text",
"size": 1,
"ssdeep": "text",
"type": "text"
},
"format": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"history": [
{
"contentDate": "2026-01-01T00:00:00.000Z",
"contents": "text",
"contentsFormat": "text",
"user": "text"
}
],
"humanCron": {
"atTimeHour": "text",
"atTimeMinute": "text",
"days": [
"text"
],
"schedulingType": "text",
"timePeriod": 1,
"timePeriodType": "text"
},
"id": "text",
"incidentCreationTime": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"instance": "text",
"investigationId": "text",
"isTodo": true,
"mirrored": true,
"modified": "2026-01-01T00:00:00.000Z",
"note": true,
"numericId": 1,
"parentContent": {},
"parentEntryTruncated": true,
"parentId": "text",
"pinned": true,
"playbookId": "text",
"polling": true,
"pollingArgs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"pollingCommand": "text",
"pollingItemsRemaining": 1,
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"readOnly": true,
"recurrent": true,
"reputationSize": 1,
"reputations": [
{
"highlights": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": [
{
"array_positions": [
1
],
"end": 1,
"pos": 1,
"start": 1
}
]
}
},
"reputationsData": [
{
"rawTerm": "text",
"reputation": 1,
"reputationId": "text",
"term": "text"
}
]
}
],
"retryTime": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"scheduled": true,
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"syncHash": "text",
"system": "text",
"tags": [
"text"
],
"tagsRaw": [
"text"
],
"taskId": "text",
"times": 1,
"timesRan": 1,
"timezone": "text",
"timezoneOffset": 1,
"type": 1,
"user": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}API to set entry tags Body example: {"id":"1@1234","version":"-1","investigationId":"1234","tags":["tag1","tag2"]"}
Entry
Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined
The contents of the entry that is actually indexed - should not be used
ContentsSize the total size of the contents
Who has created this event - relevant only for manual incidents
EndingType holds the type of schedule Ending
Source of the error
Filename of associated content
FileID is the file name when saved in the server
Holds information on how content is formatted
Internal field to make queries on role faster
store the entry based on IncidentCreationTime
The id of the investigation it belongs to
IsTodo
Only used for outbound mirroring to mark that it is already mirrored to remote system
Note
ParentEntry content - for reference
ParentEntryTruncated - indicates weather entry content was truncated
ParentId is the ID of the parent entry
Mark entry as pinned = evidence
PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook
Only used for polling entries
Do not change this field manually
ReadOnly
ReputationSize the total size of the reputation
When retry took place
The role assigned to this investigation
is it scheduled
The name of the system associated with this entry
Tags
TagsRaw
TaskID - used if the entry is assigned as note to a playbook task
EntryType specifies the type of the entry
The user who created the entry
POST /entry/tags HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 101
{
"id": "text",
"investigationId": "text",
"primaryTerm": 1,
"sequenceNumber": 1,
"tags": [
"text"
],
"version": 1
}Entry
{
"IndicatorTimeline": [
{
"Category": "text",
"Message": "text",
"Source": "text",
"Time": "2026-01-01T00:00:00.000Z",
"User": "text",
"Value": [
"text"
]
}
],
"InstanceID": "text",
"Relationships": [
{
"brand": "text",
"entityA": "text",
"entityAFamily": "text",
"entityAType": "text",
"entityB": "text",
"entityBFamily": "text",
"entityBType": "text",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"id": "text",
"instance": "text",
"name": "text",
"reliability": "text",
"reverseName": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"type": "text"
}
],
"ShardID": 1,
"allRead": true,
"allReadWrite": true,
"apiExecutionMetrics": [
{
"apiCallsCount": 1,
"type": "text"
}
],
"brand": "text",
"cacheVersn": 1,
"category": "text",
"contents": {},
"contentsSize": 1,
"created": "2026-01-01T00:00:00.000Z",
"cron": "text",
"cronView": true,
"dbotCreatedBy": "text",
"deleted": true,
"deletedBy": "text",
"deletedFromFS": true,
"endingDate": "2026-01-01T00:00:00.000Z",
"endingType": "text",
"entryTask": {
"playbookName": "text",
"quiet": true,
"taskId": "text",
"taskName": "text",
"taskStatus": "text"
},
"errorSource": "text",
"file": "text",
"fileID": "text",
"fileMetadata": {
"info": "text",
"isMediaFile": true,
"md5": "text",
"sha1": "text",
"sha256": "text",
"sha512": "text",
"size": 1,
"ssdeep": "text",
"type": "text"
},
"format": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"history": [
{
"contentDate": "2026-01-01T00:00:00.000Z",
"contents": "text",
"contentsFormat": "text",
"user": "text"
}
],
"humanCron": {
"atTimeHour": "text",
"atTimeMinute": "text",
"days": [
"text"
],
"schedulingType": "text",
"timePeriod": 1,
"timePeriodType": "text"
},
"id": "text",
"incidentCreationTime": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"instance": "text",
"investigationId": "text",
"isTodo": true,
"mirrored": true,
"modified": "2026-01-01T00:00:00.000Z",
"note": true,
"numericId": 1,
"parentContent": {},
"parentEntryTruncated": true,
"parentId": "text",
"pinned": true,
"playbookId": "text",
"polling": true,
"pollingArgs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"pollingCommand": "text",
"pollingItemsRemaining": 1,
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"readOnly": true,
"recurrent": true,
"reputationSize": 1,
"reputations": [
{
"highlights": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": [
{
"array_positions": [
1
],
"end": 1,
"pos": 1,
"start": 1
}
]
}
},
"reputationsData": [
{
"rawTerm": "text",
"reputation": 1,
"reputationId": "text",
"term": "text"
}
]
}
],
"retryTime": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"scheduled": true,
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"syncHash": "text",
"system": "text",
"tags": [
"text"
],
"tagsRaw": [
"text"
],
"taskId": "text",
"times": 1,
"timesRan": 1,
"timezone": "text",
"timezoneOffset": 1,
"type": 1,
"user": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}Last updated
Was this helpful?