Evidence
APIs for managing evidence entities
Save an evidence entity To update evidence custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip
Authorizations
AuthorizationstringRequired
Body
ShardIDinteger · int64Optional
allReadbooleanOptional
allReadWritebooleanOptional
cacheVersninteger · int64Optional
createdstring · date-timeOptional
dbotCreatedBystringOptional
Who has created this event - relevant only for manual incidents
descriptionstringOptional
The description for the resolve
entryIdstringOptional
The entry ID
fetchedstring · date-timeOptional
when the evidence entry was fetched
hasRolebooleanOptional
Internal field to make queries on role faster
idstringOptional
incidentIdstringOptional
The incident ID
indexNamestringOptional
markedBystringOptional
the user that marked this evidence
markedDatestring · date-timeOptional
when this evidence was marked
modifiedstring · date-timeOptional
numericIdinteger · int64Optional
occurredstring · date-timeOptional
When this evidence has occurred
previousAllReadbooleanOptional
previousAllReadWritebooleanOptional
previousRolesstring[]Optional
Do not change this field manually
primaryTerminteger · int64Optional
rolesstring[]Optional
The role assigned to this investigation
sequenceNumberinteger · int64Optional
sizeInBytesinteger · int64Optional
sortValuesstring[]Optional
syncHashstringOptional
tagsstring[]Optional
Tags
tagsRawstring[]Optional
TagsRaw
taskIdstringOptional
when the evidence entry was fetched
versioninteger · int64Optional
xsoarHasReadOnlyRolebooleanOptional
xsoarPreviousReadOnlyRolesstring[]Optional
xsoarReadOnlyRolesstring[]Optional
Responses
200
The new / updated Evidence
application/json
ShardIDinteger · int64Optional
allReadbooleanOptional
allReadWritebooleanOptional
cacheVersninteger · int64Optional
createdstring · date-timeOptional
dbotCreatedBystringOptional
Who has created this event - relevant only for manual incidents
descriptionstringOptional
The description for the resolve
entryIdstringOptional
The entry ID
fetchedstring · date-timeOptional
when the evidence entry was fetched
hasRolebooleanOptional
Internal field to make queries on role faster
idstringOptional
incidentIdstringOptional
The incident ID
indexNamestringOptional
markedBystringOptional
the user that marked this evidence
markedDatestring · date-timeOptional
when this evidence was marked
modifiedstring · date-timeOptional
numericIdinteger · int64Optional
occurredstring · date-timeOptional
When this evidence has occurred
previousAllReadbooleanOptional
previousAllReadWritebooleanOptional
previousRolesstring[]Optional
Do not change this field manually
primaryTerminteger · int64Optional
rolesstring[]Optional
The role assigned to this investigation
sequenceNumberinteger · int64Optional
sizeInBytesinteger · int64Optional
sortValuesstring[]Optional
syncHashstringOptional
tagsstring[]Optional
Tags
tagsRawstring[]Optional
TagsRaw
taskIdstringOptional
when the evidence entry was fetched
versioninteger · int64Optional
xsoarHasReadOnlyRolebooleanOptional
xsoarPreviousReadOnlyRolesstring[]Optional
xsoarReadOnlyRolesstring[]Optional
post/evidence
POST /evidence HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 804
{
"ShardID": 1,
"allRead": true,
"allReadWrite": true,
"cacheVersn": 1,
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"description": "text",
"entryId": "text",
"fetched": "2026-01-01T00:00:00.000Z",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentId": "text",
"indexName": "text",
"markedBy": "text",
"markedDate": "2026-01-01T00:00:00.000Z",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"occurred": "2026-01-01T00:00:00.000Z",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"roles": [
"text"
],
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"tags": [
"text"
],
"tagsRaw": [
"text"
],
"taskId": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}200
The new / updated Evidence
{
"ShardID": 1,
"allRead": true,
"allReadWrite": true,
"cacheVersn": 1,
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"description": "text",
"entryId": "text",
"fetched": "2026-01-01T00:00:00.000Z",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentId": "text",
"indexName": "text",
"markedBy": "text",
"markedDate": "2026-01-01T00:00:00.000Z",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"occurred": "2026-01-01T00:00:00.000Z",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"roles": [
"text"
],
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"tags": [
"text"
],
"tagsRaw": [
"text"
],
"taskId": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}Delete an evidence entity
Authorizations
AuthorizationstringRequired
Body
evidenceIDstringOptional
Responses
200
Deleted evidence ID
No content
post/evidence/delete
POST /evidence/delete HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 21
{
"evidenceID": "text"
}200
Deleted evidence ID
No content
Search for an evidence entutiy by filter
Authorizations
AuthorizationstringRequired
Body
incidentIDstringOptional
Responses
200
EvidencesSearchResponse
application/json
EvidencesSearchResponse returns the response from the evidences search
totalinteger · int64Optional
post/evidence/search
POST /evidence/search HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 741
{
"filter": {
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"accounts": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"fields": [
"text"
],
"filterobjectquery": "text",
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"ignoreWorkers": true,
"page": 1,
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z",
"trim_events": 1
},
"incidentID": "text"
}200
EvidencesSearchResponse
{
"evidences": [
{
"ShardID": 1,
"allRead": true,
"allReadWrite": true,
"cacheVersn": 1,
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"description": "text",
"entryId": "text",
"fetched": "2026-01-01T00:00:00.000Z",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentId": "text",
"indexName": "text",
"markedBy": "text",
"markedDate": "2026-01-01T00:00:00.000Z",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"occurred": "2026-01-01T00:00:00.000Z",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"roles": [
"text"
],
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"tags": [
"text"
],
"tagsRaw": [
"text"
],
"taskId": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}
],
"total": 1
}Last updated
Was this helpful?