Evidence

APIs for managing evidence entities

Delete evidence

post

Delete an evidence entity.

Header parameters

authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr

x-xdr-auth-idstringRequired

api_key_id

Example: 2841

Body

evidenceIDstringOptional

ID of the evidence you want to delete.

Responses

200

OK

No content

post/xsoar/public/v1/evidence/delete

POST /xsoar/public/v1/evidence/delete HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 21

{
  "evidenceID": "text"
}

200

OK

No content

Search evidence

post

Search for an evidence entity by filter.

Header parameters

authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr

x-xdr-auth-idstringRequired

api_key_id

Example: 2841

Body

incidentIDstringOptional

Responses

200

OK

application/json

EvidencesSearchResponse returns the response from the evidences search

totalinteger · int64Optional

post/xsoar/public/v1/evidence/search

POST /xsoar/public/v1/evidence/search HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 741

{
  "filter": {
    "Cache": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "accounts": {
      "ANY_ADDITIONAL_PROPERTY": {}
    },
    "fields": [
      "text"
    ],
    "filterobjectquery": "text",
    "fromDate": "2026-01-01T00:00:00.000Z",
    "fromDateLicense": "2026-01-01T00:00:00.000Z",
    "ignoreWorkers": true,
    "page": 1,
    "period": {
      "by": "text",
      "byFrom": "text",
      "byTo": "text",
      "field": "text",
      "fromValue": "text",
      "toValue": "text"
    },
    "query": "text",
    "searchAfter": [
      "text"
    ],
    "searchAfterElastic": [
      "text"
    ],
    "searchAfterMap": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "searchAfterMapOrder": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "searchBefore": [
      "text"
    ],
    "searchBeforeElastic": [
      "text"
    ],
    "size": 1,
    "sort": [
      {
        "asc": true,
        "field": "text",
        "fieldType": "text"
      }
    ],
    "timeFrame": 1,
    "toDate": "2026-01-01T00:00:00.000Z",
    "trim_events": 1
  },
  "incidentID": "text"
}

200

OK

{
  "evidences": [
    {
      "ShardID": 1,
      "allRead": true,
      "allReadWrite": true,
      "cacheVersn": 1,
      "created": "2026-01-01T00:00:00.000Z",
      "dbotCreatedBy": "text",
      "description": "text",
      "entryId": "text",
      "fetched": "2026-01-01T00:00:00.000Z",
      "hasRole": true,
      "highlight": {
        "ANY_ADDITIONAL_PROPERTY": [
          "text"
        ]
      },
      "id": "text",
      "incidentId": "text",
      "indexName": "text",
      "markedBy": "text",
      "markedDate": "2026-01-01T00:00:00.000Z",
      "modified": "2026-01-01T00:00:00.000Z",
      "numericId": 1,
      "occurred": "2026-01-01T00:00:00.000Z",
      "previousAllRead": true,
      "previousAllReadWrite": true,
      "previousRoles": [
        "text"
      ],
      "primaryTerm": 1,
      "roles": [
        "text"
      ],
      "sequenceNumber": 1,
      "sizeInBytes": 1,
      "sortValues": [
        "text"
      ],
      "syncHash": "text",
      "tags": [
        "text"
      ],
      "tagsRaw": [
        "text"
      ],
      "taskId": "text",
      "version": 1,
      "xsoarHasReadOnlyRole": true,
      "xsoarPreviousReadOnlyRoles": [
        "text"
      ],
      "xsoarReadOnlyRoles": [
        "text"
      ]
    }
  ],
  "total": 1
}