topic Re: download sample file from Threat Grid by API in Endpoint Security

download sample file from Threat Grid by API

peter.peng — Fri, 21 Feb 2020 05:08:20 GMT

Hi Sir:

Could you provide me any document about download the sample file from TG by API ? I can't find it from TG help.

Re: download sample file from Threat Grid by API

Wojciech Cecot — Mon, 25 Mar 2019 06:54:22 GMT

Hello Peter,

Please refer to:

https://panacea.threatgrid.com/mask/api-doc/api/v2/samples/:sample-id/:artifact

It is possible to download it as an artifact. Example:

curl --request GET https://panacea.threatgrid.com/api/v2/samples/ec75584d564ac189b90cad37db4dc755/sample.zip?api_key=<API_KEY> -o sample.zip

Hope that helps,

Wojciech

Re: download sample file from Threat Grid by API

peter.peng — Wed, 27 Mar 2019 08:32:32 GMT

Hi Wojciech Cecot :

Thanks a lot .

Another question: If I want to export hostname of client from FMC or TG by API. Can I make it ?

Re: download sample file from Threat Grid by API

Wojciech Cecot — Fri, 29 Mar 2019 13:13:35 GMT

Hello Peter,

Not sure about the Firepower API, however on TG I could only find information from which sensor sample came, for example from 'fmc-sensor-...", 'wsa-device-...', 'esa-device...'

That information can be found under "login" field.

https://panacea.threatgrid.eu/mask/api-doc/api/v2/samples

If you are looking for the hostname of the endpoint, I don't think it is possible to get that on TG.

Regards,

Wojciech

Re: download sample file from Threat Grid by API

HawkTeam — Wed, 24 Apr 2019 10:42:00 GMT

Hello, i use your api but not work. What's the id of :artifact meaning. Its filename or something else?
Thanks a lot

Re: download sample file from Threat Grid by API

Wojciech Cecot — Wed, 24 Apr 2019 12:03:15 GMT

Hello,

As per documentation (https://panacea.threatgrid.com/mask/api-doc/api/v2/samples/:sample-id/:artifact) id of the artifact is Sample ID, that can be either retrieved using API or from Console of TG, after clicking on the sample:

Regarding artifact parameter itself it needs to be something from the table, from documentation like, sample.zip, analysis.json etc.

--Wojciech

Re: download sample file from Threat Grid by API

HawkTeam — Wed, 24 Apr 2019 15:02:16 GMT

Thank for reply me, I already try with curl --request GET https://panacea.threatgrid.com/api/v2/samples/ec75584d564ac189b90cad37db4dc755/sampleid/nameofartifact but still not download file. I get id from report https://panacea.threatgrid.com/csa/v3/report
Am is miss something?
Thank you

Re: download sample file from Threat Grid by API

Wojciech Cecot — Thu, 25 Apr 2019 09:16:18 GMT

Looks like you are missing API key in that query, please try following (and instead of <API_KEY> place your API key):

curl --request GET https://panacea.threatgrid.com/api/v2/samples/ec75584d564ac189b90cad37db4dc755/analysis.json?api_key=<API_KEY>

If that will fail, please share response output (make sure to remove your API_KEY)

-Wojciech

Re: download sample file from Threat Grid by API

HawkTeam — Sun, 28 Apr 2019 03:42:16 GMT

hi, Im using CSA(ESA/WSA), its possible to download with api of CSA ? i think that problem, maybe CSA not allow to download sample with CSA api?