download sample file from Threat Grid by API

[peter.peng]

Hi Sir:

   Could you provide me any document about download the sample file from TG by API ? I can't find it from TG help.

[Wojciech Cecot]

Hello Peter,

Please refer to:

https://panacea.threatgrid.com/mask/api-doc/api/v2/samples/:sample-id/:artifact

It is possible to download it as an artifact. Example:

curl --request GET https://panacea.threatgrid.com/api/v2/samples/ec75584d564ac189b90cad37db4dc755/sample.zip?api_key=<API_KEY> -o sample.zip

Hope that helps,

Wojciech

[peter.peng]

Hi Wojciech Cecot :

    Thanks a lot . 

Another question: If I want to export hostname of client from FMC or TG by API. Can I make it ?

[Wojciech Cecot · Accepted solution]

Hello Peter,

Not sure about the Firepower API, however on TG I could only find information from which sensor sample came, for example from 'fmc-sensor-...", 'wsa-device-...', 'esa-device...'

That information can be found under "login" field.

https://panacea.threatgrid.eu/mask/api-doc/api/v2/samples

If you are looking for the hostname of the endpoint, I don't think it is possible to get that on TG.

Regards,

Wojciech

[HawkTeam]

Hello, i use your api but not work. What's the id of :artifact meaning. Its filename or something else?
Thanks a lot

[Wojciech Cecot]

Hello,

As per documentation (https://panacea.threatgrid.com/mask/api-doc/api/v2/samples/:sample-id/:artifact) id of the artifact is Sample ID, that can be either retrieved using API or from Console of TG, after clicking on the sample:

Regarding artifact parameter itself it needs to be something from the table, from documentation like, sample.zip, analysis.json etc.

--Wojciech

[HawkTeam]

Thank for reply me, I already try with curl --request GET https://panacea.threatgrid.com/api/v2/samples/ec75584d564ac189b90cad37db4dc755/sampleid/nameofartifact but still not download file. I get id from report https://panacea.threatgrid.com/csa/v3/report
Am is miss something?
Thank you

[Wojciech Cecot]

Looks like you are missing API key in that query, please try following (and instead of <API_KEY> place your API key):

curl --request GET https://panacea.threatgrid.com/api/v2/samples/ec75584d564ac189b90cad37db4dc755/analysis.json?api_key=<API_KEY>

If that will fail, please share response output (make sure to remove your API_KEY)

-Wojciech

[HawkTeam]

hi, Im using CSA(ESA/WSA), its possible to download with api of CSA ? i think that problem, maybe CSA not allow to download sample with CSA api?