Download a file

Base URL
https://{kibana_url}
Auth

Download a file associated with a response action. Files are downloaded in a password-protected .zip archive to prevent the file from running. Use password elastic to open the .zip in a safe environment.

Note

Files retrieved from third-party-protected hosts require a different password. Refer to Third-party response actions for your system's password.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

action_id string · min length: 1 · max length: 256 required

The ID of the response action that generated the file.

file_id string · min length: 1 · max length: 256 required

The file identifier is constructed in one of two ways:

  • For Elastic Defend agents (agentType of endpoint): combine the action_id and agent_id values using a dot (.) separator: {file_id} = {action_id}.{agent_id}
  • For all other agent types: the file_id is the agent_id for which the response action was sent to.

Response

Indicates a successful call.

application/octet-stream

Response Type: string · format: binary

Base URL
https://{kibana_url}