Download a file
Server:
https://{kibana_url}
- GET /api/endpoint/action/{action_id}/file/{file_id}/download
- GET /s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}/download
Refer to Spaces for more information.
Download a file associated with a response action. Files are downloaded in a password-protected .zip archive to prevent the file from running. Use password elastic to open the .zip in a safe environment.
info Files retrieved from third-party-protected hosts require a different password. Refer to Third-party response actions for your system's password.
Path Parameters
-
action_idstring · min: 1 · max: 256required -
The ID of the response action that generated the file.
-
file_idstring · min: 1 · max: 256required -
The file identifier is constructed in one of two ways:
- For Elastic Defend agents (
agentTypeofendpoint): combine theaction_idandagent_idvalues using a dot (.) separator:{file_id}={action_id}.{agent_id} - For all other agent types: the
file_idis theagent_idfor which the response action was sent to.
- For Elastic Defend agents (
Response
Indicates a successful call.
Response Type: string