Download a file
- Base URL
-
https://{kibana_url}
- GET /api/endpoint/action/{action_id}/file/{file_id}/download
Download a file associated with a response action. Files are downloaded in a password-protected .zip archive to prevent the file from running. Use password elastic to open the .zip in a safe environment.
Note
Files retrieved from third-party-protected hosts require a different password. Refer to Third-party response actions for your system's password.
Path parameters
-
action_idstring · min length: 1 · max length: 256required -
The ID of the response action that generated the file.
-
file_idstring · min length: 1 · max length: 256required -
The file identifier is constructed in one of two ways:
- For Elastic Defend agents (
agentTypeofendpoint): combine theaction_idandagent_idvalues using a dot (.) separator:{file_id}={action_id}.{agent_id} - For all other agent types: the
file_idis theagent_idfor which the response action was sent to.
- For Elastic Defend agents (
Response
Indicates a successful call.
Response Type: string · format: binary