Scan a file or directory

Base URL: https://{kibana_url}

POST /api/endpoint/action/scan
POST /s/{space_id}/api/endpoint/action/scan

Auth

Scan a specific file or directory on an endpoint for malware.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

agent_type enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
alert_ids string[] · format: nonempty · min items: 1: A list of alerts ids.
case_ids string[] · min items: 1: Case IDs to be updated (cannot contain empty strings)
comment string: Optional comment
endpoint_ids string[] · min items: 1 required: List of endpoint IDs (cannot contain empty strings)
parameters object required: Optional parameters object

Response

application/json

Response Type: object

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/endpoint/action/scan
{
  "comment": "Scan the file for malware",
  "endpoint_ids": [
    "ed518850-681a-4d60-bb98-e22640cae2a8"
  ],
  "parameters": {
    "path": "/usr/my-file.txt"
  }
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/endpoint/action/scan" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "comment": "Scan the file for malware",
    "endpoint_ids": [
      "ed518850-681a-4d60-bb98-e22640cae2a8"
    ],
    "parameters": {
      "path": "/usr/my-file.txt"
    }
  }'

Generated from the API spec

Response

{
  "data": {
    "agents": [
      "ed518850-681a-4d60-bb98-e22640cae2a8"
    ],
    "agentState": {
      "ed518850-681a-4d60-bb98-e22640cae2a8": {
        "isCompleted": false,
        "wasSuccessful": false
      }
    },
    "agentType": "endpoint",
    "command": "scan",
    "createdBy": "myuser",
    "hosts": {
      "ed518850-681a-4d60-bb98-e22640cae2a8": {
        "name": "gke-endpoint-gke-clu-endpoint-node-po-e1a3ab89-4c4r"
      }
    },
    "id": "27ba1b42-7cc6-4e53-86ce-675c876092b2",
    "isCompleted": false,
    "isExpired": false,
    "outputs": {},
    "parameters": {
      "path": "/usr/my-file.txt"
    },
    "startedAt": "2023-07-28T19:00:03.911Z",
    "status": "pending",
    "wasSuccessful": false
  }
}

Generated from the API spec

Path parameters

Request body { }

Response

Request body