Monitor Incident Response Tool Execution

Note

To use the incident response tool features, you can add the DFIR package to your instance of the Cybereason platform for an additional cost or request an Express IR environment (partners only). Contact your Customer Success representative to request access to this package or for details on how to submit the request, see How to Request a Cybereason Express IR Environment.

Endpoint URL: https://<your server>/rest/sensors/action/getRunIRToolStatus/<batchID>
Endpoint URI: sensors/action/getRunIRToolStatus/<batchID>

Action: GET

Monitors the execution of an incident response tool (identified by the batch ID number from an execution request). For details on how to run an incident response tool, see Run an Incident Response Tool.

This request is supported for versions 21.1.81 and later.

You must have the Responder L2 role assigned for your Cybereason user to run this request.

Note

Ensure that you have logged into the Cybereason platform. For details, see Log in with the API.

Request Headers

You must add a Content-Type:application/json header with the request.

Note

If you are using cURL, add the authorization cookie details or the path to the file containing the cookie details as part of every request.


Request Body

None


Request Parameters

URL/URI parameters: You must add the required batchID string value (taken from the response of the request to run an incident response tool) in the URL.

Request Body Parameters: none


Response Status Codes

This request can return the following status codes:

  • 200: Request OK


Response Success Schema

The response contains the following fields:

  • Sensor: The unique sensor ID for the sensors involved in the incident response tool execution.

  • Status: The status of the tool execution operation

  • Error: Any relevant error messages.


Response Failure Schema

None


Important Response Fields

All information contained in the response is important for you to understand if the tool ran successfully.


Example: Monitor the status of an incident response tool execution

Request

curl --request GET \
  --url https://12.34.56.78/rest/sensors/action/getRunIRToolStatus/1438096773 \
  --header 'Content-Type:application/json' \

Response

PYLUMCLIENT_IR-15-APRIL_WIN10-X64-19H1_005056A642D0,Succeeded,SEC_SUCCESS
PYLUMCLIENT_IR-15-APRIL_WIN10-X64-20H1_005056A66E2C,Succeeded,SEC_SUCCESS