Save evidence

Cortex XSOAR API

post /evidence Show code example
CURL
curl -X POST \ -H "Authorization: [[apiKey]]" \ -H "Accept: application/json" \ -H "Content-Type: application/json,application/xml" \ "https://hostname:443/evidence" \ -d '{ "dbotCreatedBy" : "dbotCreatedBy", "sizeInBytes" : 2, "primaryTerm" : 5, "roles" : [ "roles", "roles" ], "description" : "description", "syncHash" : "syncHash", "entryId" : "entryId", "highlight" : { "key" : [ "highlight", "highlight" ] }, "markedDate" : "2000-01-23T04:56:07.000+00:00", "modified" : "2000-01-23T04:56:07.000+00:00", "xsoarReadOnlyRoles" : [ "xsoarReadOnlyRoles", "xsoarReadOnlyRoles" ], "id" : "id", "markedBy" : "markedBy", "allReadWrite" : true, "numericId" : 1, "sequenceNumber" : 5, "previousAllRead" : true, "previousRoles" : [ "previousRoles", "previousRoles" ], "occurred" : "2000-01-23T04:56:07.000+00:00", "created" : "2000-01-23T04:56:07.000+00:00", "indexName" : "indexName", "xsoarHasReadOnlyRole" : true, "xsoarPreviousReadOnlyRoles" : [ "xsoarPreviousReadOnlyRoles", "xsoarPreviousReadOnlyRoles" ], "cacheVersn" : 6, "sortValues" : [ "sortValues", "sortValues" ], "version" : 7, "tags" : [ "tags", "tags" ], "ShardID" : 0, "previousAllReadWrite" : true, "tagsRaw" : [ "tagsRaw", "tagsRaw" ], "allRead" : true, "hasRole" : true, "incidentId" : "incidentId", "taskId" : "taskId", "fetched" : "2000-01-23T04:56:07.000+00:00" }' \ -d ' 123456789 true true 123456789 2000-01-23T04:56:07.000Z aeiou aeiou aeiou 2000-01-23T04:56:07.000Z true UNDEFINED_EXAMPLE_VALUE aeiou aeiou aeiou aeiou 2000-01-23T04:56:07.000Z 2000-01-23T04:56:07.000Z 123456789 2000-01-23T04:56:07.000Z true true aeiou 123456789 aeiou 123456789 123456789 aeiou aeiou aeiou aeiou aeiou 123456789 true aeiou aeiou '
Save an evidence entity To update evidence custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip