List all the artifacts linked to a container by the container’s ID.

​
Basic Parameters

ParameterDescription
Container IDThe ID of the container. Can be obtained by using the List Containers action.
OrderThe is the sorting order for the results.
SortField to sort results with.

​
Advanced Parameters

ParameterDescription
Page NumberPage number of the results to fetch.
Page SizeSize of page to return.

​
Example Output

{
	"count": 73,
	"num_pages": 194,
	"data": [
		{
			"tags": [
				"<string>"
			],
			"id": 431,
			"cef": {
				"sourceAddress": "<string>"
			},
			"cef_types": {
				"sourceAddress": [
					"<string>"
				]
			},
			"container": 201,
			"create_time": "2021-10-20T11:30:23",
			"description": "<string>",
			"end_time": null,
			"external_id": null,
			"hash": "<string>",
			"ingest_app": null,
			"kill_chain": null,
			"label": null,
			"name": "<string>",
			"owner": 415,
			"playbook_run": null,
			"severity": "<string>",
			"source_data_identifier": "<string>",
			"start_time": "2023-02-23T01:40:44",
			"type": null,
			"update_time": "2020-01-21T00:46:47",
			"version": 135,
			"in_case": false,
			"has_note": false,
			"parent_container": null,
			"parent_artifact": null
		}
	]
}

​
Workflow Library Example

List Container Artifacts with Splunk Soar and Send Results Via Email

Workflow Library

Preview this Workflow on desktop