Skip Navigation

Get InstaQuery results

Request a

CylanceOPTICS

InstaQuery resource results belonging to a tenant.

Service endpoint	/instaqueries/v2{queryID}/results
Optional query string parameters	—
Example	https://protectapi.cylance.com/instaqueries/v2/AF593F38EDC1B743BDC0A6FCC53A03CE/results
Method	HTTP/1.1 GET
Request headers	Accept: application/json Authorization: Bearer `JWT Token returned by Auth API` with the opticssurvey:read scope encoded

Request

None

Response

Please see the Response status codes for more information.

Response JSON schema

Field Name	Description
Id	This is the unique ID of the InstaQuery.
Status	This is the status of the InstaQuery.
Result	This is the list of responses to the InstaQuery.
@timestamp	This is the timestamp that the result was reported in Unix epoch time.
HostName	This is the hostname of the device that returned the result.
DeviceID	This is the unique ID of the device that returned the result.
@version	This is the version format of the result.
CorrelationID	This is the unique correlation ID of the result object.
Result	This is the object containing response data.
FirstObservedTime	This is the timestamp that the result was first observed on the system (for example, when a file was first observed on the system as in a file being created) .
LastObservedTime	This is the timestamp that the result was last observed on the system (for example, when a file was last observed as in the last time a file was interacted with). This value will be the same as the FirstObservedTimestamp for NetworkConnection and process artifacts.
Uid	This is the unique ID of the result.
Type	This is the type of artifact that the result's "properties" contain.
Properties	This is the object containing the individual elements of the result. This will vary depending on the artifact and type that was queried. The following 4 cells outline the possible property values:
File	Path: This is the full path to the file. CreationDateTime: This is the timestamp (in UTC) of when the file was created on the responding system. Md5: This is the MD5 hash of the file result (where applicable). Sha256: This is the SHA256 hash of the file result (where applicable). Owner: This is the owner of the file. SuspectedFileType: This is the suspected file type of the file object (where applicable). FileSignature: This is a set of information derived about the file's signature status. Size: This is the size of the file object (in bytes). OwnerUid: This is the unique ID of the owner of the file.
Process	Name: This is the name of the process. CommandLine: This is the command line arguments that the process was executed with. StartDateTime: This is the timestamp (in UTC) of when the process was executed on the responding system. PrimaryImagePath: This is the image file path of the process. PrimaryImageMd5: This is the MD5 hash of the image file of the process. PrimaryImageSha256: This is the SHA256 hash of the image file of the process. PrimaryImageUid: This is the unique ID of the image file of the process. Owner: This is the user who owns the process. OwnerUid: This is the unique ID of the user who owns the process. SuspectedFileType: This is the suspected file type of the image file of the process. FileSignature: This is a set of information derived about the image file's siganture status. IsBeingDebugged: This is a Boolean value to determine if the process has a debugger attached to it.
Network	DestinationAddress: This is the IP address that the connection was destined to. DestinationPort: This is the port associated with the remote IP address. ProcessName: This is the process name that was associated with the connection. ProcessPrimaryImageUid: This is the unique ID of the process associated with the connection. ProcessPrimaryImagePath: This is the image file path of the process associated with the connection. ProcessImageMd5: This is the MD5 hash of the image file of the process associated with the connection. ProcessImageSha256: This is the SHA256 hash of the image file of the process associated with the connection. SuspectedFileType: This is the suspected file type of the image file of the process associated with the connection.
Registry	IsPersistencePoint: This is a binary value (1 or 0) to determine if the resulting Registry item is a common persistence location. ValueName: This is the name of the Registry Value that was interacted with. Path: This is the full path of the Registry Key. FilePath: This is the full path of the file referenced in the Registry Value (where applicable). FileMd5: This is the MD5 hash of the file referenced in the Registry Value (where applicable). FileSha256: This is the SHA256 hash of the file referenced in the Registry Value (where applicable). FileUid: This is the unique ID of the file referenced in the Registry Value (where applicable). SuspectedFileType: This is the suspected file type of the file referenced in the Registry Value (where applicable). FileSignature: This is a set of information derived about a file's signature status that is referenced in the Registry Value (where applicable).