addEvidenceToCase¶

MUTATIONaddEvidenceToCase

Cases GraphQL API · Mutations

addEvidenceToCase will add more evidence to an existing case. Evidence added through this mutation will not be considered genesis evidence. The response will include the evidence that the service will attempt to add to the case. Adding evidence to cases is an asynchronous operation. It will typically finish pretty quickly, but added detections/events will may not show up in the returned case until the async job is fully complete. The processing status, that is found on the case type will reflect the state of the processing job. Once the status is set to 'SUCCESS' the background job is complete and requesting the case will return the related evidence. Adding, removing or updating evidence (closing a case) while other jobs are processing for a given case will cause the jobs to queue. Jobs will be worked through in the order they were received.

curl -X POST "https://api.taegis.sophos.com/graphql" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"query\": \"mutation AddEvidenceToCase(\$input: AddEvidenceToCaseInput!) { addEvidenceToCase(input: \$input) { caseId detectionIds detectionsSearchQuery eventIds searchQueries hostIds } }\",
  \"variables\": {
    \"input\": {
      \"caseId\": \"<caseId>\"
    }
  }
}"

import requests

response = requests.post(
    "https://api.taegis.sophos.com/graphql",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={   'query': 'mutation AddEvidenceToCase($input: AddEvidenceToCaseInput!) { '
             'addEvidenceToCase(input: $input) { caseId detectionIds '
             'detectionsSearchQuery eventIds searchQueries hostIds } }',
    'variables': {'input': {'caseId': '<caseId>'}}},
)
print(response.json())

$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "query": "mutation AddEvidenceToCase($input: AddEvidenceToCaseInput!) { addEvidenceToCase(input: $input) { caseId detectionIds detectionsSearchQuery eventIds searchQueries hostIds } }",
  "variables": {
    "input": {
      "caseId": "<caseId>"
    }
  }
}'
Invoke-RestMethod -Method POST -Uri "https://api.taegis.sophos.com/graphql" -Headers $headers -Body $body -ContentType "application/json"

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api.taegis.sophos.com/graphql", strings.NewReader(`{
  "query": "mutation AddEvidenceToCase($input: AddEvidenceToCaseInput!) { addEvidenceToCase(input: $input) { caseId detectionIds detectionsSearchQuery eventIds searchQueries hostIds } }",
  "variables": {
    "input": {
      "caseId": "<caseId>"
    }
  }
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}

const response = await fetch("https://api.taegis.sophos.com/graphql", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "query": "mutation AddEvidenceToCase($input: AddEvidenceToCaseInput!) { addEvidenceToCase(input: $input) { caseId detectionIds detectionsSearchQuery eventIds searchQueries hostIds } }",
  "variables": {
    "input": {
      "caseId": "<caseId>"
    }
  }
}),
});
const data = await response.json();
console.log(data);