Skip to main content
GET
/
api
/
v2
/
workspaces
/
{workspaceId}
/
incidents
/
{source}
/
{incidentId}
/
evidence
Get incident evidence
curl --request GET \
  --url https://api.example.com/api/v2/workspaces/{workspaceId}/incidents/{source}/{incidentId}/evidence
{
  "data": {
    "columns": [
      "<string>"
    ],
    "rows": [
      "<array>"
    ]
  },
  "meta": {
    "requestId": "<string>",
    "timestamp": "<string>"
  }
}

Documentation Index

Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt

Use this file to discover all available pages before exploring further.

Path Parameters

​
workspaceId
string<uuid>
required
​
source
enum<string>
required
Available options:
Sentinel,
DefenderXDR,
QRadar,
Splunk,
CrowdStrike,
SentinelOne
​
incidentId
string
required

Response

OK

Standard v2 API response envelope for single-item responses.

​
data
object
​
meta
object