Technical Tip: Retrieving the file hash from FortiEDR events by using Rest-API

[dhamadi]

Description	This article describes how to retrieve the hash of a process by using Rest-API.
Scope	FortiEDR version 5 and above.
Solution	The hash of the process can be viewed from the investigation view: Some users will be required to get this value via Rest-API for automation and speed-up analysis. The hash of the process is contained in the Raw Data JSON item. The procedure to get this data is shown below. Recommended Rest-API software tool: Postman The API call to get the event ID: https://abc.test.com/management-rest/events/list-events?organization=demo Use the event ID to get the Raw event IDs. https://abc.test.com/management-rest/events/list-raw-data-items?organization=demo&eventId=764802 The API call to export the raw data items Json which contains the hash: https://abc.test.com/management-rest/events/export-raw-data-items-json?organization=demo&rawItemIds=... Related articles: Technical Tip: Retrieving Files from Collectors by using Rest-API Technical Tip: Tips and Tricks with Rest API and Postman