diff --git a/automation/README.md b/automation/README.md index 2335123..59f1207 100644 --- a/automation/README.md +++ b/automation/README.md @@ -544,7 +544,7 @@ It is possible to search the database for attributes based on a list of criteria To return an event with all of its attributes, relations, shadowAttributes, use the following syntax: ~~~~ -https:///events/restSearch/download/[value]/[type]/[category]/[org]/[tag]/[quickfilter]/[from]/[to]/[last] +https:///events/restSearch/download/[value]/[type]/[category]/[org]/[tag]/[quickfilter]/[from]/[to]/[last]/[eventid]/[withAttachments]/[metadata]/[uuid] ~~~~
@@ -578,6 +578,10 @@ https:///events/restSearch/download/null/null/null/null/tag1&&tag2&&!t
Events published within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m). This filter will use the published timestamp of the event.
eventid
The events that should be included / excluded from the search
+
withAttachments
+
Include the attachments/encrypted samples in the export
+
metadata
+
Only fetch the event metadata (event data, tags, relations) and skip the attributes
The keywords false or null should be used for optional empty parameters in the URL. @@ -622,13 +626,15 @@ To just return a list of attributes, use the following syntax:
last
Events published within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m). This filter will use the published timestamp of the event.
eventid
-
The events that should be included / excluded from the search
+
The events that should be included / excluded from the search.
+
uuid
+
The returned events must include an attribute with the given UUID, or alternatively the event's UUID must match the value(s) passed.
The keywords false or null should be used for optional empty parameters in the URL. ~~~~ -https:///attributes/restSearch/download/[value]/[type]/[category]/[org]/[tag]/[from]/[to]/[last]/[eventid] +https:///attributes/restSearch/download/[value]/[type]/[category]/[org]/[tag]/[from]/[to]/[last]/[eventid]/[withattachments]/[uuid] ~~~~ Value, type, category and org are optional. It is possible to search for several terms in each category by joining them with the '&&' operator. It is