Exporting Report Data
Exporting a Report
You can export any report to your local machine. This downloads a file containing the IOCs from your selected report and all data sources from the graph including intelligence sources, correlated reports, and community reports.
Formats supported for export include:
- JSON
- STIX
- TXT
- FireEye TAP
To export a report:
- Click the three dots at the top of the Details pane (left side of Constellation View). This displays a dropdown menu.
- Choose the export options you want to use.
The file is immediately downloaded to your local machine.
File Formats
This section explains each of the download formats for data export.
JSON
Data Exported
- Report ID: Unique identifier generated by the platform for each report
- Creation timestamp: indicating when the platform created the report
- Report title
- timeBegan timestamp: this is the time provided by the user when submitting a report. If user doesn't provide a time the Creation timestamp is used.
- Status showing if report has been fully Processed
- Report body
- Submission source (API or Web)
- List of extracted IOCs with type and value of each IOC
Example: report-ab7f60fa-0f11-4ebf-baf5-bed8dc0005fd.json
STIX
Data exported:
- STIX_PACKAGE
- Report description
Example: report-ab7f60fa-0f11-4ebf-baf5-bed8dc0005fd.xml
TXT
Data exported:
- Report title
- IOCs extracted
- Correlated intel
Example: report-ab7f60fa-0f11-4ebf-baf5-bed8dc0005fd.txt
FIREEYE TAP
Data exported:
- Report ID
- IOCs extracted
- IOC type
- Risk
