files

Required user permissions

modules.cases.file.**

Required bot permissions

Attach Files

[+] File permissions are narrowed by case type, case ownership, file ownership, and archive state.

Subcommands

/files is a group command. Choose one of the interactions below.

/files add

Attach up to ten files to a case.

/files add <case> <file-a> [file-b … file-j] [visibility]

Arguments

case integer

Required

The case ID.

file-a attachment

Required

The first file.

file-b … file-j attachment

Optional

Up to nine additional files.

visibility string

Optional

Whether targets may see the uploaded files.

Default: Inherit

Choices:InheritHiddenVisible

Example

Upload evidence hidden from the case target.

/files add case:418 file-a:evidence.png visibility:Hidden

/files list

List files attached to a case.

/files list <case> [page]

Arguments

case integer

Required

The case ID.

page integer

Optional

Page of files.

Default: 1

Example

List the first page of files.

/files list case:418

/files inspect

Inspect one case file.

/files inspect <case> <file-id>

Arguments

case integer

Required

The case ID.

file-id string

Required

The short file ID shown by the list command.

Example

Inspect a file.

/files inspect case:418 file-id:d1621c

/files visibility

Change visibility for up to ten files.

/files visibility <case> <visibility> <file-id-a> [file-id-b … file-id-j]

Arguments

case integer

Required

The case ID.

visibility string

Required

The new visibility.

Choices:InheritHiddenVisible

file-id-a string

Required

The first file ID.

file-id-b … file-id-j string

Optional

Up to nine additional file IDs.

Example

Reveal two files to the case target.

/files visibility case:418 visibility:Visible file-id-a:d1621c file-id-b:f21a00

/files archive

Soft-delete a case file.

/files archive <case> <file-id> <reason>

Arguments

case integer

Required

The case ID.

file-id string

Required

The file ID.

reason string

Required

Why the file is being archived.

Example

Archive an obsolete file.

/files archive case:418 file-id:d1621c reason:"Superseded"

/files delete

Permanently delete a case file.

/files delete <case> <file-id> <reason>

Arguments

case integer

Required

The case ID.

file-id string

Required

The file ID.

reason string

Required

Why permanent deletion is required.

Example

Permanently delete an unsafe upload.

/files delete case:418 file-id:d1621c reason:"Malware"