Nuix

This Connector integrates Nuix's REST API with Swimlane Turbine.

Prerequisites

The Nuix Connector requires an URL, USERNAME AND PASSWORD for authentication.

Capabilities

This Connector provides the following capabilities:

Creates a case

Creates a case subset

Case Evidence

Evidence File

Evidence LoadFile

Evidence Mail

Evidence MS365

Evidence Repository

Notes

NUIX APIs

Configurations

NUIX Asset

Authenticates using NUIX credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
licence_shortname	Nuix License Shortname, this will be the license used as long as the value is not overridden in a task that uses this asset.	string	Optional
workers	Default number of workers. This will be the number of workers for a task if the value is not overridden in a task that uses this asset.	string	Optional
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Creates a case

Use this operation to create a case.

Endpoint

URL: /cases

Method: POST

Input

Argument Name	Type	Required	Description
name	string	Optional	Name of the resource
location	string	Optional	Parameter for Creates a case
description	string	Optional	Parameter for Creates a case
compound	boolean	Optional	Parameter for Creates a case
investigator	string	Optional	Parameter for Creates a case

Input Example

{"json_body":{"name":"SimpleCase","location":"inventory0","description":"About My simple Case","compound":false,"investigator":"Inspector Gadget"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
caseId	string	Unique identifier
name	string	Name of the resource
path	string	Output field: path
description	string	Output field: description
investigator	string	Output field: investigator
creationDate	number	Date value
compound	boolean	Output field: compound
elastic	boolean	Output field: elastic
binaryStoreLocation	string	Output field: binaryStoreLocation
indexId	string	Unique identifier
caseSize	number	Output field: caseSize
casePathParent	string	Output field: casePathParent
caseInvestigationTimeZone	string	Output field: caseInvestigationTimeZone
hasExclusions	object	Output field: hasExclusions
hasNuixSystemTags	object	Output field: hasNuixSystemTags
hasProductionSets	object	Output field: hasProductionSets
hasCalculatedAuditSize	object	Output field: hasCalculatedAuditSize
casePath	string	Output field: casePath
caseName	string	Name of the resource
caseDescription	string	Output field: caseDescription
caseCreationDate	number	Date value
caseInvestigator	string	Output field: caseInvestigator

Output Example

{"status_code":201,"response_headers":{},"reason":"OK","json_body":{"caseId":"559710fa433a44c0a8b3a5805c4c8ba0","name":"SimpleCase","path":"/opt/nuix/cases/SimpleCase","description":"About My simple Case","investigator":"Inspector Gadget","creationDate":1606248486451,"compound":false,"elastic":false,"binaryStoreLocation":"","indexId":"","caseSize":0,"casePathParent":"/opt/nuix/cases","caseInvestigationTimeZone":"Etc/GMT","hasExclusions":null,"hasNuixSystemTags":null}}

Case Evidence

Ingests a new repository and/or supported containers into a simple case. Use this operation to ingest different types of data during a single processing session.

Endpoint

URL: /cases/{{caseId}}/evidence

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	Parameters for the Case Evidence action
processingProfile	string	Optional	Parameter for Case Evidence
containers	array	Optional	Parameter for Case Evidence
containers.files	array	Optional	Parameter for Case Evidence
containers.files.path	string	Optional	Parameter for Case Evidence
containers.s3Buckets	array	Optional	Parameter for Case Evidence
containers.s3Buckets.access	string	Optional	Parameter for Case Evidence
containers.s3Buckets.bucket	string	Optional	Parameter for Case Evidence
containers.s3Buckets.endpoint	string	Optional	Parameter for Case Evidence
containers.s3Buckets.secret	string	Optional	Parameter for Case Evidence

Input Example

{"json_body":{"processingProfile":"Default","containers":[{"files":[{"path":"/mnt/raw-data/singleFile.txt"},{"path":"/mnt/raw-data/directory"}],"s3Buckets":[{"access":"AWSACCESSKEY","bucket":"my.aws.bucket/bucketFolder","endpoint":"","secret":"AWSSECRETACCESSKEY"}]}]},"path_parameters":{"caseId":"ahdh123"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
functionKey	string	Output field: functionKey
location	string	Output field: location

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"functionKey":"string","location":"string"}}

Creates a case subset

Use this operation to create a case subset.

Endpoint

URL: /cases/{{caseId}}/subset

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	Parameters for the Creates a case subset action
query	string	Optional	Parameter for Creates a case subset
location	string	Optional	Parameter for Creates a case subset
caseMetadata	object	Optional	Response data
caseMetadata.name	string	Optional	Response data
caseMetadata.description	string	Optional	Response data

Input Example

{"json_body":{"query":"*","location":"inventory0","caseMetadata":{"name":"MyCase","description":"Simple case subset"}},"path_parameters":{"caseId":"hdgfhj5253"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
functionKey	string	Output field: functionKey
location	string	Output field: location

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"functionKey":"string","location":"string"}}

Evidence File

Ingests a new file/directory target into a container in a simple case.

Endpoint

URL: /cases/{{caseId}}/evidence/file

Method: POST

Input

Argument Name	Type	Required	Description
path_paramters	object	Required	Parameter for Evidence File
path_paramters.caseId	string	Required	Unique identifier
target	object	Optional	Parameter for Evidence File
target.path	string	Optional	Parameter for Evidence File

Input Example

{"json_body":{"target":{"path":"/mnt/raw-data/singleFile.txt"}},"path_paramters":{"caseId":"bsdhdh234"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
functionKey	string	Output field: functionKey
location	string	Output field: location

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"functionKey":"string","location":"string"}}

Evidence LoadFile

Use this operation to ingest a single type of data from a single source during a processing session. This endpoint currently supports loadfiles in CSV format.

Endpoint

URL: /cases/{{caseId}}/evidence/loadFile

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	Parameters for the Evidence LoadFile action
target	object	Optional	Parameter for Evidence LoadFile
target.path	string	Optional	Parameter for Evidence LoadFile

Input Example

{"json_body":{"target":{"path":"/mnt/loadfile.csv"}},"path_parameters":{"caseId":"gdgh2535"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
functionKey	string	Output field: functionKey
location	string	Output field: location

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"functionKey":"string","location":"string"}}

Evidence Mail

Use this operation to ingest an individual mail store into a simple case. This is useful when you want to ingest non-Microsoft Exchange targets.

Endpoint

URL: /cases/{{caseId}}/evidence/mail

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	Parameters for the Evidence Mail action
target	object	Optional	Parameter for Evidence Mail
target.protocol	string	Optional	Parameter for Evidence Mail
target.host	string	Optional	Parameter for Evidence Mail
target.port	number	Optional	Parameter for Evidence Mail
target.username	string	Optional	Name of the resource
target.password	string	Optional	Parameter for Evidence Mail

Input Example

{"json_body":{"target":{"protocol":"imap","host":"imap.gmail.com","port":993,"username":"myuser","password":"mypassword"}},"path_parameters":{"caseId":"ahdh123"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
functionKey	string	Output field: functionKey
location	string	Output field: location

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"functionKey":"string","location":"string"}}

Evidence MS365

Use this operation to ingest a single type of data from one source during a processing session.

Endpoint

URL: /cases/{{caseId}}/evidence/ms365

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	Parameters for the Evidence MS365 action
target	object	Optional	Parameter for Evidence MS365
target.tenantId	string	Optional	Unique identifier
target.clientId	string	Optional	Unique identifier
target.clientSecret	string	Optional	Parameter for Evidence MS365
target.from	string	Optional	Parameter for Evidence MS365
target.to	string	Optional	Parameter for Evidence MS365
target.username	string	Optional	Name of the resource
target.password	string	Optional	Parameter for Evidence MS365
target.userPrincipalNames	array	Optional	Name of the resource
target.retrievals	array	Optional	Parameter for Evidence MS365

Input Example

{"json_body":{"target":{"tenantId":"tenantId","clientId":"clientId","clientSecret":"clientSecret","from":"2021-01-01","to":"2021-04-30","username":"username","password":"password","userPrincipalNames":["[email protected]"],"retrievals":["USERS_CONTACTS"]}},"path_parameters":{"caseId":"gdjgs234"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
functionKey	string	Output field: functionKey
location	string	Output field: location

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"functionKey":"string","location":"string"}}

Evidence Repository

Use this operation to ingest a single directory into a simple case as an evidence repository.

Endpoint

URL: /cases/{{caseId}}/evidence/repository

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	Parameters for the Evidence Repository action
repository	object	Optional	Parameter for Evidence Repository
repository.path	string	Optional	Parameter for Evidence Repository

Input Example

{"json_body":{"repository":{"path":"/mnt/repositories"}},"path_parameters":{"caseId":"shddhj123"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
functionKey	string	Output field: functionKey
location	string	Output field: location

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"functionKey":"string","location":"string"}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT