The interface to Download content has several options allowing you to customize what you download and in what format you get your content.

Objects

This section tells the system which TLO types you would like to include in your download. By default the type for the TLO you are looking at is selected. This is only useful if you are looking to include some level of relationships with your download.

Depth

This is the quantity of levels we will traverse in order to collect content for your download. By default it is set to "0" which means "No relationships, just the TLO I am looking at." Increasing it to "1" means all first-level relationships (the ones you can see on the Details page for this TLO). Increasing it to "2" means include the first-level relationships of all of this TLO's relationships, etc. There is a hard-stop at a depth of 5 by default, but that value can be adjusted by an Admin in the Control Panel.

Maximum

The maximum amount of Objects we will include in your download. We download breadth-first and will continue down in depth until we've accumulated the maximum amount of TLOs. There is a hard-stop at 250 by default, but that value can be adjusted by an Admin in the Control Panel.

Relationships

This is the maximum amount of first-level relationships an object can have before we ignore it. We've found that many TLOs can have hundreds of relationships, and if it gets included in a Download can cause you to miss out on most of the other relationships. This value will ensure that if a single TLO has more than N number of relationships it won't be included in your download. By default there is a hard-stop at 50 relationships, but that value can be adjusted by an Admin in the Control Panel.

Result Format

This is where things get tricky. The result format tells the system what format you would like your data in.

• zip
  • You will get a zip file with a password of "infected" containing your binaries in the format you select with Binary Format or your XML documents. If the result is only a single XML document, it will be returned to you as XML.
• STIX
  • You will get either a single STIX document containing your results, or a zip file with a password of "infected" containing however many STIX documents were generated. If there were binaries associated with any TLOs they will be included inside of the STIX document in "base64" format.
• STIX (no binaries)
  • The same as "STIX" but the binaries will not be included in the download.

Binary Format

We allow you to customize the format of the binaries included in your download (unless they are included in a STIX document in which case they will always be "base64" encoded).