assign_acquisition_task
Assign evidence collection tasks to specific endpoints for digital forensics using case IDs, acquisition profiles, and endpoint IDs. Supports compression, encryption, and CPU usage limits.
Instructions
Assign an evidence acquisition task to specific endpoints
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| acquisitionProfileId | Yes | The acquisition profile ID to use for the task | |
| analyzers | No | Array of analyzer IDs to use (e.g. ["bha", "wsa"]) | |
| caseId | Yes | The case ID to associate the acquisition with | |
| cpuLimit | No | CPU usage limit percentage (1-100). Defaults to 80 | |
| enableCompression | No | Whether to enable compression. Defaults to true | |
| enableEncryption | No | Whether to enable encryption. Defaults to false | |
| encryptionPassword | No | Password for encryption if enabled | |
| endpointIds | Yes | Array of endpoint IDs to collect evidence from | |
| keywords | No | Array of keywords to search for | |
| organizationIds | No | Array of organization IDs to filter by. Defaults to [0] |