Nuix SDK – Part 4: Case Creation

Getting Started: Simple Case Creation

Thu, 11 Feb 2021 00:00:00 +0000

Create a Case

Now that you are authenticated, lets create your first Nuix simple case.

curl --location --request POST 'http://localhost:8080/nuix-restful-service/svc/v1/cases' \
--header 'nuix-auth-token: 9729a460-eda7-48dc-ba70-d12b3aae3c8d' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data-raw '{
   "name":"HelloWorld",
   "location":"inventory0",
   "description":"My first simple Nuix case",
   "compound":false,
   "investigator":"Inspector Gadget"
}'

{
    "caseId": "43b070164ce8453ca30ed9e2dfcce67b",
    "name": "HelloWorld",
    "path": "/Cases/HelloWorld",
    "description": "My first simple Nuix case",
    "investigator": "Inspector Gadget",
    "creationDate": 1612906749154,
    "compound": false,
    "elastic": false,
    "binaryStoreLocation": "",
    "indexId": "",
    "caseSize": 0,
    "casePathParent": "/Cases",
    "caseInvestigationTimeZone": "America/New_York",
    "hasExclusions": null,
    "hasNuixSystemTags": null,
    "hasProductionSets": null,
    "hasCalculatedAuditSize": null,
    "casePath": "/Cases/HelloWorld",
    "caseDescription": "My first simple Nuix case",
    "caseCreationDate": 1612906749154,
    "caseInvestigator": "Inspector Gadget",
    "caseName": "HelloWorld"
}

You have now successfully created your first case! Next, let’s ingest some data!

Getting Started: Compound Case Creation

Thu, 11 Feb 2021 00:00:00 +0000

Create a Compound Case

Now that you are authenticated, lets create your first Nuix compound case.

curl --location --request POST 'http://localhost:8080/nuix-restful-service/svc/v1/cases' \
--header 'nuix-auth-token: 9729a460-eda7-48dc-ba70-d12b3aae3c8d' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data-raw '{
   "name":"HelloCompoundCase",
   "location":"inventory0",
   "description":"My first Nuix compound Case",
   "compound":true,
   "investigator":"Inspector Gadget"
}'

{
    "caseId": "967db64ab9944daebf4d34fcad6b5e8f",
    "name": "HelloCompoundCase",
    "path": "/Cases/HelloCompoundCase",
    "description": "My first Nuix compound Case",
    "investigator": "Inspector Gadget",
    "creationDate": 1613066921882,
    "compound": true,
    "elastic": false,
    "binaryStoreLocation": "",
    "indexId": "",
    "caseSize": 0,
    "casePathParent": "/Cases",
    "caseInvestigationTimeZone": "America/New_York",
    "hasExclusions": null,
    "hasNuixSystemTags": null,
    "hasProductionSets": null,
    "hasCalculatedAuditSize": null,
    "caseName": "HelloCompoundCase",
    "casePath": "/Cases/HelloCompoundCase",
    "caseDescription": "My first Nuix compound Case",
    "caseCreationDate": 1613066921882,
    "caseInvestigator": "Inspector Gadget"
}

You have now successfully created your first compound case! Take note of your case ID 967db64ab9944daebf4d34fcad6b5e8f. Next, we have to add simple child cases to the compound case. Let’s create two simple child cases and add them to the compound case.

Create Child Case 1

curl --location --request POST 'http://localhost:8080/nuix-restful-service/svc/v1/cases' \
--header 'nuix-auth-token: 9729a460-eda7-48dc-ba70-d12b3aae3c8d' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data-raw '{
   "name":"HelloChild-1",
   "location":"inventory0",
   "description":"About My first child case",
   "compound":false,
   "investigator":"Inspector Gadget"
}'

{
    "caseId": "521b4f8f875541d2b2c5912f927897e2",
    "name": "HelloChild-1",
    "path": "/Cases/HelloChild-1",
    "description": "About My first child case",
    "investigator": "Inspector Gadget",
    "creationDate": 1613067156583,
    "compound": false,
    "elastic": false,
    "binaryStoreLocation": "",
    "indexId": "",
    "caseSize": 0,
    "casePathParent": "/Cases",
    "caseInvestigationTimeZone": "America/New_York",
    "hasExclusions": null,
    "hasNuixSystemTags": null,
    "hasProductionSets": null,
    "hasCalculatedAuditSize": null,
    "caseName": "HelloChild-1",
    "casePath": "/Cases/HelloChild-1",
    "caseDescription": "About My first child case",
    "caseCreationDate": 1613067156583,
    "caseInvestigator": "Inspector Gadget"
}

Create Child Case 2

curl --location --request POST 'http://localhost:8080/nuix-restful-service/svc/v1/cases' \
--header 'nuix-auth-token: 9729a460-eda7-48dc-ba70-d12b3aae3c8d' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data-raw '{
   "name":"HelloChild-2",
   "location":"inventory0",
   "description":"About My second child case",
   "compound":false,
   "investigator":"Inspector Gadget"
}'

{
    "caseId": "1a33156e3be34e7ea74a77912be526f3",
    "name": "HelloChild-2",
    "path": "/Cases/HelloChild-2",
    "description": "About My second child case",
    "investigator": "Inspector Gadget",
    "creationDate": 1613067352626,
    "compound": false,
    "elastic": false,
    "binaryStoreLocation": "",
    "indexId": "",
    "caseSize": 0,
    "casePathParent": "/Cases",
    "caseInvestigationTimeZone": "America/New_York",
    "hasExclusions": null,
    "hasNuixSystemTags": null,
    "hasProductionSets": null,
    "hasCalculatedAuditSize": null,
    "caseName": "HelloChild-2",
    "casePath": "/Cases/HelloChild-2",
    "caseDescription": "About My second child case",
    "caseCreationDate": 1613067352626,
    "caseInvestigator": "Inspector Gadget"
}

Adding Child Cases to a Compound Case

Finally, let’s add our two simple child cases that we just created to our compound case. The childCases endpoint simply acknowledges the addition of the child cases to the compound case by returning a HTTP status code of 200

curl --location --request POST 'http://localhost:8080/nuix-restful-service/svc/v1/cases/967db64ab9944daebf4d34fcad6b5e8f/childCases' \
--header 'nuix-auth-token: 9729a460-eda7-48dc-ba70-d12b3aae3c8d' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data-raw '[ "521b4f8f875541d2b2c5912f927897e2", "1a33156e3be34e7ea74a77912be526f3" ]'

You have now successfully created your first compound case! Next, let’s ingest some data!

Getting Started: Elastic Case Creation

Wed, 10 Feb 2021 00:00:00 +0000

Create an Elastic Case

Now that you are authenticated, let’s create an Elasticsearch case. Configuration of Elasticsearch is outside the scope of this tutorial. Additionally, sharding strategies and replicas are also outside the scope of this tutorial. In order to create an Elasticsearch case you will need to know the Elasticsearch cluster name and host name. For this example, we will use a single shard and zero replicas.

curl --location --request POST 'http://localhost:8080/nuix-restful-service/svc/v1/cases' \
--header 'nuix-auth-token: 9729a460-eda7-48dc-ba70-d12b3aae3c8d' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data-raw '{
   "name":"HelloElasticCase",
   "location":"inventory0",
   "description":"My first Nuix Elasticsearch case",
   "compound":false,
   "investigator":"Inspector Gadget",
   "elasticSearchSettings": {
   	"cluster.name": "elasticsearch",
   	"index.number_of_shards": 1,
   	"index.number_of_replicas": 0,
   	"nuix.transport.hosts": ["127.0.0.1"],
    "nuix.http.hosts": ["127.0.0.1"] 
   }
}
'

{
    "caseId": "776a45b03d1841379b1dea524098a33b",
    "name": "HelloElasticCase",
    "path": "/Cases/HelloElasticCase",
    "description": "My first Nuix Elasticsearch case",
    "investigator": "Inspector Gadget",
    "creationDate": 1613068118333,
    "compound": false,
    "elastic": true,
    "binaryStoreLocation": "/Cases/HelloElasticCase/Stores/BinaryStore",
    "indexId": "nuix-776a45b03d1841379b1dea524098a33b",
    "caseSize": 0,
    "casePathParent": "/Cases",
    "caseInvestigationTimeZone": "America/New_York",
    "hasExclusions": null,
    "hasNuixSystemTags": null,
    "hasProductionSets": null,
    "hasCalculatedAuditSize": null,
    "caseName": "HelloElasticCase",
    "casePath": "/Cases/HelloElasticCase",
    "caseDescription": "My first Nuix Elasticsearch case",
    "caseCreationDate": 1613068118333,
    "caseInvestigator": "Inspector Gadget"
}

You have now successfully created your first Elasticsearch case! Next, let’s ingest some data!

Getting Started: Compound Elastic Case Creation

Fri, 12 Feb 2021 00:00:00 +0000

Create a Compound Elastic Case

Now that you are authenticated, let’s create a compound Elasticsearch case. Configuration of Elasticsearch is outside the scope of this tutorial. Additionally, sharding strategies and replicas are also outside the scope of this tutorial. In order to create an Elasticsearch case you will need to know the Elasticsearch cluster name and host name. For this example, we will use a single shard and zero replicas.

curl --location --request POST 'http://localhost:8080/nuix-restful-service/svc/v1/cases' \
--header 'nuix-auth-token: 9729a460-eda7-48dc-ba70-d12b3aae3c8d' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data-raw '{
   "name":"HelloCompoundElasticsearchCase",
   "location":"inventory0",
   "description":"My first compound Elasticsearch case",
   "compound":true,
   "investigator":"Inspector Gadget",
   "elasticSearchSettings": {
   	"cluster.name": "elasticsearch",
   	"index.number_of_shards": 1,
   	"index.number_of_replicas": 0,
   	"nuix.transport.hosts": ["127.0.0.1"],
    "nuix.http.hosts": ["127.0.0.1"] 
   }
}
'

{
    "caseId": "a571f00ec43d41538d9e8c4f0bf1bda5",
    "name": "HelloCompoundElasticsearchCase",
    "path": "/Cases/HelloCompoundElasticsearchCase",
    "description": "My first compound Elasticsearch case",
    "investigator": "Inspector Gadget",
    "creationDate": 1613154608469,
    "compound": true,
    "elastic": true,
    "binaryStoreLocation": "/Cases/HelloCompoundElasticsearchCase/Stores/BinaryStore",
    "indexId": "nuix-a571f00ec43d41538d9e8c4f0bf1bda5",
    "caseSize": 0,
    "casePathParent": "/Cases",
    "caseInvestigationTimeZone": "America/New_York",
    "hasExclusions": null,
    "hasNuixSystemTags": null,
    "hasProductionSets": null,
    "hasCalculatedAuditSize": null,
    "casePath": "/Cases/HelloCompoundElasticsearchCase",
    "caseDescription": "My first compound Elasticsearch case",
    "caseCreationDate": 1613154608469,
    "caseInvestigator": "Inspector Gadget",
    "caseName": "HelloCompoundElasticsearchCase"
}

You have now successfully created your first compound Elasticsearch case! Take note of your case ID a571f00ec43d41538d9e8c4f0bf1bda5. Next, we have to add elastic simple child cases to the compound case. Let’s create two elastic simple child cases and add them to the compound case.

Create Elasticsearch Child Case 1

curl --location --request POST 'http://localhost:8080/nuix-restful-service/svc/v1/cases' \
--header 'nuix-auth-token: 9729a460-eda7-48dc-ba70-d12b3aae3c8d' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data-raw '{
   "name":"HelloElasticChild1",
   "location":"inventory0",
   "description":"My elastic child case 1",
   "compound":false,
   "investigator":"Inspector Gadget",
   "elasticSearchSettings": {
   	"cluster.name": "elasticsearch",
   	"index.number_of_shards": 1,
   	"index.number_of_replicas": 0,
   	"nuix.transport.hosts": ["127.0.0.1"],
    "nuix.http.hosts": ["127.0.0.1"] 
   }
}
'

{
    "caseId": "0d4060b5d16046e58172286266a80980",
    "name": "HelloElasticChild1",
    "path": "/Cases/HelloElasticChild1",
    "description": "My elastic child case 1",
    "investigator": "Inspector Gadget",
    "creationDate": 1613155151596,
    "compound": false,
    "elastic": true,
    "binaryStoreLocation": "/Cases/HelloElasticChild1/Stores/BinaryStore",
    "indexId": "nuix-0d4060b5d16046e58172286266a80980",
    "caseSize": 0,
    "casePathParent": "/Cases",
    "caseInvestigationTimeZone": "America/New_York",
    "hasExclusions": null,
    "hasNuixSystemTags": null,
    "hasProductionSets": null,
    "hasCalculatedAuditSize": null,
    "casePath": "/Cases/HelloElasticChild1",
    "caseDescription": "My elastic child case 1",
    "caseCreationDate": 1613155151596,
    "caseInvestigator": "Inspector Gadget",
    "caseName": "HelloElasticChild1"
}

Create Elasticsearch Child Case 2

curl --location --request POST 'http://localhost:8080/nuix-restful-service/svc/v1/cases' \
--header 'nuix-auth-token: 9729a460-eda7-48dc-ba70-d12b3aae3c8d' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data-raw '{
   "name":"HelloElasticChild2",
   "location":"inventory0",
   "description":"My elastic child case 2",
   "compound":false,
   "investigator":"Inspector Gadget",
   "elasticSearchSettings": {
   	"cluster.name": "elasticsearch",
   	"index.number_of_shards": 1,
   	"index.number_of_replicas": 0,
   	"nuix.transport.hosts": ["127.0.0.1"],
    "nuix.http.hosts": ["127.0.0.1"] 
   }
}
'

{
    "caseId": "8c680473e5274719a585ba77eb4f9ca5",
    "name": "HelloElasticChild2",
    "path": "/Cases/HelloElasticChild2",
    "description": "My elastic child case 2",
    "investigator": "Inspector Gadget",
    "creationDate": 1613155276207,
    "compound": false,
    "elastic": true,
    "binaryStoreLocation": "/Cases/HelloElasticChild2/Stores/BinaryStore",
    "indexId": "nuix-8c680473e5274719a585ba77eb4f9ca5",
    "caseSize": 0,
    "casePathParent": "/Cases",
    "caseInvestigationTimeZone": "America/New_York",
    "hasExclusions": null,
    "hasNuixSystemTags": null,
    "hasProductionSets": null,
    "hasCalculatedAuditSize": null,
    "casePath": "/Cases/HelloElasticChild2",
    "caseDescription": "My elastic child case 2",
    "caseCreationDate": 1613155276207,
    "caseInvestigator": "Inspector Gadget",
    "caseName": "HelloElasticChild2"
}

Adding Elasticsearch Child Cases to an Elasticsearch Compound Case

Finally, let’s add our two simple Elasticsearch child cases that we just created to our Elasticsearch compound case. The childCases endpoint simply acknowledges the addition of the child cases to the compound case by returning a HTTP status code of 200

curl --location --request POST 'http://localhost:8080/nuix-restful-service/svc/v1/cases/a571f00ec43d41538d9e8c4f0bf1bda5/childCases' \
--header 'nuix-auth-token: 9729a460-eda7-48dc-ba70-d12b3aae3c8d' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data-raw '[ "0d4060b5d16046e58172286266a80980", "8c680473e5274719a585ba77eb4f9ca5" ]'

You have now successfully created your first Elasticsearch compound case! Next, let’s ingest some data!