Sign in

v1

latestOpenAPI 3.0.0Proprietary - Commercial Use Only2026-08-06172139621.6 KB
Findings

Get a IP reputation finding of a company.

The asset reputation score is based on the number of IPs or domains are blacklisted or that are used for sophisticated APT attacks. The reputation feeds are collected from VirusTotal, Cymon, Firehol, BlackList DNS servers, etc. This category has 7% effect on total scan score.<br/><br/> For storage optimization, the system <b>permanently</b> deletes all findings that haven't been detected by the Black Kite scanner for over a year. Findings with manually changed statuses or associated tickets are excluded.

get/api/v2/companies/{id}/findings/ipreputation/{findingId}

Path parameters

idinteger required

The id of the company that includes finding.

findingIdinteger required

The id of the target finding.

Response

Success

FindingIdinteger

The unique identifier of this finding.

Domainstring

The domain which this finding is related.

IPAddressstring

The related IP address which contains the finding.

Severity'Info' | 'Low' | 'Medium' | 'High' | 'Critical'

The severity of a finding.

Status'Active' | 'FalsePositive' | 'Suppressed' | 'Acknowledged' | 'Deleted' | 'Remediated'

The status of this finding.

  • Active, means the finding is still active with no review as of yet.
  • FalsePositive, means the finding is considered to be false alarm.
  • Suppressed, means the finding is suppressed, similar to FalsePositive.
  • Acknowledged, means the finding is accepted, for example will not be fixed.
  • Deleted, means the finding is deleted, similar to FalsePositive.
  • Remediated, means the finding is mitigated.
ControlIdstring

The unique identifier of the control that this finding relates to.

Categorystring

The type of the black list that contains the IP address. OBSOLETE: Inspect ReputationListings field.

FirstListingDatestring date-time nullable

The earliest date that the IP address blacklisted on the listing URL.

ListingUrlstring

The black list URL that contains the IP address. OBSOLETE: Inspect ReputationListings field.

Descriptionstring

The short description of the black list that contains the IP address. OBSOLETE: Inspect ReputationListings field.

ReportDatestring date-time

The last date the IP address is seen in the blacklist along. NOTE: This field has the same value as the 'FindingDate' field.

FindingDatestring date-time

The last date the IP address is seen in the blacklist along.

ConfidenceLevel'Low' | 'Medium' | 'High' | 'VeryHigh' nullable

The confidence level of this finding.

UpdateDatestring date-time nullable

The date that the finding was last updated.

IsRsiFindingboolean

Indicates whether this finding contributes to the company's Ransomware Susceptibility Index (RSI) score.

Example response

{
  "FindingId": 2590965999,
  "Domain": "acmeinc.com",
  "IPAddress": "192.168.1.1",
  "Severity": "Medium",
  "Status": "Active",
  "ControlId": "FRADOM-001",
  "Ticket": {
    "Status": "Assigned",
    "Owner": "John Doe"
  },
  "Category": "organizations, googlesafebrowse,reputation, dnsblacklist",
  "FirstListingDate": "2021-08-09T08:30:30.682Z",
  "ListingUrl": "https://lite.ip2location.com/ip2proxy-lite",
  "Description": "ip2location Proxy Ipv4 List",
  "ReportDate": "2021-08-09T08:30:30.682Z",
  "FindingDate": "2021-08-09T08:30:30.682Z",
  "ReputationListings": [
    {
      "Category": "organizations, googlesafebrowse,reputation, dnsblacklist",
      "Description": "ip2location Proxy Ipv4 List",
      "Url": "https://lite.ip2location.com/ip2proxy-lite",
      "Date": "2024-05-08T00:00:00.000Z"
    }
  ],
  "ConfidenceLevel": "High",
  "UpdateDate": "2021-08-09T08:30:30.682Z",
  "IsRsiFinding": true
}