Sign in

v1

latestOpenAPI 3.0.0Proprietary - Commercial Use Only2026-08-06172139621.6 KB
Findings

Get a patch management finding of a company.

Company asset system versions are collected from internet-wide scanners like Censys, Shodan, Zoomeye etc. These version numbers are converted into the corresponding common platform enumeration number (CPE-ID) and are correlated with NIST NVD and MITRE CVSS databases to detect and approximate any unmitigated known vulnerabilities.<br/><br/> For storage optimization, the system <b>permanently</b> deletes all findings that haven't been detected by the Black Kite scanner for over a year. Findings with manually changed statuses or associated tickets are excluded.

get/api/v2/companies/{id}/findings/patchmanagement/{findingId}

Path parameters

idinteger required

The id of the company that includes finding.

findingIdinteger required

The id of the target finding.

Query parameters

exclude_fieldsstring
Example:Cpes,References

Comma separated field names to exclude from the response. Supported values are: Cpes and References. When a field is excluded, it will be returned as null. Unsupported field names are silently ignored.

Response

Success

FindingIdinteger

The unique identifier of this finding.

Domainstring

The domain which this finding is related.

IPAddressstring

The related IP address which contains the finding.

Subdomainstring nullable

The related subdomain which contains the finding. This field may be empty.

Severity'Info' | 'Low' | 'Medium' | 'High' | 'Critical'

The severity of a finding.

Status'Active' | 'FalsePositive' | 'Suppressed' | 'Acknowledged' | 'Deleted' | 'Remediated'

The status of this finding.

  • Active, means the finding is still active with no review as of yet.
  • FalsePositive, means the finding is considered to be false alarm.
  • Suppressed, means the finding is suppressed, similar to FalsePositive.
  • Acknowledged, means the finding is accepted, for example will not be fixed.
  • Deleted, means the finding is deleted, similar to FalsePositive.
  • Remediated, means the finding is mitigated.
ProductNamestring

The name of the product that needs the patch.

PublishDatestring date-time nullable

The date of the related patch was published.

FindingDatestring date-time

The date that Black Kite first seen the finding.

LastCheckDatestring date-time

The date that Black Kite last checked the finding.

ControlIdstring

The unique identifier of the control that this finding relates to.

CvssScorenumber float nullable

The Common Vulnerability Scoring System score of the finding.

CwssScorenumber float nullable

The Common Weakness Scoring System score of the finding.

CveIdstring nullable

The related CVE id of the finding.

CweIdstring nullable

The related CWE id of the finding.

Detailstring

A short detail specific to the finding. Possibly HTML formatted.

Titlestring

A title for the finding. Same with the security control's title referenced by the ControlId.

Referencesstring[] nullable
Cpesstring[]

A list of related CPEs.

Portnumber nullable

The port number of asset(s)

Epssnumber float nullable

Given score to the CveId that related to the relevant finding, by the Exploit Prediction Scoring System.

InKevboolean nullable

Indicates whether the CveId related to the relevant finding is one of the known exploited vulnerabilities (KEV) based on CISA’s KEV catalog.

Output'Failed'

The output field in PatchManagement findings works differently from other findings. All findings are treated as "Failed".

ConfidenceLevel'Low' | 'Medium' | 'High' | 'VeryHigh' nullable

The confidence level of this finding.

UpdateDatestring date-time nullable

The date that the finding was last updated.

IsRsiFindingboolean

Indicates whether this finding contributes to the company's Ransomware Susceptibility Index (RSI) score.

Example response

{
  "FindingId": 2590965999,
  "Domain": "acmeinc.com",
  "IPAddress": "192.168.1.1",
  "Subdomain": "mysubdomain.acmeinc.com",
  "Severity": "Medium",
  "Status": "Active",
  "ProductName": "openssl/1.1.1",
  "PublishDate": "2021-08-09T08:30:30.682Z",
  "FindingDate": "2021-08-09T08:30:30.682Z",
  "LastCheckDate": "2021-08-09T08:30:30.682Z",
  "ControlId": "FRADOM-001",
  "Ticket": {
    "Status": "Assigned",
    "Owner": "John Doe"
  },
  "CveId": "CVE-2019-15846",
  "CweId": "CWE-119",
  "Detail": "X-Content-Type-Options header not found",
  "Title": "X-Content-Type-Options HTTP Header",
  "References": [
    "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"
  ],
  "Cpes": [
    "cpe:/a:product:product:4.89:rc5"
  ],
  "Epss": 0.25,
  "Tags": [
    {
      "Id": 46,
      "Name": "ScreenConnect"
    }
  ],
  "Output": "Failed",
  "ConfidenceLevel": "High",
  "UpdateDate": "2021-08-09T08:30:30.682Z",
  "IsRsiFinding": true
}