Sign in

v1

latestOpenAPI 3.1.02026-07-2481742657.4 KB
Threat Hunting
Adversary Investigation

CensEye: Retrieve value counts to discover pivots

Get counts of web assets for specific field-value pairs and combinations of field-value pairs. This is similar to the CensEye functionality available in the Platform web UI, but it allows you to define specific fields of interest rather than the default fields leveraged by the tool in the UI.<br><br>Each array can only target fields within the same nested object and may contain at most 5 field-value pairs. For example, you can combine host.services.port=80 and host.services.protocol=SSH in the same array, but you cannot combine host.services.port=80 and host.location.country="United States" in the same array. You can input multiple arrays of objects in each API call.<br><br>To use this endpoint, your organization must have access to the Adversary Investigation module. This endpoint costs 1 credit per count condition (array of objects) included in the API call.

post/v3/threat-hunting/value-counts

Query parameters

organization_idstring uuid required

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

Headers

X-Organization-IDstring uuid

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Example:11111111-2222-3333-4444-555555555555

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Request body

querystring

CenQL query string to filter documents

Example request

{
  "and_count_conditions": [
    {
      "field_value_pairs": [
        {
          "field": "host.services.port",
          "value": "80"
        }
      ]
    }
  ]
}

Response

OK