v1

latestOpenAPI 3.1.02026-07-2481742657.4 KB
Threat Hunting
Adversary Investigation

Get host history for a certificate

Retrieve the historical observations of hosts associated with a certificate. This is useful for threat hunting, detection engineering, and timeline generation. Certificate history is also visible to Adversary Investigation users in the Platform UI on the certificate timeline.<br><br>You can define a specific time frame of interest. If you do not specify a time frame, this endpoint will search the historical dataset that is available to your account. You may also filter results by port and transport protocol.<br><br>This endpoint is available to organizations that have access to the Adversary Investigation module. It costs 5 credits per page of results.

get/v3/threat-hunting/certificate/{certificate_id}/observations/hosts

Path parameters

certificate_idstring required

SHA-256 hash of the certificate

Example:55af8a301eb51abdaf7c31bec951638fe5a99d5d92117eca2be493026613fa46

SHA-256 hash of the certificate

Query parameters

organization_idstring uuid required

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

start_timestring

Only show ranges ending at or after this time (ISO 8601)

Example:2023-01-01T00:00:00Z

Only show ranges ending at or after this time (ISO 8601)

end_timestring

Only show ranges starting at or before this time (ISO 8601)

Example:2023-12-31T23:59:59Z

Only show ranges starting at or before this time (ISO 8601)

portinteger

The port to filter by

Example:443

The port to filter by

protocolstring

The transport protocol to filter by

Example:TCP

The transport protocol to filter by

page_tokenstring

Pagination token from previous response to retrieve next page of results

Pagination token from previous response to retrieve next page of results

page_sizeinteger

Number of results per page. Maximum 100, defaults to 100 if not specified

Example:50

Number of results per page. Maximum 100, defaults to 100 if not specified

Headers

X-Organization-IDstring uuid

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Example:11111111-2222-3333-4444-555555555555

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Response

A list of host observations for the certificate