Sign in

v1

latestOpenAPI 3.1.02026-07-2481742657.4 KB
Threat Hunting
Adversary Investigation

Get threat history for a host

Retrieve historical threat observations for a host. This endpoint returns time ranges during which threats were detected on the host.<br><br>You can define a specific time frame of interest. If you do not specify a time frame, this endpoint will search the historical dataset that is available to your account.<br><br>You can filter by port number, protocol, threat name, and transport protocol.<br><br>This endpoint is available to organizations that have access to the Adversary Investigation module.

get/v3/threat-hunting/host/{ip}/observations/threats

Path parameters

ipstring ip required

The IP address of a host.

Example:8.8.8.8

The IP address of a host.

Query parameters

organization_idstring uuid required

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

start_timestring

Start of date range (RFC3339 format, e.g., 2024-01-01T00:00:00Z). If not specified, defaults to the maximum query window back from the end time.

Example:2024-01-01T00:00:00Z

Start of date range (RFC3339 format, e.g., 2024-01-01T00:00:00Z). If not specified, defaults to the maximum query window back from the end time.

end_timestring

End of date range (RFC3339 format, e.g., 2024-01-31T23:59:59Z). If not specified, defaults to now. Cannot be in the future.

Example:2024-01-31T23:59:59Z

End of date range (RFC3339 format, e.g., 2024-01-31T23:59:59Z). If not specified, defaults to now. Cannot be in the future.

page_sizeinteger

Number of results per page (max 100)

Example:50

Number of results per page (max 100)

page_tokenstring

Pagination token from previous response

Pagination token from previous response

portinteger

Filter by port number

Example:443

Filter by port number

protocolstring

Filter by application protocol

Example:HTTP

Filter by application protocol

threat_namestring

Filter by threat name

Example:Acunetix

Filter by threat name

transport_protocol'tcp' | 'udp'

Filter by transport protocol

Example:tcp

Filter by transport protocol

order_bystring[] nullable

Order observations by these fields. Multiple values can be provided to sort by multiple fields (e.g., ['port DESC', 'protocol ASC']).

Order observations by these fields. Multiple values can be provided to sort by multiple fields (e.g., ['port DESC', 'protocol ASC']).

Headers

X-Organization-IDstring uuid

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Example:11111111-2222-3333-4444-555555555555

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Response

A list of threat observation ranges