Sign in

v1

latestOpenAPI 3.0.02026-07-24311994.6 KB
Investigations

Search by File

Search for credentials based on file names.

post/search-by-file

Request body

file_namestring required

Name or partial name of files to search for. Supports both exact matches and partial matches. Case-insensitive. Examples include configuration files ('config.json'), credential files ('credentials.yml'), or key files ('id_rsa').

cursorstring

Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the 'nextCursor' field in the previous response. Enables efficient pagination through large result sets without skipping or duplicating records.

start_datestring date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter results from this date/time onward. Applies to the field specified in 'sort_by'. Useful for monitoring new file exposures since a specific date.

end_datestring date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter results up to this date/time. Applies to the field specified in 'sort_by'. Useful for analyzing historical file exposures within a specific timeframe.

sort_by'date_compromised' | 'date_uploaded'

Field to sort results by. 'date_compromised' sorts by when the file was captured during infection, while 'date_uploaded' sorts by when the file data was integrated into our platform.

sort_direction'asc' | 'desc'

Direction to sort results. 'desc' returns newest file exposures first (recommended for threat monitoring), while 'asc' returns oldest exposures first (useful for forensic analysis and incident timelines).

Example request

{
  "file_name": "aws key",
  "start_date": "2023-01-01T00:00:00Z",
  "end_date": "2023-12-31T23:59:59Z",
  "sort_by": "date_compromised",
  "sort_direction": "desc"
}

Response

Successful file search

nextCursorstring

Cursor for the next page of results