Sign in
latestSwagger 2.02026-08-109450223.9 KB

94acb422c07d

Reseller

Get Signal

Shows details of a single Signal belonging to the account associated with your API credentials.

Signals are used to highlight interesting user or system behaviors that an analyst can reference during a cyber investigation. A detected Signal could be as broad and low fidelity as the detection of a command line user running whoami, or it could be as specific and high fidelity as detecting a known malware file.

get/v1/accounts/{account_id}/signals/{id}

Path parameters

account_idinteger required
idinteger required

Signal ID within Huntress account

Response

Get Signal

Example response

{
  "signal": {
    "id": 1,
    "created_at": "2025-06-26T18:57:03Z",
    "details": {
      "rule_name": "Firewall Disabled via Netsh",
      "username": "admin22",
      "process_name": "C:\\WINDOWS\\system32\\netsh.exe",
      "command_line": "NetSh.exe  Advfirewall set allprofiles state off",
      "registry_key": "",
      "file_path": "",
      "file_rename_target": "",
      "cleartext": ""
    },
    "entity": {
      "id": 72183,
      "name": "Laptop 52",
      "type": "agent"
    },
    "investigated_at": "2025-06-26T18:57:03Z",
    "investigation_context": "False Positive, Business Accepted Risk",
    "name": "Firewall Disabled via Netsh",
    "organization": {
      "id": 232,
      "name": "Huntress"
    },
    "status": "closed",
    "type": "Process Insights",
    "updated_at": "2025-06-26T18:57:03Z"
  }
}