latestSwagger 2.02026-08-109450223.9 KB

94acb422c07d

Signals

List Signals

Shows details of Signals belonging to the account associated with your API credentials.

Signals are used to highlight interesting user or system behaviors that an analyst can reference during a cyber investigation. A detected Signal could be as broad and low fidelity as the detection of a command line user running whoami, or it could be as specific and high fidelity as detecting a known malware file.

Note: This endpoint will also return a pagination key on the root level.
Please refer to the pagination section within our docs for more information.

get/v1/signals

Query parameters

limitinteger

Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.

page_tokenstring

Token used to request the next page in paginated results. Defaults to 'null'

sort_field'id' | 'created_at' | 'updated_at' | 'status'

Field to sort by. Defaults to 'id'.

sort_direction'asc' | 'desc'

Sort direction. Defaults to 'desc'.

investigated_at_minstring

Filter by an ISO-8601 formatted date string that represents the lower bound of the search range for the investigated_at date.

investigated_at_maxstring

Filter by an ISO-8601 formatted date string that represents the upper bound of the search range for the investigated_at date.

Filter by the entity type that the Signal originated from. This filter can be used without specifying entity_id.

entity_idstring

Filter by the entity ID that the Signal originated from. Must be used in tandem with entity_type parameter.

organization_idinteger

Filter by organization ID within Huntress account

typesstring

Filter by the types of Signal, must be comma-separated string containing the values: Antivirus, Process Insights, Managed ITDR, Footholds, MDE Detections, SIEM, Ransomware Canaries, Favicon Detections, Attack Disruptions, App Control

statusesstring

Filter by status. Must be comma-separated string containing the values: reported, closed

Response

List Signals

Example response

{
  "signals": [
    {
      "id": 1,
      "created_at": "2025-06-26T18:57:03Z",
      "details": {
        "rule_name": "Firewall Disabled via Netsh",
        "username": "admin22",
        "process_name": "C:\\WINDOWS\\system32\\netsh.exe",
        "command_line": "NetSh.exe  Advfirewall set allprofiles state off",
        "registry_key": "",
        "file_path": "",
        "file_rename_target": "",
        "cleartext": ""
      },
      "entity": {
        "id": 72183,
        "name": "Laptop 52",
        "type": "agent"
      },
      "investigated_at": "2025-06-26T18:57:03Z",
      "investigation_context": "False Positive, Business Accepted Risk",
      "name": "Firewall Disabled via Netsh",
      "organization": {
        "id": 232,
        "name": "Huntress"
      },
      "status": "closed",
      "type": "Process Insights",
      "updated_at": "2025-06-26T18:57:03Z"
    }
  ]
}