v1

latestOpenAPI 3.1.12026-07-242899061.7 MB

Identity Novel Exposures

Bulk Identity Novel Exposures alerts lookup

Perform a detailed lookup of data panels for several Identity Novel Exposures alerts at once.

post/identity_novel_exposures

Request body

playbook_alert_idsstring[] required

The unique ids of the triggered Playbook Alerts. Maximum number of ids in a single request is 250.

panelsstring[]

Request inclusion of detailed Case data, grouped into a set of panels. If left unset, all panels will be returned.

Example request

{
  "panels": [
    "summary",
    "details",
    "log"
  ]
}

Response

Data for the requested panels.

Example response

{
  "status": {
    "status_code": "Ok",
    "status_message": "Ok"
  },
  "data": [
    {
      "panel_status": {
        "status": "Resolved",
        "assignee_name": "Marty McFly",
        "assignee_id": "uhash:40wXmPVONA",
        "created": "2023-07-21T17:32:28Z",
        "updated": "2023-07-21T17:32:28Z",
        "creator_name": "Marty McFly",
        "creator_id": "uhash:40wXmPVONA",
        "owner_id": "uhash:3HX3rIn4Kv",
        "owner_name": "Recorded Future",
        "organisation_id": "uhash:3HX3rIn4Kv",
        "organisation_name": "Recorded Future",
        "owner_organisation_details": {
          "organisations": [
            {
              "organisation_id": "uhash:3HX3rIn4Kv",
              "organisation_name": "Recorded Future"
            }
          ],
          "enterprise_id": "uhash:1HX2qIn4Zy",
          "enterprise_name": "Recorded Future"
        },
        "targets": [
          {
            "id": "ip:8.8.8.8",
            "type": "IpAddress",
            "name": "8.8.8.8"
          }
        ],
        "actions_taken": [
          "cyber_vulnerability.patched",
          "brand_mentions_on_code_repository.keys_rotated",
          "domain_abuse.takedown",
          "malicious_sites.takedown",
          "third_party_risk.vendor_mitigated_findings",
          "identity_novel_exposures.enforced_password_reset"
        ]
      },
      "panel_evidence_summary": {
        "subject": "user@example.com",
        "exposed_secret": {
          "type": "clear",
          "hashes": [
            {
              "algorithm": "SHA256",
              "hash": "ae976b7cea782af2e98761dd2e0af8d20e4fe958a95580b848fecbc1fedb30b9",
              "hash_prefix": "ae976b7cea782af2"
            }
          ],
          "details": {
            "clear_text_value": "Qwerty12345",
            "clear_text_hint": "Qwe"
          }
        },
        "dump": {
          "name": "Stealer Malware Logs 2023-12-19",
          "description": "This credential data was derived from stealer malware logs."
        },
        "authorization_url": "https://example.com/auth/login",
        "compromised_host": {
          "exfiltration_date": "2022-11-13T15:51:43.000Z",
          "os": "Windows 10 Pro [x64]",
          "os_username": "admin",
          "malware_file": "C:\\Users\\admin\\AppData\\Local\\Temp\\build.exe",
          "timezone": "UTC+03:00",
          "computer_name": "DESKTOP-SNP2T8O",
          "uac": "AllowAll",
          "antivirus": [
            "Windows Defender"
          ]
        },
        "malware_family": {
          "id": "YuDlEm",
          "name": "Vidar"
        },
        "infrastructure": {
          "ip": "10.212.35.167"
        },
        "technologies": [
          {
            "name": "Amazon AWS",
            "id": "I50CbE",
            "category": "I50CbE"
          }
        ]
      },
      "panel_log": [
        {
          "actor_name": "Marty McFly",
          "actor_id": "uhash:40wXmPVONA",
          "created": "2023-07-21T17:32:28Z",
          "modified": "2023-07-21T17:32:28Z",
          "message": "Sample log message.",
          "changes": {
            "assignee_change": {
              "old": "uhash:Ds92mDX",
              "new": "uhash:AbHGsX"
            },
            "status_change": {
              "old": "New",
              "new": "InProgress"
            },
            "priority_change": {
              "old": "Moderate",
              "new": "High"
            },
            "reopen_strategy_change": {
              "old": "SignificantUpdates",
              "new": "Never"
            },
            "actions_change": {
              "removed": [
                "task:4d65b0f8-8254-402c-8178-4a9f97afc9b2"
              ],
              "added": [
                "task:4d65b0f8-8254-402c-8178-4a9f97afc9b2"
              ]
            },
            "assessment_ids_change": {
              "removed": [
                "Active Mail Server"
              ],
              "added": [
                "C&C Server"
              ]
            }
          },
          "context": {
            "changes": [
              {
                "attacker": "mail.google.mail.pl",
                "manual_addition_user_id": "uhash:40wXmPVONA",
                "manual_addition_user_name": "User Name",
                "typosquat_targets": [
                  "google.com"
                ],
                "similar_domains_keywords": [
                  "*infix*"
                ]
              }
            ]
          }
        }
      ],
      "panel_log_v2": [
        {
          "id": "uuid:a3c4f8f0-8dd8-4940-8b0a-75a59764d068",
          "author_id": "uhash:40wXmPVONA",
          "author_name": "Marty McFly",
          "created": "2023-07-21T17:32:28Z",
          "changes": [
            {
              "old": {
                "id": "uhash:Ds92mDX",
                "name": "Marty"
              },
              "new": {
                "id": "uhash:Ds92mDX",
                "name": "Marty"
              }
            }
          ]
        }
      ]
    }
  ]
}