v1
latestOpenAPI 3.1.12026-07-242899061.7 MBIdentity Novel Exposures
Detailed Identity Novel Exposures alert data
Retrieve detailed information about a Identity Novel Exposures Playbook Alert with data grouped into UI-ready panels.
post/identity_novel_exposures/{playbook_alert_id}
Path parameters
playbook_alert_idstring required
The unique id of a specific Playbook Alert
Request body
Example request
{
"panels": [
"summary",
"details",
"log"
]
}Response
Data for the requested panels.
Example response
{
"status": {
"status_code": "Ok",
"status_message": "Ok"
},
"data": {
"panel_status": {
"status": "Resolved",
"assignee_name": "Marty McFly",
"assignee_id": "uhash:40wXmPVONA",
"created": "2023-07-21T17:32:28Z",
"updated": "2023-07-21T17:32:28Z",
"creator_name": "Marty McFly",
"creator_id": "uhash:40wXmPVONA",
"owner_id": "uhash:3HX3rIn4Kv",
"owner_name": "Recorded Future",
"organisation_id": "uhash:3HX3rIn4Kv",
"organisation_name": "Recorded Future",
"owner_organisation_details": {
"organisations": [
{
"organisation_id": "uhash:3HX3rIn4Kv",
"organisation_name": "Recorded Future"
}
],
"enterprise_id": "uhash:1HX2qIn4Zy",
"enterprise_name": "Recorded Future"
},
"targets": [
{
"id": "ip:8.8.8.8",
"type": "IpAddress",
"name": "8.8.8.8"
}
],
"actions_taken": [
"cyber_vulnerability.patched",
"brand_mentions_on_code_repository.keys_rotated",
"domain_abuse.takedown",
"malicious_sites.takedown",
"third_party_risk.vendor_mitigated_findings",
"identity_novel_exposures.enforced_password_reset"
]
},
"panel_evidence_summary": {
"subject": "user@example.com",
"exposed_secret": {
"type": "clear",
"hashes": [
{
"algorithm": "SHA256",
"hash": "ae976b7cea782af2e98761dd2e0af8d20e4fe958a95580b848fecbc1fedb30b9",
"hash_prefix": "ae976b7cea782af2"
}
],
"details": {
"clear_text_value": "Qwerty12345",
"clear_text_hint": "Qwe"
}
},
"dump": {
"name": "Stealer Malware Logs 2023-12-19",
"description": "This credential data was derived from stealer malware logs."
},
"authorization_url": "https://example.com/auth/login",
"compromised_host": {
"exfiltration_date": "2022-11-13T15:51:43.000Z",
"os": "Windows 10 Pro [x64]",
"os_username": "admin",
"malware_file": "C:\\Users\\admin\\AppData\\Local\\Temp\\build.exe",
"timezone": "UTC+03:00",
"computer_name": "DESKTOP-SNP2T8O",
"uac": "AllowAll",
"antivirus": [
"Windows Defender"
]
},
"malware_family": {
"id": "YuDlEm",
"name": "Vidar"
},
"infrastructure": {
"ip": "10.212.35.167"
},
"technologies": [
{
"name": "Amazon AWS",
"id": "I50CbE",
"category": "I50CbE"
}
]
},
"panel_log": [
{
"actor_name": "Marty McFly",
"actor_id": "uhash:40wXmPVONA",
"created": "2023-07-21T17:32:28Z",
"modified": "2023-07-21T17:32:28Z",
"message": "Sample log message.",
"changes": {
"assignee_change": {
"old": "uhash:Ds92mDX",
"new": "uhash:AbHGsX"
},
"status_change": {
"old": "New",
"new": "InProgress"
},
"priority_change": {
"old": "Moderate",
"new": "High"
},
"reopen_strategy_change": {
"old": "SignificantUpdates",
"new": "Never"
},
"actions_change": {
"removed": [
"task:4d65b0f8-8254-402c-8178-4a9f97afc9b2"
],
"added": [
"task:4d65b0f8-8254-402c-8178-4a9f97afc9b2"
]
},
"assessment_ids_change": {
"removed": [
"Active Mail Server"
],
"added": [
"C&C Server"
]
}
},
"context": {
"changes": [
{
"attacker": "mail.google.mail.pl",
"manual_addition_user_id": "uhash:40wXmPVONA",
"manual_addition_user_name": "User Name",
"typosquat_targets": [
"google.com"
],
"similar_domains_keywords": [
"*infix*"
]
}
]
}
}
],
"panel_log_v2": [
{
"id": "uuid:a3c4f8f0-8dd8-4940-8b0a-75a59764d068",
"author_id": "uhash:40wXmPVONA",
"author_name": "Marty McFly",
"created": "2023-07-21T17:32:28Z",
"changes": [
{
"old": {
"id": "uhash:Ds92mDX",
"name": "Marty"
},
"new": {
"id": "uhash:Ds92mDX",
"name": "Marty"
}
}
]
}
]
}
}