v1
latestOpenAPI 3.1.12026-07-242899061.7 MBDetections
Detections
Retrieve identity exposure detections with novel-only filtering and malware family attribution.
post/identity/detections
Request body
Example request
{
"organization_id": [
"uhash:a1b2c3d4"
],
"filter": {
"domains": [
"example-corp.com"
],
"authorization_technology": {
"id": [
"tech-okta-sso"
],
"name": [
"Okta Single Sign-On"
]
},
"created": {
"gte": "2024-07-20T10:00:00Z",
"lt": "2024-07-25T10:00:00Z"
}
},
"offset": "cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U"
}Response
Success
Example response
{
"detections": [
{
"id": "f47ac10b58cc4372a5670e02b2c3d479",
"organization_id": "uhash:a1b2c3d4",
"subject": "john.smith@example-corp.com",
"password": {
"type": "Cleartext",
"hashes": [
{
"hash": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8"
}
],
"cleartext_hint": "Pass",
"cleartext": "Passw0rd123!"
},
"authorization_service": {
"url": "https://signin.example-corp.com/login",
"domain": "example-corp.com",
"fqdn": "signin.example-corp.com",
"protocols": [
"HTTPS"
],
"technology": [
{
"id": "tech-wordpress",
"name": "WordPress",
"category": "CMS"
}
]
},
"cookies": [
{
"dns": ".example.com",
"name": "session_id",
"expiration": "2025-08-25T09:57:39Z",
"value": "3a2d5f8b-9e4c-4a1d-b8f9-c6e7d8f9a0b1"
}
],
"malware_family": {
"id": "mal-vidar",
"name": "Vidar Stealer"
},
"dump": {
"name": "Antiscam Log 2024-07-22",
"type": "Stealer Log",
"source": "dump-antiscam-2024-07-22-045",
"description": "Log data from Antiscam malware campaign.",
"infrastructure": {
"ip": "203.0.113.55"
},
"compromise": {
"os": "Windows 11",
"os_username": "victim_user",
"malware_file": "C:\\Windows\\Temp\\update.exe",
"timezone": "(UTC+02:00) Helsinki, Kyiv, Riga, Sofia, Tallinn, Vilnius",
"computer_name": "DESKTOP-A1B2C3D",
"uac": "UAC-Limited",
"antivirus": [
"Avast"
],
"exfiltration_date": "2025-07-21T12:00:00Z"
},
"location": {
"country": {
"name": "UNITED_STATES",
"displayName": "United States",
"countryCode": "USA",
"alpha2Code": "US",
"alpha3Code": "USA"
},
"city": "New York",
"address": "123 Main Street, Apt 4B",
"address1": "123 Main Street",
"address2": "Apt 4B",
"state": "NY",
"postal_code": "10001",
"zip": "10001"
},
"breaches": [
{
"name": "SocialNet Breach",
"domain": "socialnet.com",
"type": "Database Breach",
"breached": "2023-11-01T00:00:00Z",
"start": "2023-10-15T00:00:00Z",
"stop": "2023-10-20T00:00:00Z",
"description": "User database with emails and hashed passwords was compromised.",
"site_description": "Social networking platform."
}
],
"downloaded": "2025-07-22T08:00:00Z"
},
"created": "2025-07-25T09:57:39Z"
}
],
"next_offset": "cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U"
}