v1
latestOpenAPI 3.1.12026-07-242899061.7 MBActive Risks
Get a single active risk rule with enriched evidence
Fetch a single active risk rule for a company with paginated, rule-type-specific enriched evidence (open ports, leaked credentials, vulnerable products).
post/active/rule
Request body
Example request
{
"company": "B_E7B",
"rule_alias": "openPort",
"limit": 10,
"offset": 5
}Response
A single active risk rule (if active).
Example response
{
"entity": {
"id": "B_E7B",
"provided_id": "B_E7B",
"type": "Company",
"name": "Microsoft"
},
"risk_rule": {
"risk_id": "attr:d3079850-9fd1-11ec-ab46-acde48001122",
"risk_name": "Company IP With Often-Exploited Open Port",
"rule_alias": "openPort",
"criticality": 2,
"evidence": "100000+ sightings: 116847 company-owned IP addresses observed with open ports that are often exploited or insecure including <e id=ip:1.186.218.51>1.186.218.51</e> (1 port: <e id=iHVYYW>1433</e>; last seen September 19, 2025), <e id=ip:1.186.233.10>1.186.233.10</e> (1 port: <e id=gf0wYX>21</e>; last seen October 05, 2025), <e id=ip:1.186.248.158>1.186.248.158</e> (1 port: <e id=iHVx_1>445</e>; last seen September 13, 2025).",
"added": "2025-10-09T05:29:33.302Z",
"enriched_evidence": {
"evidence_type": "openPort",
"total": 123685,
"results": [
{
"ip": "ip:1.186.28.20",
"port": 23,
"first_seen": "2025-06-05T22:46:00.000Z",
"last_seen": "2025-10-06T01:12:00.000Z"
},
{
"ip": "ip:1.186.60.85",
"port": 21,
"first_seen": "2025-06-05T15:49:00.000Z",
"last_seen": "2025-10-05T19:38:00.000Z"
},
{
"ip": "ip:1.186.69.135",
"port": 445,
"first_seen": "2025-05-19T21:56:00.000Z",
"last_seen": "2025-09-13T21:14:00.000Z"
},
{
"ip": "ip:1.186.69.135",
"port": 3389,
"first_seen": "2025-05-19T21:56:00.000Z",
"last_seen": "2025-09-13T21:14:00.000Z"
},
{
"ip": "ip:1.186.85.65",
"port": 23,
"first_seen": "2025-06-05T22:46:00.000Z",
"last_seen": "2025-10-06T01:12:00.000Z"
}
]
}
}
}