v1

latestOpenAPI 3.1.12026-07-242899061.7 MB

Credentials

Incident Report

Get a detailed exposure incident report for a single malware log, including compromised credentials, device details, and malware attribution.

post/identity/incident/report

Request body

organization_idstring

sourcestring required

The dump source identifier (e.g., dump-redline-2024-07-21-001)

include_detailsboolean required

Include extended device and malware details in the response

limitinteger

Maximum number of credential entries to return

offsetstring

Pagination token for next page

Example request

{
  "organization_id": "uhash:a1b2c3d4",
  "source": "dump-redline-2024-07-21-001",
  "offset": "eyJsaW1pdCI6IDEwMCwgIm9mZnNldCI6IDEwMH0="
}

Response

Success

countinteger required

total_countinteger required

next_offsetstring

Example response

{
  "credentials": [
    {
      "authorization_domain": "login.microsoftonline.com",
      "email_or_login": "admin_user",
      "password": "CompanySecret!2024",
      "password_sha1": "2ef7bde608ce5404e97d5f042f95f89f1c232871",
      "domain_category": "Cloud Provider",
      "domain_technology": "Microsoft Office 365"
    }
  ],
  "details": {
    "malware_family": "RedLine Stealer",
    "os": "Windows 10 Pro",
    "os_username": "jsmith",
    "malware_file": "C:\\Users\\jsmith\\AppData\\Local\\Temp\\winmgr.exe",
    "timezone": "America/New_York",
    "uac": "UAC-Admin",
    "exfiltration_date": "2025-07-24T14:30:00Z",
    "antivirus": "Windows Defender",
    "ip_address": "198.51.100.14",
    "postal_code": "90210",
    "country": "United States"
  },
  "next_offset": "eyJsaW1pdCI6IDEwMCwgIm9mZnNldCI6IDIwMH0="
}