---
title: "GET /v1beta/projects/{project}/findings/{finding}"
method: GET
path: "/v1beta/projects/{project}/findings/{finding}"
tags: ["threatintelligence"]
---

# GET /v1beta/projects/{project}/findings/{finding}

`GET /v1beta/projects/{project}/findings/{finding}`

Get a finding by name.

## Path parameters

- `project` string, required
- `finding` string, required

## Headers

- `x-goog-user-project` string, required

## Response `default`

Successful operation

- Finding — A ‘stateless’ and a point in time event that a check produced a result of interest.
  - `name` string — Identifier. Server generated name for the finding (leave clear during creation). Format: projects/{project}/findings/{finding}
  - `provider` string, required — Required. Logical source of this finding (name of the sub-engine).
  - `displayName` string, required — Required. A short descriptive title for the finding <= 250 chars. EX: "Actor 'baddy' offering $1000 for credentials of 'goodguy'".
  - `detail` FindingDetail, required — Wrapper class that contains the union struct for all the various findings detail specific classes.
    - `initialAccessBroker` InitialAccessBrokerFindingDetail — A detail object for an Initial Access Broker (IAB) finding.
      - `matchScore` number, float, required — Required. Reference to the match score of the IAB finding. This is a float value between 0 and 1 calculated by the matching engine based on the similarity of the document and the user provided configurations.
      - `severity` 'SEVERITY_UNSPECIFIED' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required — Required. The severity of the IAB finding. This indicates the potential impact of the threat.
      - `documentId` string, required — Required. The unique identifier of the document that triggered the IAB finding. This ID can be used to retrieve the content of the document for further analysis.
    - `dataLeak` DataLeakFindingDetail — A detail object for a Data Leak finding.
      - `matchScore` number, float, required — Required. Reference to the match score of the Data Leak finding. This is a float value greater than 0 and less than or equal to 1 calculated by the matching engine based on the similarity of the document and the user provided configurations.
      - `severity` 'SEVERITY_UNSPECIFIED' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required — Required. The severity of the Data Leak finding. This indicates the potential impact of the threat.
      - `documentId` string, required — Required. The unique identifier of the document that triggered the Data Leak finding. This ID can be used to retrieve the content of the document for further analysis.
    - `insiderThreat` InsiderThreatFindingDetail — A detail object for a InsiderThreat finding.
      - `matchScore` number, float, required — Required. Reference to the match score of the InsiderThreat finding. This is a float value greater than 0 and less than or equal to 1 calculated by the matching engine based on the similarity of the document and the user provided configurations.
      - `severity` 'SEVERITY_UNSPECIFIED' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required — Required. The severity of the InsiderThreat finding. This indicates the potential impact of the threat.
      - `documentId` string, required — Required. The unique identifier of the document that triggered the InsiderThreat finding. This ID can be used to retrieve the content of the document for further analysis.
    - `detailType` string — Output only. Name of the detail type. Will be set by the server during creation to the name of the field that is set in the detail union.
  - `severity` number, float — Optional. Deprecated: Use the `severity_analysis` field instead. Base severity score from the finding source.
  - `reoccurrenceTimes` string[] — Output only. When identical finding (same labels and same details) has re-occurred.
  - `relevanceAnalysis` RelevanceAnalysis — Structured relevance analysis for a threat.
    - `relevant` boolean — Indicates whether the threat is considered relevant.
    - `confidence` 'CONFIDENCE_LEVEL_UNSPECIFIED' | 'CONFIDENCE_LEVEL_LOW' | 'CONFIDENCE_LEVEL_MEDIUM' | 'CONFIDENCE_LEVEL_HIGH'
    - `reasoning` string — Human-readable explanation from the matcher, detailing why a particular result is considered relevant or not relevant.
    - `evidence` Evidence — Details the evidence used to determine the relevance verdict.
      - `commonThemes` string[] — A list of semantic themes or concepts found to be common, related, or aligned between the sources, supporting the verdict.
      - `distinctThemes` string[] — A list of semantic themes or descriptions unique to one source or semantically distant.
    - `relevanceLevel` 'RELEVANCE_LEVEL_UNSPECIFIED' | 'RELEVANCE_LEVEL_LOW' | 'RELEVANCE_LEVEL_MEDIUM' | 'RELEVANCE_LEVEL_HIGH'
  - `severityAnalysis` SeverityAnalysis — Structured severity analysis for a threat.
    - `severityLevel` 'SEVERITY_LEVEL_UNSPECIFIED' | 'SEVERITY_LEVEL_LOW' | 'SEVERITY_LEVEL_MEDIUM' | 'SEVERITY_LEVEL_HIGH'
    - `confidence` 'CONFIDENCE_LEVEL_UNSPECIFIED' | 'CONFIDENCE_LEVEL_LOW' | 'CONFIDENCE_LEVEL_MEDIUM' | 'CONFIDENCE_LEVEL_HIGH'
    - `reasoning` string — Human-readable explanation from the model, detailing why a particular result is considered to have a certain severity.
  - `aiSummary` string — Optional. AI summary of the alert.
  - `audit` Audit — Tracks basic CRUD facts.
    - `updateTime` string, date-time — Output only. Time of creation or last update.
    - `createTime` string, date-time — Output only. Time of creation.
    - `creator` string — Output only. Agent that created or updated the record, could be a UserId or a JobId.
    - `updater` string — Output only. Agent that last updated the record, could be a UserId or a JobId.
  - `alert` string — Optional. Name of the alert that this finding is bound to.
  - `configurations` string[] — Optional. Configuration names that are bound to this finding.

---

[API](https://skmtc.net/virustotal/apis/threat-landscape.md) · [All operations](https://skmtc.net/virustotal/apis/threat-landscape/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/virustotal/threat-landscape/versions/d61b85e6a6b3/schema)