> ## Documentation Index > Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt > Use this file to discover all available pages before exploring further. # Get threat indicators for a case ## OpenAPI ````yaml https://api.wirespeed.co/v1/openapi.json get /v1/cases/{id}/threat-indicators openapi: 3.0.0 info: title: Wirespeed API description: The public Wirespeed API. v1 is the first stable contract. version: '1.0' contact: {} servers: - url: https://api.wirespeed.co security: [] tags: [] paths: /v1/cases/{id}/threat-indicators: get: tags: - Cases summary: Get threat indicators for a case operationId: CasesController_threatIndicators parameters: - name: id required: true in: path description: Case identifier schema: type: string - name: size required: false in: query schema: type: number - name: page required: false in: query schema: type: number - name: filter required: false in: query schema: type: string - name: search required: false in: query schema: type: string - name: orderBy required: false in: query schema: type: string - name: orderDir required: false in: query schema: type: string enum: - asc - desc x-extensible-enum: true responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/ThreatIndicatorsPage' security: - bearer: [] components: schemas: ThreatIndicatorsPage: type: object properties: data: description: Paginated threat-indicator detections associated with the case type: array items: $ref: '#/components/schemas/DetectionWithEntities' totalCount: type: number description: Total number of threat-indicator detections matching the case required: - data - totalCount DetectionWithEntities: type: object properties: id: type: string description: Unique identifier for the detection teamId: type: string description: ID of the team that owns this detection teamName: type: string description: Name of the team that owns this detection sourceDescription: type: string description: Description from the source system notes: type: string description: User-added notes about the detection sourceName: type: string description: Name of the source that generated this detection status: type: string enum: - PREFLIGHT - NEW - PROCESSING - ESCALATED - HUNTING - MONITORING - CHATOPS - CLOSED description: Current status of the detection x-extensible-enum: true createdAt: type: string description: Timestamp when the detection was created containments: type: array description: Types of containment actions performed items: type: string enum: - USER - PROCESS - USER_AGENT - FILE - ENDPOINT - LOCATION - IP - DOMAIN x-extensible-enum: true testMode: type: boolean description: Whether this detection is in test mode caseId: type: string description: ID of the case this detection belongs to sourceIngestedAt: type: string description: Timestamp when the detection was ingested by Wirespeed sourceDetectedAt: type: string description: Timestamp when the detection was originally detected by source verdictedAt: type: string description: Timestamp when the detection verdict was assigned updatedAt: type: string description: Timestamp when the detection was last updated closedAt: type: string description: Timestamp when the detection was closed logs: description: Chronological log entries for this detection type: array items: $ref: '#/components/schemas/JSONLog' raw: type: object description: Raw detection data from the source system refreshRaw: type: object description: Raw detection data from the most recent refresh lastRefreshAt: type: string description: Timestamp of the last successful detection refresh verdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN description: Final verdict assigned to the detection x-extensible-enum: true helpfulnessRating: type: string enum: - happy - neutral - unhappy nullable: true description: Helpfulness feedback selected when detection was resolved x-extensible-enum: true title: type: string description: Display title for the detection integrationPlatform: type: string enum: - acronis - admin-by-request - agger-labs - anthropic - aws - axonius - barracuda-cloudgen-firewall - bitwarden - box - checkpoint-firewall - checkpoint-harmony - cisco-asa - cisco-catalyst - cisco-duo - cisco-meraki - cisco-secure-access - cisco-umbrella - connectwise-psa - crowdstrike-falcon - cyberark - darktrace - dfir-iris - email - exium - fleet-dm - fortianalyzer - fortinet - freshservice - generic-json - generic-syslog - github - github-enterprise-cloud - google-alert-center - google-chronicle - google-directory - google-security-center - halcyon - halo-itsm - have-i-been-pwned - horizon3 - hyas-protect - ipinfo - jamf-internet-security - jamf-pro - jamf-protect - jira-cloud - jira-data-center - jumpcloud - kandji - manage-engine-ad-audit-plus - microsoft - microsoft-entra - microsoft-teams - microsoft-teams-v2 - mimecast - netskope - ninjaone - odoo-helpdesk - okta - one-password - onelogin - openai - orca-security - pager-duty - palo-alto-networks-cortex - palo-alto-ngfw - perception-point - picus - ping-one - proofpoint - reversing-labs - safebreach - sandfly - sentinel-one - service-now - slack - sms - smtp - sonic-wall - sophos - splunk - stairwell - sublime-security - tenable-nessus - thinkst-canary - tracebit - unifi - vectra - watchguard-firebox - windows-event-logs - wirespeed - wiz - wordfence - zabbix - zscaler-zpa description: Source integration platform that generated this detection x-extensible-enum: true integrationId: type: string description: ID of the integration instance that generated this detection duplicateDetectionId: type: string description: ID of the original detection if this is a duplicate contained: type: boolean description: Whether containment actions were performed on this detection nextSteps: type: string description: AI-generated recommended next steps for this detection reingested: type: boolean description: Whether this detection was reprocessed after initial ingestion prevented: type: boolean description: Whether the detected threat was successfully prevented managedByThirdParty: type: boolean description: >- Whether this detection is managed by a third-party service (e.g. Falcon Complete) excludeFromMeans: type: boolean description: >- Whether to exclude this detection from MTTC and other metrics calculations caseSid: type: string description: Short identifier for the case this detection belongs to sid: type: string description: Short identifier for this detection firstRun: type: boolean description: Whether this is the first time this detection has been processed containOnChatOpsFailure: type: boolean description: Whether to automatically contain if ChatOps workflow fails wasEscalated: type: boolean description: Whether this detection was escalated to external systems alwaysNotifyApplied: type: boolean description: Whether Always Notify policy forced escalation for this detection escalatedAt: type: string description: Timestamp when the detection was escalated ocsfDetectionFinding: type: object description: OCSF standardized detection finding data sourceUrl: type: string nullable: true description: URL for this detection in its source system actionSlug: type: string description: Slug identifier for the action taken on this detection exclusionId: type: string description: ID of the exclusion rule that matches this detection exclusionSid: type: string description: Short identifier for the exclusion rule that matches this detection autoClosed: type: boolean description: Whether this detection was automatically contained by the system autoContained: type: boolean category: type: string enum: - OTHER__DIAGNOSTIC - OTHER__INFORMATIONAL_EVENT - OTHER__WARNING - OTHER__UNKNOWN - OTHER__DECEPTION - OTHER__DECEPTION__SIMULATION - OTHER__CUSTOM_DETECTION - CLOUD__INVOCATION - CLOUD__DISCOVERY - CLOUD__DATA_TRANSFER - CLOUD__PERSISTENCE - CLOUD__PUBLIC_BUCKET - ENDPOINT__DISCOVERY - ENDPOINT__EXECUTION - ENDPOINT__LIVE_OFF_THE_LAND - ENDPOINT__NUISANCE - ENDPOINT__MALWARE_DISCOVERY - ENDPOINT__MALWARE_EXECUTION - ENDPOINT__LATE_STAGE - ENDPOINT__PERSISTENCE - ENDPOINT__REMOTE_MANAGEMENT - ENDPOINT__LATERAL_MOVEMENT - ENDPOINT__IMPACT - ENDPOINT__EVASION - ENDPOINT__EXPLOITATION - ENDPOINT__SIMULATION - ENDPOINT__PLANNED_CHANGE - IDENTITY__LOGIN - IDENTITY__REJECTED_MFA - IDENTITY__DISCOVERY - IDENTITY__BRUTE_FORCE - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE - IDENTITY__PERSISTENCE - IDENTITY__ACCOUNT_COMPROMISE - IDENTITY__OAUTH_GRANT - IDENTITY__SIMULATION - IDENTITY__PLANNED_CHANGE - NETWORK__INBOUND_CONNECTION - NETWORK__OUTBOUND_CONNECTION - NETWORK__PHISHING - NETWORK__NOISY - NETWORK__DISCOVERY - EMAIL__PHISHING - EMAIL__PHISHING_REPORTED - EMAIL__EVASION - EMAIL__MALWARE - EMAIL__MALICIOUS_LINK - EMAIL__GRAYMAIL - EMAIL__SPAM - EMAIL__BUSINESS_EMAIL_COMPROMISE - EMAIL__MAILBOX_RULE - DATA__DATA_TRANSFER - DATA__DATA_SHARE - POSTURE__POSTURE - POSTURE__HEALTH description: Security category classification for this detection x-extensible-enum: true verdictSetting: description: Verdict rule configuration that was applied to this detection allOf: - $ref: '#/components/schemas/PartialVerdictSetting' chatOpsTest: type: boolean description: Whether this detection is part of a ChatOps test scenario severity: type: string enum: - INFORMATIONAL - LOW - MEDIUM - HIGH - CRITICAL description: Severity level of the detection x-extensible-enum: true severityOrdinal: type: number description: Numeric representation of severity for sorting purposes containsVIP: type: boolean description: Whether this detection involves VIP users containsHVA: type: boolean description: Whether this detection involves critical assets excluded: type: boolean description: Whether this detection is excluded by an exclusion rule chatOpsTestEmail: type: string description: Email address for ChatOps testing notifications chatOpsTestPhoneNumber: type: string description: Phone number for ChatOps testing notifications customDetectionId: type: string description: ID of the custom detection that detected this detection externalCustomDetectionId: type: string description: ID of the external custom detection rule that matched this detection autoRemediateStartedAt: type: string description: Timestamp when auto remediation started remediatedAt: type: string description: Timestamp when remediation was completed endpoints: description: Endpoints involved in this detection type: array items: $ref: '#/components/schemas/Endpoint' files: description: Files involved in this detection type: array items: $ref: '#/components/schemas/File' processes: description: Processes involved in this detection type: array items: $ref: '#/components/schemas/Process' locations: description: Geographic locations involved in this detection type: array items: $ref: '#/components/schemas/Location' directory: description: Directory users involved in this detection type: array items: $ref: '#/components/schemas/DirectoryUser' ips: description: IP addresses involved in this detection type: array items: $ref: '#/components/schemas/IP' domains: description: Domains involved in this detection type: array items: $ref: '#/components/schemas/Domain' fileRisk: type: string enum: - BENIGN - MALWARE - LATE_STAGE - NUISANCE - LIVE_OFF_THE_LAND - REMOTE_MANAGEMENT - UNKNOWN description: Highest risk level among all files in this detection x-extensible-enum: true userAgents: description: User agents involved in this detection type: array items: $ref: '#/components/schemas/UserAgent' artifacts: description: Embedded artifacts extracted from this detection type: array items: $ref: '#/components/schemas/ExtractionArtifactDto' processTree: nullable: true description: Normalized process hierarchy extracted from this detection allOf: - $ref: '#/components/schemas/ProcessTreeDto' whatHappened: type: string description: AI-generated summary of what happened in this detection chatOpsActions: description: ChatOps actions performed on this detection type: array items: $ref: '#/components/schemas/ActionChatops' containmentActions: description: Containment actions performed on this detection type: array items: $ref: '#/components/schemas/ActionContainWithUser' customDetection: description: Wirespeed custom detection rule that fired this alert allOf: - $ref: '#/components/schemas/CustomDetection' externalCustomDetection: description: Imported vendor rule that fired this alert allOf: - $ref: '#/components/schemas/ExternalCustomDetectionDto' groups: type: string nullable: true description: CSV of unique group names from endpoints and directory users groupNames: description: >- Unique group names from endpoints and directory users on this detection type: array items: type: string required: - id - teamId - status - createdAt - containments - testMode - sourceIngestedAt - sourceDetectedAt - logs - raw - verdict - title - integrationPlatform - contained - reingested - prevented - managedByThirdParty - excludeFromMeans - sid - firstRun - containOnChatOpsFailure - wasEscalated - alwaysNotifyApplied - ocsfDetectionFinding - category - chatOpsTest - severity - severityOrdinal - containsVIP - containsHVA - excluded - endpoints - files - processes - locations - directory - ips - domains - fileRisk - artifacts - whatHappened - chatOpsActions - containmentActions - groupNames JSONLog: type: object properties: log: type: string description: Log message content timestamp: type: string description: Timestamp when the log was created debug: type: boolean description: Whether this is a debug log entry required: - log - timestamp - debug PartialVerdictSetting: type: object properties: id: type: string stage: type: string enum: - TRIAGE - HUNT - MONITOR x-extensible-enum: true default: type: boolean managedByWspd: type: boolean category: type: string enum: - OTHER__DIAGNOSTIC - OTHER__INFORMATIONAL_EVENT - OTHER__WARNING - OTHER__UNKNOWN - OTHER__DECEPTION - OTHER__DECEPTION__SIMULATION - OTHER__CUSTOM_DETECTION - CLOUD__INVOCATION - CLOUD__DISCOVERY - CLOUD__DATA_TRANSFER - CLOUD__PERSISTENCE - CLOUD__PUBLIC_BUCKET - ENDPOINT__DISCOVERY - ENDPOINT__EXECUTION - ENDPOINT__LIVE_OFF_THE_LAND - ENDPOINT__NUISANCE - ENDPOINT__MALWARE_DISCOVERY - ENDPOINT__MALWARE_EXECUTION - ENDPOINT__LATE_STAGE - ENDPOINT__PERSISTENCE - ENDPOINT__REMOTE_MANAGEMENT - ENDPOINT__LATERAL_MOVEMENT - ENDPOINT__IMPACT - ENDPOINT__EVASION - ENDPOINT__EXPLOITATION - ENDPOINT__SIMULATION - ENDPOINT__PLANNED_CHANGE - IDENTITY__LOGIN - IDENTITY__REJECTED_MFA - IDENTITY__DISCOVERY - IDENTITY__BRUTE_FORCE - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE - IDENTITY__PERSISTENCE - IDENTITY__ACCOUNT_COMPROMISE - IDENTITY__OAUTH_GRANT - IDENTITY__SIMULATION - IDENTITY__PLANNED_CHANGE - NETWORK__INBOUND_CONNECTION - NETWORK__OUTBOUND_CONNECTION - NETWORK__PHISHING - NETWORK__NOISY - NETWORK__DISCOVERY - EMAIL__PHISHING - EMAIL__PHISHING_REPORTED - EMAIL__EVASION - EMAIL__MALWARE - EMAIL__MALICIOUS_LINK - EMAIL__GRAYMAIL - EMAIL__SPAM - EMAIL__BUSINESS_EMAIL_COMPROMISE - EMAIL__MAILBOX_RULE - DATA__DATA_TRANSFER - DATA__DATA_SHARE - POSTURE__POSTURE - POSTURE__HEALTH x-extensible-enum: true wspdRule: type: string retired: type: boolean escalate: type: boolean chatOps: type: boolean close: type: boolean disabled: type: boolean containUserActions: type: array items: type: string enum: - disable - reset_mfa - reset_password - revoke_sessions x-extensible-enum: true containEndpointActions: type: array items: type: string enum: - isolate - lock x-extensible-enum: true containFileActions: type: array items: type: string enum: - delete - quarantine x-extensible-enum: true uncontainUserActions: type: array items: type: string enum: - enable x-extensible-enum: true uncontainEndpointActions: type: array items: type: string enum: - unisolate - unlock x-extensible-enum: true uncontainFileActions: type: array items: type: string enum: - unquarantine x-extensible-enum: true chatOpsMFA: type: boolean monitor: type: boolean monitorFallbackPreset: type: string enum: - ESCALATE - ESCALATE_CONTAIN - CLOSE x-extensible-enum: true vipChatOps: type: boolean createdAt: type: string updatedAt: type: string teamId: type: string chatOpsTimeoutVerdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN x-extensible-enum: true chatOpsTimeoutMonitor: type: boolean chatOpsTimeoutClose: type: boolean chatOpsUnsureVerdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN x-extensible-enum: true verdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN x-extensible-enum: true description: type: string managedByParent: type: boolean severity: type: string enum: - INFORMATIONAL - LOW - MEDIUM - HIGH - CRITICAL x-extensible-enum: true useSourceSeverity: type: boolean ignoresRemediation: type: boolean defaults: nullable: true allOf: - $ref: '#/components/schemas/PartialVerdictSetting' Endpoint: type: object properties: sourceDispositions: type: array description: >- Actions the source product reported taking on this asset for the detection items: $ref: '#/components/schemas/SourceDisposition' id: type: string description: Unique identifier for the endpoint displayName: type: string description: Human-readable display name for the endpoint teamId: type: string description: ID of the team that owns this endpoint edrSourceId: type: string description: ID from the EDR (Endpoint Detection & Response) system mdmSourceId: type: string description: ID from the MDM (Mobile Device Management) system name: type: string description: Name of the endpoint hva: type: boolean description: Indicates if this is a Critical Asset hvaOverriddenByUser: type: boolean description: >- Indicates if the Critical Asset status was manually overridden by a user createdAt: type: string description: Timestamp when the endpoint was created privateIpAddress: type: string description: Private IP address of the endpoint live: type: boolean description: Indicates if the endpoint is currently active/online operatingSystem: type: string description: Operating system of the endpoint operatingSystemCategory: type: string enum: - Windows - Windows Server - macOS - Linux - iOS - Android - ChromeOS - Network Device - Other description: Categorized operating system type x-extensible-enum: true integrationId: type: string nullable: true description: ID of the integration that discovered this endpoint canonicalId: type: string nullable: true description: >- When set, this row is a duplicate source; points at the canonical representative endpoint id canonicalClusterMemberCount: type: number nullable: true description: >- Child endpoint rows in the same canonical cluster (canonical_id = root), excluding the root row; null when there are no children canonicalClusterMembers: nullable: true description: >- Preview of other integration-backed rows in the same canonical cluster (at most five children when count exceeds five); null when none example: - id: 22222222-2222-2222-2222-222222222201 displayLabel: WS-SAMPLE-BRAVO-WKS$ integrationId: aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0002 integrationPlatform: sentinel-one name: WS-SAMPLE-BRAVO-WKS$ managed: true live: true operatingSystem: Windows11 - 23H2 createdAt: '2025-01-02T00:00:00.000Z' updatedAt: '2025-01-15T12:00:00.000Z' - id: 22222222-2222-2222-2222-222222222202 displayLabel: WS-SAMPLE-CHARLIE-WKS$ integrationId: aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0003 integrationPlatform: crowdstrike-falcon name: WS-SAMPLE-CHARLIE-WKS$ managed: true live: true operatingSystem: Windows 10 Enterprise 22H2 (OS build 19045.4046) createdAt: '2025-01-03T00:00:00.000Z' updatedAt: '2025-01-15T12:00:00.000Z' type: array items: $ref: '#/components/schemas/CanonicalAssetClusterMemberDto' contained: type: boolean description: Indicates if the endpoint has been contained/isolated managed: type: boolean description: Indicates if the endpoint is managed by MDM/EDR publicIpAddress: type: string description: Public IP address associated with this endpoint workstation: type: boolean description: Indicates if this is a workstation device server: type: boolean description: Indicates if this is a server device mobile: type: boolean description: Indicates if this is a mobile device domainController: type: boolean description: Indicates if this is a domain controller lastSeenAt: type: string description: Timestamp when the endpoint was last seen updatedAt: type: string description: Timestamp when the endpoint was last updated raw: type: object description: Raw data from the integration source groups: description: Groups assigned to this endpoint type: array items: $ref: '#/components/schemas/EndpointGroupDTO' groupContainmentEnabled: type: boolean description: Whether all groups on this endpoint allow containment groupChatOpsEnabled: type: boolean description: Whether all groups on this endpoint allow chat ops groupSourceSystemUpdates: type: boolean description: >- Whether all groups on this endpoint allow outbound updates to the source product groupsSynced: type: boolean description: Whether this endpoint has had its first round of group checks run lockPin: type: string nullable: true description: >- Lock PIN for this device, set when the device was locked via MDM (e.g. JumpCloud Apple MDM). Null if not locked or PIN not available. required: - id - displayName - teamId - hva - createdAt - integrationId - contained - workstation - server - mobile - domainController - groups - groupContainmentEnabled - groupChatOpsEnabled - groupSourceSystemUpdates - groupsSynced File: type: object properties: id: type: string displayName: type: string teamId: type: string name: type: string path: type: string sha256: type: string sha1: type: string toolName: type: string createdAt: type: string updatedAt: type: string lastEnrichedAt: type: string nullable: true nameWithPath: type: string fileRisk: type: string enum: - BENIGN - MALWARE - LATE_STAGE - NUISANCE - LIVE_OFF_THE_LAND - REMOTE_MANAGEMENT - UNKNOWN x-extensible-enum: true metadata: $ref: '#/components/schemas/FileMetadata' enrichedViaIntegration: type: boolean contained: type: boolean sourceDispositions: type: array description: >- Actions the source product reported taking on this asset for the detection items: $ref: '#/components/schemas/SourceDisposition' required: - id - displayName - teamId - createdAt - updatedAt - fileRisk - enrichedViaIntegration Process: type: object properties: sourceDispositions: type: array description: >- Actions the source product reported taking on this asset for the detection items: $ref: '#/components/schemas/SourceDisposition' id: type: string displayName: type: string teamId: type: string command: type: string sha256: type: string sha1: type: string createdAt: type: string required: - id - displayName - teamId - createdAt Location: type: object properties: id: type: string displayName: type: string teamId: type: string lat: type: string lon: type: string city: type: string state: type: string country: type: string countryCode: type: string continent: type: string continentCode: type: string createdAt: type: string required: - id - displayName - teamId - createdAt DirectoryUser: type: object properties: id: type: string description: Unique identifier for the directory user displayName: type: string description: Display name for the user teamId: type: string description: Team ID that owns this user enabled: type: boolean description: Whether the user account is enabled directoryId: type: string description: Directory-specific identifier for the user name: type: string description: Full name of the user phoneNumber: type: string description: Phone number of the user previousPhoneNumber: type: string description: Previous phone number if changed title: type: string description: Job title of the user email: type: string description: Email address of the user additionalEmails: description: Additional email addresses of the user type: array items: type: string allEmails: description: All email addresses of the user (primary + additional) type: array items: type: string vip: type: boolean description: Whether the user is marked as VIP nhi: type: boolean description: Whether the user is non-human identity (service account) financial: type: boolean description: Whether the user has financial access/permissions technical: type: boolean description: Whether the user has technical access/permissions external: type: boolean description: Whether the user is external managerDirectoryId: type: string description: Directory ID of the user's manager managerEmail: type: string description: Email address of the user's manager domain: type: string description: Domain the user belongs to department: type: string description: Department the user works in createdAt: type: string description: Timestamp when the user was created integrationId: type: string nullable: true description: ID of the integration this user came from canonicalId: type: string nullable: true description: >- When set, this row is a duplicate source; points at the canonical representative row id canonicalClusterMemberCount: type: number nullable: true description: >- Child directory user rows in the same canonical cluster (canonical_id = root), excluding the root row; null when there are no children canonicalClusterMembers: nullable: true description: >- Preview of other integration-backed rows in the same canonical cluster (at most five children when count exceeds five); null when none example: - id: 22222222-2222-2222-2222-222222222201 displayLabel: WS-SAMPLE-BRAVO-WKS$ integrationId: aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0002 integrationPlatform: sentinel-one name: WS-SAMPLE-BRAVO-WKS$ managed: true live: true operatingSystem: Windows11 - 23H2 createdAt: '2025-01-02T00:00:00.000Z' updatedAt: '2025-01-15T12:00:00.000Z' - id: 22222222-2222-2222-2222-222222222202 displayLabel: WS-SAMPLE-CHARLIE-WKS$ integrationId: aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0003 integrationPlatform: crowdstrike-falcon name: WS-SAMPLE-CHARLIE-WKS$ managed: true live: true operatingSystem: Windows 10 Enterprise 22H2 (OS build 19045.4046) createdAt: '2025-01-03T00:00:00.000Z' updatedAt: '2025-01-15T12:00:00.000Z' type: array items: $ref: '#/components/schemas/CanonicalAssetClusterMemberDto' canonicalClusterEmails: description: >- Every email address across the whole canonical cluster (this row plus every linked source row), so authentication history reads span all of the directories the person exists in rather than the single source being viewed. Falls back to this row's emails when the row has no cluster. type: array items: type: string roles: description: Roles assigned to the user nullable: true type: array items: type: string lastCredentialExposure: type: string nullable: true description: Timestamp of the last credential exposure credentialsExposed: type: boolean description: Whether the user's credentials have been exposed numberCredentialExposures: type: number description: Number of times user credentials have been exposed lastCheckedForCredentialExposures: type: string nullable: true description: Timestamp when last checked for credential exposures needsChatOpsWelcome: type: boolean description: Whether user needs to receive chat operations welcome message contained: type: boolean description: Whether the user is currently contained username: type: string description: Username for the user account containable: type: boolean description: >- Whether the user can be contained via automation. Deprecated — use isUserContainable logic in the containment dialog instead. This is just an alias to user.managed deprecated: true smsConsentReceivedAt: type: string nullable: true description: Timestamp when SMS consent was received smsInviteAttempts: type: number description: Number of SMS invite attempts sent smsInviteLastSentAt: type: string description: Timestamp of last SMS invite sent smsInviteOptOut: type: boolean description: Whether user opted out of SMS invites administrator: type: boolean description: Whether the user has administrative privileges updatedAt: type: string description: Timestamp when the user was last updated passwordLastChangedAt: type: string description: Timestamp when password was last changed lastSignInAt: type: string description: Timestamp of the user's last sign-in raw: type: object description: Raw data from the directory source groups: description: Groups assigned to this user type: array items: $ref: '#/components/schemas/DirectoryUserGroupDTO' licenses: description: Licenses assigned by this user directory integration type: array items: $ref: '#/components/schemas/DirectoryUserLicense' managed: type: boolean description: Whether the user is managed by an integration chatOpsOnboardingUser: type: boolean description: Whether the user is in the chat ops onboarding group groupContainmentEnabled: type: boolean description: Whether all groups on this user allow containment groupChatOpsEnabled: type: boolean description: Whether all groups on this user allow chat ops groupSourceSystemUpdates: type: boolean description: >- Whether all groups on this user allow outbound updates to the source product groupsSynced: type: boolean description: Whether this user has had its first round of group checks run verifiedPhoneNumber: type: string description: Verified phone number of the user emailDirection: type: string enum: - sender - receiver description: Email direction when user is associated with an email detection x-extensible-enum: true sourceDispositions: type: array description: >- Actions the source product reported taking on this asset for the detection items: $ref: '#/components/schemas/SourceDisposition' required: - id - displayName - teamId - additionalEmails - allEmails - createdAt - integrationId - canonicalClusterEmails - credentialsExposed - numberCredentialExposures - containable - smsInviteAttempts - groups - licenses - groupContainmentEnabled - groupChatOpsEnabled - groupSourceSystemUpdates - groupsSynced IP: type: object properties: sourceDispositions: type: array description: >- Actions the source product reported taking on this asset for the detection items: $ref: '#/components/schemas/SourceDisposition' ipv4: type: string description: IPv4 address ipv6: type: string description: IPv6 address metadata: description: Enriched metadata about the IP address allOf: - $ref: '#/components/schemas/IPInfoMetadataImpl' displayName: type: string description: Display name for the IP address id: type: string description: Unique identifier for the IP address teamId: type: string description: Team ID that owns this IP address createdAt: type: string description: Timestamp when the IP was created updatedAt: type: string description: Timestamp when the IP was last updated locationId: type: string description: Associated location ID metadataLastFetchedAt: type: string description: Timestamp when metadata was last fetched required: - displayName - id - teamId - createdAt - updatedAt - metadataLastFetchedAt Domain: type: object properties: sourceDispositions: type: array description: >- Actions the source product reported taking on this asset for the detection items: $ref: '#/components/schemas/SourceDisposition' id: type: string description: Unique identifier for the domain displayName: type: string description: Display name for the domain teamId: type: string description: Team ID that owns this domain name: type: string description: Domain name createdAt: type: string description: Timestamp when the domain was created required: - id - displayName - teamId - name - createdAt UserAgent: type: object properties: id: type: string userAgent: type: string userAgentAlt: type: string teamId: type: string createdAt: type: string displayName: type: string browserName: type: string browserVersion: type: string browserMajorVersion: type: string cpuArchitecture: type: string deviceModel: type: string deviceVendor: type: string engineName: type: string engineVersion: type: string osName: type: string osVersion: type: string required: - id - userAgent - teamId - createdAt - displayName ExtractionArtifactDto: type: object properties: type: type: string enum: - MAILBOX_RULE x-extensible-enum: true data: $ref: '#/components/schemas/MailboxRuleArtifactDataDto' required: - type - data ProcessTreeDto: type: object properties: nodes: type: array items: $ref: '#/components/schemas/ProcessTreeNodeDto' limitsHit: nullable: true description: Present when ingest or response sanitization truncated this tree allOf: - $ref: '#/components/schemas/ProcessTreeLimitsHitDto' required: - nodes ActionChatops: type: object properties: id: type: string description: Unique identifier for the chat ops action teamId: type: string description: Team ID that owns this chat ops action directoryUserId: type: string description: Directory user ID associated with this chat ops action integrationId: type: string nullable: true description: Integration ID used for this chat ops action detectionId: type: string description: Detection ID associated with this chat ops action caseId: type: string description: Case ID associated with this chat ops action mfaAttempts: type: number description: Number of MFA attempts createdAt: type: string description: Timestamp when the chat ops action was created message: type: string description: Message sent in the chat ops action settingsAtTimeOfAction: type: object description: Settings at the time of the action respondedAt: type: string description: Timestamp when the user responded ipAddress: type: string description: IP address of the user verdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN description: Verdict assigned to this chat ops action x-extensible-enum: true isSuccessful: type: boolean description: Whether the action was successful isTimeout: type: boolean description: Whether the action timed out isRateLimited: type: boolean description: Whether the action is rate limited isOverride: type: boolean description: >- Whether the action was overridden by closing the detection/case while chatops was active isMfaSuccess: type: boolean description: Whether MFA was successful isMfaFailure: type: boolean description: Whether MFA failed isMfaUnavailable: type: boolean description: Whether MFA is unavailable mfaRespondedAt: type: string description: Timestamp when MFA was responded to required: - id - teamId - directoryUserId - integrationId - detectionId - mfaAttempts - createdAt - isSuccessful - isTimeout - isRateLimited - isOverride ActionContainWithUser: type: object properties: id: type: string description: Unique identifier for the containment action teamId: type: string description: Team ID that owns this containment action detectionId: type: string description: Detection ID associated with this containment caseId: type: string description: Case ID associated with this containment type: type: string enum: - directory_user - endpoint - file description: Type of containment action x-extensible-enum: true action: type: string enum: - contain - uncontain description: Action performed x-extensible-enum: true endpointId: type: string description: Endpoint ID for endpoint containment directoryUserId: type: string description: Directory user ID for user containment fileId: type: string description: File ID for file containment userId: type: string description: User ID who performed the action result: type: string enum: - success - pending - failure description: Result of the containment action x-extensible-enum: true integrationResponse: type: object description: Integration response data subAction: type: string description: Specific sub-action performed (e.g., disable, reset_password) integrationId: type: string description: Integration that performed the action createdAt: type: string description: Timestamp when the containment action was performed integrationPlatform: type: string description: Platform of the integration that executed the containment action required: - id - teamId - type - action - createdAt CustomDetection: type: object properties: id: type: string description: Unique identifier for the custom detection name: type: string description: Name of the custom detection category: type: string description: Category of the custom detection description: type: string description: Description of the custom detection query: type: string description: SIEM 2.0 WHERE predicate for the custom detection legacyQuery: type: string nullable: true description: Original full-SQL query retained for migration auditing sourceTable: type: string nullable: true description: SIEM 2.0 source table; null only for rows awaiting manual migration lastRan: type: string description: Timestamp when the custom detection was last run createdAt: type: string description: Timestamp when the custom detection was created enabled: type: boolean description: Whether the custom detection is enabled alwaysNotify: type: boolean description: >- Always notify for detections from this rule, even when the verdict would resolve or only run chat ops deduplication: nullable: true description: Asset-aware suppression policy allOf: - $ref: '#/components/schemas/DetectionRuleDeduplicationDto' createdBy: type: string description: Email or ID of the user who created the custom detection updatedAt: type: string description: Timestamp when the custom detection was last edited updatedBy: type: string description: Email or ID of the user who last edited the custom detection required: - id - name - category - query - lastRan - createdAt - enabled - alwaysNotify - createdBy - updatedAt - updatedBy ExternalCustomDetectionDto: type: object properties: id: type: string teamId: type: string integrationId: type: string provider: type: string sourceActionSlug: type: string sourceRuleId: type: string name: type: string description: type: string severity: type: string severityOrdinal: type: number status: type: string category: type: string aiSuggestedCategory: type: string aiReasoning: type: string classifiedAt: type: string query: type: string queryLanguage: type: string ruleGroup: type: string ruleType: type: string alwaysNotify: type: boolean providerEnabled: type: boolean providerMetadata: type: object sampleDetection: type: object providerCreatedAt: type: string providerUpdatedAt: type: string lastSyncedAt: type: string createdAt: type: string updatedAt: type: string deletedAt: type: string required: - id - teamId - integrationId - provider - sourceRuleId - name - severityOrdinal - status - alwaysNotify - providerEnabled - lastSyncedAt - createdAt - updatedAt SourceDisposition: type: string enum: - BLOCKED - QUARANTINED - KILLED - REMEDIATED - ISOLATED - PASSWORD_RESET - ACTION_FAILED x-extensible-enum: true CanonicalAssetClusterMemberDto: type: object properties: id: type: string description: Directory user or endpoint id displayLabel: type: string description: Display label for the row integrationId: type: string nullable: true description: Integration id for this source row integrationPlatform: type: string enum: - acronis - admin-by-request - agger-labs - anthropic - aws - axonius - barracuda-cloudgen-firewall - bitwarden - box - checkpoint-firewall - checkpoint-harmony - cisco-asa - cisco-catalyst - cisco-duo - cisco-meraki - cisco-secure-access - cisco-umbrella - connectwise-psa - crowdstrike-falcon - cyberark - darktrace - dfir-iris - email - exium - fleet-dm - fortianalyzer - fortinet - freshservice - generic-json - generic-syslog - github - github-enterprise-cloud - google-alert-center - google-chronicle - google-directory - google-security-center - halcyon - halo-itsm - have-i-been-pwned - horizon3 - hyas-protect - ipinfo - jamf-internet-security - jamf-pro - jamf-protect - jira-cloud - jira-data-center - jumpcloud - kandji - manage-engine-ad-audit-plus - microsoft - microsoft-entra - microsoft-teams - microsoft-teams-v2 - mimecast - netskope - ninjaone - odoo-helpdesk - okta - one-password - onelogin - openai - orca-security - pager-duty - palo-alto-networks-cortex - palo-alto-ngfw - perception-point - picus - ping-one - proofpoint - reversing-labs - safebreach - sandfly - sentinel-one - service-now - slack - sms - smtp - sonic-wall - sophos - splunk - stairwell - sublime-security - tenable-nessus - thinkst-canary - tracebit - unifi - vectra - watchguard-firebox - windows-event-logs - wirespeed - wiz - wordfence - zabbix - zscaler-zpa nullable: true description: Integration platform when joined from integration table x-extensible-enum: true name: type: string nullable: true username: type: string nullable: true email: type: string nullable: true additionalEmails: nullable: true type: array items: type: string roles: nullable: true type: array items: type: string title: type: string nullable: true department: type: string nullable: true managed: type: boolean nullable: true enabled: type: boolean nullable: true createdAt: type: string nullable: true updatedAt: type: string nullable: true live: type: boolean nullable: true operatingSystem: type: string nullable: true privateIpAddress: type: string nullable: true publicIpAddress: type: string nullable: true required: - id - displayLabel - integrationId EndpointGroupDTO: type: object properties: id: type: string description: Unique identifier for the endpoint group endpointId: type: string description: ID of the endpoint this group belongs to group: type: string description: Group type (system enum or custom string) teamId: type: string description: Team ID that owns this group enabled: type: boolean description: Whether the group is currently enabled createdAt: type: string description: Timestamp when the group was created overriddenByUser: type: boolean description: Whether the group was manually overridden by a user overriddenByUserId: type: string description: ID of the user who manually overrode the group overriddenByUserIdentifier: type: string nullable: true description: >- Email of the user who manually overrode the group (persists after user deletion) groupId: type: string description: Group ID from the group table groupName: type: string description: Display name of the associated group groupSlug: type: string description: Slug of the associated group groupContainmentEnabled: type: boolean description: Whether the associated group allows containment groupChatOpsEnabled: type: boolean description: Whether the associated group allows chat ops groupSourceSystemUpdates: type: boolean description: >- Whether the associated group allows outbound updates to the source product groupAlwaysNotify: type: boolean description: >- Whether the associated group always escalates detections for notification groupRuleSearch: type: string description: >- Search expression from the group rule that added this group membership groupRuleSearchField: type: string description: Search field from the group rule that added this group membership groupRuleSearchType: type: string enum: - text - regexp description: Search type from the group rule that added this group membership x-extensible-enum: true required: - id - endpointId - group - teamId - enabled - createdAt - overriddenByUser - groupId FileMetadata: type: object properties: threatNames: type: array items: $ref: '#/components/schemas/ThreatName' lastScanTime: type: string story: type: string versionInfo: type: array items: $ref: '#/components/schemas/FileMetadataVersionInfo' proposedFileNames: type: array items: type: string fileNameCatalogMatches: type: array items: type: string required: - threatNames - versionInfo - proposedFileNames - fileNameCatalogMatches DirectoryUserGroupDTO: type: object properties: id: type: string description: Unique identifier for the user group directoryUserId: type: string description: ID of the directory user this group belongs to group: type: string description: Type of group assigned to the user teamId: type: string description: Team ID that owns this group overriddenByUser: type: boolean description: Whether the group was manually overridden by a user overriddenByUserId: type: string description: ID of the user who manually overrode the group nullable: true overriddenByUserIdentifier: type: string nullable: true description: >- Email of the user who manually overrode the group (persists after user deletion) enabled: type: boolean description: Whether the group is currently enabled createdAt: type: string description: Timestamp when the group was created groupId: type: string description: Group ID from the group table groupName: type: string description: Display name of the associated group groupSlug: type: string description: Slug of the associated group groupContainmentEnabled: type: boolean description: Whether the associated group allows containment groupChatOpsEnabled: type: boolean description: Whether the associated group allows chat ops groupSourceSystemUpdates: type: boolean description: >- Whether the associated group allows outbound updates to the source product groupAlwaysNotify: type: boolean description: >- Whether the associated group always escalates detections for notification groupRuleSearch: type: string description: >- Search expression from the group rule that added this group membership groupRuleSearchField: type: string description: Search field from the group rule that added this group membership groupRuleSearchType: type: string enum: - text - regexp description: Search type from the group rule that added this group membership x-extensible-enum: true required: - id - directoryUserId - group - teamId - overriddenByUser - overriddenByUserId - overriddenByUserIdentifier - enabled - createdAt - groupId DirectoryUserLicense: type: object properties: licenseId: type: string description: Integration-provided license identifier licenseName: type: string description: Synced license name, falling back to the integration identifier productId: type: string nullable: true description: Google Licensing API product identifier when applicable integrationPlatform: type: string enum: - acronis - admin-by-request - agger-labs - anthropic - aws - axonius - barracuda-cloudgen-firewall - bitwarden - box - checkpoint-firewall - checkpoint-harmony - cisco-asa - cisco-catalyst - cisco-duo - cisco-meraki - cisco-secure-access - cisco-umbrella - connectwise-psa - crowdstrike-falcon - cyberark - darktrace - dfir-iris - email - exium - fleet-dm - fortianalyzer - fortinet - freshservice - generic-json - generic-syslog - github - github-enterprise-cloud - google-alert-center - google-chronicle - google-directory - google-security-center - halcyon - halo-itsm - have-i-been-pwned - horizon3 - hyas-protect - ipinfo - jamf-internet-security - jamf-pro - jamf-protect - jira-cloud - jira-data-center - jumpcloud - kandji - manage-engine-ad-audit-plus - microsoft - microsoft-entra - microsoft-teams - microsoft-teams-v2 - mimecast - netskope - ninjaone - odoo-helpdesk - okta - one-password - onelogin - openai - orca-security - pager-duty - palo-alto-networks-cortex - palo-alto-ngfw - perception-point - picus - ping-one - proofpoint - reversing-labs - safebreach - sandfly - sentinel-one - service-now - slack - sms - smtp - sonic-wall - sophos - splunk - stairwell - sublime-security - tenable-nessus - thinkst-canary - tracebit - unifi - vectra - watchguard-firebox - windows-event-logs - wirespeed - wiz - wordfence - zabbix - zscaler-zpa description: Source integration x-extensible-enum: true required: - licenseId - licenseName - productId - integrationPlatform IPInfoMetadataImpl: type: object properties: ip: type: string description: IP address hostname: type: string description: Hostname associated with the IP city: type: string description: City where IP is located region: type: string description: Region where IP is located country: type: string description: Country where IP is located loc: type: string description: Geographic coordinates of IP location postal: type: string description: Postal code of IP location timezone: type: string description: Timezone of IP location org: type: string description: Organization that owns the IP asn: description: Autonomous System Number information allOf: - $ref: '#/components/schemas/ASN' company: description: Company information for the IP allOf: - $ref: '#/components/schemas/Company' privacy: description: Privacy/anonymization service information allOf: - $ref: '#/components/schemas/IPMetadataPrivacy' abuse: description: Abuse contact information allOf: - $ref: '#/components/schemas/Abuse' domains: description: Domains hosted on this IP allOf: - $ref: '#/components/schemas/Domains' ofac: type: boolean description: Whether IP is on OFAC sanctions list adversarial: type: boolean description: Whether IP is flagged as adversarial/malicious isAnycast: type: boolean description: Whether the IP is anycast isMobile: type: boolean description: Whether the IP is a mobile connection isSatellite: type: boolean description: Whether the IP is a satellite connection required: - ofac - adversarial MailboxRuleArtifactDataDto: type: object properties: externalId: type: string name: type: string mailbox: $ref: '#/components/schemas/MailboxRuleMailboxDto' tenantExternalId: type: string operation: type: string enum: - CREATE - UPDATE - DELETE - UNKNOWN x-extensible-enum: true actions: type: array items: $ref: '#/components/schemas/MailboxRuleActionDto' conditions: type: array items: $ref: '#/components/schemas/MailboxRuleConditionDto' properties: type: array items: $ref: '#/components/schemas/ExtractionArtifactPropertyDto' required: - externalId - mailbox - operation - actions - conditions - properties ProcessTreeNodeDto: type: object properties: id: type: string parentId: type: string nullable: true sourceUid: type: string nullable: true cpid: type: string nullable: true pid: type: number nullable: true createdTime: type: number nullable: true name: type: string nullable: true cmdLine: type: string nullable: true path: type: string nullable: true sha1: type: string nullable: true sha256: type: string nullable: true required: - id - parentId - sourceUid - cpid - pid - createdTime - name - cmdLine - path - sha1 - sha256 ProcessTreeLimitsHitDto: type: object properties: nodes: type: boolean edges: type: boolean fields: type: boolean DetectionRuleDeduplicationDto: type: object properties: assetTypes: type: array description: >- Canonical asset types where any shared asset suppresses repeated detections items: type: string enum: - USER - PROCESS - USER_AGENT - FILE - ENDPOINT - LOCATION - IP - DOMAIN x-extensible-enum: true windowSeconds: type: number enum: - 900 - 1800 - 3600 - 14400 - 43200 - 86400 description: Suppression window in seconds required: - assetTypes - windowSeconds ThreatName: type: object properties: name: type: string engine: type: string excluded: type: boolean matchedFileRiskRules: type: array items: type: string required: - name - engine - excluded FileMetadataVersionInfo: type: object properties: name: type: string value: type: string required: - name - value ASN: type: object properties: asn: type: string description: Autonomous System Number name: type: string description: Name of the ASN organization domain: type: string description: Domain associated with the ASN route: type: string description: Network route for the ASN type: type: string description: Type of ASN organization required: - asn - name - domain - type Company: type: object properties: name: type: string description: Company name domain: type: string description: Company domain type: type: string description: Company type required: - name - domain - type IPMetadataPrivacy: type: object properties: vpn: type: boolean description: Whether IP is associated with VPN service proxy: type: boolean description: Whether IP is associated with proxy service tor: type: boolean description: Whether IP is associated with Tor network relay: type: boolean description: Whether IP is associated with relay service hosting: type: boolean description: Whether IP is associated with hosting service service: type: string description: Type of privacy service detected residentialProxy: type: boolean description: Whether IP is associated with a residential proxy lastSeen: type: string description: Date the IP was last seen as anonymous (YYYY-MM-DD) percentDaysSeen: type: number description: >- Percentage of days the IP was seen as anonymous in the observation window required: - vpn - proxy - tor - relay - hosting - service Abuse: type: object properties: address: type: string description: Abuse contact address country: type: string description: Country for abuse contact email: type: string description: Abuse contact email address name: type: string description: Abuse contact name network: type: string description: Network associated with abuse contact phone: type: string description: Abuse contact phone number ofac: type: boolean description: Whether IP is on OFAC sanctions list adversarial: type: boolean description: Whether IP is flagged as adversarial required: - address - country - email - name - network - phone Domains: type: object properties: ip: type: string description: IP address for domain lookup total: type: number description: Total number of domains hosted on this IP domains: description: List of domains hosted on this IP type: array items: type: string required: - ip - total - domains MailboxRuleMailboxDto: type: object properties: address: type: string externalId: type: string MailboxRuleActionDto: type: object properties: type: type: string value: type: string required: - type MailboxRuleConditionDto: type: object properties: field: type: string operator: type: string value: type: string required: - field - value ExtractionArtifactPropertyDto: type: object properties: name: type: string value: type: string required: - name - value securitySchemes: bearer: scheme: bearer bearerFormat: API key type: http description: >- Team API key sent as a Bearer token. Create a key in Wirespeed under Settings → Team. See https://docs.wirespeed.co/api-reference/authentication. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.