> ## Documentation Index > Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt > Use this file to discover all available pages before exploring further. # Get detection by ID or SID ## OpenAPI ````yaml https://api.wirespeed.co/v1/openapi.json get /v1/detection/{idOrSid} openapi: 3.0.0 info: title: Wirespeed API description: The public Wirespeed API. v1 is the first stable contract. version: '1.0' contact: {} servers: - url: https://api.wirespeed.co security: [] tags: [] paths: /v1/detection/{idOrSid}: get: tags: - Detection summary: Get detection by ID or SID operationId: DetectionController_findOne parameters: - name: idOrSid required: true in: path description: Detection ID or SID schema: type: string responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/DetectionWithEntities' '400': description: '' content: application/json: schema: $ref: '#/components/schemas/HttpError' '404': description: '' '422': description: '' content: application/json: schema: $ref: '#/components/schemas/HttpError' security: - bearer: [] components: schemas: DetectionWithEntities: type: object properties: id: type: string description: Unique identifier for the detection teamId: type: string description: ID of the team that owns this detection teamName: type: string description: Name of the team that owns this detection sourceDescription: type: string description: Description from the source system notes: type: string description: User-added notes about the detection sourceName: type: string description: Name of the source that generated this detection status: type: string enum: - NEW - PROCESSING - ESCALATED - HUNTING - MONITORING - CHATOPS - CLOSED description: Current status of the detection createdAt: type: string description: Timestamp when the detection was created containments: type: array description: Types of containment actions performed items: type: string enum: - USER - PROCESS - USER_AGENT - FILE - ENDPOINT - LOCATION - IP - DOMAIN testMode: type: boolean description: Whether this detection is in test mode caseId: type: string description: ID of the case this detection belongs to sourceIngestedAt: type: string description: Timestamp when the detection was ingested by Wirespeed sourceDetectedAt: type: string description: Timestamp when the detection was originally detected by source verdictedAt: type: string description: Timestamp when the detection verdict was assigned updatedAt: type: string description: Timestamp when the detection was last updated closedAt: type: string description: Timestamp when the detection was closed logs: description: Chronological log entries for this detection type: array items: $ref: '#/components/schemas/JSONLog' raw: type: object description: Raw detection data from the source system refreshRaw: type: object description: Raw detection data from the most recent refresh lastRefreshAt: type: string description: Timestamp of the last successful detection refresh verdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN description: Final verdict assigned to the detection helpfulnessRating: type: string enum: - happy - neutral - unhappy nullable: true description: Helpfulness feedback selected when detection was resolved title: type: string description: Display title for the detection integrationPlatform: type: string enum: - admin-by-request - aws - axonius - bitwarden - box - checkpoint-firewall - checkpoint-harmony - cisco-catalyst - cisco-duo - cisco-meraki - cisco-secure-access - cisco-umbrella - cisco-xdr - connectwise-psa - crowdstrike-falcon - cyberark - darktrace - email - exium - fleet-dm - fortianalyzer - fortinet - freshservice - generic-json - generic-syslog - google-alert-center - google-chronicle - google-directory - google-security-center - halcyon - halo-itsm - have-i-been-pwned - horizon3 - hyas-protect - ipinfo - jamf-pro - jamf-protect - jira-cloud - jira-data-center - jumpcloud - kandji - manage-engine-ad-audit-plus - microsoft - microsoft-entra - microsoft-teams - microsoft-teams-v2 - mimecast - ninjaone - odoo-helpdesk - okta - one-password - onelogin - orca-security - pager-duty - palo-alto-networks-cortex - picus - ping-one - reversing-labs - safebreach - sandfly - sentinel-one - service-now - slack - sms - smtp - sonic-wall - sophos - splunk - stairwell - tenable-nessus - thinkst-canary - tracebit - unifi - vectra - watchguard-firebox - windows-event-logs - wirespeed - wiz - wordfence - zscaler-zpa description: Source integration platform that generated this detection integrationId: type: string description: ID of the integration instance that generated this detection duplicateDetectionId: type: string description: ID of the original detection if this is a duplicate contained: type: boolean description: Whether containment actions were performed on this detection nextSteps: type: string description: AI-generated recommended next steps for this detection reingested: type: boolean description: Whether this detection was reprocessed after initial ingestion prevented: type: boolean description: Whether the detected threat was successfully prevented managedByThirdParty: type: boolean description: >- Whether this detection is managed by a third-party service (e.g. Falcon Complete) excludeFromMeans: type: boolean description: >- Whether to exclude this detection from MTTC and other metrics calculations caseSid: type: string description: Short identifier for the case this detection belongs to sid: type: string description: Short identifier for this detection firstRun: type: boolean description: Whether this is the first time this detection has been processed containOnChatOpsFailure: type: boolean description: Whether to automatically contain if ChatOps workflow fails wasEscalated: type: boolean description: Whether this detection was escalated to external systems escalatedAt: type: string description: Timestamp when the detection was escalated ocsfDetectionFinding: type: object description: OCSF standardized detection finding data sourceUrl: type: string nullable: true description: URL for this detection in its source system actionSlug: type: string description: Slug identifier for the action taken on this detection exclusionId: type: string description: ID of the exclusion rule that matches this detection exclusionSid: type: string description: Short identifier for the exclusion rule that matches this detection autoClosed: type: boolean description: Whether this detection was automatically contained by the system autoContained: type: boolean category: type: string enum: - OTHER__DIAGNOSTIC - OTHER__INFORMATIONAL_EVENT - OTHER__WARNING - OTHER__UNKNOWN - OTHER__DECEPTION - OTHER__DECEPTION__SIMULATION - OTHER__CUSTOM_DETECTION - CLOUD__INVOCATION - CLOUD__DISCOVERY - CLOUD__DATA_TRANSFER - CLOUD__PERSISTENCE - CLOUD__PUBLIC_BUCKET - ENDPOINT__DISCOVERY - ENDPOINT__EXECUTION - ENDPOINT__LIVE_OFF_THE_LAND - ENDPOINT__NUISANCE - ENDPOINT__MALWARE_DISCOVERY - ENDPOINT__MALWARE_EXECUTION - ENDPOINT__LATE_STAGE - ENDPOINT__PERSISTENCE - ENDPOINT__REMOTE_MANAGEMENT - ENDPOINT__LATERAL_MOVEMENT - ENDPOINT__IMPACT - ENDPOINT__EVASION - ENDPOINT__EXPLOITATION - ENDPOINT__SIMULATION - ENDPOINT__PLANNED_CHANGE - IDENTITY__LOGIN - IDENTITY__REJECTED_MFA - IDENTITY__DISCOVERY - IDENTITY__BRUTE_FORCE - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE - IDENTITY__PERSISTENCE - IDENTITY__ACCOUNT_COMPROMISE - IDENTITY__SIMULATION - NETWORK__INBOUND_CONNECTION - NETWORK__OUTBOUND_CONNECTION - NETWORK__PHISHING - NETWORK__NOISY - NETWORK__DISCOVERY - EMAIL__PHISHING - EMAIL__PHISHING_REPORTED - EMAIL__EVASION - EMAIL__MALWARE - EMAIL__MALICIOUS_LINK - EMAIL__GRAYMAIL - EMAIL__SPAM - EMAIL__BUSINESS_EMAIL_COMPROMISE - EMAIL__MAILBOX_RULE - DATA__DATA_TRANSFER - DATA__DATA_SHARE - POSTURE__POSTURE - POSTURE__HEALTH description: Security category classification for this detection verdictSetting: description: Verdict rule configuration that was applied to this detection allOf: - $ref: '#/components/schemas/VerdictRule' chatOpsTest: type: boolean description: Whether this detection is part of a ChatOps test scenario severity: type: string enum: - INFORMATIONAL - LOW - MEDIUM - HIGH - CRITICAL description: Severity level of the detection severityOrdinal: type: number description: Numeric representation of severity for sorting purposes containsVIP: type: boolean description: Whether this detection involves VIP users containsHVA: type: boolean description: Whether this detection involves critical assets excluded: type: boolean description: Whether this detection is excluded by an exclusion rule chatOpsTestEmail: type: string description: Email address for ChatOps testing notifications chatOpsTestPhoneNumber: type: string description: Phone number for ChatOps testing notifications customDetectionId: type: string description: ID of the custom detection that detected this detection externalCustomDetectionId: type: string description: ID of the external custom detection rule that matched this detection autoRemediateStartedAt: type: string description: Timestamp when auto remediation started remediatedAt: type: string description: Timestamp when remediation was completed endpoints: description: Endpoints involved in this detection type: array items: $ref: '#/components/schemas/Endpoint' files: description: Files involved in this detection type: array items: $ref: '#/components/schemas/File' processes: description: Processes involved in this detection type: array items: $ref: '#/components/schemas/Process' locations: description: Geographic locations involved in this detection type: array items: $ref: '#/components/schemas/Location' directory: description: Directory users involved in this detection type: array items: $ref: '#/components/schemas/DirectoryUser' ips: description: IP addresses involved in this detection type: array items: $ref: '#/components/schemas/IP' domains: description: Domains involved in this detection type: array items: $ref: '#/components/schemas/Domain' fileRisk: type: string enum: - BENIGN - MALWARE - LATE_STAGE - NUISANCE - LIVE_OFF_THE_LAND - REMOTE_MANAGEMENT - UNKNOWN description: Highest risk level among all files in this detection userAgents: description: User agents involved in this detection type: array items: $ref: '#/components/schemas/UserAgent' artifacts: description: Embedded artifacts extracted from this detection type: array items: $ref: '#/components/schemas/ExtractionArtifactDto' whatHappened: type: string description: AI-generated summary of what happened in this detection chatOpsActions: description: ChatOps actions performed on this detection type: array items: $ref: '#/components/schemas/ActionChatops' containmentActions: description: Containment actions performed on this detection type: array items: $ref: '#/components/schemas/ActionContainWithUser' groups: type: string nullable: true description: CSV of unique group names from endpoints and directory users groupNames: description: >- Unique group names from endpoints and directory users on this detection type: array items: type: string required: - id - teamId - status - createdAt - containments - testMode - sourceIngestedAt - sourceDetectedAt - logs - raw - verdict - title - integrationPlatform - contained - reingested - prevented - managedByThirdParty - excludeFromMeans - sid - firstRun - containOnChatOpsFailure - wasEscalated - ocsfDetectionFinding - category - chatOpsTest - severity - severityOrdinal - containsVIP - containsHVA - excluded - endpoints - files - processes - locations - directory - ips - domains - fileRisk - artifacts - whatHappened - chatOpsActions - containmentActions - groupNames HttpError: type: object properties: message: type: string statusCode: type: number required: - message - statusCode JSONLog: type: object properties: log: type: string description: Log message content timestamp: type: string description: Timestamp when the log was created debug: type: boolean description: Whether this is a debug log entry required: - log - timestamp - debug VerdictRule: type: object properties: id: type: string stage: type: string enum: - TRIAGE - HUNT - MONITOR default: type: boolean managedByWspd: type: boolean category: type: string enum: - OTHER__DIAGNOSTIC - OTHER__INFORMATIONAL_EVENT - OTHER__WARNING - OTHER__UNKNOWN - OTHER__DECEPTION - OTHER__DECEPTION__SIMULATION - OTHER__CUSTOM_DETECTION - CLOUD__INVOCATION - CLOUD__DISCOVERY - CLOUD__DATA_TRANSFER - CLOUD__PERSISTENCE - CLOUD__PUBLIC_BUCKET - ENDPOINT__DISCOVERY - ENDPOINT__EXECUTION - ENDPOINT__LIVE_OFF_THE_LAND - ENDPOINT__NUISANCE - ENDPOINT__MALWARE_DISCOVERY - ENDPOINT__MALWARE_EXECUTION - ENDPOINT__LATE_STAGE - ENDPOINT__PERSISTENCE - ENDPOINT__REMOTE_MANAGEMENT - ENDPOINT__LATERAL_MOVEMENT - ENDPOINT__IMPACT - ENDPOINT__EVASION - ENDPOINT__EXPLOITATION - ENDPOINT__SIMULATION - ENDPOINT__PLANNED_CHANGE - IDENTITY__LOGIN - IDENTITY__REJECTED_MFA - IDENTITY__DISCOVERY - IDENTITY__BRUTE_FORCE - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE - IDENTITY__PERSISTENCE - IDENTITY__ACCOUNT_COMPROMISE - IDENTITY__SIMULATION - NETWORK__INBOUND_CONNECTION - NETWORK__OUTBOUND_CONNECTION - NETWORK__PHISHING - NETWORK__NOISY - NETWORK__DISCOVERY - EMAIL__PHISHING - EMAIL__PHISHING_REPORTED - EMAIL__EVASION - EMAIL__MALWARE - EMAIL__MALICIOUS_LINK - EMAIL__GRAYMAIL - EMAIL__SPAM - EMAIL__BUSINESS_EMAIL_COMPROMISE - EMAIL__MAILBOX_RULE - DATA__DATA_TRANSFER - DATA__DATA_SHARE - POSTURE__POSTURE - POSTURE__HEALTH wspdRule: type: string enum: - CLOUD__INVOCATION - CLOUD__INVOCATION__LOW_SEVERITY - CLOUD__INVOCATION__MANAGED_DEVICE - CLOUD__INVOCATION__KNOWN_SAFE_IP - CLOUD__DISCOVERY - CLOUD__DISCOVERY__LOW_SEVERITY - CLOUD__DISCOVERY__MANAGED_DEVICE - CLOUD__DISCOVERY__KNOWN_SAFE_IP - CLOUD__DATA_TRANSFER - CLOUD__DATA_TRANSFER__LOW_SEVERITY - CLOUD__DATA_TRANSFER__MANAGED_DEVICE - CLOUD__DATA_TRANSFER__KNOWN_SAFE_IP - CLOUD__PERSISTENCE - CLOUD__PERSISTENCE__LOW_SEVERITY - CLOUD__PERSISTENCE__MANAGED_DEVICE - CLOUD__PERSISTENCE__KNOWN_SAFE_IP - CLOUD__PUBLIC_BUCKET - CLOUD__PUBLIC_BUCKET__LOW_CONFIDENCE - CLOUD__PUBLIC_BUCKET__LISTABLE - ENDPOINT__DISCOVERY - ENDPOINT__DISCOVERY__LOW_SEVERITY - ENDPOINT__DISCOVERY__USER_TECHNICAL - ENDPOINT__LIVE_OFF_THE_LAND__LOW_SEVERITY - ENDPOINT__LIVE_OFF_THE_LAND__BLOCKED_HVA - ENDPOINT__LIVE_OFF_THE_LAND__BLOCKED - ENDPOINT__LIVE_OFF_THE_LAND__MASQUERADED - ENDPOINT__LIVE_OFF_THE_LAND__AI_VERDICT - ENDPOINT__LIVE_OFF_THE_LAND__USER_NON_TECHNICAL - ENDPOINT__LIVE_OFF_THE_LAND - ENDPOINT__NUISANCE - ENDPOINT__EXECUTION__LOW_SEVERITY - ENDPOINT__EXECUTION__BLOCKED_HVA - ENDPOINT__EXECUTION__MASQUERADED - ENDPOINT__EXECUTION__BENIGN - ENDPOINT__EXECUTION__BLOCKED - ENDPOINT__EXECUTION - ENDPOINT__EXECUTION__TECHNICAL_USER - ENDPOINT__MALWARE_DISCOVERY - ENDPOINT__MALWARE_DISCOVERY__HVA - ENDPOINT__MALWARE_DISCOVERY__BLOCKED - ENDPOINT__MALWARE_DISCOVERY__BLOCKED_HVA - ENDPOINT__MALWARE_DISCOVERY__BENIGN - ENDPOINT__MALWARE_DISCOVERY__SERVER - ENDPOINT__MALWARE_DISCOVERY__NO_FILES - ENDPOINT__MALWARE_DISCOVERY__LATE_STAGE_BLOCKED - ENDPOINT__MALWARE_DISCOVERY__LATE_STAGE - ENDPOINT__MALWARE_EXECUTION - ENDPOINT__MALWARE_EXECUTION__BLOCKED - ENDPOINT__MALWARE_EXECUTION__BLOCKED_HVA - ENDPOINT__LATE_STAGE - ENDPOINT__LATE_STAGE__BLOCKED - ENDPOINT__LATE_STAGE__BLOCKED_HVA - ENDPOINT__LATE_STAGE__BLOCKED_ADMINISTRATOR - ENDPOINT__LATE_STAGE__ADMINISTRATOR - ENDPOINT__REMOTE_MANAGEMENT - ENDPOINT__REMOTE_MANAGEMENT__BLOCKED - ENDPOINT__REMOTE_MANAGEMENT__BLOCKED_HVA - ENDPOINT__REMOTE_MANAGEMENT__ADMIN_INSTALL - ENDPOINT__REMOTE_MANAGEMENT__USER_TECHNICAL - ENDPOINT__LATERAL_MOVEMENT - ENDPOINT__LATERAL_MOVEMENT__BURST - ENDPOINT__LATERAL_MOVEMENT__RELATED_BURST - ENDPOINT__LATERAL_MOVEMENT__LOW_SEVERITY - ENDPOINT__LATERAL_MOVEMENT__HVA - ENDPOINT__LATERAL_MOVEMENT__SERVER - ENDPOINT__LATERAL_MOVEMENT__BLOCKED - ENDPOINT__LATERAL_MOVEMENT__TECHNICAL_USER - ENDPOINT__LATERAL_MOVEMENT__HUNT__SUDDENLY_ACTIVE - ENDPOINT__LATERAL_MOVEMENT__HUNT__WEEKEND_QUIET_HOURS - ENDPOINT__IMPACT__LOW_SEVERITY - ENDPOINT__IMPACT - ENDPOINT__EVASION__LOW_SEVERITY - ENDPOINT__EVASION - ENDPOINT__EXPLOITATION__LOW_SEVERITY - ENDPOINT__EXPLOITATION - ENDPOINT__SIMULATION - ENDPOINT__PLANNED_CHANGE - IDENTITY__DISCOVERY - IDENTITY__DISCOVERY__LOW_SEVERITY - IDENTITY__REJECTED_MFA - IDENTITY__REJECTED_MFA__HUNT__COMMON_TENANT_IP - IDENTITY__LOGIN - IDENTITY__LOGIN__LEARNING_ENVIRONMENT - IDENTITY__LOGIN__LOW_SEVERITY - IDENTITY__LOGIN__NO_USER - IDENTITY__LOGIN__BLOCKED - IDENTITY__LOGIN__BLOCKED_VIP - IDENTITY__LOGIN__BLOCKED_PRIVACY_POLICY - IDENTITY__LOGIN__MANAGED_DEVICE - IDENTITY__LOGIN__HUNT__MANAGED_DEVICE - IDENTITY__LOGIN__ADVERSARIAL_COUNTRY - IDENTITY__LOGIN__HOSTING_PROVIDER - IDENTITY__LOGIN__KNOWN_SAFE_IP_ADDRESS - IDENTITY__LOGIN__KNOWN_UNSAFE_IP_ADDRESS - IDENTITY__LOGIN__TOR - IDENTITY__LOGIN__RESIDENTIAL_PROXY - IDENTITY__LOGIN__AITM_PROXY - IDENTITY__LOGIN__PRIVACY_VPN__MOBILE - IDENTITY__LOGIN__PRIVACY_VPN__EXTERNAL - IDENTITY__LOGIN__PRIVACY_VPN - IDENTITY__LOGIN__HUNT__HIGH_USAGE_IP_ADDRESS - IDENTITY__LOGIN__HUNT__ISP_HIGH_USAGE_REGION - IDENTITY__LOGIN__HUNT__APPLE_PRIVATE_RELAY - IDENTITY__LOGIN__HUNT__BLOCKED_BY_POLICY - IDENTITY__LOGIN__HUNT__AUTHORIZED_DEVICE - IDENTITY__LOGIN__HUNT__AITM - IDENTITY__LOGIN__HUNT__FAILED_LOGIN - IDENTITY__LOGIN__HUNT__ADVERSARIAL_COUNTRY - IDENTITY__LOGIN__MONITOR__MAILBOX_RULES - IDENTITY__LOGIN__MONITOR__MAILBOX_SEND - IDENTITY__LOGIN__MONITOR__MASS_EMAIL_ACCESS - IDENTITY__LOGIN__MONITOR__MASS_EMAIL_SEND - IDENTITY__LOGIN__MONITOR__PERSISTENCE - IDENTITY__LOGIN__MONITOR__OAUTH_GRANT - IDENTITY__LOGIN__MONITOR__SESSION_CHANGE - IDENTITY__LOGIN__MONITOR__AITM - IDENTITY__PERSISTENCE - IDENTITY__PERSISTENCE__LOW_SEVERITY - IDENTITY__PERSISTENCE__TECHNICAL_USER - IDENTITY__PERSISTENCE__ADMIN_USER - IDENTITY__BRUTE_FORCE - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE__PASSWORD_RESET - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE__OLD_BREACH - IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE__IMPORTANT_USER - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE__DC_SYNC - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE__LOW_SEVERITY - IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE - IDENTITY__ACCOUNT_COMPROMISE__TEAM_AUTH_BASELINE_IP - IDENTITY__ACCOUNT_COMPROMISE - IDENTITY__SIMULATION - ENDPOINT__PERSISTENCE__LOW_SEVERITY - ENDPOINT__PERSISTENCE__BLOCKED - ENDPOINT__PERSISTENCE__BLOCKED_HVA - ENDPOINT__PERSISTENCE__HVA - ENDPOINT__PERSISTENCE__USER_TECHNICAL - ENDPOINT__PERSISTENCE - NETWORK__INBOUND_CONNECTION - NETWORK__INBOUND_CONNECTION__KNOWN_SAFE_IP - NETWORK__INBOUND_CONNECTION__KNOWN_UNSAFE_IP - NETWORK__INBOUND_CONNECTION__BLOCKED - NETWORK__INBOUND_CONNECTION__TOR - NETWORK__INBOUND_CONNECTION__VPN - NETWORK__INBOUND_CONNECTION__PROXY - NETWORK__INBOUND_CONNECTION__RELAY - NETWORK__INBOUND_CONNECTION__LOW_SEVERITY - NETWORK__OUTBOUND_CONNECTION - NETWORK__OUTBOUND_CONNECTION__KNOWN_SAFE_IP - NETWORK__OUTBOUND_CONNECTION__KNOWN_UNSAFE_IP - NETWORK__OUTBOUND_CONNECTION__SERVER - NETWORK__OUTBOUND_CONNECTION__TOR - NETWORK__OUTBOUND_CONNECTION__TECHNICAL_USER - NETWORK__OUTBOUND_CONNECTION__VPN - NETWORK__OUTBOUND_CONNECTION__PROXY - NETWORK__OUTBOUND_CONNECTION__RELAY - NETWORK__OUTBOUND_CONNECTION__BLOCKED - NETWORK__OUTBOUND_CONNECTION__BLOCKED_HVA - NETWORK__OUTBOUND_CONNECTION__LOW_SEVERITY - NETWORK__OUTBOUND_CONNECTION__NO_ASSET - NETWORK__PHISHING - NETWORK__PHISHING__LOW_SEVERITY - NETWORK__PHISHING__MOBILE - NETWORK__PHISHING__HUNT__BLOCKED - NETWORK__NOISY - NETWORK__DISCOVERY - NETWORK__DISCOVERY__LOW_SEVERITY - EMAIL__PHISHING - EMAIL__PHISHING__VIP - EMAIL__PHISHING__BLOCKED - EMAIL__PHISHING__LOW_SEVERITY - EMAIL__PHISHING_REPORTED - EMAIL__PHISHING_REPORTED__EXTERNAL_SENDER - EMAIL__PHISHING_REPORTED__INTERNAL_SENDER - EMAIL__EVASION__LOW_SEVERITY - EMAIL__EVASION - EMAIL__MALWARE - EMAIL__MALWARE__BLOCKED - EMAIL__MALWARE__BENIGN - EMAIL__MALICIOUS_LINK - EMAIL__MALICIOUS_LINK__BLOCKED - EMAIL__GRAYMAIL - EMAIL__SPAM - EMAIL__BUSINESS_EMAIL_COMPROMISE - EMAIL__MAILBOX_RULE - EMAIL__MAILBOX_RULE__NO_ARTIFACT - EMAIL__MAILBOX_RULE__DELETE_ALL - EMAIL__MAILBOX_RULE__COMMON_TENANT_IP - EMAIL__MAILBOX_RULE__SUSPICIOUS_NAME - EMAIL__MAILBOX_RULE__HIDDEN_MOVE - DATA__DATA_TRANSFER__BLOCKED - DATA__DATA_TRANSFER - DATA__DATA_SHARE_BLOCKED - DATA__DATA_SHARE - POSTURE__POSTURE - POSTURE__HEALTH - OTHER__DECEPTION - OTHER__DECEPTION__LOW_SEVERITY - OTHER__DECEPTION__SIMULATION - OTHER__UNKNOWN - OTHER__DIAGNOSTIC - OTHER__INFORMATIONAL_EVENT - OTHER__WARNING - OTHER__WARNING__LOW_SEVERITY - OTHER__CUSTOM_DETECTION - OTHER__CUSTOM_DETECTION__LOW_SEVERITY retired: type: boolean escalate: type: boolean chatOps: type: boolean close: type: boolean disabled: type: boolean containUserActions: type: array items: type: string enum: - disable - reset_password - revoke_sessions containEndpointActions: type: array items: type: string enum: - isolate - lock containFileActions: type: array items: type: string enum: - delete - quarantine uncontainUserActions: type: array items: type: string enum: - enable uncontainEndpointActions: type: array items: type: string enum: - unisolate - unlock uncontainFileActions: type: array items: type: string enum: - unquarantine chatOpsMFA: type: boolean monitor: type: boolean monitorFallbackPreset: type: string enum: - ESCALATE - ESCALATE_CONTAIN - CLOSE managerChatOps: type: boolean vipChatOps: type: boolean createdAt: type: string updatedAt: type: string teamId: type: string chatOpsTimeoutVerdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN chatOpsTimeoutMonitor: type: boolean chatOpsTimeoutClose: type: boolean chatOpsUnsureVerdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN verdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN description: type: string managedByParent: type: boolean severity: type: string enum: - INFORMATIONAL - LOW - MEDIUM - HIGH - CRITICAL useSourceSeverity: type: boolean ignoresRemediation: type: boolean defaults: $ref: '#/components/schemas/VerdictRule' required: - stage - default - managedByWspd - category - wspdRule - retired - escalate - chatOps - close - disabled - containUserActions - containEndpointActions - containFileActions - uncontainUserActions - uncontainEndpointActions - uncontainFileActions - chatOpsMFA - monitor - managerChatOps - vipChatOps - chatOpsUnsureVerdict - description - severity Endpoint: type: object properties: id: type: string description: Unique identifier for the endpoint displayName: type: string description: Human-readable display name for the endpoint teamId: type: string description: ID of the team that owns this endpoint edrSourceId: type: string description: ID from the EDR (Endpoint Detection & Response) system mdmSourceId: type: string description: ID from the MDM (Mobile Device Management) system name: type: string description: Name of the endpoint hva: type: boolean description: Indicates if this is a Critical Asset hvaOverriddenByUser: type: boolean description: >- Indicates if the Critical Asset status was manually overridden by a user createdAt: type: string description: Timestamp when the endpoint was created privateIpAddress: type: string description: Private IP address of the endpoint live: type: boolean description: Indicates if the endpoint is currently active/online operatingSystem: type: string description: Operating system of the endpoint operatingSystemCategory: type: string enum: - Windows - Windows Server - macOS - Linux - iOS - Android - ChromeOS - Network Device - Other description: Categorized operating system type integrationId: type: string nullable: true description: ID of the integration that discovered this endpoint canonicalId: type: string nullable: true description: >- When set, this row is a duplicate source; points at the canonical representative endpoint id canonicalClusterMemberCount: type: number nullable: true description: >- Child endpoint rows in the same canonical cluster (canonical_id = root), excluding the root row; null when asset dedupe is off or there are no children canonicalClusterMembers: nullable: true description: >- Preview of other integration-backed rows in the same canonical cluster (at most five children when count exceeds five); null when none example: - id: 22222222-2222-2222-2222-222222222201 displayLabel: WS-SAMPLE-BRAVO-WKS$ integrationId: aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0002 integrationPlatform: sentinel-one name: WS-SAMPLE-BRAVO-WKS$ managed: true live: true operatingSystem: Windows11 - 23H2 createdAt: '2025-01-02T00:00:00.000Z' updatedAt: '2025-01-15T12:00:00.000Z' - id: 22222222-2222-2222-2222-222222222202 displayLabel: WS-SAMPLE-CHARLIE-WKS$ integrationId: aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0003 integrationPlatform: crowdstrike-falcon name: WS-SAMPLE-CHARLIE-WKS$ managed: true live: true operatingSystem: Windows 10 Enterprise 22H2 (OS build 19045.4046) createdAt: '2025-01-03T00:00:00.000Z' updatedAt: '2025-01-15T12:00:00.000Z' type: array items: $ref: '#/components/schemas/CanonicalAssetClusterMemberDto' contained: type: boolean description: Indicates if the endpoint has been contained/isolated managed: type: boolean description: Indicates if the endpoint is managed by MDM/EDR publicIpAddress: type: string description: Public IP address associated with this endpoint workstation: type: boolean description: Indicates if this is a workstation device server: type: boolean description: Indicates if this is a server device mobile: type: boolean description: Indicates if this is a mobile device domainController: type: boolean description: Indicates if this is a domain controller lastSeenAt: type: string description: Timestamp when the endpoint was last seen updatedAt: type: string description: Timestamp when the endpoint was last updated raw: type: object description: Raw data from the integration source groups: description: Groups assigned to this endpoint type: array items: $ref: '#/components/schemas/EndpointGroupDTO' groupContainmentEnabled: type: boolean description: Whether all groups on this endpoint allow containment groupChatOpsEnabled: type: boolean description: Whether all groups on this endpoint allow chat ops groupSourceSystemUpdates: type: boolean description: >- Whether all groups on this endpoint allow outbound updates to the source product groupsSynced: type: boolean description: Whether this endpoint has had its first round of group checks run lockPin: type: string nullable: true description: >- Lock PIN for this device, set when the device was locked via MDM (e.g. JumpCloud Apple MDM). Null if not locked or PIN not available. required: - id - displayName - teamId - hva - createdAt - integrationId - contained - workstation - server - mobile - domainController - groups - groupContainmentEnabled - groupChatOpsEnabled - groupSourceSystemUpdates - groupsSynced File: type: object properties: id: type: string displayName: type: string teamId: type: string name: type: string path: type: string sha256: type: string sha1: type: string toolName: type: string createdAt: type: string updatedAt: type: string lastEnrichedAt: type: string nullable: true nameWithPath: type: string fileRisk: type: string enum: - BENIGN - MALWARE - LATE_STAGE - NUISANCE - LIVE_OFF_THE_LAND - REMOTE_MANAGEMENT - UNKNOWN metadata: $ref: '#/components/schemas/FileMetadata' enrichedViaIntegration: type: boolean contained: type: boolean required: - id - displayName - teamId - createdAt - updatedAt - fileRisk - enrichedViaIntegration Process: type: object properties: id: type: string displayName: type: string teamId: type: string command: type: string sha256: type: string sha1: type: string createdAt: type: string required: - id - displayName - teamId - createdAt Location: type: object properties: id: type: string displayName: type: string teamId: type: string lat: type: string lon: type: string city: type: string state: type: string country: type: string countryCode: type: string continent: type: string continentCode: type: string createdAt: type: string required: - id - displayName - teamId - createdAt DirectoryUser: type: object properties: id: type: string description: Unique identifier for the directory user displayName: type: string description: Display name for the user teamId: type: string description: Team ID that owns this user enabled: type: boolean description: Whether the user account is enabled directoryId: type: string description: Directory-specific identifier for the user name: type: string description: Full name of the user phoneNumber: type: string description: Phone number of the user previousPhoneNumber: type: string description: Previous phone number if changed title: type: string description: Job title of the user email: type: string description: Email address of the user additionalEmails: description: Additional email addresses of the user type: array items: type: string allEmails: description: All email addresses of the user (primary + additional) type: array items: type: string vip: type: boolean description: Whether the user is marked as VIP nhi: type: boolean description: Whether the user is non-human identity (service account) financial: type: boolean description: Whether the user has financial access/permissions technical: type: boolean description: Whether the user has technical access/permissions external: type: boolean description: Whether the user is external managerDirectoryId: type: string description: Directory ID of the user's manager managerEmail: type: string description: Email address of the user's manager domain: type: string description: Domain the user belongs to department: type: string description: Department the user works in createdAt: type: string description: Timestamp when the user was created integrationId: type: string nullable: true description: ID of the integration this user came from canonicalId: type: string nullable: true description: >- When set, this row is a duplicate source; points at the canonical representative row id canonicalClusterMemberCount: type: number nullable: true description: >- Child directory user rows in the same canonical cluster (canonical_id = root), excluding the root row; null when asset dedupe is off or there are no children canonicalClusterMembers: nullable: true description: >- Preview of other integration-backed rows in the same canonical cluster (at most five children when count exceeds five); null when none example: - id: 22222222-2222-2222-2222-222222222201 displayLabel: WS-SAMPLE-BRAVO-WKS$ integrationId: aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0002 integrationPlatform: sentinel-one name: WS-SAMPLE-BRAVO-WKS$ managed: true live: true operatingSystem: Windows11 - 23H2 createdAt: '2025-01-02T00:00:00.000Z' updatedAt: '2025-01-15T12:00:00.000Z' - id: 22222222-2222-2222-2222-222222222202 displayLabel: WS-SAMPLE-CHARLIE-WKS$ integrationId: aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0003 integrationPlatform: crowdstrike-falcon name: WS-SAMPLE-CHARLIE-WKS$ managed: true live: true operatingSystem: Windows 10 Enterprise 22H2 (OS build 19045.4046) createdAt: '2025-01-03T00:00:00.000Z' updatedAt: '2025-01-15T12:00:00.000Z' type: array items: $ref: '#/components/schemas/CanonicalAssetClusterMemberDto' roles: description: Roles assigned to the user nullable: true type: array items: type: string lastCredentialExposure: type: string nullable: true description: Timestamp of the last credential exposure credentialsExposed: type: boolean description: Whether the user's credentials have been exposed numberCredentialExposures: type: number description: Number of times user credentials have been exposed lastCheckedForCredentialExposures: type: string nullable: true description: Timestamp when last checked for credential exposures needsChatOpsWelcome: type: boolean description: Whether user needs to receive chat operations welcome message contained: type: boolean description: Whether the user is currently contained username: type: string description: Username for the user account containable: type: boolean description: >- Whether the user can be contained via automation. Deprecated — use isUserContainable logic in the containment dialog instead. This is just an alias to user.managed deprecated: true smsConsentReceivedAt: type: string nullable: true description: Timestamp when SMS consent was received smsInviteAttempts: type: number description: Number of SMS invite attempts sent smsInviteLastSentAt: type: string description: Timestamp of last SMS invite sent smsInviteOptOut: type: boolean description: Whether user opted out of SMS invites administrator: type: boolean description: Whether the user has administrative privileges updatedAt: type: string description: Timestamp when the user was last updated passwordLastChangedAt: type: string description: Timestamp when password was last changed lastSignInAt: type: string description: Timestamp of the user's last sign-in raw: type: object description: Raw data from the directory source groups: description: Groups assigned to this user type: array items: $ref: '#/components/schemas/DirectoryUserGroupDTO' managed: type: boolean description: Whether the user is managed by an integration chatOpsOnboardingUser: type: boolean description: Whether the user is in the chat ops onboarding group groupContainmentEnabled: type: boolean description: Whether all groups on this user allow containment groupChatOpsEnabled: type: boolean description: Whether all groups on this user allow chat ops groupSourceSystemUpdates: type: boolean description: >- Whether all groups on this user allow outbound updates to the source product groupsSynced: type: boolean description: Whether this user has had its first round of group checks run verifiedPhoneNumber: type: string description: Verified phone number of the user emailDirection: type: string enum: - sender - receiver description: Email direction when user is associated with an email detection required: - id - displayName - teamId - additionalEmails - allEmails - createdAt - integrationId - credentialsExposed - numberCredentialExposures - containable - smsInviteAttempts - groups - groupContainmentEnabled - groupChatOpsEnabled - groupSourceSystemUpdates - groupsSynced IP: type: object properties: ipv4: type: string description: IPv4 address ipv6: type: string description: IPv6 address metadata: description: Enriched metadata about the IP address allOf: - $ref: '#/components/schemas/IPInfoMetadataImpl' displayName: type: string description: Display name for the IP address id: type: string description: Unique identifier for the IP address teamId: type: string description: Team ID that owns this IP address createdAt: type: string description: Timestamp when the IP was created updatedAt: type: string description: Timestamp when the IP was last updated locationId: type: string description: Associated location ID metadataLastFetchedAt: type: string description: Timestamp when metadata was last fetched required: - displayName - id - teamId - createdAt - updatedAt - metadataLastFetchedAt Domain: type: object properties: id: type: string description: Unique identifier for the domain displayName: type: string description: Display name for the domain teamId: type: string description: Team ID that owns this domain name: type: string description: Domain name createdAt: type: string description: Timestamp when the domain was created required: - id - displayName - teamId - name - createdAt UserAgent: type: object properties: id: type: string userAgent: type: string userAgentAlt: type: string teamId: type: string createdAt: type: string displayName: type: string browserName: type: string browserVersion: type: string browserMajorVersion: type: string cpuArchitecture: type: string deviceModel: type: string deviceVendor: type: string engineName: type: string engineVersion: type: string osName: type: string osVersion: type: string required: - id - userAgent - teamId - createdAt - displayName ExtractionArtifactDto: type: object properties: type: type: string enum: - MAILBOX_RULE data: $ref: '#/components/schemas/MailboxRuleArtifactDataDto' required: - type - data ActionChatops: type: object properties: id: type: string description: Unique identifier for the chat ops action teamId: type: string description: Team ID that owns this chat ops action directoryUserId: type: string description: Directory user ID associated with this chat ops action integrationId: type: string nullable: true description: Integration ID used for this chat ops action detectionId: type: string description: Detection ID associated with this chat ops action caseId: type: string description: Case ID associated with this chat ops action mfaAttempts: type: number description: Number of MFA attempts isManager: type: boolean description: Whether the user is a manager createdAt: type: string description: Timestamp when the chat ops action was created message: type: string description: Message sent in the chat ops action settingsAtTimeOfAction: type: object description: Settings at the time of the action respondedAt: type: string description: Timestamp when the user responded ipAddress: type: string description: IP address of the user verdict: type: string enum: - MALICIOUS - SUSPICIOUS - BENIGN description: Verdict assigned to this chat ops action isSuccessful: type: boolean description: Whether the action was successful isTimeout: type: boolean description: Whether the action timed out isRateLimited: type: boolean description: Whether the action is rate limited isOverride: type: boolean description: >- Whether the action was overridden by closing the detection/case while chatops was active isMfaSuccess: type: boolean description: Whether MFA was successful isMfaFailure: type: boolean description: Whether MFA failed isMfaUnavailable: type: boolean description: Whether MFA is unavailable mfaRespondedAt: type: string description: Timestamp when MFA was responded to required: - id - teamId - directoryUserId - integrationId - detectionId - mfaAttempts - isManager - createdAt - isSuccessful - isTimeout - isRateLimited - isOverride ActionContainWithUser: type: object properties: id: type: string description: Unique identifier for the containment action teamId: type: string description: Team ID that owns this containment action detectionId: type: string description: Detection ID associated with this containment caseId: type: string description: Case ID associated with this containment type: type: string enum: - directory_user - endpoint - file description: Type of containment action action: type: string enum: - contain - uncontain description: Action performed endpointId: type: string description: Endpoint ID for endpoint containment directoryUserId: type: string description: Directory user ID for user containment fileId: type: string description: File ID for file containment userId: type: string description: User ID who performed the action result: type: string enum: - success - pending - failure description: Result of the containment action integrationResponse: type: object description: Integration response data subAction: type: string description: Specific sub-action performed (e.g., disable, reset_password) integrationId: type: string description: Integration that performed the action createdAt: type: string description: Timestamp when the containment action was performed integrationPlatform: type: string description: Platform of the integration that executed the containment action required: - id - teamId - type - action - createdAt CanonicalAssetClusterMemberDto: type: object properties: id: type: string description: Directory user or endpoint id displayLabel: type: string description: Display label for the row integrationId: type: string nullable: true description: Integration id for this source row integrationPlatform: type: string enum: - admin-by-request - aws - axonius - bitwarden - box - checkpoint-firewall - checkpoint-harmony - cisco-catalyst - cisco-duo - cisco-meraki - cisco-secure-access - cisco-umbrella - cisco-xdr - connectwise-psa - crowdstrike-falcon - cyberark - darktrace - email - exium - fleet-dm - fortianalyzer - fortinet - freshservice - generic-json - generic-syslog - google-alert-center - google-chronicle - google-directory - google-security-center - halcyon - halo-itsm - have-i-been-pwned - horizon3 - hyas-protect - ipinfo - jamf-pro - jamf-protect - jira-cloud - jira-data-center - jumpcloud - kandji - manage-engine-ad-audit-plus - microsoft - microsoft-entra - microsoft-teams - microsoft-teams-v2 - mimecast - ninjaone - odoo-helpdesk - okta - one-password - onelogin - orca-security - pager-duty - palo-alto-networks-cortex - picus - ping-one - reversing-labs - safebreach - sandfly - sentinel-one - service-now - slack - sms - smtp - sonic-wall - sophos - splunk - stairwell - tenable-nessus - thinkst-canary - tracebit - unifi - vectra - watchguard-firebox - windows-event-logs - wirespeed - wiz - wordfence - zscaler-zpa nullable: true description: Integration platform when joined from integration table name: type: string nullable: true username: type: string nullable: true email: type: string nullable: true additionalEmails: nullable: true type: array items: type: string roles: nullable: true type: array items: type: string title: type: string nullable: true department: type: string nullable: true managed: type: boolean nullable: true enabled: type: boolean nullable: true createdAt: type: string nullable: true updatedAt: type: string nullable: true live: type: boolean nullable: true operatingSystem: type: string nullable: true privateIpAddress: type: string nullable: true publicIpAddress: type: string nullable: true required: - id - displayLabel - integrationId EndpointGroupDTO: type: object properties: id: type: string description: Unique identifier for the endpoint group endpointId: type: string description: ID of the endpoint this group belongs to group: type: string description: Group type (system enum or custom string) teamId: type: string description: Team ID that owns this group enabled: type: boolean description: Whether the group is currently enabled createdAt: type: string description: Timestamp when the group was created overriddenByUser: type: boolean description: Whether the group was manually overridden by a user overriddenByUserId: type: string description: ID of the user who manually overrode the group overriddenByUserIdentifier: type: string nullable: true description: >- Email of the user who manually overrode the group (persists after user deletion) groupId: type: string description: Group ID from the group table groupName: type: string description: Display name of the associated group groupSlug: type: string description: Slug of the associated group groupContainmentEnabled: type: boolean description: Whether the associated group allows containment groupChatOpsEnabled: type: boolean description: Whether the associated group allows chat ops groupSourceSystemUpdates: type: boolean description: >- Whether the associated group allows outbound updates to the source product groupAlwaysNotify: type: boolean description: >- Whether the associated group always escalates detections to notify the client groupRuleSearch: type: string description: >- Search expression from the group rule that added this group membership groupRuleSearchField: type: string description: Search field from the group rule that added this group membership groupRuleSearchType: type: string enum: - text - regexp description: Search type from the group rule that added this group membership required: - id - endpointId - group - teamId - enabled - createdAt - overriddenByUser - groupId FileMetadata: type: object properties: threatNames: type: array items: $ref: '#/components/schemas/ThreatName' lastScanTime: type: string story: type: string versionInfo: type: array items: $ref: '#/components/schemas/FileMetadataVersionInfo' proposedFileNames: type: array items: type: string fileNameCatalogMatches: type: array items: type: string required: - threatNames - versionInfo - proposedFileNames - fileNameCatalogMatches DirectoryUserGroupDTO: type: object properties: id: type: string description: Unique identifier for the user group directoryUserId: type: string description: ID of the directory user this group belongs to group: type: string description: Type of group assigned to the user teamId: type: string description: Team ID that owns this group overriddenByUser: type: boolean description: Whether the group was manually overridden by a user overriddenByUserId: type: string description: ID of the user who manually overrode the group nullable: true overriddenByUserIdentifier: type: string nullable: true description: >- Email of the user who manually overrode the group (persists after user deletion) enabled: type: boolean description: Whether the group is currently enabled createdAt: type: string description: Timestamp when the group was created groupId: type: string description: Group ID from the group table groupName: type: string description: Display name of the associated group groupSlug: type: string description: Slug of the associated group groupContainmentEnabled: type: boolean description: Whether the associated group allows containment groupChatOpsEnabled: type: boolean description: Whether the associated group allows chat ops groupSourceSystemUpdates: type: boolean description: >- Whether the associated group allows outbound updates to the source product groupAlwaysNotify: type: boolean description: >- Whether the associated group always escalates detections to notify the client groupRuleSearch: type: string description: >- Search expression from the group rule that added this group membership groupRuleSearchField: type: string description: Search field from the group rule that added this group membership groupRuleSearchType: type: string enum: - text - regexp description: Search type from the group rule that added this group membership required: - id - directoryUserId - group - teamId - overriddenByUser - overriddenByUserId - overriddenByUserIdentifier - enabled - createdAt - groupId IPInfoMetadataImpl: type: object properties: ip: type: string description: IP address hostname: type: string description: Hostname associated with the IP city: type: string description: City where IP is located region: type: string description: Region where IP is located country: type: string description: Country where IP is located loc: type: string description: Geographic coordinates of IP location postal: type: string description: Postal code of IP location timezone: type: string description: Timezone of IP location org: type: string description: Organization that owns the IP asn: description: Autonomous System Number information allOf: - $ref: '#/components/schemas/ASN' company: description: Company information for the IP allOf: - $ref: '#/components/schemas/Company' privacy: description: Privacy/anonymization service information allOf: - $ref: '#/components/schemas/IPMetadataPrivacy' abuse: description: Abuse contact information allOf: - $ref: '#/components/schemas/Abuse' domains: description: Domains hosted on this IP allOf: - $ref: '#/components/schemas/Domains' ofac: type: boolean description: Whether IP is on OFAC sanctions list adversarial: type: boolean description: Whether IP is flagged as adversarial/malicious isAnycast: type: boolean description: Whether the IP is anycast isMobile: type: boolean description: Whether the IP is a mobile connection isSatellite: type: boolean description: Whether the IP is a satellite connection required: - ofac - adversarial MailboxRuleArtifactDataDto: type: object properties: externalId: type: string name: type: string mailbox: $ref: '#/components/schemas/MailboxRuleMailboxDto' tenantExternalId: type: string operation: type: string enum: - CREATE - UPDATE - DELETE - UNKNOWN actions: type: array items: $ref: '#/components/schemas/MailboxRuleActionDto' conditions: type: array items: $ref: '#/components/schemas/MailboxRuleConditionDto' properties: type: array items: $ref: '#/components/schemas/ExtractionArtifactPropertyDto' required: - externalId - mailbox - operation - actions - conditions - properties ThreatName: type: object properties: name: type: string engine: type: string excluded: type: boolean matchedFileRiskRules: type: array items: type: string required: - name - engine - excluded FileMetadataVersionInfo: type: object properties: name: type: string value: type: string required: - name - value ASN: type: object properties: asn: type: string description: Autonomous System Number name: type: string description: Name of the ASN organization domain: type: string description: Domain associated with the ASN route: type: string description: Network route for the ASN type: type: string description: Type of ASN organization required: - asn - name - domain - type Company: type: object properties: name: type: string description: Company name domain: type: string description: Company domain type: type: string description: Company type required: - name - domain - type IPMetadataPrivacy: type: object properties: vpn: type: boolean description: Whether IP is associated with VPN service proxy: type: boolean description: Whether IP is associated with proxy service tor: type: boolean description: Whether IP is associated with Tor network relay: type: boolean description: Whether IP is associated with relay service hosting: type: boolean description: Whether IP is associated with hosting service service: type: string description: Type of privacy service detected residentialProxy: type: boolean description: Whether IP is associated with a residential proxy lastSeen: type: string description: Date the IP was last seen as anonymous (YYYY-MM-DD) percentDaysSeen: type: number description: >- Percentage of days the IP was seen as anonymous in the observation window required: - vpn - proxy - tor - relay - hosting - service Abuse: type: object properties: address: type: string description: Abuse contact address country: type: string description: Country for abuse contact email: type: string description: Abuse contact email address name: type: string description: Abuse contact name network: type: string description: Network associated with abuse contact phone: type: string description: Abuse contact phone number ofac: type: boolean description: Whether IP is on OFAC sanctions list adversarial: type: boolean description: Whether IP is flagged as adversarial required: - address - country - email - name - network - phone Domains: type: object properties: ip: type: string description: IP address for domain lookup total: type: number description: Total number of domains hosted on this IP domains: description: List of domains hosted on this IP type: array items: type: string required: - ip - total - domains MailboxRuleMailboxDto: type: object properties: address: type: string externalId: type: string MailboxRuleActionDto: type: object properties: type: type: string value: type: string required: - type MailboxRuleConditionDto: type: object properties: field: type: string operator: type: string value: type: string required: - field - value ExtractionArtifactPropertyDto: type: object properties: name: type: string value: type: string required: - name - value securitySchemes: bearer: scheme: bearer bearerFormat: JWT type: http ````