API documentation

Inventory item

An unlocked, downloadable stealer log archive.

Fields

_idstring
Record id (24 hex characters).
firmstring
Id of the firm the record belongs to — always your API key’s firm.
userIdstring
Id of the user who unlocked the file.

The leak event the file belongs to (summary).

eventId._idstring
Event id.
eventId.protectionResourceIdstring
Id of the protection resource the record belongs to.
eventId.leakTypestring
What the leak matched: `domain`, `email`, `username`, `ip`, `hwid`, `application`.
eventId.credentialIdstring | null
Id of the credential record in the event.
eventId.eventDatestring
When the leak happened (infection date, ISO 8601).
eventId.machineIdstring | null
Id of the machine record in the event.
eventId.protectionResourceGroupIdstring
Id of the protection resource group the record belongs to.
eventId.severitystring
Severity: `critical`, `high`, `medium`, `low` or `unknown`.
eventId.statusstring
Event status.
eventId.typestring
Whose leak: `employee`, `customer` (360) or `third_party`.

The machine–credential relation the file belongs to.

relationId._idstring
Relation id.
relationId.credentialIdstring
Credential record id.
relationId.machineIdstring | object | null
Machine record (summary).
relationId.stealerFamilyIdstring | object | null
Stealer family (summary).
protectionResourceGroupIdstring
Id of the protection resource group the record belongs to.
protectionResourceIdstring
Id of the protection resource the record belongs to.
fileNamestring
Name of the downloadable archive.
fileSizenumber
Archive size (bytes).
mimeTypestring
File type (`application/zip`).
unlockedAtstring
When the file was unlocked.

Additional information attached to the record.

metadata.stealerFamilystring
Stealer family (e.g. `Lumma`, `RedLine`).
metadata.ipAddressstring
IP address of the infected machine.
metadata.countryCodestring
Country code of the infected machine.
createdAtstring
Creation time (ISO 8601).
updatedAtstring
Last update time (ISO 8601).
hasFileboolean
Whether the archive is available for download.

JSON schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://darkradar.com/docs/schemas/inventory.schema.json",
  "title": "Inventory item",
  "description": "An unlocked, downloadable stealer log archive.",
  "type": "object",
  "properties": {
    "_id": {
      "type": "string",
      "description": "Record id (24 hex characters)."
    },
    "firm": {
      "type": "string",
      "description": "Id of the firm the record belongs to — always your API key’s firm."
    },
    "userId": {
      "type": "string",
      "description": "Id of the user who unlocked the file."
    },
    "eventId": {
      "type": [
        "object",
        "string"
      ],
      "description": "The leak event the file belongs to (summary).",
      "properties": {
        "_id": {
          "type": "string",
          "description": "Event id."
        },
        "protectionResourceId": {
          "type": "string",
          "description": "Id of the protection resource the record belongs to."
        },
        "leakType": {
          "type": "string",
          "description": "What the leak matched: `domain`, `email`, `username`, `ip`, `hwid`, `application`."
        },
        "credentialId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Id of the credential record in the event."
        },
        "eventDate": {
          "type": "string",
          "description": "When the leak happened (infection date, ISO 8601)."
        },
        "machineId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Id of the machine record in the event."
        },
        "protectionResourceGroupId": {
          "type": "string",
          "description": "Id of the protection resource group the record belongs to."
        },
        "severity": {
          "type": "string",
          "description": "Severity: `critical`, `high`, `medium`, `low` or `unknown`."
        },
        "status": {
          "type": "string",
          "description": "Event status."
        },
        "type": {
          "type": "string",
          "description": "Whose leak: `employee`, `customer` (360) or `third_party`."
        }
      }
    },
    "relationId": {
      "type": [
        "object",
        "string"
      ],
      "description": "The machine–credential relation the file belongs to.",
      "properties": {
        "_id": {
          "type": "string",
          "description": "Relation id."
        },
        "credentialId": {
          "type": "string",
          "description": "Credential record id."
        },
        "machineId": {
          "type": [
            "string",
            "object",
            "null"
          ],
          "description": "Machine record (summary)."
        },
        "stealerFamilyId": {
          "type": [
            "string",
            "object",
            "null"
          ],
          "description": "Stealer family (summary)."
        }
      }
    },
    "protectionResourceGroupId": {
      "type": "string",
      "description": "Id of the protection resource group the record belongs to."
    },
    "protectionResourceId": {
      "type": "string",
      "description": "Id of the protection resource the record belongs to."
    },
    "fileName": {
      "type": "string",
      "description": "Name of the downloadable archive."
    },
    "fileSize": {
      "type": "number",
      "description": "Archive size (bytes)."
    },
    "mimeType": {
      "type": "string",
      "description": "File type (`application/zip`)."
    },
    "unlockedAt": {
      "type": "string",
      "description": "When the file was unlocked."
    },
    "metadata": {
      "type": "object",
      "description": "Additional information attached to the record.",
      "properties": {
        "stealerFamily": {
          "type": "string",
          "description": "Stealer family (e.g. `Lumma`, `RedLine`)."
        },
        "ipAddress": {
          "type": "string",
          "description": "IP address of the infected machine."
        },
        "countryCode": {
          "type": "string",
          "description": "Country code of the infected machine."
        }
      }
    },
    "createdAt": {
      "type": "string",
      "description": "Creation time (ISO 8601)."
    },
    "updatedAt": {
      "type": "string",
      "description": "Last update time (ISO 8601)."
    },
    "hasFile": {
      "type": "boolean",
      "description": "Whether the archive is available for download."
    }
  }
}

Was this page helpful?