API documentation

Leak event

A single leak that matched one of your protected assets.

Fields

_idstring
Record id (24 hex characters).
firmstring
Id of the firm the record belongs to — always your API key’s firm.
protectionResourceGroupIdstring | null
Id of the protection resource group the record belongs to.
eventIdstring
Event id (string).
leakTypestring
What the leak matched: `domain`, `email`, `username`, `ip`, `hwid`, `application`.
typestring
Whose leak: `employee`, `customer` (360) or `third_party`.
severitystring
Severity: `critical`, `high`, `medium`, `low` or `unknown`.
mainValuestring | null
The matched value (domain, email, …) — for display.
stealerFamilystring
Stealer family (e.g. `Lumma`, `RedLine`).
stealerFamiliesarray
All stealer families linked to the record.
eventDatestring
When the leak happened (infection date, ISO 8601).
statusstring
Event status: `open`, `resolved`, …
actionTakenboolean
Whether an action was taken.
actionTypestring | null
Type of the last action.
actionTakenAtstring | null
Time of the last action.
actionsarray
Actions taken on the event.

Additional information attached to the record.

metadata.sourcestring
Data source.
metadata.isThirdPartyboolean
Whether it is a third-party leak.
metadata.isMachineBasedboolean
Whether the match is machine-based (not credential-based).
metadata.stealerFamilystring
Stealer family.

Summary of the leaked credential.

leakMetadata.usernamestring | null
Leaked username/email.
leakMetadata.passwordstring | null
`***` if a password exists, otherwise `null` — the password itself is never returned.
leakMetadata.domainstring | null
Domain the credential was used on.
leakMetadata.usernameDomainstring | null
Domain of the username (email).
relationCountnumber
Machine–credential relations linked to the event.

JSON schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://darkradar.com/docs/schemas/leak-event.schema.json",
  "title": "Leak event",
  "description": "A single leak that matched one of your protected assets.",
  "type": "object",
  "properties": {
    "_id": {
      "type": "string",
      "description": "Record id (24 hex characters)."
    },
    "firm": {
      "type": "string",
      "description": "Id of the firm the record belongs to — always your API key’s firm."
    },
    "protectionResourceGroupId": {
      "type": [
        "string",
        "null"
      ],
      "description": "Id of the protection resource group the record belongs to."
    },
    "eventId": {
      "type": "string",
      "description": "Event id (string)."
    },
    "leakType": {
      "type": "string",
      "description": "What the leak matched: `domain`, `email`, `username`, `ip`, `hwid`, `application`."
    },
    "type": {
      "type": "string",
      "description": "Whose leak: `employee`, `customer` (360) or `third_party`."
    },
    "severity": {
      "type": "string",
      "description": "Severity: `critical`, `high`, `medium`, `low` or `unknown`."
    },
    "mainValue": {
      "type": [
        "string",
        "null"
      ],
      "description": "The matched value (domain, email, …) — for display."
    },
    "stealerFamily": {
      "type": "string",
      "description": "Stealer family (e.g. `Lumma`, `RedLine`)."
    },
    "stealerFamilies": {
      "type": "array",
      "description": "All stealer families linked to the record.",
      "items": {}
    },
    "eventDate": {
      "type": "string",
      "description": "When the leak happened (infection date, ISO 8601)."
    },
    "status": {
      "type": "string",
      "description": "Event status: `open`, `resolved`, …"
    },
    "actionTaken": {
      "type": "boolean",
      "description": "Whether an action was taken."
    },
    "actionType": {
      "type": [
        "string",
        "null"
      ],
      "description": "Type of the last action."
    },
    "actionTakenAt": {
      "type": [
        "string",
        "null"
      ],
      "description": "Time of the last action."
    },
    "actions": {
      "type": "array",
      "description": "Actions taken on the event.",
      "items": {}
    },
    "metadata": {
      "type": "object",
      "description": "Additional information attached to the record.",
      "properties": {
        "source": {
          "type": "string",
          "description": "Data source."
        },
        "isThirdParty": {
          "type": "boolean",
          "description": "Whether it is a third-party leak."
        },
        "isMachineBased": {
          "type": "boolean",
          "description": "Whether the match is machine-based (not credential-based)."
        },
        "stealerFamily": {
          "type": "string",
          "description": "Stealer family."
        }
      }
    },
    "leakMetadata": {
      "type": "object",
      "description": "Summary of the leaked credential.",
      "properties": {
        "username": {
          "type": [
            "string",
            "null"
          ],
          "description": "Leaked username/email."
        },
        "password": {
          "type": [
            "string",
            "null"
          ],
          "description": "`***` if a password exists, otherwise `null` — the password itself is never returned."
        },
        "domain": {
          "type": [
            "string",
            "null"
          ],
          "description": "Domain the credential was used on."
        },
        "usernameDomain": {
          "type": [
            "string",
            "null"
          ],
          "description": "Domain of the username (email)."
        }
      }
    },
    "relationCount": {
      "type": "number",
      "description": "Machine–credential relations linked to the event."
    }
  }
}

Was this page helpful?