Leak report

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://darkradar.com/docs/schemas/leak-report.schema.json",
  "title": "Leak report",
  "description": "A summary of your firm’s leaks for a period.",
  "type": "object",
  "properties": {
    "stats": {
      "type": "object",
      "description": "Summary counts for the report.",
      "properties": {
        "severities": {
          "type": "object",
          "description": "Event counts by severity."
        },
        "leakTypes": {
          "type": "object",
          "description": "Event counts by leak type."
        },
        "actionTracking": {
          "type": "object",
          "description": "Event counts by action status (actioned / not actioned)."
        },
        "totalEvents": {
          "type": "number",
          "description": "Total leak events."
        },
        "totalCredentials": {
          "type": "number",
          "description": "Total credential records."
        },
        "uniqueCredentials": {
          "type": "number",
          "description": "Unique credentials."
        },
        "totalMachines": {
          "type": "number",
          "description": "Total infected machine records."
        },
        "uniqueMachines": {
          "type": "number",
          "description": "Unique infected machines."
        },
        "totalRelations": {
          "type": "number",
          "description": "Total machine–credential relations."
        },
        "uniqueRelations": {
          "type": "number",
          "description": "Unique machine–credential relations."
        },
        "employees": {
          "type": "number",
          "description": "Employee events."
        },
        "customers": {
          "type": "number",
          "description": "Customer events (360)."
        },
        "uniqueEmployees": {
          "type": "number",
          "description": "Unique employees."
        },
        "uniqueCustomers": {
          "type": "number",
          "description": "Unique customers."
        }
      }
    },
    "lastBreaches": {
      "type": "object",
      "description": "Most recent breaches.",
      "properties": {
        "employee": {
          "type": "object",
          "description": "Most recent employee breach."
        },
        "customer": {
          "type": "object",
          "description": "Most recent customer breach."
        }
      }
    },
    "_id": {
      "type": "string",
      "description": "Record id (24 hex characters)."
    },
    "firm": {
      "type": "string",
      "description": "Id of the firm the record belongs to — always your API key’s firm."
    },
    "protectionResourceGroupId": {
      "type": [
        "string",
        "null"
      ],
      "description": "Id of the protection resource group the record belongs to."
    },
    "startDate": {
      "type": "string",
      "description": "Start of the report period."
    },
    "endDate": {
      "type": "string",
      "description": "End of the report period."
    },
    "status": {
      "type": "string",
      "description": "Report status: `pending`, `processing`, `completed`, `failed`."
    },
    "reportData": {
      "type": [
        "object",
        "null"
      ],
      "description": "Record counts covered by the report.",
      "properties": {
        "eventsCount": {
          "type": "number",
          "description": "Event count."
        },
        "credentialsCount": {
          "type": "number",
          "description": "Credential count."
        },
        "machinesCount": {
          "type": "number",
          "description": "Machine count."
        },
        "relationsCount": {
          "type": "number",
          "description": "Relation count."
        }
      }
    },
    "eventTimeline": {
      "type": [
        "object",
        "null"
      ],
      "description": "Events per day (`YYYY-MM-DD` → count)."
    },
    "protectionResourceBreakdown": {
      "type": [
        "object",
        "null"
      ],
      "description": "Events per protection resource (resource id → count)."
    },
    "credentialsData": {
      "type": [
        "object",
        "null"
      ],
      "description": "Credential summaries.",
      "properties": {
        "total": {
          "type": "number",
          "description": "Total credentials."
        },
        "unique": {
          "type": "number",
          "description": "Unique credentials."
        },
        "domains": {
          "type": "number",
          "description": "Distinct domains."
        },
        "uniquePasswords": {
          "type": "number",
          "description": "Number of distinct passwords (passwords are never returned)."
        },
        "inDateRange": {
          "type": "object",
          "description": "Credential counts within the report period."
        }
      }
    },
    "passwordData": {
      "type": [
        "object",
        "null"
      ],
      "description": "Password summaries — counts only.",
      "properties": {
        "total": {
          "type": "number",
          "description": "Total passwords."
        },
        "unique": {
          "type": "number",
          "description": "Unique passwords."
        }
      }
    },
    "stealerData": {
      "type": [
        "object",
        "null"
      ],
      "description": "Stealer summaries.",
      "properties": {
        "total": {
          "type": "number",
          "description": "Total records."
        },
        "families": {
          "type": "array",
          "description": "Record counts by family.",
          "items": {}
        }
      }
    },
    "antivirusData": {
      "type": [
        "object",
        "null"
      ],
      "description": "Antivirus summaries on infected machines.",
      "properties": {
        "total": {
          "type": "number",
          "description": "Machines with antivirus information."
        },
        "breakdown": {
          "type": "object",
          "description": "Machines per antivirus product."
        }
      }
    },
    "requestedBy": {
      "type": "string",
      "description": "Id of the user who requested the report."
    },
    "createdAt": {
      "type": "string",
      "description": "Creation time (ISO 8601)."
    },
    "updatedAt": {
      "type": "string",
      "description": "Last update time (ISO 8601)."
    },
    "processStartedAt": {
      "type": "string",
      "description": "When processing started."
    },
    "completedAt": {
      "type": "string",
      "description": "When it completed."
    },
    "processingDurationMs": {
      "type": "number",
      "description": "Processing time (milliseconds)."
    }
  }
}