Scan finding

A leak event found in a scan.

Fields

_idstring
Record id (24 hex characters).

scanstring
Id of the scan the finding belongs to.

firmstring
Id of the firm the record belongs to — always your API key’s firm.

The leak event found (same fields as the leak event schema).

leakEvent._idstring
Event id.

leakEvent.eventIdstring
Event id (string).

leakEvent.leakTypestring
What the leak matched: `domain`, `email`, `username`, `ip`, `hwid`, `application`.

leakEvent.typestring
Whose leak: `employee`, `customer` (360) or `third_party`.

leakEvent.severitystring
Severity: `critical`, `high`, `medium`, `low` or `unknown`.

leakEvent.mainValuestring
The matched value (domain, email, …) — for display.

leakEvent.eventDatestring
When the leak happened (infection date, ISO 8601).

leakEvent.statusstring
Event status.

leakEvent.actionTakenboolean
Whether an action was taken.

leakEvent.actionTypestring | null
Type of the last action.

leakEvent.metadataobject
Additional information attached to the record.

leakEvent.stealerFamilystring
Stealer family (e.g. `Lumma`, `RedLine`).

leakEvent.stealerFamiliesarray
All stealer families linked to the record.

leakEvent.systemInfoobject
System summary of the infected machine.

leakEvent.relationCountnumber
Relation count.

leakEvent.createdAtstring
Creation time (ISO 8601).

leakEvent.updatedAtstring
Last update time (ISO 8601).

leakEvent.leakMetadataobject
Leaked credential summary (password only as `***`).

isNewlyFoundboolean
Whether it was found for the first time in this scan.

severityAtScanstring
Severity at scan time.

leakTypestring
What the leak matched: `domain`, `email`, `username`, `ip`, `hwid`, `application`.

createdAtstring
Creation time (ISO 8601).

updatedAtstring
Last update time (ISO 8601).

JSON schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://darkradar.com/docs/schemas/scan-finding.schema.json",
  "title": "Scan finding",
  "description": "A leak event found in a scan.",
  "type": "object",
  "properties": {
    "_id": {
      "type": "string",
      "description": "Record id (24 hex characters)."
    },
    "scan": {
      "type": "string",
      "description": "Id of the scan the finding belongs to."
    },
    "firm": {
      "type": "string",
      "description": "Id of the firm the record belongs to — always your API key’s firm."
    },
    "leakEvent": {
      "type": "object",
      "description": "The leak event found (same fields as the leak event schema).",
      "properties": {
        "_id": {
          "type": "string",
          "description": "Event id."
        },
        "eventId": {
          "type": "string",
          "description": "Event id (string)."
        },
        "leakType": {
          "type": "string",
          "description": "What the leak matched: `domain`, `email`, `username`, `ip`, `hwid`, `application`."
        },
        "type": {
          "type": "string",
          "description": "Whose leak: `employee`, `customer` (360) or `third_party`."
        },
        "severity": {
          "type": "string",
          "description": "Severity: `critical`, `high`, `medium`, `low` or `unknown`."
        },
        "mainValue": {
          "type": "string",
          "description": "The matched value (domain, email, …) — for display."
        },
        "eventDate": {
          "type": "string",
          "description": "When the leak happened (infection date, ISO 8601)."
        },
        "status": {
          "type": "string",
          "description": "Event status."
        },
        "actionTaken": {
          "type": "boolean",
          "description": "Whether an action was taken."
        },
        "actionType": {
          "type": [
            "string",
            "null"
          ],
          "description": "Type of the last action."
        },
        "metadata": {
          "type": "object",
          "description": "Additional information attached to the record."
        },
        "stealerFamily": {
          "type": "string",
          "description": "Stealer family (e.g. `Lumma`, `RedLine`)."
        },
        "stealerFamilies": {
          "type": "array",
          "description": "All stealer families linked to the record.",
          "items": {}
        },
        "systemInfo": {
          "type": "object",
          "description": "System summary of the infected machine."
        },
        "relationCount": {
          "type": "number",
          "description": "Relation count."
        },
        "createdAt": {
          "type": "string",
          "description": "Creation time (ISO 8601)."
        },
        "updatedAt": {
          "type": "string",
          "description": "Last update time (ISO 8601)."
        },
        "leakMetadata": {
          "type": "object",
          "description": "Leaked credential summary (password only as `***`)."
        }
      }
    },
    "isNewlyFound": {
      "type": "boolean",
      "description": "Whether it was found for the first time in this scan."
    },
    "severityAtScan": {
      "type": "string",
      "description": "Severity at scan time."
    },
    "leakType": {
      "type": "string",
      "description": "What the leak matched: `domain`, `email`, `username`, `ip`, `hwid`, `application`."
    },
    "createdAt": {
      "type": "string",
      "description": "Creation time (ISO 8601)."
    },
    "updatedAt": {
      "type": "string",
      "description": "Last update time (ISO 8601)."
    }
  }
}

Endpoints that return this schema

Get scan findingsGET /v1/scans/{scanId}/findings