API documentation

Portfolio Monitoring finding

A leak found for a watched asset.

Fields

idstring
Record id.
statusstring
Finding status: `new`, `reviewing`, `resolved`, `closed`.
severitystring
Severity: `critical`, `high`, `medium`, `low` or `unknown`.
sourcestring
Finding source.
exposedDataTypesarray
Exposed data types (e.g. `password`, `email`).
assetIdstring
Id of the related Portfolio Monitoring asset.
assetTypestring
Asset type.
assetValuestring
Asset value.
leakedSecretMaskedstring | null
Masked form of the leaked secret (e.g. `Ya******23`); the plain value is never returned.
cardFlagboolean
Whether it contains card data.
beaconAvailableboolean
Whether the detailed record is available in the Intelligence panel.
contentLockedboolean
Whether the content is locked (visible after unlocking).
firstSeenAtstring
When the leak was first seen.
detectedAtstring
When Dark Radar detected it.
summarystring
Short summary.
titlestring
Title.
reportRefstring
Related report reference.

Infection details (masked).

details.computerNamestring | null
Computer name (masked).
details.stealerFamilystring | null
Stealer family (e.g. `Lumma`, `RedLine`).
details.operatingSystemstring | null
Operating system.
details.countrystring | null
Country.
details.antivirusstring | null
Antivirus.
details.corporateServicesCountstring | null
Leaked corporate services.
details.userServicesCountstring | null
Leaked personal services.
details.daysAgostring | null
Days ago.
recommendationsarray
Recommended steps.

JSON schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://darkradar.com/docs/schemas/watch-finding.schema.json",
  "title": "Portfolio Monitoring finding",
  "description": "A leak found for a watched asset.",
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "Record id."
    },
    "status": {
      "type": "string",
      "description": "Finding status: `new`, `reviewing`, `resolved`, `closed`."
    },
    "severity": {
      "type": "string",
      "description": "Severity: `critical`, `high`, `medium`, `low` or `unknown`."
    },
    "source": {
      "type": "string",
      "description": "Finding source."
    },
    "exposedDataTypes": {
      "type": "array",
      "description": "Exposed data types (e.g. `password`, `email`).",
      "items": {}
    },
    "assetId": {
      "type": "string",
      "description": "Id of the related Portfolio Monitoring asset."
    },
    "assetType": {
      "type": "string",
      "description": "Asset type."
    },
    "assetValue": {
      "type": "string",
      "description": "Asset value."
    },
    "leakedSecretMasked": {
      "type": [
        "string",
        "null"
      ],
      "description": "Masked form of the leaked secret (e.g. `Ya******23`); the plain value is never returned."
    },
    "cardFlag": {
      "type": "boolean",
      "description": "Whether it contains card data."
    },
    "beaconAvailable": {
      "type": "boolean",
      "description": "Whether the detailed record is available in the Intelligence panel."
    },
    "contentLocked": {
      "type": "boolean",
      "description": "Whether the content is locked (visible after unlocking)."
    },
    "firstSeenAt": {
      "type": "string",
      "description": "When the leak was first seen."
    },
    "detectedAt": {
      "type": "string",
      "description": "When Dark Radar detected it."
    },
    "summary": {
      "type": "string",
      "description": "Short summary."
    },
    "title": {
      "type": "string",
      "description": "Title."
    },
    "reportRef": {
      "type": "string",
      "description": "Related report reference."
    },
    "details": {
      "type": "object",
      "description": "Infection details (masked).",
      "properties": {
        "computerName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Computer name (masked)."
        },
        "stealerFamily": {
          "type": [
            "string",
            "null"
          ],
          "description": "Stealer family (e.g. `Lumma`, `RedLine`)."
        },
        "operatingSystem": {
          "type": [
            "string",
            "null"
          ],
          "description": "Operating system."
        },
        "country": {
          "type": [
            "string",
            "null"
          ],
          "description": "Country."
        },
        "antivirus": {
          "type": [
            "string",
            "null"
          ],
          "description": "Antivirus."
        },
        "corporateServicesCount": {
          "type": [
            "string",
            "null"
          ],
          "description": "Leaked corporate services."
        },
        "userServicesCount": {
          "type": [
            "string",
            "null"
          ],
          "description": "Leaked personal services."
        },
        "daysAgo": {
          "type": [
            "string",
            "null"
          ],
          "description": "Days ago."
        }
      }
    },
    "recommendations": {
      "type": "array",
      "description": "Recommended steps.",
      "items": {}
    }
  }
}

Was this page helpful?