Portfolio Monitoring finding
A leak found for a watched asset.
Fields
idstringRecord id.
statusstringFinding status: `new`, `reviewing`, `resolved`, `closed`.
severitystringSeverity: `critical`, `high`, `medium`, `low` or `unknown`.
sourcestringFinding source.
exposedDataTypesarrayExposed data types (e.g. `password`, `email`).
assetIdstringId of the related Portfolio Monitoring asset.
assetTypestringAsset type.
assetValuestringAsset value.
leakedSecretMaskedstring | nullMasked form of the leaked secret (e.g. `Ya******23`); the plain value is never returned.
cardFlagbooleanWhether it contains card data.
beaconAvailablebooleanWhether the detailed record is available in the Intelligence panel.
contentLockedbooleanWhether the content is locked (visible after unlocking).
firstSeenAtstringWhen the leak was first seen.
detectedAtstringWhen Dark Radar detected it.
summarystringShort summary.
titlestringTitle.
reportRefstringRelated report reference.
Infection details (masked).
details.computerNamestring | nullComputer name (masked).
details.stealerFamilystring | nullStealer family (e.g. `Lumma`, `RedLine`).
details.operatingSystemstring | nullOperating system.
details.countrystring | nullCountry.
details.antivirusstring | nullAntivirus.
details.corporateServicesCountstring | nullLeaked corporate services.
details.userServicesCountstring | nullLeaked personal services.
details.daysAgostring | nullDays ago.
recommendationsarrayRecommended steps.
JSON schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://darkradar.com/docs/schemas/watch-finding.schema.json",
"title": "Portfolio Monitoring finding",
"description": "A leak found for a watched asset.",
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Record id."
},
"status": {
"type": "string",
"description": "Finding status: `new`, `reviewing`, `resolved`, `closed`."
},
"severity": {
"type": "string",
"description": "Severity: `critical`, `high`, `medium`, `low` or `unknown`."
},
"source": {
"type": "string",
"description": "Finding source."
},
"exposedDataTypes": {
"type": "array",
"description": "Exposed data types (e.g. `password`, `email`).",
"items": {}
},
"assetId": {
"type": "string",
"description": "Id of the related Portfolio Monitoring asset."
},
"assetType": {
"type": "string",
"description": "Asset type."
},
"assetValue": {
"type": "string",
"description": "Asset value."
},
"leakedSecretMasked": {
"type": [
"string",
"null"
],
"description": "Masked form of the leaked secret (e.g. `Ya******23`); the plain value is never returned."
},
"cardFlag": {
"type": "boolean",
"description": "Whether it contains card data."
},
"beaconAvailable": {
"type": "boolean",
"description": "Whether the detailed record is available in the Intelligence panel."
},
"contentLocked": {
"type": "boolean",
"description": "Whether the content is locked (visible after unlocking)."
},
"firstSeenAt": {
"type": "string",
"description": "When the leak was first seen."
},
"detectedAt": {
"type": "string",
"description": "When Dark Radar detected it."
},
"summary": {
"type": "string",
"description": "Short summary."
},
"title": {
"type": "string",
"description": "Title."
},
"reportRef": {
"type": "string",
"description": "Related report reference."
},
"details": {
"type": "object",
"description": "Infection details (masked).",
"properties": {
"computerName": {
"type": [
"string",
"null"
],
"description": "Computer name (masked)."
},
"stealerFamily": {
"type": [
"string",
"null"
],
"description": "Stealer family (e.g. `Lumma`, `RedLine`)."
},
"operatingSystem": {
"type": [
"string",
"null"
],
"description": "Operating system."
},
"country": {
"type": [
"string",
"null"
],
"description": "Country."
},
"antivirus": {
"type": [
"string",
"null"
],
"description": "Antivirus."
},
"corporateServicesCount": {
"type": [
"string",
"null"
],
"description": "Leaked corporate services."
},
"userServicesCount": {
"type": [
"string",
"null"
],
"description": "Leaked personal services."
},
"daysAgo": {
"type": [
"string",
"null"
],
"description": "Days ago."
}
}
},
"recommendations": {
"type": "array",
"description": "Recommended steps.",
"items": {}
}
}
}