{"info":{"version":"0.0.1","title":"CyCognito API V1 Reference","description":"The CyCognito API V1 is a REST API that allows you to post and get data from our main data entities—assets and issues. You can also manage the scope of your attack surface, attribute assets to organizations, and verify the identity of IP scans on your assets. Our legacy API (V0) documentation is available for download [here](https://platform.cycognito.com/CyCognito-API-V0-Reference.pdf). While V0 is still being supported, please note that this API is undergoing deprecation.\n| Code | Name | Description |\n|------|------|-------------|\n| 200 | OK | Success |\n| 400 | Bad Request | The request is malformed—e.g., the body cannot be properly parsed, expected fields are not included in the body, or unsupported request header values. |\n| 403 | Access Restricted | There are insufficient permissions or a valid API key was not provided. |\n| 404 | Not Found | The provided resource was not found. |\n| 405 | Method Not Allowed | The HTTP method is not allowed for the given resource. |\n| 415 | Unsupported Media Type | The request content type is not supported. |\n| 5XX | | Server failure |  |\n"},"components":{"securitySchemes":{"apiAuth":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"json.any?":{"anyOf":[{"type":"string"},{"type":"boolean"},{"type":"number"},{"type":"string","format":"dateTime"},{"type":"string","format":"byte"},{"type":"array","items":{"$ref":"#/components/schemas/json.any?"}},{"type":"object","additionalProperties":{"$ref":"#/components/schemas/json.any?"}},{"type":"null"}]}}},"openapi":"3.0.3","paths":{"/v1/assets":{"post":{"description":"Query assets across all asset types (IPs, domains, certificates, web applications, IP ranges) simultaneously in a single API call. This unified endpoint simplifies asset management by allowing you to retrieve and filter multiple asset types at once, rather than querying each type separately. Returns results in a consistent format with fields set to `null` when not applicable to a specific asset type.","security":[{"apiAuth":[]}],"summary":"Retrieve unified assets","tags":["Assets"],"parameters":[{"name":"count","in":"query","schema":{"type":"integer"},"required":false,"description":"Defines the number of results to be retrieved. Defaults to 10 with a max limit of 1000."},{"name":"advanced-search","in":"query","schema":{"type":"string"},"required":false,"description":"Allows you to input raw CyQL in order to query assets, issues, or organizations. See our <span name=\"kb-advanced-search-link\">Advanced Search</span> documentation for more details."},{"name":"offset","in":"query","schema":{"type":"integer"},"required":false,"description":"Sets the starting index for result retrieval, influenced by the `count` parameter. By default, `offset` is 0. Example: `offset` 3 with `count` 25 fetches results from index 75 to 99."},{"name":"q","in":"query","schema":{"type":"string"},"required":false,"description":"Specifies a search term for conducting a keyword-based search and retrieving data that matches your query."},{"name":"fields","in":"query","schema":{"type":"string"},"required":false,"description":"A comma-separated list specifying the desired entity properties to appear in the response. For more information, view the response example and schema."},{"name":"sort-by","in":"query","schema":{"type":"string"},"required":false,"description":"Specifies the field by which the results should be sorted."},{"name":"sort-order","in":"query","schema":{"type":"string","enum":["asc","desc"]},"required":false,"description":"Sorts the specified field in ascending or descending order."}],"requestBody":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"field":{"description":"Field to apply the filter on. Typically, any field present in the response can be used.","allOf":[{"type":"string"}],"example":"status"},"op":{"description":"Specifies the operation to apply on the desired field.\n            \n*Supported values:*  \n            \n* `is` – Searches for values that match the specified text exactly.  \n            \n* `not` – Searches for values that **do not** match the specified text exactly.  \n            \n* `in` – Filters entities for values that include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `not-in` – Filters entities for values that do not include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `only-in` – Filters **exclusively** so that only entities with the values specified will be searched. This operator is currently available only for the `organizations` and `tags` properties for assets and issues.  \n            \n* `between` – Searches by dates that are in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `not-between` – Searches by dates that are **not** in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `within-range` – Searches by number values that are in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[60,75]`.\n            \n* `not-within-range` – Searches by number values that are **not** in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[10,59]`.\n            \n* `within-last` – Searches for date values that are within the specified time frame in days—e.g., `64` is the value for 64 days.\n            \n* `not-within-last` – Searches for date values that are **not** within the specified time frame in days—e.g., `128` is the value for 128 days.\n            \n* `contains` – Searches for a specific substring within a string value.","allOf":[{"type":"string","enum":["is","not","in","not-in","only-in","key-of","not-key-of","between","not-between","within-range","not-within-range","contains","within-last","not-within-last"]}],"example":"in"},"values":{"description":"Specifies the value or values for the field.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"example":["new"]}},"required":["field","op","values"]}}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"active":{"description":"Indicates whether an IP address, domain, or certificate is currently used by your organization's IT infrastructure.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"additional-properties":{"description":"Supplementary attributes or characteristics of a web application asset, particularly detailing any unique web resource features or specifications of interest.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n      \"hosting.environment\": {\n        \"value\": [\n          \"IaaS\"\n        ],\n        \"display_name\": \"Hosting environment\"\n      },\n      \"hosting.provider\": {\n        \"value\": [\n          \"Amazon\"\n        ],\n        \"display_name\": \"Hosting provider\"\n      },\n      \"hosting.type\": {\n        \"value\": [\n          \"cloud\"\n        ],\n        \"display_name\": \"Hosting type\"\n      }\n    }"},"advisories":{"description":"A list of curated pieces of threat intelligence that highlight vulnerabilities actively exploited by attackers in the wild. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"last-verified":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"evidence-id":{"anyOf":[{"type":"string"},{"type":"null"}]},"evidence-last-seen":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"vulnerable":{"anyOf":[{"type":"boolean"},{"type":"null"}]},"advisory":{"anyOf":[{"type":"string"},{"type":"null"}]},"issue-id":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["last-verified","evidence-id","evidence-last-seen","vulnerable","advisory","issue-id"]},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"last_verified\": \"2024-08-04T08:21:17.000Z\",\n        \"id\": \"ip/1.2.2.2\",\n        \"issue_id\": \"CYC-VS-APACHE-HTTP_SERVER-2.2.15\",\n        \"advisory\": \"CISA | Known Exploited Vulnerabilities (KEV) catalog\",\n        \"type\": \"ip\",\n        \"evidence_id\": \"issue/1.2.2.2-cyc-vs-apache-http_server-2.2.15\",\n        \"realm_id\": \"acme-corporation\",\n        \"security_score\": 16,\n        \"evidence_last_seen\": \"2024-08-04T08:21:17.000Z\",\n        \"vulnerable\": true\n      }\n    ]"},"alive":{"description":"Indicates whether an IP Address has at least one open or closed port (i.e., an installed service), or responds to a ping.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"alive-evidence":{"description":"Refers to any specific evidence gathered from the internet which indicates the reason why an asset is considered alive.","anyOf":[{"type":"string"},{"type":"null"}],"example":"ports"},"as-list":{"description":"The list of autonomous systems (AS list) to which an IP range and its IP addresses belong.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"AS1234\",\n      \"AS23456\",\n      \"AS567890\"\n    ]"},"asns":{"description":"The Autonomous System Number (ASN) of an IP address.","anyOf":[{"type":"array","items":{"$ref":"#/components/schemas/json.any?"}},{"type":"null"}],"example":"[\n      {\n        \"owner\": \"Amazon.com, Inc.\",\n        \"asn\": \"AS16509\"\n      },\n      {\n        \"owner\": \"GoDaddy.com, LLC\",\n        \"asn\": \"AS26496\"\n      }\n    ]"},"attractiveness":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a highly attractive target for attackers, regardless of any issues it has.","anyOf":[{"type":"number"},{"type":"null"}],"example":"extreme"},"attractiveness-label":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a higher-priority target for attackers, regardless of any issues it has.","anyOf":[{"type":"string"},{"type":"null"}],"example":"extreme"},"attribution-certainty":{"description":"Refers to the degree of certainty in which an organization can be said to own a particular asset. This value is expressed as one of five levels for ease of prioritization.","anyOf":[{"type":"string"},{"type":"null"}],"example":"highest"},"business-units":{"description":"[DEPRECATED] - The functional areas of the business that use the assets or the platform, or are affected by the issue.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Marketing\"\n    ]"},"certificate-subject-key-id":{"description":"The certificates subject key.","anyOf":[{"type":"string"},{"type":"null"}]},"certification-authority-key-id":{"description":"The certificates authority key.","anyOf":[{"type":"string"},{"type":"null"}]},"cidr":{"description":"The CIDR IP range.","anyOf":[{"type":"string"},{"type":"null"}],"example":"1.1.*.*"},"cis-controls":{"description":"Refers to the compliance control number of the CIS framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"7.6\",\n      \"3.11\",\n      \"7.5\",\n      \"16.7\"\n    ]"},"closed-ports":{"description":"A collection of objects describing closed ports associated with the asset.","anyOf":[{"type":"array","items":{"type":"object","properties":{"status":{"type":"string"},"port":{"type":"integer"},"first-seen":{"type":"string"},"protocol":{"type":"string","enum":["tcp","udp"]}},"required":["status","port","first-seen","protocol"],"additionalProperties":false}},{"type":"null"}],"example":"[\n      {\n        \"port\": 80,\n        \"protocol\": \"udp\",\n        \"status\": \"closed\"\n      },\n      {\n        \"port\": 8081,\n        \"protocol\": \"tcp\",\n   \"first_seen\": \"2024-09-29T18:26:30.650Z\",\n     \"status\": \"closed\"\n      }\n    ]"},"cloud-env":{"description":"The cloud environment in which the asset is located.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"ACME AWS Cloud Environment"},"cloud-env-metadata":{"description":"Data that CyCognito fetches directly from your cloud service (e.g., AWS, Azure, GCP) and includes the configuration of your instance.","anyOf":[{"type":"array","items":{"type":"object","additionalProperties":{"anyOf":[{"type":"string"},{"type":"object"}]}}},{"type":"null"}],"example":"[{\"cloud-env\": \"value\"\n                                                                      \"cloud-env-id\": \"value\"\n                                                                      \"metadata\": \"value\"}]"},"comment":{"description":"Custom text that can be added to the details of an asset or issue. Comments are typically used to make notes or personal descriptions regarding the significance of a particular asset or issue.","anyOf":[{"type":"object","properties":{"content":{"type":"string"},"last-update":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}},"required":["content","last-update"]},{"type":"null"}],"example":"Reviewed by Gary"},"comments":{"description":"Comments is a collection of custom text entries, providing the ability to record multiple notes or personal descriptions related to an asset or issue. Unlike the single 'comment' field, this allows for a running log or more detailed commentary over time.","anyOf":[{"type":"array","items":{"type":"object","properties":{"content":{"type":"string"},"created-by-name":{"anyOf":[{"type":"string"},{"type":"null"}]},"last-update":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["content","created-by-name","last-update"]}},{"type":"null"}],"example":"Reviewed by Gary"},"compliance-violations":{"description":"Refers to specific compliance frameworks that have been violated.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"NIST-800-171\",\n      \"CIS\",\n      \"ISO27001\"\n    ]"},"continent":{"description":"The geographical continent in which the asset or issue is located.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Americas"},"country-code":{"description":"The country code in which the asset's underlying IP range is currently hosted.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"created":{"description":"The date and time at which the asset was created—e.g., *2019-03-03T22:00:10.000Z*.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2019-03-03T22:00:10.000Z"},"discoverability":{"description":"Indicates an asset's level of exposure, or how easily an attacker can find an asset affected by a specific issue and identify its relation to your enterprise.","anyOf":[{"type":"string"},{"type":"null"}],"example":"extreme"},"discovery-path":{"description":"The sequence of steps involved in discovering a specific asset or organization in your attack surface. It details each step and the connections between them, illustrating how one step leads to the subsequent step in the discovery process.","anyOf":[{"type":"array","items":{"type":"object","properties":{"src":{"type":"string"},"dest":{"type":"string"},"movement-type":{"$ref":"#/components/schemas/json.any?"},"movement-data":{"$ref":"#/components/schemas/json.any?"}},"required":["src","dest","movement-type","movement-data"]}},{"type":"null"}],"example":"[{\"dest\":\"org/acme-corporation\",\"movement_data\":{\"sources\":[]},\"movement_type\":\"default\",\"src\":\"_ENTRY_\"},{\"dest\":\"ip/1.1.1.1\",\"movement_data\":{\"probability\":1,\"relation_id\":\"org-relation/acme-corporation-has-subsidiary-acme-jubilee-limited\",\"sources\":[]},\"movement_type\":\"relation\",\"src\":\"org/acme-corporation\"}]"},"dns-rcode":{"description":"A string representing one of the common <a href=\"https://support.umbrella.com/hc/en-us/articles/232254248-Common-DNS-return-codes-for-any-DNS-service-and-Umbrella-\">DNS return code messages</a>.","anyOf":[{"type":"string"},{"type":"null"}],"example":"NXDOMAIN"},"dns-records":{"description":"A list of the domain's DNS, SPF, and DKIM records.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n      \"A\": [\n        \"1.1.255.255\"\n      ],\n      \"MX\": [\n        \"10 us2.mx1.foobar.com.\"\n      ],\n      \"NS\": [\n        \"ns0.acmedns.net.\"\n      ],\n      \"SOA\": [\n        \"ns0.acmedns.net. support.acme.com. 1122334455 66778 8990 9090 1212\"\n      ],\n      \"TXT\": [\n        \"\\\"v=spf1 redirect=_spf.foobar.com\\\"\"\n      ]\n    }"},"domain":{"description":"The domain name associated with the asset.","anyOf":[{"type":"string"},{"type":"null"}],"example":"www.foobar.com"},"domains":{"description":"A list of domain names associated with the IP address.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"blog.domain.com\",\n      \"blog2.domain.com\",\n      \"blog3.domain.com\"\n    ]"},"dynamic-dns":{"description":"Indicates whether a domain changes its DNS resolutions frequently or not.","anyOf":[{"type":"string"},{"type":"null"}],"example":"no"},"dynamically-resolved":{"description":"Refers to whether an IP address is dynamically resolved or not, or partially dynamically resolved.","anyOf":[{"type":"array","items":{"$ref":"#/components/schemas/json.any?"}},{"type":"string"},{"type":"null"}],"example":"no"},"environments":{"description":"Refers to IT environments, or the different hardware, software, infrastructure, and networks in which your assets are found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"Cryptographic Protocols\",\n      \"Operating Systems\",\n      \"Web Servers\"\n    ]"},"expiration":{"description":"The date and time at which the asset expired—e.g., *2019-06-01T22:00:10.000Z*.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2023-02-07T23:59:59.000Z"},"first-detected":{"description":"The date and time at which CyCognito first discovered and attributed the asset to the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2022-03-18T09:07:22.977Z"},"first-seen":{"description":"The date and time at which CyCognito first discovered and attributed the asset to the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2022-03-18T09:07:22.977Z"},"formats":{"description":"The specific type or standard of the web application's structure and markup. It denotes the version or specification of web content being used, enabling users to identify how the application's content is formatted. *Examples: html-5*, *xhtml-1.0-strict*, *xhtml-1.0-transitional*, etc.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"html-5\"\n    ]"},"has-form":{"description":"Indicates whether a web page belonging to a web application contains a form or not.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"has-login":{"description":"Refers to whether a web application includes a login mechanism in which a user could input credentials.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"home-page-description":{"description":"The description of the homepage.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Official homepage of Acme"},"home-page-status-code":{"description":"Indicates the HTTP status code returned by the homepage of a web application. This integer value represents the response status of the website, providing insight into its current accessibility or operational state.","anyOf":[{"type":"number"},{"type":"null"}],"example":"200"},"home-page-title":{"description":"The title of the homepage.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Acme Home"},"home-page-url":{"description":"The URL of the homepage.","anyOf":[{"type":"string"},{"type":"null"}],"example":"https://1.1.1.1"},"hosting-type":{"description":"Refers to type of hosting platform for the asset or issue.","anyOf":[{"type":"string"},{"type":"null"}],"example":"undetermined"},"id":{"description":"The unique identifier for an asset, formatted by combining its type (ip, domain, cert, webapp, or iprange) with its name: IP addresses as `ip/{ip}`, domains as `domain/{domain}`, certificates as `cert/{cert}`, web applications as `webapp/{webapp}`, and IP ranges as `iprange/{iprange}`. \n *Examples:* `ip/192.168.0.0`, `domain/acme-studios.com`","anyOf":[{"type":"string"},{"type":"null"}],"example":"ip/192.168.0.0"},"investigation-status":{"description":"Indicates whether or not an asset or issue has undergone investigation by you or someone on your team.","anyOf":[{"type":"string","enum":["investigating","investigated","uninvestigated"]},{"type":"null"}],"example":"investigating"},"ip":{"description":"The IP address—e.g., `1.2.3.4`.","anyOf":[{"type":"string"},{"type":"null"}],"example":"1.1.1.1"},"ip-addresses":{"description":"A list of the IP addresses hosting the asset.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"1.1.1.2\",\n      \"1.1.2.1\",\n      \"1.2.1.1\"\n    ]"},"ip-ranges":{"description":"A list detailing specific IP ranges, with each item indicating the range (`inetnum`) and its associated owner (i.e., the organization registered in the Whois database). For example, a range might be *1.1.1.1-2.2.2.2* owned by *Acme Studios*.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"inetnum":{"anyOf":[{"type":"string"},{"type":"null"}]},"owner":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["inetnum","owner"]},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"inetnum\": \"1.1.1.1-1.1.1.255\",\n        \"owner\": \"Acme Utilities\"\n      },\n      {\n        \"inetnum\": \"1.1.2.1-2.2.2.2\",\n        \"owner\": \"Acme Gardens\"\n      }\n    ]"},"ips-count":{"description":"The number of IP address assets that are contained within the IP range.","anyOf":[{"type":"number"},{"type":"null"}],"example":"8"},"is-encrypted":{"description":"Indicates whether a web page that is contained by a web application is encrypted or not.","anyOf":[{"type":"string"},{"type":"null"}],"example":"no"},"is-subdomain":{"description":"Indicates whether a domain is actually a subdomain of a particular parent domain.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"iso27001-controls":{"description":"Refers to the compliance control number of the ISO 27001 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"iso27002-controls":{"description":"Refers to the compliance control number of the ISO 27002 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"issuer-alt-names":{"description":"A list of alternate names for the certificate's issuer.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"http://ca.example.net/\",\n      \"certmaster@example.net\",\n      \"1.1.1.1\"\n    ]"},"issuer-common-name":{"description":"The common name for the certificate's issuer.","anyOf":[{"type":"string"},{"type":"null"}],"example":"example.com"},"issuer-country":{"description":"The country of the certificate's issuer—e.g., *US*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"issuer-locality":{"description":"The locality of the certificate's issuer—e.g., *US*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"issuer-organization":{"description":"The organization of the certificate's issuer.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Acme Corporation"},"issuer-organization-unit":{"description":"The organization unit of the certificate's issuer.","anyOf":[{"type":"string"},{"type":"null"}],"example":"IT Department"},"issuer-state":{"description":"The state of the certificate's issuer.","anyOf":[{"type":"string"},{"type":"null"}],"example":"California"},"issues-count":{"description":"The number of issues found on a particular asset or organization.","anyOf":[{"type":"integer"},{"type":"null"}],"example":"7"},"known-status":{"description":"Indicates whether a user designated an asset as *known* to your enterprise.","anyOf":[{"type":"string"},{"type":"null"}],"example":"known"},"last-detected":{"description":"The date and time at which CyCognito most recently discovered and attributed the asset to the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-06-17T07:02:04.181Z"},"last-seen":{"description":"The date and time at which CyCognito most recently discovered and attributed the asset to the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-06-17T07:02:04.181Z"},"locations":{"description":"The geographic locations (i.e., countries or regions) where the asset or issue is found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"USA\"\n    ]"},"name-servers":{"description":"Identifies the servers where the domain is registered, aiding in asset searches based on domain-related information.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"ns0.acmedns.net\",\n      \"ns1.acmedns.net\"\n    ]"},"nist-800-171-controls":{"description":"Refers to the compliance control number of the NIST 800-171 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"3.3.5\",\n      \"3.12.2\",\n      \"3.11.2\"\n    ]"},"nist-800-53-controls":{"description":"Refers to the compliance control number of the NIST 800-53 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"CM-8\",\n      \"SI-2(3)\",\n      \"SI-4(16)\"\n    ]"},"open-ports":{"description":"A collection of objects describing open ports that are associated with the asset.","anyOf":[{"type":"array","items":{"type":"object","properties":{"status":{"type":"string"},"port":{"type":"integer"},"first-seen":{"type":"string"},"protocol":{"type":"string","enum":["tcp","udp"]}},"required":["status","port","first-seen","protocol"],"additionalProperties":false}},{"type":"null"}],"example":"[\n      {\n        \"port\": 80,\n        \"protocol\": \"tcp\",\n   \"first_seen\": \"2024-09-29T18:26:30.650Z\",\n     \"status\": \"open\"\n      }\n    ]"},"organizations":{"description":"Specifies the organizations to whom the asset belongs, or those that are affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Gardens\"\n    ]"},"parent-domain":{"description":"The parent domain of a domain asset.","anyOf":[{"type":"string"},{"type":"null"}],"example":"acme.net"},"pci-dss-controls":{"description":"Refers to the compliance control number of the PCI DSS, which is an information security standard used to handle credit card information.","anyOf":[{"type":"array","items":{"type":"string"},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"10.2.2\",\n      \"8.3.1\",\n      \"1.2.4\"\n    ]"},"platforms":{"description":"A list of platforms associated with an asset or issue.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"Apache\",\n      \"CentOS\",\n      \"HTTP Protocol\",\n      \"TLS Protocol\"\n    ]"},"ptr-domains":{"description":"The PTR record associated with an IP address.","anyOf":[{"type":"array","items":{"anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"domain_name\": \"is-oveds.sabich.amazonaws.com\",\n        \"first_seen\": \"2023-05-09T11:53:26.726Z\",\n        \"subject\": [\n          \"2.4.6.8.foo.bar.\"\n        ],\n        \"to_time\": \"2024-07-28T09:49:19.227Z\"\n      }\n    ]"},"public-key-length":{"description":"The public key length of the certificate's signature.","anyOf":[{"type":"number"},{"type":"null"}],"example":"2048"},"public-key-type":{"description":"The public key type of the certificate's signature.","anyOf":[{"type":"string"},{"type":"null"}],"example":"RSA"},"range":{"description":"A range of IP addresses (e.g., `1.1.1.1-2.2.2.2`), corresponding to the **IP Range** column in the Asset List.","anyOf":[{"type":"string"},{"type":"null"}],"example":"1.1.1.1-2.2.2.2"},"range-description":{"description":"A text string describing the significance of the particular IP range.","anyOf":[{"type":"string"},{"type":"null"}],"example":"\"Acme Commerce Sdn Bhd\\nVO2-07-07\\nLingkaran SV\\nSunway Velocity\\nJalan Peel\\n55100 Kuala Lumpur\""},"range-name":{"description":"A text string representing a common name for the IP range.","anyOf":[{"type":"string"},{"type":"null"}],"example":"WEBSERVER-AS-AP"},"region":{"description":"Refers to the regional location of the asset or issue. *Examples: Northern Africa*, *South-eastern Asia*, *Central America*, etc.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Central Asia"},"registered-org-name":{"description":"The name of the organization as it appears in the Whois database.","anyOf":[{"type":"string"},{"type":"null"}],"example":"WEBSERVER-AS-AP"},"registrant":{"description":"The company that holds or owns the domain.","anyOf":[{"type":"string"},{"type":"null"}],"example":"acme"},"registrar":{"description":"The company that manages the domain name.","anyOf":[{"type":"string"},{"type":"null"}],"example":"godaddy.com"},"related":{"description":"Indicates whether an asset is directly related to your organization.","anyOf":[{"type":"string"},{"type":"null"}],"example":"yes"},"related-asset-ids":{"description":"A list of IDs for assets that are associated with the specified asset.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n      \"ip\": [\n        \"ip/1.1.1.1\",\n        \"ip/2.2.2.2\"\n      ],\n      \"cert\": [\n        \"cert/1234567890qwertyuiop\"\n      ],\n      \"webapp\": [\n        \"webapp/acmecorporation.com:82\"\n      ]\n    }"},"related-screenshot-urls":{"description":"A list mapping URLs of a web application's associated web resources to their corresponding screenshot URLs.","anyOf":[{"type":"object","additionalProperties":{"type":"string"}},{"type":"null"}],"example":"{\n      \"http://1.2.3.4/\": \"https://foo.bar.com/abc-1d23e4fg5hi67j8k\"\n    }"},"revalidation-request-time":{"description":"Indicates the date and time at which an issue revalidation was requested.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-08-03T15:18:48.452Z"},"revalidation-requested":{"description":"Indicates whether a revalidation request is currently in progress on a specific issue.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"security-grade":{"description":"Specifies the security grade of the asset based on factors such as attractiveness, and the number and severity of its associated issues.","anyOf":[{"type":"string"},{"type":"null"}],"example":"F"},"security-score":{"description":"Refers to CyCognito's method of evaluating an individual asset's security status, and how likely it contributes to the overall security of its organization. This value is expressed as an integer from 0 to 100.","anyOf":[{"type":"number"},{"type":"null"}],"example":"5"},"serial-number":{"description":"The serial number associated with the information being secured by a certificate.","anyOf":[{"type":"string"},{"type":"null"}],"example":"3960198806143193780718529211402714933521680192"},"services":{"description":"Refers to software that runs on a particular platform.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"id":{"anyOf":[{"type":"string"},{"type":"null"}]},"scan-status":{"anyOf":[{"type":"string"},{"type":"null"}]},"ports":{"anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"integer"},{"type":"null"}]}},{"type":"null"}]},"first-seen":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"},{"type":"string"}]},"last-seen":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"},{"type":"string"}]},"evidence":{"anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}]},"banners":{"anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"port":{"anyOf":[{"type":"string"},{"type":"null"}]},"banner":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["port","banner"]},{"type":"null"}]}},{"type":"null"}]}},"additionalProperties":false},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"first_seen\": \"2024-08-02 22:12:44.161\",\n        \"id\": \"cpe:2.3:o:foo:bar:*:*:*:*:*:*:*:*\",\n        \"last_seen\": \"2024-08-02 22:12:44.161\",\n        \"ports\": [\n          \"443/tcp\",\n          \"80/tcp\"\n        ],\n        \"scan_status\": \"new\",\n        \"banners\": \"Version 1.2.3\"\n, \n  \"evidence\": {\n        \"hosts\": [\n          \"1.1.1.1\"\n        ],\n        \"urls\": [\n          https//:\n        ]\n      }, \n      }\n    ]"},"serving-machines":{"description":"A list of servers that have been found to serve the certificate.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"[\n      {\n        \"id\": \"ip/1.1.1.1\",\n        \"ip\": \"1.2.3.4\",\n        \"port\": \"443\",\n        \"protocol\": \"tcp\"\n      }\n    ]"},"severe-issues":{"description":"The number of severe issues associated with the asset.","anyOf":[{"type":"integer"},{"type":"null"}],"example":"24"},"signature":{"description":"The identifier for the certificate.","anyOf":[{"type":"string"},{"type":"null"}],"example":"qwert56789ghjkl2345fghjyuio90cvb345cvbghjtyu"},"signature-algorithm":{"description":"The certificate's signature algorithm—e.g., `SHA256`.","anyOf":[{"type":"string"},{"type":"null"}],"example":"SHA256"},"source":{"description":"The name of the service or origin from which data about the IP range was gathered.","anyOf":[{"type":"string"},{"type":"null"}],"example":"WHOISXMLAPI"},"sni-hosts":{"description":"Retrieves certificates from alive, non-shared IPs with open ports — using SNI when a host is present, or without SNI otherwise (443 must be open).","anyOf":[{"type":"array","items":{"type":"object","properties":{"ip":{"type":"string"},"port":{"type":"integer"},"protocol":{"type":"string"},"sni":{"anyOf":[{"type":"string"},{"type":"null"}]},"time":{"type":"string"}},"required":["ip","port","protocol","sni","time"]}},{"type":"null"}]},"status":{"description":"Refers to the latest status of an asset following the most recent data update (or \"scan\"). The following are the supported statuses and their definitions: \n * `new` – The asset was first seen up to 30 days before the latest data update. \n * `normal` – The asset has not changed since the latest data update. \n * `removed` – The asset was not seen in the latest data update. \n * `changed` – Changes to the asset's ports or services were found in the latest data update. This status is valid for IP assets only. ","anyOf":[{"type":"string"},{"type":"string"},{"type":"null"}],"example":"new"},"subject-alt-names":{"description":"A list of the certificate's alternate subject names.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"www-qa1.acmemarkets.com\",\n      \"www-qa2.acmemarkets.com\",\n      \"shop-qa2.acmemarkets.com\"\n    ]"},"subject-common-name":{"description":"The common name for the certificate's subject—e.g., `api.prod.acme.com`.","anyOf":[{"type":"string"},{"type":"null"}],"example":"api.prod.acme.com"},"subject-country":{"description":"The country of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"subject-locality":{"description":"The locality of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"San Francisco"},"subject-organization":{"description":"The organization of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Acme Product"},"subject-organization-unit":{"description":"The organization unit of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"IT"},"subject-state":{"description":"The state of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"California"},"supported-protocols":{"description":"Specifies the type of application layer protocol for the web application.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"html/1.1\"\n    ]"},"tags":{"description":"Custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"My tag\",\n      \"Another tag\"\n    ]"},"teams":{"description":"Lists the teams associated with the queried asset, issue, or organization. This property is available only in realms where the Teams feature is enabled.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Homes IT team\",\n      \"Onboarding IT\",\n      \"Project managers\"\n    ]"},"tech-owners":{"description":"The names of the technical owners of a specific asset or organization, or of an asset or organization affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"email":{"type":"string"},"org-name":{"type":"string"}},"required":["name","email","org-name"]}},{"type":"null"}],"example":"[\n      {\n        \"name\": \"Marty McFly\",\n        \"email\": \"marty@acme.com\",\n        \"org_id\": \"org/acme.org\",\n        \"org_name\": \"Acme Corporation\"\n      }\n    ]"},"type":{"description":"Indicates one of the five supported types of assets in CyCognito: IP address, domain, certificate, web application, or IP range. ","anyOf":[{"type":"string"},{"type":"null"}],"example":"ip"},"web-pages":{"description":"A list of the web application's underlying web pages.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"html-5\"\n    ]"},"web-resources-urls":{"description":"A list of the web application's underlying web resource URLs.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"http://1.1.1.1:10080/\"\n    ]"},"web-servers":{"description":"A string representing the name of the home page's web server.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"AmazonS3\"\n    ]"},"webapp-address":{"description":"The name of the web application asset—e.g., `1.2.3.4`, `subdomain.acme.com`. This corresponds to the **Webapp Address** column in the Asset List.","anyOf":[{"type":"string"},{"type":"null"}],"example":"webapp.acme.com"}}}}}}}}},"delete":{"description":"Remove multiple assets from your attack surface in a single request. CyCognito will continue to monitor removed assets for changes, in case you later decide that they are relevant again.","security":[{"apiAuth":[]}],"summary":"Remove assets in bulk","tags":["Assets"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"entity-ids":{"description":"A comma-separated list in which each item contains the unique ID for the assets whose custom tags you would like to modify. The unique ID corresponds to the `id` field (from the *Retrieve assets* response) and should be in the format `&lt;asset_type&gt;/&lt;asset_id&gt;`.\n   \n*Examples:* `ip/1.1.1.1`, `domain/acme.com`","type":"array","items":{"type":"string"},"example":["ip/1.1.1.1","ip/2.2.2.2","domain/acme.com","webapp/acme.com","iprange/1.1.1.1-1.2.3.4"]},"removal-type":{"description":"Indicates whether or not an asset removal should affect discovery. A value of `block-discovery` means that the selected asset will be removed, and that all other assets that are discovered via this asset will also be removed. A value of `allow-discovery` means that the selected asset will be removed, and that all other assets discovered via this asset will **not** be affected. ","type":"string","enum":["block-discovery","allow-discovery"],"example":"block-discovery"},"comment":{"description":"An explanation or reason why the asset is being removed.","type":"string","example":"The asset is no longer relevant."}},"required":["entity-ids","comment"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"status":{"description":"Indicates whether an asset was successfully removed.","type":"string","example":"Asset successfully removed."}},"required":["status"]}}}}}}},"/v1/assets/{asset_type}":{"post":{"description":"Fetch assets based on given criteria. If you are comparing search results with the CyCognito app, note that <span name=\"kb-predefined-filters-api-explanation\">Predefined Filters</span> are not applied to data queried via the API by default.","security":[{"apiAuth":[]}],"summary":"Retrieve assets","tags":["Assets"],"parameters":[{"name":"asset_type","in":"path","schema":{"type":"string","enum":["ip","domain","cert","webapp","iprange"]},"required":true,"description":"Specifies the category of the asset."},{"name":"count","in":"query","schema":{"type":"integer"},"required":false,"description":"Defines the number of results to be retrieved. Defaults to 10 with a max limit of 1000."},{"name":"advanced-search","in":"query","schema":{"type":"string"},"required":false,"description":"Allows you to input raw CyQL in order to query assets, issues, or organizations. See our <span name=\"kb-advanced-search-link\">Advanced Search</span> documentation for more details."},{"name":"offset","in":"query","schema":{"type":"integer"},"required":false,"description":"Sets the starting index for result retrieval, influenced by the `count` parameter. By default, `offset` is 0. Example: `offset` 3 with `count` 25 fetches results from index 75 to 99."},{"name":"q","in":"query","schema":{"type":"string"},"required":false,"description":"Specifies a search term for conducting a keyword-based search and retrieving data that matches your query."},{"name":"fields","in":"query","schema":{"type":"string"},"required":false,"description":"A comma-separated list specifying the desired entity properties to appear in the response. For more information, view the response example and schema."},{"name":"sort-by","in":"query","schema":{"type":"string"},"required":false,"description":"Specifies the field by which the results should be sorted."},{"name":"sort-order","in":"query","schema":{"type":"string","enum":["asc","desc"]},"required":false,"description":"Sorts the specified field in ascending or descending order."}],"requestBody":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"field":{"description":"Field to apply the filter on. Typically, any field present in the response can be used.","allOf":[{"type":"string"}],"example":"status"},"op":{"description":"Specifies the operation to apply on the desired field.\n            \n*Supported values:*  \n            \n* `is` – Searches for values that match the specified text exactly.  \n            \n* `not` – Searches for values that **do not** match the specified text exactly.  \n            \n* `in` – Filters entities for values that include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `not-in` – Filters entities for values that do not include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `only-in` – Filters **exclusively** so that only entities with the values specified will be searched. This operator is currently available only for the `organizations` and `tags` properties for assets and issues.  \n            \n* `between` – Searches by dates that are in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `not-between` – Searches by dates that are **not** in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `within-range` – Searches by number values that are in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[60,75]`.\n            \n* `not-within-range` – Searches by number values that are **not** in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[10,59]`.\n            \n* `within-last` – Searches for date values that are within the specified time frame in days—e.g., `64` is the value for 64 days.\n            \n* `not-within-last` – Searches for date values that are **not** within the specified time frame in days—e.g., `128` is the value for 128 days.\n            \n* `contains` – Searches for a specific substring within a string value.","allOf":[{"type":"string","enum":["is","not","in","not-in","only-in","key-of","not-key-of","between","not-between","within-range","not-within-range","contains","within-last","not-within-last"]}],"example":"in"},"values":{"description":"Specifies the value or values for the field.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"example":["new"]}},"required":["field","op","values"]}}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"active":{"description":"Indicates whether an IP address, domain, or certificate is currently used by your organization's IT infrastructure.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"additional-properties":{"description":"Supplementary attributes or characteristics of a web application asset, particularly detailing any unique web resource features or specifications of interest.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n      \"hosting.environment\": {\n        \"value\": [\n          \"IaaS\"\n        ],\n        \"display_name\": \"Hosting environment\"\n      },\n      \"hosting.provider\": {\n        \"value\": [\n          \"Amazon\"\n        ],\n        \"display_name\": \"Hosting provider\"\n      },\n      \"hosting.type\": {\n        \"value\": [\n          \"cloud\"\n        ],\n        \"display_name\": \"Hosting type\"\n      }\n    }"},"advisories":{"description":"A list of curated pieces of threat intelligence that highlight vulnerabilities actively exploited by attackers in the wild. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"last-verified":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"evidence-id":{"anyOf":[{"type":"string"},{"type":"null"}]},"evidence-last-seen":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"vulnerable":{"anyOf":[{"type":"boolean"},{"type":"null"}]},"advisory":{"anyOf":[{"type":"string"},{"type":"null"}]},"issue-id":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["last-verified","evidence-id","evidence-last-seen","vulnerable","advisory","issue-id"]},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"last_verified\": \"2024-08-04T08:21:17.000Z\",\n        \"id\": \"ip/1.2.2.2\",\n        \"issue_id\": \"CYC-VS-APACHE-HTTP_SERVER-2.2.15\",\n        \"advisory\": \"CISA | Known Exploited Vulnerabilities (KEV) catalog\",\n        \"type\": \"ip\",\n        \"evidence_id\": \"issue/1.2.2.2-cyc-vs-apache-http_server-2.2.15\",\n        \"realm_id\": \"acme-corporation\",\n        \"security_score\": 16,\n        \"evidence_last_seen\": \"2024-08-04T08:21:17.000Z\",\n        \"vulnerable\": true\n      }\n    ]"},"alive":{"description":"Indicates whether an IP Address has at least one open or closed port (i.e., an installed service), or responds to a ping.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"alive-evidence":{"description":"Refers to any specific evidence gathered from the internet which indicates the reason why an asset is considered alive.","anyOf":[{"type":"string"},{"type":"null"}],"example":"ports"},"as-list":{"description":"The list of autonomous systems (AS list) to which an IP range and its IP addresses belong.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"AS1234\",\n      \"AS23456\",\n      \"AS567890\"\n    ]"},"asns":{"description":"The Autonomous System Number (ASN) of an IP address.","anyOf":[{"type":"array","items":{"$ref":"#/components/schemas/json.any?"}},{"type":"null"}],"example":"[\n      {\n        \"owner\": \"Amazon.com, Inc.\",\n        \"asn\": \"AS16509\"\n      },\n      {\n        \"owner\": \"GoDaddy.com, LLC\",\n        \"asn\": \"AS26496\"\n      }\n    ]"},"attractiveness":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a highly attractive target for attackers, regardless of any issues it has.","anyOf":[{"type":"number"},{"type":"null"}],"example":"extreme"},"attractiveness-label":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a higher-priority target for attackers, regardless of any issues it has.","anyOf":[{"type":"string"},{"type":"null"}],"example":"extreme"},"attribution-certainty":{"description":"Refers to the degree of certainty in which an organization can be said to own a particular asset. This value is expressed as one of five levels for ease of prioritization.","anyOf":[{"type":"string"},{"type":"null"}],"example":"highest"},"business-units":{"description":"[DEPRECATED] - The functional areas of the business that use the assets or the platform, or are affected by the issue.","type":"array","items":{"type":"string"},"example":"[\n      \"Marketing\"\n    ]"},"certificate-subject-key-id":{"description":"The certificates subject key.","anyOf":[{"type":"string"},{"type":"null"}]},"certification-authority-key-id":{"description":"The certificates authority key.","anyOf":[{"type":"string"},{"type":"null"}]},"cidr":{"description":"The CIDR IP range.","anyOf":[{"type":"string"},{"type":"null"}],"example":"1.1.*.*"},"cis-controls":{"description":"Refers to the compliance control number of the CIS framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"7.6\",\n      \"3.11\",\n      \"7.5\",\n      \"16.7\"\n    ]"},"closed-ports":{"description":"A collection of objects describing closed ports associated with the asset.","type":"array","items":{"type":"object","properties":{"status":{"type":"string"},"port":{"type":"integer"},"first-seen":{"type":"string"},"protocol":{"type":"string","enum":["tcp","udp"]}},"required":["status","port","first-seen","protocol"],"additionalProperties":false},"example":"[\n      {\n        \"port\": 80,\n        \"protocol\": \"udp\",\n        \"status\": \"closed\"\n      },\n      {\n        \"port\": 8081,\n        \"protocol\": \"tcp\",\n   \"first_seen\": \"2024-09-29T18:26:30.650Z\",\n     \"status\": \"closed\"\n      }\n    ]"},"cloud-env":{"description":"The cloud environment in which the asset is located.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"ACME AWS Cloud Environment"},"cloud-env-metadata":{"description":"Data that CyCognito fetches directly from your cloud service (e.g., AWS, Azure, GCP) and includes the configuration of your instance.","anyOf":[{"type":"array","items":{"type":"object","additionalProperties":{"anyOf":[{"type":"string"},{"type":"object"}]}}},{"type":"null"}],"example":"[{\"cloud-env\": \"value\"\n                                                                      \"cloud-env-id\": \"value\"\n                                                                      \"metadata\": \"value\"}]"},"comment":{"description":"Custom text that can be added to the details of an asset or issue. Comments are typically used to make notes or personal descriptions regarding the significance of a particular asset or issue.","anyOf":[{"type":"object","properties":{"content":{"type":"string"},"last-update":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}},"required":["content","last-update"]},{"type":"null"}],"example":"Reviewed by Gary"},"comments":{"description":"Comments is a collection of custom text entries, providing the ability to record multiple notes or personal descriptions related to an asset or issue. Unlike the single 'comment' field, this allows for a running log or more detailed commentary over time.","anyOf":[{"type":"array","items":{"type":"object","properties":{"content":{"type":"string"},"created-by-name":{"anyOf":[{"type":"string"},{"type":"null"}]},"last-update":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["content","created-by-name","last-update"]}},{"type":"null"}],"example":"Reviewed by Gary"},"compliance-violations":{"description":"Refers to specific compliance frameworks that have been violated.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"NIST-800-171\",\n      \"CIS\",\n      \"ISO27001\"\n    ]"},"continent":{"description":"The geographical continent in which the asset or issue is located.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Americas"},"country-code":{"description":"The country code in which the asset's underlying IP range is currently hosted.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"created":{"description":"The date and time at which the asset was created—e.g., *2019-03-03T22:00:10.000Z*.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2019-03-03T22:00:10.000Z"},"discoverability":{"description":"Indicates an asset's level of exposure, or how easily an attacker can find an asset affected by a specific issue and identify its relation to your enterprise.","anyOf":[{"type":"string"},{"type":"null"}],"example":"extreme"},"discovery-path":{"description":"The sequence of steps involved in discovering a specific asset or organization in your attack surface. It details each step and the connections between them, illustrating how one step leads to the subsequent step in the discovery process.","anyOf":[{"type":"array","items":{"type":"object","properties":{"src":{"type":"string"},"dest":{"type":"string"},"movement-type":{"$ref":"#/components/schemas/json.any?"},"movement-data":{"$ref":"#/components/schemas/json.any?"}},"required":["src","dest","movement-type","movement-data"]}},{"type":"null"}],"example":"[{\"dest\":\"org/acme-corporation\",\"movement_data\":{\"sources\":[]},\"movement_type\":\"default\",\"src\":\"_ENTRY_\"},{\"dest\":\"ip/1.1.1.1\",\"movement_data\":{\"probability\":1,\"relation_id\":\"org-relation/acme-corporation-has-subsidiary-acme-jubilee-limited\",\"sources\":[]},\"movement_type\":\"relation\",\"src\":\"org/acme-corporation\"}]"},"dns-rcode":{"description":"A string representing one of the common <a href=\"https://support.umbrella.com/hc/en-us/articles/232254248-Common-DNS-return-codes-for-any-DNS-service-and-Umbrella-\">DNS return code messages</a>.","anyOf":[{"type":"string"},{"type":"null"}],"example":"NXDOMAIN"},"dns-records":{"description":"A list of the domain's DNS, SPF, and DKIM records.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n      \"A\": [\n        \"1.1.255.255\"\n      ],\n      \"MX\": [\n        \"10 us2.mx1.foobar.com.\"\n      ],\n      \"NS\": [\n        \"ns0.acmedns.net.\"\n      ],\n      \"SOA\": [\n        \"ns0.acmedns.net. support.acme.com. 1122334455 66778 8990 9090 1212\"\n      ],\n      \"TXT\": [\n        \"\\\"v=spf1 redirect=_spf.foobar.com\\\"\"\n      ]\n    }"},"domain":{"description":"The domain name associated with the asset.","type":"string","example":"www.foobar.com"},"domains":{"description":"A list of domain names associated with the IP address.","type":"array","items":{"type":"string"},"example":"[\n      \"blog.domain.com\",\n      \"blog2.domain.com\",\n      \"blog3.domain.com\"\n    ]"},"dynamic-dns":{"description":"Indicates whether a domain changes its DNS resolutions frequently or not.","anyOf":[{"type":"string"},{"type":"null"}],"example":"no"},"dynamically-resolved":{"description":"Refers to whether an IP address is dynamically resolved or not, or partially dynamically resolved.","anyOf":[{"type":"array","items":{"$ref":"#/components/schemas/json.any?"}},{"type":"string"},{"type":"null"}],"example":"no"},"environments":{"description":"Refers to IT environments, or the different hardware, software, infrastructure, and networks in which your assets are found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"Cryptographic Protocols\",\n      \"Operating Systems\",\n      \"Web Servers\"\n    ]"},"expiration":{"description":"The date and time at which the asset expired—e.g., *2019-06-01T22:00:10.000Z*.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2023-02-07T23:59:59.000Z"},"first-detected":{"description":"The date and time at which CyCognito first discovered and attributed the asset to the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2022-03-18T09:07:22.977Z"},"first-seen":{"description":"The date and time at which CyCognito first discovered and attributed the asset to the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2022-03-18T09:07:22.977Z"},"formats":{"description":"The specific type or standard of the web application's structure and markup. It denotes the version or specification of web content being used, enabling users to identify how the application's content is formatted. *Examples: html-5*, *xhtml-1.0-strict*, *xhtml-1.0-transitional*, etc.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"html-5\"\n    ]"},"has-form":{"description":"Indicates whether a web page belonging to a web application contains a form or not.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"has-login":{"description":"Refers to whether a web application includes a login mechanism in which a user could input credentials.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"home-page-description":{"description":"The description of the homepage.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Official homepage of Acme"},"home-page-status-code":{"description":"Indicates the HTTP status code returned by the homepage of a web application. This integer value represents the response status of the website, providing insight into its current accessibility or operational state.","anyOf":[{"type":"number"},{"type":"null"}],"example":"200"},"home-page-title":{"description":"The title of the homepage.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Acme Home"},"home-page-url":{"description":"The URL of the homepage.","anyOf":[{"type":"string"},{"type":"null"}],"example":"https://1.1.1.1"},"hosting-type":{"description":"Refers to type of hosting platform for the asset or issue.","type":"string","example":"undetermined"},"id":{"description":"The unique identifier for an asset, formatted by combining its type (ip, domain, cert, webapp, or iprange) with its name: IP addresses as `ip/{ip}`, domains as `domain/{domain}`, certificates as `cert/{cert}`, web applications as `webapp/{webapp}`, and IP ranges as `iprange/{iprange}`. \n *Examples:* `ip/192.168.0.0`, `domain/acme-studios.com`","type":"string","example":"ip/192.168.0.0"},"investigation-status":{"description":"Indicates whether or not an asset or issue has undergone investigation by you or someone on your team.","anyOf":[{"type":"string","enum":["investigating","investigated","uninvestigated"]},{"type":"null"}],"example":"investigating"},"ip":{"description":"The IP address—e.g., `1.2.3.4`.","type":"string","example":"1.1.1.1"},"ip-addresses":{"description":"A list of the IP addresses hosting the asset.","type":"array","items":{"type":"string"},"example":"[\n      \"1.1.1.2\",\n      \"1.1.2.1\",\n      \"1.2.1.1\"\n    ]"},"ip-ranges":{"description":"A list detailing specific IP ranges, with each item indicating the range (`inetnum`) and its associated owner (i.e., the organization registered in the Whois database). For example, a range might be *1.1.1.1-2.2.2.2* owned by *Acme Studios*.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"inetnum":{"anyOf":[{"type":"string"},{"type":"null"}]},"owner":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["inetnum","owner"]},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"inetnum\": \"1.1.1.1-1.1.1.255\",\n        \"owner\": \"Acme Utilities\"\n      },\n      {\n        \"inetnum\": \"1.1.2.1-2.2.2.2\",\n        \"owner\": \"Acme Gardens\"\n      }\n    ]"},"ips-count":{"description":"The number of IP address assets that are contained within the IP range.","type":"number","example":"8"},"is-encrypted":{"description":"Indicates whether a web page that is contained by a web application is encrypted or not.","anyOf":[{"type":"string"},{"type":"null"}],"example":"no"},"is-subdomain":{"description":"Indicates whether a domain is actually a subdomain of a particular parent domain.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"iso27001-controls":{"description":"Refers to the compliance control number of the ISO 27001 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"iso27002-controls":{"description":"Refers to the compliance control number of the ISO 27002 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"issuer-alt-names":{"description":"A list of alternate names for the certificate's issuer.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"http://ca.example.net/\",\n      \"certmaster@example.net\",\n      \"1.1.1.1\"\n    ]"},"issuer-common-name":{"description":"The common name for the certificate's issuer.","anyOf":[{"type":"string"},{"type":"null"}],"example":"example.com"},"issuer-country":{"description":"The country of the certificate's issuer—e.g., *US*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"issuer-locality":{"description":"The locality of the certificate's issuer—e.g., *US*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"issuer-organization":{"description":"The organization of the certificate's issuer.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Acme Corporation"},"issuer-organization-unit":{"description":"The organization unit of the certificate's issuer.","anyOf":[{"type":"string"},{"type":"null"}],"example":"IT Department"},"issuer-state":{"description":"The state of the certificate's issuer.","anyOf":[{"type":"string"},{"type":"null"}],"example":"California"},"issues-count":{"description":"The number of issues found on a particular asset or organization.","anyOf":[{"type":"integer"},{"type":"null"}],"example":"7"},"known-status":{"description":"Indicates whether a user designated an asset as *known* to your enterprise.","anyOf":[{"type":"string"},{"type":"null"}],"example":"known"},"last-detected":{"description":"The date and time at which CyCognito most recently discovered and attributed the asset to the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-06-17T07:02:04.181Z"},"last-seen":{"description":"The date and time at which CyCognito most recently discovered and attributed the asset to the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-06-17T07:02:04.181Z"},"locations":{"description":"The geographic locations (i.e., countries or regions) where the asset or issue is found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"USA\"\n    ]"},"name-servers":{"description":"Identifies the servers where the domain is registered, aiding in asset searches based on domain-related information.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"ns0.acmedns.net\",\n      \"ns1.acmedns.net\"\n    ]"},"nist-800-171-controls":{"description":"Refers to the compliance control number of the NIST 800-171 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"3.3.5\",\n      \"3.12.2\",\n      \"3.11.2\"\n    ]"},"nist-800-53-controls":{"description":"Refers to the compliance control number of the NIST 800-53 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"CM-8\",\n      \"SI-2(3)\",\n      \"SI-4(16)\"\n    ]"},"open-ports":{"description":"A collection of objects describing open ports that are associated with the asset.","type":"array","items":{"type":"object","properties":{"status":{"type":"string"},"port":{"type":"integer"},"first-seen":{"type":"string"},"protocol":{"type":"string","enum":["tcp","udp"]}},"required":["status","port","first-seen","protocol"],"additionalProperties":false},"example":"[\n      {\n        \"port\": 80,\n        \"protocol\": \"tcp\",\n   \"first_seen\": \"2024-09-29T18:26:30.650Z\",\n     \"status\": \"open\"\n      }\n    ]"},"organizations":{"description":"Specifies the organizations to whom the asset belongs, or those that are affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Gardens\"\n    ]"},"parent-domain":{"description":"The parent domain of a domain asset.","anyOf":[{"type":"string"},{"type":"null"}],"example":"acme.net"},"pci-dss-controls":{"description":"Refers to the compliance control number of the PCI DSS, which is an information security standard used to handle credit card information.","anyOf":[{"type":"array","items":{"type":"string"},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"10.2.2\",\n      \"8.3.1\",\n      \"1.2.4\"\n    ]"},"platforms":{"description":"A list of platforms associated with an asset or issue.","type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"example":"[\n      \"Apache\",\n      \"CentOS\",\n      \"HTTP Protocol\",\n      \"TLS Protocol\"\n    ]"},"ptr-domains":{"description":"The PTR record associated with an IP address.","anyOf":[{"type":"array","items":{"anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"domain_name\": \"is-oveds.sabich.amazonaws.com\",\n        \"first_seen\": \"2023-05-09T11:53:26.726Z\",\n        \"subject\": [\n          \"2.4.6.8.foo.bar.\"\n        ],\n        \"to_time\": \"2024-07-28T09:49:19.227Z\"\n      }\n    ]"},"public-key-length":{"description":"The public key length of the certificate's signature.","anyOf":[{"type":"number"},{"type":"null"}],"example":"2048"},"public-key-type":{"description":"The public key type of the certificate's signature.","anyOf":[{"type":"string"},{"type":"null"}],"example":"RSA"},"range":{"description":"A range of IP addresses (e.g., `1.1.1.1-2.2.2.2`), corresponding to the **IP Range** column in the Asset List.","type":"string","example":"1.1.1.1-2.2.2.2"},"range-description":{"description":"A text string describing the significance of the particular IP range.","anyOf":[{"type":"string"},{"type":"null"}],"example":"\"Acme Commerce Sdn Bhd\\nVO2-07-07\\nLingkaran SV\\nSunway Velocity\\nJalan Peel\\n55100 Kuala Lumpur\""},"range-name":{"description":"A text string representing a common name for the IP range.","anyOf":[{"type":"string"},{"type":"null"}],"example":"WEBSERVER-AS-AP"},"region":{"description":"Refers to the regional location of the asset or issue. *Examples: Northern Africa*, *South-eastern Asia*, *Central America*, etc.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Central Asia"},"registered-org-name":{"description":"The name of the organization as it appears in the Whois database.","anyOf":[{"type":"string"},{"type":"null"}],"example":"WEBSERVER-AS-AP"},"registrant":{"description":"The company that holds or owns the domain.","anyOf":[{"type":"string"},{"type":"null"}],"example":"acme"},"registrar":{"description":"The company that manages the domain name.","anyOf":[{"type":"string"},{"type":"null"}],"example":"godaddy.com"},"related":{"description":"Indicates whether an asset is directly related to your organization.","anyOf":[{"type":"string"},{"type":"null"}],"example":"yes"},"related-asset-ids":{"description":"A list of IDs for assets that are associated with the specified asset.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n      \"ip\": [\n        \"ip/1.1.1.1\",\n        \"ip/2.2.2.2\"\n      ],\n      \"cert\": [\n        \"cert/1234567890qwertyuiop\"\n      ],\n      \"webapp\": [\n        \"webapp/acmecorporation.com:82\"\n      ]\n    }"},"related-screenshot-urls":{"description":"A list mapping URLs of a web application's associated web resources to their corresponding screenshot URLs.","anyOf":[{"type":"object","additionalProperties":{"type":"string"}},{"type":"null"}],"example":"{\n      \"http://1.2.3.4/\": \"https://foo.bar.com/abc-1d23e4fg5hi67j8k\"\n    }"},"revalidation-request-time":{"description":"Indicates the date and time at which an issue revalidation was requested.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-08-03T15:18:48.452Z"},"revalidation-requested":{"description":"Indicates whether a revalidation request is currently in progress on a specific issue.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"security-grade":{"description":"Specifies the security grade of the asset based on factors such as attractiveness, and the number and severity of its associated issues.","anyOf":[{"type":"string"},{"type":"null"}],"example":"F"},"security-score":{"description":"Refers to CyCognito's method of evaluating an individual asset's security status, and how likely it contributes to the overall security of its organization. This value is expressed as an integer from 0 to 100.","anyOf":[{"type":"number"},{"type":"null"}],"example":"5"},"serial-number":{"description":"The serial number associated with the information being secured by a certificate.","anyOf":[{"type":"string"},{"type":"null"}],"example":"3960198806143193780718529211402714933521680192"},"services":{"description":"Refers to software that runs on a particular platform.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"id":{"anyOf":[{"type":"string"},{"type":"null"}]},"scan-status":{"anyOf":[{"type":"string"},{"type":"null"}]},"ports":{"anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"integer"},{"type":"null"}]}},{"type":"null"}]},"first-seen":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"},{"type":"string"}]},"last-seen":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"},{"type":"string"}]},"evidence":{"anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}]},"banners":{"anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"port":{"anyOf":[{"type":"string"},{"type":"null"}]},"banner":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["port","banner"]},{"type":"null"}]}},{"type":"null"}]}},"additionalProperties":false},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"first_seen\": \"2024-08-02 22:12:44.161\",\n        \"id\": \"cpe:2.3:o:foo:bar:*:*:*:*:*:*:*:*\",\n        \"last_seen\": \"2024-08-02 22:12:44.161\",\n        \"ports\": [\n          \"443/tcp\",\n          \"80/tcp\"\n        ],\n        \"scan_status\": \"new\",\n        \"banners\": \"Version 1.2.3\"\n, \n  \"evidence\": {\n        \"hosts\": [\n          \"1.1.1.1\"\n        ],\n        \"urls\": [\n          https//:\n        ]\n      }, \n      }\n    ]"},"serving-machines":{"description":"A list of servers that have been found to serve the certificate.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"[\n      {\n        \"id\": \"ip/1.1.1.1\",\n        \"ip\": \"1.2.3.4\",\n        \"port\": \"443\",\n        \"protocol\": \"tcp\"\n      }\n    ]"},"severe-issues":{"description":"The number of severe issues associated with the asset.","type":"integer","example":"24"},"signature":{"description":"The identifier for the certificate.","type":"string","example":"qwert56789ghjkl2345fghjyuio90cvb345cvbghjtyu"},"signature-algorithm":{"description":"The certificate's signature algorithm—e.g., `SHA256`.","anyOf":[{"type":"string"},{"type":"null"}],"example":"SHA256"},"source":{"description":"The name of the service or origin from which data about the IP range was gathered.","anyOf":[{"type":"string"},{"type":"null"}],"example":"WHOISXMLAPI"},"sni-hosts":{"description":"Retrieves certificates from alive, non-shared IPs with open ports — using SNI when a host is present, or without SNI otherwise (443 must be open).","anyOf":[{"type":"array","items":{"type":"object","properties":{"ip":{"type":"string"},"port":{"type":"integer"},"protocol":{"type":"string"},"sni":{"anyOf":[{"type":"string"},{"type":"null"}]},"time":{"type":"string"}},"required":["ip","port","protocol","sni","time"]}},{"type":"null"}]},"status":{"description":"Refers to the latest status of an asset following the most recent data update (or \"scan\"). The following are the supported statuses and their definitions: \n * `new` – The asset was first seen up to 30 days before the latest data update. \n * `normal` – The asset has not changed since the latest data update. \n * `removed` – The asset was not seen in the latest data update. \n * `changed` – Changes to the asset's ports or services were found in the latest data update. This status is valid for IP assets only. ","anyOf":[{"type":"string"},{"type":"string"},{"type":"null"}],"example":"new"},"subject-alt-names":{"description":"A list of the certificate's alternate subject names.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"www-qa1.acmemarkets.com\",\n      \"www-qa2.acmemarkets.com\",\n      \"shop-qa2.acmemarkets.com\"\n    ]"},"subject-common-name":{"description":"The common name for the certificate's subject—e.g., `api.prod.acme.com`.","anyOf":[{"type":"string"},{"type":"null"}],"example":"api.prod.acme.com"},"subject-country":{"description":"The country of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"subject-locality":{"description":"The locality of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"San Francisco"},"subject-organization":{"description":"The organization of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Acme Product"},"subject-organization-unit":{"description":"The organization unit of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"IT"},"subject-state":{"description":"The state of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"California"},"supported-protocols":{"description":"Specifies the type of application layer protocol for the web application.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"html/1.1\"\n    ]"},"tags":{"description":"Custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"My tag\",\n      \"Another tag\"\n    ]"},"teams":{"description":"Lists the teams associated with the queried asset, issue, or organization. This property is available only in realms where the Teams feature is enabled.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Homes IT team\",\n      \"Onboarding IT\",\n      \"Project managers\"\n    ]"},"tech-owners":{"description":"The names of the technical owners of a specific asset or organization, or of an asset or organization affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"email":{"type":"string"},"org-name":{"type":"string"}},"required":["name","email","org-name"]}},{"type":"null"}],"example":"[\n      {\n        \"name\": \"Marty McFly\",\n        \"email\": \"marty@acme.com\",\n        \"org_id\": \"org/acme.org\",\n        \"org_name\": \"Acme Corporation\"\n      }\n    ]"},"type":{"description":"Indicates one of the five supported types of assets in CyCognito: IP address, domain, certificate, web application, or IP range. ","type":"string","example":"ip"},"web-pages":{"description":"A list of the web application's underlying web pages.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"html-5\"\n    ]"},"web-resources-urls":{"description":"A list of the web application's underlying web resource URLs.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"http://1.1.1.1:10080/\"\n    ]"},"web-servers":{"description":"A string representing the name of the home page's web server.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"AmazonS3\"\n    ]"},"webapp-address":{"description":"The name of the web application asset—e.g., `1.2.3.4`, `subdomain.acme.com`. This corresponds to the **Webapp Address** column in the Asset List.","type":"string","example":"webapp.acme.com"}}}}}}}}}},"/v1/assets/{asset_type}/{asset_id}":{"get":{"description":"Obtain specific asset details by type and ID.","security":[{"apiAuth":[]}],"summary":"Fetch asset details","tags":["Assets"],"parameters":[{"name":"asset_type","in":"path","schema":{"type":"string","enum":["ip","domain","cert","webapp","iprange"]},"required":true,"description":"Specifies the category of the asset."},{"name":"asset_id","in":"path","schema":{"type":"string"},"required":true,"description":"Unique identifier for the asset (e.g., IP address, domain name)."}],"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"active":{"description":"Indicates whether an IP address, domain, or certificate is currently used by your organization's IT infrastructure.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"additional-properties":{"description":"Supplementary attributes or characteristics of a web application asset, particularly detailing any unique web resource features or specifications of interest.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n      \"hosting.environment\": {\n        \"value\": [\n          \"IaaS\"\n        ],\n        \"display_name\": \"Hosting environment\"\n      },\n      \"hosting.provider\": {\n        \"value\": [\n          \"Amazon\"\n        ],\n        \"display_name\": \"Hosting provider\"\n      },\n      \"hosting.type\": {\n        \"value\": [\n          \"cloud\"\n        ],\n        \"display_name\": \"Hosting type\"\n      }\n    }"},"advisories":{"description":"A list of curated pieces of threat intelligence that highlight vulnerabilities actively exploited by attackers in the wild. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"last-verified":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"evidence-id":{"anyOf":[{"type":"string"},{"type":"null"}]},"evidence-last-seen":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"vulnerable":{"anyOf":[{"type":"boolean"},{"type":"null"}]},"advisory":{"anyOf":[{"type":"string"},{"type":"null"}]},"issue-id":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["last-verified","evidence-id","evidence-last-seen","vulnerable","advisory","issue-id"]},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"last_verified\": \"2024-08-04T08:21:17.000Z\",\n        \"id\": \"ip/1.2.2.2\",\n        \"issue_id\": \"CYC-VS-APACHE-HTTP_SERVER-2.2.15\",\n        \"advisory\": \"CISA | Known Exploited Vulnerabilities (KEV) catalog\",\n        \"type\": \"ip\",\n        \"evidence_id\": \"issue/1.2.2.2-cyc-vs-apache-http_server-2.2.15\",\n        \"realm_id\": \"acme-corporation\",\n        \"security_score\": 16,\n        \"evidence_last_seen\": \"2024-08-04T08:21:17.000Z\",\n        \"vulnerable\": true\n      }\n    ]"},"alive":{"description":"Indicates whether an IP Address has at least one open or closed port (i.e., an installed service), or responds to a ping.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"alive-evidence":{"description":"Refers to any specific evidence gathered from the internet which indicates the reason why an asset is considered alive.","anyOf":[{"type":"string"},{"type":"null"}],"example":"ports"},"as-list":{"description":"The list of autonomous systems (AS list) to which an IP range and its IP addresses belong.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"AS1234\",\n      \"AS23456\",\n      \"AS567890\"\n    ]"},"asns":{"description":"The Autonomous System Number (ASN) of an IP address.","anyOf":[{"type":"array","items":{"$ref":"#/components/schemas/json.any?"}},{"type":"null"}],"example":"[\n      {\n        \"owner\": \"Amazon.com, Inc.\",\n        \"asn\": \"AS16509\"\n      },\n      {\n        \"owner\": \"GoDaddy.com, LLC\",\n        \"asn\": \"AS26496\"\n      }\n    ]"},"attractiveness":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a highly attractive target for attackers, regardless of any issues it has.","anyOf":[{"type":"number"},{"type":"null"}],"example":"extreme"},"attractiveness-label":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a higher-priority target for attackers, regardless of any issues it has.","anyOf":[{"type":"string"},{"type":"null"}],"example":"extreme"},"attribution-certainty":{"description":"Refers to the degree of certainty in which an organization can be said to own a particular asset. This value is expressed as one of five levels for ease of prioritization.","anyOf":[{"type":"string"},{"type":"null"}],"example":"highest"},"business-units":{"description":"[DEPRECATED] - The functional areas of the business that use the assets or the platform, or are affected by the issue.","type":"array","items":{"type":"string"},"example":"[\n      \"Marketing\"\n    ]"},"certificate-subject-key-id":{"description":"The certificates subject key.","anyOf":[{"type":"string"},{"type":"null"}]},"certification-authority-key-id":{"description":"The certificates authority key.","anyOf":[{"type":"string"},{"type":"null"}]},"cidr":{"description":"The CIDR IP range.","anyOf":[{"type":"string"},{"type":"null"}],"example":"1.1.*.*"},"cis-controls":{"description":"Refers to the compliance control number of the CIS framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"7.6\",\n      \"3.11\",\n      \"7.5\",\n      \"16.7\"\n    ]"},"closed-ports":{"description":"A collection of objects describing closed ports associated with the asset.","type":"array","items":{"type":"object","properties":{"status":{"type":"string"},"port":{"type":"integer"},"first-seen":{"type":"string"},"protocol":{"type":"string","enum":["tcp","udp"]}},"required":["status","port","first-seen","protocol"],"additionalProperties":false},"example":"[\n      {\n        \"port\": 80,\n        \"protocol\": \"udp\",\n        \"status\": \"closed\"\n      },\n      {\n        \"port\": 8081,\n        \"protocol\": \"tcp\",\n   \"first_seen\": \"2024-09-29T18:26:30.650Z\",\n     \"status\": \"closed\"\n      }\n    ]"},"cloud-env":{"description":"The cloud environment in which the asset is located.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"ACME AWS Cloud Environment"},"cloud-env-metadata":{"description":"Data that CyCognito fetches directly from your cloud service (e.g., AWS, Azure, GCP) and includes the configuration of your instance.","anyOf":[{"type":"array","items":{"type":"object","additionalProperties":{"anyOf":[{"type":"string"},{"type":"object"}]}}},{"type":"null"}],"example":"[{\"cloud-env\": \"value\"\n                                                                      \"cloud-env-id\": \"value\"\n                                                                      \"metadata\": \"value\"}]"},"comment":{"description":"Custom text that can be added to the details of an asset or issue. Comments are typically used to make notes or personal descriptions regarding the significance of a particular asset or issue.","anyOf":[{"type":"object","properties":{"content":{"type":"string"},"last-update":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}},"required":["content","last-update"]},{"type":"null"}],"example":"Reviewed by Gary"},"comments":{"description":"Comments is a collection of custom text entries, providing the ability to record multiple notes or personal descriptions related to an asset or issue. Unlike the single 'comment' field, this allows for a running log or more detailed commentary over time.","anyOf":[{"type":"array","items":{"type":"object","properties":{"content":{"type":"string"},"created-by-name":{"anyOf":[{"type":"string"},{"type":"null"}]},"last-update":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["content","created-by-name","last-update"]}},{"type":"null"}],"example":"Reviewed by Gary"},"compliance-violations":{"description":"Refers to specific compliance frameworks that have been violated.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"NIST-800-171\",\n      \"CIS\",\n      \"ISO27001\"\n    ]"},"continent":{"description":"The geographical continent in which the asset or issue is located.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Americas"},"country-code":{"description":"The country code in which the asset's underlying IP range is currently hosted.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"created":{"description":"The date and time at which the asset was created—e.g., *2019-03-03T22:00:10.000Z*.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2019-03-03T22:00:10.000Z"},"discoverability":{"description":"Indicates an asset's level of exposure, or how easily an attacker can find an asset affected by a specific issue and identify its relation to your enterprise.","anyOf":[{"type":"string"},{"type":"null"}],"example":"extreme"},"discovery-path":{"description":"The sequence of steps involved in discovering a specific asset or organization in your attack surface. It details each step and the connections between them, illustrating how one step leads to the subsequent step in the discovery process.","anyOf":[{"type":"array","items":{"type":"object","properties":{"src":{"type":"string"},"dest":{"type":"string"},"movement-type":{"$ref":"#/components/schemas/json.any?"},"movement-data":{"$ref":"#/components/schemas/json.any?"}},"required":["src","dest","movement-type","movement-data"]}},{"type":"null"}],"example":"[{\"dest\":\"org/acme-corporation\",\"movement_data\":{\"sources\":[]},\"movement_type\":\"default\",\"src\":\"_ENTRY_\"},{\"dest\":\"ip/1.1.1.1\",\"movement_data\":{\"probability\":1,\"relation_id\":\"org-relation/acme-corporation-has-subsidiary-acme-jubilee-limited\",\"sources\":[]},\"movement_type\":\"relation\",\"src\":\"org/acme-corporation\"}]"},"dns-rcode":{"description":"A string representing one of the common <a href=\"https://support.umbrella.com/hc/en-us/articles/232254248-Common-DNS-return-codes-for-any-DNS-service-and-Umbrella-\">DNS return code messages</a>.","anyOf":[{"type":"string"},{"type":"null"}],"example":"NXDOMAIN"},"dns-records":{"description":"A list of the domain's DNS, SPF, and DKIM records.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n      \"A\": [\n        \"1.1.255.255\"\n      ],\n      \"MX\": [\n        \"10 us2.mx1.foobar.com.\"\n      ],\n      \"NS\": [\n        \"ns0.acmedns.net.\"\n      ],\n      \"SOA\": [\n        \"ns0.acmedns.net. support.acme.com. 1122334455 66778 8990 9090 1212\"\n      ],\n      \"TXT\": [\n        \"\\\"v=spf1 redirect=_spf.foobar.com\\\"\"\n      ]\n    }"},"domain":{"description":"The domain name associated with the asset.","type":"string","example":"www.foobar.com"},"domains":{"description":"A list of domain names associated with the IP address.","type":"array","items":{"type":"string"},"example":"[\n      \"blog.domain.com\",\n      \"blog2.domain.com\",\n      \"blog3.domain.com\"\n    ]"},"dynamic-dns":{"description":"Indicates whether a domain changes its DNS resolutions frequently or not.","anyOf":[{"type":"string"},{"type":"null"}],"example":"no"},"dynamically-resolved":{"description":"Refers to whether an IP address is dynamically resolved or not, or partially dynamically resolved.","anyOf":[{"type":"array","items":{"$ref":"#/components/schemas/json.any?"}},{"type":"string"},{"type":"null"}],"example":"no"},"environments":{"description":"Refers to IT environments, or the different hardware, software, infrastructure, and networks in which your assets are found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"Cryptographic Protocols\",\n      \"Operating Systems\",\n      \"Web Servers\"\n    ]"},"expiration":{"description":"The date and time at which the asset expired—e.g., *2019-06-01T22:00:10.000Z*.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2023-02-07T23:59:59.000Z"},"first-detected":{"description":"The date and time at which CyCognito first discovered and attributed the asset to the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2022-03-18T09:07:22.977Z"},"first-seen":{"description":"The date and time at which CyCognito first discovered and attributed the asset to the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2022-03-18T09:07:22.977Z"},"formats":{"description":"The specific type or standard of the web application's structure and markup. It denotes the version or specification of web content being used, enabling users to identify how the application's content is formatted. *Examples: html-5*, *xhtml-1.0-strict*, *xhtml-1.0-transitional*, etc.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"html-5\"\n    ]"},"has-form":{"description":"Indicates whether a web page belonging to a web application contains a form or not.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"has-login":{"description":"Refers to whether a web application includes a login mechanism in which a user could input credentials.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"home-page-description":{"description":"The description of the homepage.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Official homepage of Acme"},"home-page-status-code":{"description":"Indicates the HTTP status code returned by the homepage of a web application. This integer value represents the response status of the website, providing insight into its current accessibility or operational state.","anyOf":[{"type":"number"},{"type":"null"}],"example":"200"},"home-page-title":{"description":"The title of the homepage.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Acme Home"},"home-page-url":{"description":"The URL of the homepage.","anyOf":[{"type":"string"},{"type":"null"}],"example":"https://1.1.1.1"},"hosting-type":{"description":"Refers to type of hosting platform for the asset or issue.","type":"string","example":"undetermined"},"id":{"description":"The unique identifier for an asset, formatted by combining its type (ip, domain, cert, webapp, or iprange) with its name: IP addresses as `ip/{ip}`, domains as `domain/{domain}`, certificates as `cert/{cert}`, web applications as `webapp/{webapp}`, and IP ranges as `iprange/{iprange}`. \n *Examples:* `ip/192.168.0.0`, `domain/acme-studios.com`","type":"string","example":"ip/192.168.0.0"},"investigation-status":{"description":"Indicates whether or not an asset or issue has undergone investigation by you or someone on your team.","anyOf":[{"type":"string","enum":["investigating","investigated","uninvestigated"]},{"type":"null"}],"example":"investigating"},"ip":{"description":"The IP address—e.g., `1.2.3.4`.","type":"string","example":"1.1.1.1"},"ip-addresses":{"description":"A list of the IP addresses hosting the asset.","type":"array","items":{"type":"string"},"example":"[\n      \"1.1.1.2\",\n      \"1.1.2.1\",\n      \"1.2.1.1\"\n    ]"},"ip-ranges":{"description":"A list detailing specific IP ranges, with each item indicating the range (`inetnum`) and its associated owner (i.e., the organization registered in the Whois database). For example, a range might be *1.1.1.1-2.2.2.2* owned by *Acme Studios*.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"inetnum":{"anyOf":[{"type":"string"},{"type":"null"}]},"owner":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["inetnum","owner"]},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"inetnum\": \"1.1.1.1-1.1.1.255\",\n        \"owner\": \"Acme Utilities\"\n      },\n      {\n        \"inetnum\": \"1.1.2.1-2.2.2.2\",\n        \"owner\": \"Acme Gardens\"\n      }\n    ]"},"ips-count":{"description":"The number of IP address assets that are contained within the IP range.","type":"number","example":"8"},"is-encrypted":{"description":"Indicates whether a web page that is contained by a web application is encrypted or not.","anyOf":[{"type":"string"},{"type":"null"}],"example":"no"},"is-subdomain":{"description":"Indicates whether a domain is actually a subdomain of a particular parent domain.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"iso27001-controls":{"description":"Refers to the compliance control number of the ISO 27001 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"iso27002-controls":{"description":"Refers to the compliance control number of the ISO 27002 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"issuer-alt-names":{"description":"A list of alternate names for the certificate's issuer.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"http://ca.example.net/\",\n      \"certmaster@example.net\",\n      \"1.1.1.1\"\n    ]"},"issuer-common-name":{"description":"The common name for the certificate's issuer.","anyOf":[{"type":"string"},{"type":"null"}],"example":"example.com"},"issuer-country":{"description":"The country of the certificate's issuer—e.g., *US*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"issuer-locality":{"description":"The locality of the certificate's issuer—e.g., *US*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"issuer-organization":{"description":"The organization of the certificate's issuer.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Acme Corporation"},"issuer-organization-unit":{"description":"The organization unit of the certificate's issuer.","anyOf":[{"type":"string"},{"type":"null"}],"example":"IT Department"},"issuer-state":{"description":"The state of the certificate's issuer.","anyOf":[{"type":"string"},{"type":"null"}],"example":"California"},"issues-count":{"description":"The number of issues found on a particular asset or organization.","anyOf":[{"type":"integer"},{"type":"null"}],"example":"7"},"known-status":{"description":"Indicates whether a user designated an asset as *known* to your enterprise.","anyOf":[{"type":"string"},{"type":"null"}],"example":"known"},"last-detected":{"description":"The date and time at which CyCognito most recently discovered and attributed the asset to the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-06-17T07:02:04.181Z"},"last-seen":{"description":"The date and time at which CyCognito most recently discovered and attributed the asset to the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-06-17T07:02:04.181Z"},"locations":{"description":"The geographic locations (i.e., countries or regions) where the asset or issue is found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"USA\"\n    ]"},"name-servers":{"description":"Identifies the servers where the domain is registered, aiding in asset searches based on domain-related information.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"ns0.acmedns.net\",\n      \"ns1.acmedns.net\"\n    ]"},"nist-800-171-controls":{"description":"Refers to the compliance control number of the NIST 800-171 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"3.3.5\",\n      \"3.12.2\",\n      \"3.11.2\"\n    ]"},"nist-800-53-controls":{"description":"Refers to the compliance control number of the NIST 800-53 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"CM-8\",\n      \"SI-2(3)\",\n      \"SI-4(16)\"\n    ]"},"open-ports":{"description":"A collection of objects describing open ports that are associated with the asset.","type":"array","items":{"type":"object","properties":{"status":{"type":"string"},"port":{"type":"integer"},"first-seen":{"type":"string"},"protocol":{"type":"string","enum":["tcp","udp"]}},"required":["status","port","first-seen","protocol"],"additionalProperties":false},"example":"[\n      {\n        \"port\": 80,\n        \"protocol\": \"tcp\",\n   \"first_seen\": \"2024-09-29T18:26:30.650Z\",\n     \"status\": \"open\"\n      }\n    ]"},"organizations":{"description":"Specifies the organizations to whom the asset belongs, or those that are affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Gardens\"\n    ]"},"parent-domain":{"description":"The parent domain of a domain asset.","anyOf":[{"type":"string"},{"type":"null"}],"example":"acme.net"},"pci-dss-controls":{"description":"Refers to the compliance control number of the PCI DSS, which is an information security standard used to handle credit card information.","anyOf":[{"type":"array","items":{"type":"string"},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"10.2.2\",\n      \"8.3.1\",\n      \"1.2.4\"\n    ]"},"platforms":{"description":"A list of platforms associated with an asset or issue.","type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"example":"[\n      \"Apache\",\n      \"CentOS\",\n      \"HTTP Protocol\",\n      \"TLS Protocol\"\n    ]"},"ptr-domains":{"description":"The PTR record associated with an IP address.","anyOf":[{"type":"array","items":{"anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"domain_name\": \"is-oveds.sabich.amazonaws.com\",\n        \"first_seen\": \"2023-05-09T11:53:26.726Z\",\n        \"subject\": [\n          \"2.4.6.8.foo.bar.\"\n        ],\n        \"to_time\": \"2024-07-28T09:49:19.227Z\"\n      }\n    ]"},"public-key-length":{"description":"The public key length of the certificate's signature.","anyOf":[{"type":"number"},{"type":"null"}],"example":"2048"},"public-key-type":{"description":"The public key type of the certificate's signature.","anyOf":[{"type":"string"},{"type":"null"}],"example":"RSA"},"range":{"description":"A range of IP addresses (e.g., `1.1.1.1-2.2.2.2`), corresponding to the **IP Range** column in the Asset List.","type":"string","example":"1.1.1.1-2.2.2.2"},"range-description":{"description":"A text string describing the significance of the particular IP range.","anyOf":[{"type":"string"},{"type":"null"}],"example":"\"Acme Commerce Sdn Bhd\\nVO2-07-07\\nLingkaran SV\\nSunway Velocity\\nJalan Peel\\n55100 Kuala Lumpur\""},"range-name":{"description":"A text string representing a common name for the IP range.","anyOf":[{"type":"string"},{"type":"null"}],"example":"WEBSERVER-AS-AP"},"region":{"description":"Refers to the regional location of the asset or issue. *Examples: Northern Africa*, *South-eastern Asia*, *Central America*, etc.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Central Asia"},"registered-org-name":{"description":"The name of the organization as it appears in the Whois database.","anyOf":[{"type":"string"},{"type":"null"}],"example":"WEBSERVER-AS-AP"},"registrant":{"description":"The company that holds or owns the domain.","anyOf":[{"type":"string"},{"type":"null"}],"example":"acme"},"registrar":{"description":"The company that manages the domain name.","anyOf":[{"type":"string"},{"type":"null"}],"example":"godaddy.com"},"related":{"description":"Indicates whether an asset is directly related to your organization.","anyOf":[{"type":"string"},{"type":"null"}],"example":"yes"},"related-asset-ids":{"description":"A list of IDs for assets that are associated with the specified asset.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n      \"ip\": [\n        \"ip/1.1.1.1\",\n        \"ip/2.2.2.2\"\n      ],\n      \"cert\": [\n        \"cert/1234567890qwertyuiop\"\n      ],\n      \"webapp\": [\n        \"webapp/acmecorporation.com:82\"\n      ]\n    }"},"related-screenshot-urls":{"description":"A list mapping URLs of a web application's associated web resources to their corresponding screenshot URLs.","anyOf":[{"type":"object","additionalProperties":{"type":"string"}},{"type":"null"}],"example":"{\n      \"http://1.2.3.4/\": \"https://foo.bar.com/abc-1d23e4fg5hi67j8k\"\n    }"},"revalidation-request-time":{"description":"Indicates the date and time at which an issue revalidation was requested.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-08-03T15:18:48.452Z"},"revalidation-requested":{"description":"Indicates whether a revalidation request is currently in progress on a specific issue.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"security-grade":{"description":"Specifies the security grade of the asset based on factors such as attractiveness, and the number and severity of its associated issues.","anyOf":[{"type":"string"},{"type":"null"}],"example":"F"},"security-score":{"description":"Refers to CyCognito's method of evaluating an individual asset's security status, and how likely it contributes to the overall security of its organization. This value is expressed as an integer from 0 to 100.","anyOf":[{"type":"number"},{"type":"null"}],"example":"5"},"serial-number":{"description":"The serial number associated with the information being secured by a certificate.","anyOf":[{"type":"string"},{"type":"null"}],"example":"3960198806143193780718529211402714933521680192"},"services":{"description":"Refers to software that runs on a particular platform.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"id":{"anyOf":[{"type":"string"},{"type":"null"}]},"scan-status":{"anyOf":[{"type":"string"},{"type":"null"}]},"ports":{"anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"integer"},{"type":"null"}]}},{"type":"null"}]},"first-seen":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"},{"type":"string"}]},"last-seen":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"},{"type":"string"}]},"evidence":{"anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}]},"banners":{"anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"port":{"anyOf":[{"type":"string"},{"type":"null"}]},"banner":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["port","banner"]},{"type":"null"}]}},{"type":"null"}]}},"additionalProperties":false},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"first_seen\": \"2024-08-02 22:12:44.161\",\n        \"id\": \"cpe:2.3:o:foo:bar:*:*:*:*:*:*:*:*\",\n        \"last_seen\": \"2024-08-02 22:12:44.161\",\n        \"ports\": [\n          \"443/tcp\",\n          \"80/tcp\"\n        ],\n        \"scan_status\": \"new\",\n        \"banners\": \"Version 1.2.3\"\n, \n  \"evidence\": {\n        \"hosts\": [\n          \"1.1.1.1\"\n        ],\n        \"urls\": [\n          https//:\n        ]\n      }, \n      }\n    ]"},"serving-machines":{"description":"A list of servers that have been found to serve the certificate.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"[\n      {\n        \"id\": \"ip/1.1.1.1\",\n        \"ip\": \"1.2.3.4\",\n        \"port\": \"443\",\n        \"protocol\": \"tcp\"\n      }\n    ]"},"severe-issues":{"description":"The number of severe issues associated with the asset.","type":"integer","example":"24"},"signature":{"description":"The identifier for the certificate.","type":"string","example":"qwert56789ghjkl2345fghjyuio90cvb345cvbghjtyu"},"signature-algorithm":{"description":"The certificate's signature algorithm—e.g., `SHA256`.","anyOf":[{"type":"string"},{"type":"null"}],"example":"SHA256"},"source":{"description":"The name of the service or origin from which data about the IP range was gathered.","anyOf":[{"type":"string"},{"type":"null"}],"example":"WHOISXMLAPI"},"sni-hosts":{"description":"Retrieves certificates from alive, non-shared IPs with open ports — using SNI when a host is present, or without SNI otherwise (443 must be open).","anyOf":[{"type":"array","items":{"type":"object","properties":{"ip":{"type":"string"},"port":{"type":"integer"},"protocol":{"type":"string"},"sni":{"anyOf":[{"type":"string"},{"type":"null"}]},"time":{"type":"string"}},"required":["ip","port","protocol","sni","time"]}},{"type":"null"}]},"status":{"description":"Refers to the latest status of an asset following the most recent data update (or \"scan\"). The following are the supported statuses and their definitions: \n * `new` – The asset was first seen up to 30 days before the latest data update. \n * `normal` – The asset has not changed since the latest data update. \n * `removed` – The asset was not seen in the latest data update. \n * `changed` – Changes to the asset's ports or services were found in the latest data update. This status is valid for IP assets only. ","anyOf":[{"type":"string"},{"type":"string"},{"type":"null"}],"example":"new"},"subject-alt-names":{"description":"A list of the certificate's alternate subject names.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"www-qa1.acmemarkets.com\",\n      \"www-qa2.acmemarkets.com\",\n      \"shop-qa2.acmemarkets.com\"\n    ]"},"subject-common-name":{"description":"The common name for the certificate's subject—e.g., `api.prod.acme.com`.","anyOf":[{"type":"string"},{"type":"null"}],"example":"api.prod.acme.com"},"subject-country":{"description":"The country of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"subject-locality":{"description":"The locality of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"San Francisco"},"subject-organization":{"description":"The organization of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Acme Product"},"subject-organization-unit":{"description":"The organization unit of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"IT"},"subject-state":{"description":"The state of the certificate's subject.","anyOf":[{"type":"string"},{"type":"null"}],"example":"California"},"supported-protocols":{"description":"Specifies the type of application layer protocol for the web application.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"html/1.1\"\n    ]"},"tags":{"description":"Custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"My tag\",\n      \"Another tag\"\n    ]"},"teams":{"description":"Lists the teams associated with the queried asset, issue, or organization. This property is available only in realms where the Teams feature is enabled.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Homes IT team\",\n      \"Onboarding IT\",\n      \"Project managers\"\n    ]"},"tech-owners":{"description":"The names of the technical owners of a specific asset or organization, or of an asset or organization affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"email":{"type":"string"},"org-name":{"type":"string"}},"required":["name","email","org-name"]}},{"type":"null"}],"example":"[\n      {\n        \"name\": \"Marty McFly\",\n        \"email\": \"marty@acme.com\",\n        \"org_id\": \"org/acme.org\",\n        \"org_name\": \"Acme Corporation\"\n      }\n    ]"},"type":{"description":"Indicates one of the five supported types of assets in CyCognito: IP address, domain, certificate, web application, or IP range. ","type":"string","example":"ip"},"web-pages":{"description":"A list of the web application's underlying web pages.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"html-5\"\n    ]"},"web-resources-urls":{"description":"A list of the web application's underlying web resource URLs.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"http://1.1.1.1:10080/\"\n    ]"},"web-servers":{"description":"A string representing the name of the home page's web server.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"AmazonS3\"\n    ]"},"webapp-address":{"description":"The name of the web application asset—e.g., `1.2.3.4`, `subdomain.acme.com`. This corresponds to the **Webapp Address** column in the Asset List.","type":"string","example":"webapp.acme.com"}}}}}}}},"delete":{"description":"Remove an asset from your attack surface. Note that CyCognito will continue to monitor removed assets for changes, in case you later decide that they are relevant again.","security":[{"apiAuth":[]}],"summary":"Remove asset","tags":["Assets"],"parameters":[{"name":"asset_type","in":"path","schema":{"type":"string","enum":["ip","domain","cert","webapp","iprange"]},"required":true,"description":"Specifies the category of the asset."},{"name":"asset_id","in":"path","schema":{"type":"string"},"required":true,"description":"Unique identifier for the asset (e.g., IP address, domain name)."}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"removal-type":{"description":"Indicates whether or not an asset removal should affect discovery. A value of `block-discovery` means that the selected asset will be removed, and that all other assets that are discovered via this asset will also be removed. A value of `allow-discovery` means that the selected asset will be removed, and that all other assets discovered via this asset will **not** be affected. ","type":"string","enum":["block-discovery","allow-discovery"],"example":"block-discovery"},"comment":{"description":"An explanation or reason why the asset is being removed.","type":"string","example":"The asset is no longer relevant."}},"required":["comment"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"status":{"description":"Indicates whether an asset was successfully removed.","type":"string","example":"Asset successfully removed."}},"required":["status"]}}}}}}},"/v1/assets/{asset_type}/{asset_id}/investigation-status":{"put":{"description":"Adjust the specified asset's investigation status:\n- **Investigated** – The asset has been investigated.\n- **Investigating** – The asset is currently undergoing investigation by someone in your team.\n- **Uninvestigated** – The asset has not been investigated yet. ","security":[{"apiAuth":[]}],"summary":"Update asset's investigation status","tags":["Assets"],"parameters":[{"name":"asset_type","in":"path","schema":{"type":"string","enum":["ip","domain","cert","webapp","iprange"]},"required":true,"description":"Specifies the category of the asset."},{"name":"asset_id","in":"path","schema":{"type":"string"},"required":true,"description":"Unique identifier for the asset (e.g., IP address, domain name)."}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"investigation-status":{"description":"Indicates whether or not an asset or issue has undergone investigation by you or someone on your team.  \n   \n*Supported values:* `investigating`, `investigated`, `uninvestigated`","type":"string","enum":["investigating","investigated","uninvestigated"]}},"required":["investigation-status"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"failed":{"description":"A list of entity IDs for which the requested action could not be completed. When the response status is 200, the list includes entity IDs where the action could not be executed, possibly due to insufficient permissions or because the entity ID is associated with multiple teams. When the response status is 400, the list contains an error message indicating that the number of provided entity IDs exceeds the maximum allowable limit.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"uniqueItems":true},"updated":{"description":"A list of entity IDs that were successfully updated as a result of the action. It confirms the successful execution of the requested operation on these entities.","type":"array","items":{"type":"string"},"uniqueItems":true}},"required":["failed","updated"]}}}}}}},"/v1/assets/actions/add/comment":{"put":{"description":"Allows you to add comments to multiple assets identified by their unique IDs. The comments are appended to the existing comment log and do not replace any existing content.","security":[{"apiAuth":[]}],"summary":"Add comments to assets","tags":["Assets"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"entity-ids":{"description":"A comma-separated list of unique asset identifiers. Each ID corresponds to the `id` field from the *Retrieve assets* response and should be formatted as `&lt;asset_type&gt;/&lt;asset_id&gt;`.\n   \n*Examples:* `ip/1.1.1.1`, `domain/acme.com`, `webapp/acme.com`, `iprange/1.1.1.1-1.2.3.4`","type":"array","items":{"type":"string"},"example":["ip/1.1.1.1","domain/acme.com"]},"comment":{"description":"The content of the comment to be added to the specified assets.","type":"string","example":"This is a new comment on the asset"}},"required":["entity-ids","comment"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"failed":{"description":"A list of entity IDs for which the requested action could not be completed. When the response status is 200, the list includes entity IDs where the action could not be executed, possibly due to insufficient permissions or because the entity ID is associated with multiple teams. When the response status is 400, the list contains an error message indicating that the number of provided entity IDs exceeds the maximum allowable limit.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"uniqueItems":true},"updated":{"description":"A list of entity IDs that were successfully updated as a result of the action. It confirms the successful execution of the requested operation on these entities.","type":"array","items":{"type":"string"},"uniqueItems":true}},"required":["failed","updated"]}}}}}}},"/v1/assets/actions/{action}/tags":{"put":{"description":"Add or remove custom tags from specified assets.","security":[{"apiAuth":[]}],"summary":"Handle asset tags","tags":["Assets"],"parameters":[{"name":"action","in":"path","schema":{"type":"string","enum":["add","remove","replace","remove-all"]},"required":true,"description":"Choose an action to apply to the tags on the specified entities: \n * **add** – Apply new tags in addition to the existing tags on the specified entities. \n * **remove** – Clears only the indicated tags from the specified entities. \n * **replace** – Replaces *all* of the current tags on *all* of the specified entities with the indicated tags. \n * **remove-all** – Clears *all* of the existing tags from the specified entities."}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"entity-ids":{"description":"A comma-separated list in which each item contains the unique ID for the assets whose custom tags you would like to modify. The unique ID corresponds to the `id` field (from the *Retrieve assets* response) and should be in the format `&lt;asset_type&gt;/&lt;asset_id&gt;`.  \n   \n*Examples:* `ip/1.1.1.1`, `domain/acme.com`","type":"array","items":{"type":"string"},"example":["ip/1.1.1.1","ip/2.2.2.2","domain/acme.com","webapp/acme.com","iprange/1.1.1.1-1.2.3.4"]},"tags":{"description":"A comma-separated list of custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","type":"array","items":{"type":"string"},"example":["My tag","Another tag"]}},"required":["entity-ids"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"failed":{"description":"A list of entity IDs for which the requested action could not be completed. When the response status is 200, the list includes entity IDs where the action could not be executed, possibly due to insufficient permissions or because the entity ID is associated with multiple teams. When the response status is 400, the list contains an error message indicating that the number of provided entity IDs exceeds the maximum allowable limit.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"uniqueItems":true},"updated":{"description":"A list of entity IDs that were successfully updated as a result of the action. It confirms the successful execution of the requested operation on these entities.","type":"array","items":{"type":"string"},"uniqueItems":true}},"required":["failed","updated"]}}}}}}},"/v1/issues":{"post":{"description":"Retrieve a list of issues based on given filter criteria. If you are comparing search results with the CyCognito app, note that <span name=\"kb-predefined-filters-api-explanation\">Predefined Filters</span> are not applied to data queried via the API by default.","security":[{"apiAuth":[]}],"summary":"Search issues","tags":["Issues"],"parameters":[{"name":"count","in":"query","schema":{"type":"integer"},"required":false,"description":"Defines the number of results to be retrieved. Defaults to 10 with a max limit of 1000."},{"name":"advanced-search","in":"query","schema":{"type":"string"},"required":false,"description":"Allows you to input raw CyQL in order to query assets, issues, or organizations. See our <span name=\"kb-advanced-search-link\">Advanced Search</span> documentation for more details."},{"name":"offset","in":"query","schema":{"type":"integer"},"required":false,"description":"Sets the starting index for result retrieval, influenced by the `count` parameter. By default, `offset` is 0. Example: `offset` 3 with `count` 25 fetches results from index 75 to 99."},{"name":"q","in":"query","schema":{"type":"string"},"required":false,"description":"Specifies a search term for conducting a keyword-based search and retrieving data that matches your query."},{"name":"fields","in":"query","schema":{"type":"string"},"required":false,"description":"A comma-separated list specifying the desired entity properties to appear in the response. For more information, view the response example and schema."},{"name":"sort-by","in":"query","schema":{"type":"string"},"required":false,"description":"Specifies the field by which the results should be sorted."},{"name":"sort-order","in":"query","schema":{"type":"string","enum":["asc","desc"]},"required":false,"description":"Sorts the specified field in ascending or descending order."}],"requestBody":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"field":{"description":"Field to apply the filter on. Typically, any field present in the response can be used.","allOf":[{"type":"string"}],"example":"status"},"op":{"description":"Specifies the operation to apply on the desired field.\n            \n*Supported values:*  \n            \n* `is` – Searches for values that match the specified text exactly.  \n            \n* `not` – Searches for values that **do not** match the specified text exactly.  \n            \n* `in` – Filters entities for values that include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `not-in` – Filters entities for values that do not include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `only-in` – Filters **exclusively** so that only entities with the values specified will be searched. This operator is currently available only for the `organizations` and `tags` properties for assets and issues.  \n            \n* `between` – Searches by dates that are in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `not-between` – Searches by dates that are **not** in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `within-range` – Searches by number values that are in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[60,75]`.\n            \n* `not-within-range` – Searches by number values that are **not** in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[10,59]`.\n            \n* `within-last` – Searches for date values that are within the specified time frame in days—e.g., `64` is the value for 64 days.\n            \n* `not-within-last` – Searches for date values that are **not** within the specified time frame in days—e.g., `128` is the value for 128 days.\n            \n* `contains` – Searches for a specific substring within a string value.","allOf":[{"type":"string","enum":["is","not","in","not-in","only-in","key-of","not-key-of","between","not-between","within-range","not-within-range","contains","within-last","not-within-last"]}],"example":"in"},"values":{"description":"Specifies the value or values for the field.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"example":["new"]}},"required":["field","op","values"]}}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"advisories":{"description":"A list of curated pieces of threat intelligence that highlight vulnerabilities actively exploited by attackers in the wild. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"advisory":{"anyOf":[{"type":"string"},{"type":"null"}]},"url":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["advisory","url"]},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"entity_id\": \"issue/1.1.1.1-cve-2019-19781\",\n        \"ti_severity_score\": 10,\n        \"confidence\": 100,\n        \"advisory\": \"CISA | Known Exploited Vulnerabilities (KEV) catalog\",\n        \"realm_id\": \"acme-corporation\",\n        \"id\": \"issue/1.1.1.1-cve-2019-19781\",\n        \"type\": \"issue\",\n        \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\"\n      }\n    ]"},"affected-asset":{"description":"The unique ID of the asset with which the issue is associated.","type":"string","example":"webapp/1.1.1.1"},"affected-asset-tags":{"description":"Custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"My tag\",\n      \"Another tag\"\n    ]"},"affected-ptr-domains":{"description":"The PTR record associated with an IP address.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"r2.acme.net"},"asset-status":{"description":"The most recent status of an asset—e.g., Changed (was modified since the previous scan), New (was discovered during the most recent scan), Normal (nothing has changed since the previous scan), Removed (was not discovered in the most recent scan).","anyOf":[{"type":"string"},{"type":"null"}],"example":"changed"},"attacker-interest":{"description":"A measurement of how attractive an issue's affected asset may be to a potential attacker. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"High"},"attractiveness":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a higher-priority target for attackers, regardless of any issues it has.","anyOf":[{"type":"number"},{"type":"null"}],"example":"4"},"attractiveness-label":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a higher-priority target for attackers, regardless of any issues it has.","anyOf":[{"type":"string"},{"type":"null"}],"example":"extreme"},"base-severity":{"description":"Refers to an issue's seriousness, indicating how urgently it should be remediated, based on the potential damage that can be caused were an attacker to exploit it. This property is available only for customers using Exploit Intelligence.\n*Supported values:* `low`, `medium`, `high`, `critical`","anyOf":[{"type":"string"},{"type":"null"}],"example":"high"},"base-severity-score":{"description":"The severity score, which is mostly inherited from the CVSS method for measuring of severity, and is the basis (about 80%) for the majority of the Enhanced Severity Score calculation. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"number"},{"type":"null"}],"example":"10"},"business-units":{"description":"[DEPRECATED] - The functional areas of the business that use the assets or the platform, or are affected by the issue.","type":"array","items":{"type":"string"},"example":"[\n      \"Marketing\"\n    ]"},"cis-controls":{"description":"Refers to the compliance control number of the CIS framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"7.6\",\n      \"3.11\",\n      \"7.5\",\n      \"16.7\"\n    ]"},"comment":{"description":"Custom text that can be added to the details of an asset or issue. Comments are typically used to make notes or personal descriptions regarding the significance of a particular asset or issue.","anyOf":[{"type":"object","properties":{"content":{"type":"string"},"last-update":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}},"required":["content","last-update"]},{"type":"null"}],"example":"Reviewed by Gary"},"comments":{"description":"Comments is a collection of custom text entries, providing the ability to record multiple notes or personal descriptions related to an asset or issue. Unlike the single 'comment' field, this allows for a running log or more detailed commentary over time.","anyOf":[{"type":"array","items":{"type":"object","properties":{"content":{"type":"string"},"created-by-name":{"anyOf":[{"type":"string"},{"type":"null"}]},"last-update":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["content","created-by-name","last-update"]}},{"type":"null"}],"example":"Reviewed by Gary"},"compliance-violations":{"description":"Refers to specific compliance frameworks that have been violated.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"NIST-800-171\",\n      \"CIS\",\n      \"ISO27001\"\n    ]"},"confidence":{"description":"Refers to the probability that an issue is valid and relevant on a scale of 0 to 100, where 0 indicates no confidence, and 100 indicates absolute confidence.","anyOf":[{"type":"number"},{"type":"null"}],"example":"90"},"confidence-level":{"description":"“Refers to the probability that an issue is valid and relevant. Possible values (from most probable to the least) are Confirmed, Likely, Potential, and Inconclusive.","anyOf":[{"type":"string"},{"type":"null"}],"example":"confirmed"},"continent":{"description":"The geographical continent in which the asset or issue is located.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Americas"},"cve-ids":{"description":"Refers to the specific CVE-ID number of the issue as established by the Mitre Corporation.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"CVE-2019-19781\"\n    ]"},"detection-complexity":{"description":"Measures the difficulty at which a vulnerable asset can be detected by a potential attacker.\n*Supported values:* `easy`, `moderate`, `hard`","type":"string","example":"easy"},"detection-method":{"description":"Indicates the method used to detect the issue.\n*Supported values:* `active`, `passive`","anyOf":[{"type":"string"},{"type":"null"}],"example":"active"},"enhanced-severity":{"description":"The severity grade (enhanced by CyCognito's Exploit Intelligence) that represents the potential damage that can be caused were an attacker to exploit this issue. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"critical"},"enhanced-severity-score":{"description":"The severity score of an issue (enhanced by CyCognito's Exploit Intelligence) that quantifies the potential damage that can be caused were an attacker to exploit this issue. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"number"},{"type":"null"}],"example":"10"},"environments":{"description":"Refers to IT environments, or the different hardware, software, infrastructure, and networks in which your assets are found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"Cryptographic Protocols\",\n      \"Operating Systems\",\n      \"Web Servers\"\n    ]"},"evidence":{"description":"Provides detailed proof supporting the detection of an issue by CyCognito, including validation steps and necessary information for verification.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n                                      \"evidence\": \"This field is designed to handle complex data structures, potentially involving multiple nested properties that vary from issue to issue.\",\n                                      \"more-details-link\": \"A URL to more details\",\n                                      \"curl-cmd\": \"The curl command\",\n                                      \"hostname\": \"The host name\"\n                                      }"},"exploitation-availability":{"description":"Indicates how easily an issue can be exploited. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"High"},"exploitation-complexity":{"description":"Measures the difficulty at which a vulnerable asset can be assessed and consequently exploited by a potential attacker, based on the complexity of the required exploitation methods. \n*Supported values:* `very easy`, `easy`, `moderate`, `hard`, `extreme`","anyOf":[{"type":"string"},{"type":"null"}],"example":"easy"},"exploitation-method":{"description":"A practical method or series of methods by which an attacker can compromise or exploit an issue on a particular asset which they have detected.","anyOf":[{"type":"string"},{"type":"null"}],"example":"No PoC"},"exploitation-score":{"description":"Specifies how difficult it would be for an attacker to exploit an asset upon detecting the issue, based on the method or methods that would be required to perform the attack. For example, a simple action like a brute-force exploitation would be considered a relatively easy exploitation method.","type":"integer","example":"5"},"first-detected":{"description":"The date and time at which CyCognito first detected the issue.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2023-01-26T13:12:57.253Z"},"id":{"description":"A unique ID for the instance of a particular issue on a specific asset. This is equivalent to the `issue_instance_id` value.","type":"string","example":"issue/webapp-1.1.1.1-cyc-js-jquery-2"},"investigating-since":{"description":"The date at which investigation on a specific issue began. \n*Format:* `YYYY-MM-DD`","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2023-08-21T13:12:57.253Z"},"investigation-status":{"description":"Indicates whether or not an asset or issue has undergone investigation by you or someone on your team.","anyOf":[{"type":"string","enum":["investigating","investigated","uninvestigated"]},{"type":"null"}],"example":"investigating"},"is-snoozed":{"description":"Indicates whether an issue has been snoozed—i.e., it has been hidden from view until a later date.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"iso27001-controls":{"description":"Refers to the compliance control number of the ISO 27001 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"iso27002-controls":{"description":"Refers to the compliance control number of the ISO 27002 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"issue-id":{"description":"An ID that identifies a particular issue—e.g., *CYC-TLS-HSTS-INSECURE*, *CVE-2022-33915*.","type":"string","example":"CYC-TLS-HSTS-INSECURE"},"issue-status":{"description":"Refers to the current status of the issue following the most recent data update (or \"scan\"). The following are the supported statuses and their definitions: \n * `new` – The issue was first detected up to 30 days before your latest data update. \n * `normal` – The issue is still outstanding. \n * `issue-removed` – The issue was not detected in the latest data update. \n * `asset-removed` – The issue's affected asset was not seen in the latest data update. \n * `asset-not-alive` – The issue's affected asset is not alive.","anyOf":[{"type":"string"},{"type":"string"},{"type":"null"}],"example":"new"},"issue-type":{"description":"The type of issue as classified by CyCognito—e.g., *abandoned asset*, *cryptographic vulnerability*, *exposed data*, *phishing threat*, *weak credentials*, etc.","type":"string","example":"Vulnerable Software"},"issue-types":{"description":"A list of issue types as classified by CyCognito—e.g., *abandoned asset*, *cryptographic vulnerability*, *exposed data*, *phishing threat*, *weak credentials*, etc.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Unsafe Authentication\",\n      \"Misconfiguration\",\n      \"Network Security\"\n    ]"},"last-detected":{"description":"The date and time at which CyCognito most recently detected the issue.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-06-17T07:02:04.181Z"},"locations":{"description":"The geographic locations (i.e., countries or regions) where the asset or issue is found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"USA\"\n    ]"},"mitre-attack-next-technique-name":{"description":"The MITRE ATT&CK technique that attackers are likely to use to continue their attack on a vulnerability.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Credential Access: Steal Web Session Cookie"},"mitre-attack-next-technique-subtitle":{"description":"Details the likely method or action under the next tactic from the MITRE ATT&CK Enterprise Matrix.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Steal Web Session Cookie"},"mitre-attack-next-technique-title":{"description":"Points to the subsequent tactic in the MITRE ATT&CK Enterprise Matrix that an adversary might pursue after successfully employing the current technique.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Credential Access"},"mitre-attack-technique-name":{"description":"The MITRE ATT&CK technique that is currently being used by attackers to exploit a vulnerability.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Initial Access: Exploit Public-Facing Application"},"mitre-attack-technique-subtitle":{"description":"Highlights the specific technique or method under the identified tactic in the MITRE ATT&CK Enterprise Matrix—e.g., *Spearphishing Attachment* under *Initial Access*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Exploit Public-Facing Application"},"mitre-attack-technique-title":{"description":"Indicates the currently prevailing tactic from the MITRE ATT&CK Enterprise Matrix that an attacker could potentially employ to exploit this issue—e.g., *Initial Access*, *Execution*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Initial Access"},"nist-800-171-controls":{"description":"Refers to the compliance control number of the NIST 800-171 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"3.3.5\",\n      \"3.12.2\",\n      \"3.11.2\"\n    ]"},"nist-800-53-controls":{"description":"Refers to the compliance control number of the NIST 800-53 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"CM-8\",\n      \"SI-2(3)\",\n      \"SI-4(16)\"\n    ]"},"organizations":{"description":"Specifies the organizations to whom the asset belongs, or those that are affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Gardens\"\n    ]"},"package":{"description":"Indicates package of the issue id.","anyOf":[{"type":"string"},{"type":"null"}],"example":"AST"},"pci-dss-controls":{"description":"Refers to the compliance control number of the PCI DSS, which is an information security standard used to handle credit card information.","anyOf":[{"type":"array","items":{"type":"string"},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"10.2.2\",\n      \"8.3.1\",\n      \"1.2.4\"\n    ]"},"platforms":{"description":"A list of platforms associated with an asset or issue.","type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"example":"[\n      \"Apache\",\n      \"CentOS\",\n      \"HTTP Protocol\",\n      \"TLS Protocol\"\n    ]"},"port":{"description":"Indicates the number of an open TCP port on the issue's affected IP asset.","anyOf":[{"type":"number"},{"type":"null"}],"example":"443"},"potential-impact":{"description":"A list of categories that describe what might happen if the issue is exploited—e.g., loss of integrity, loss of confidentiality, privacy violation, credential theft, etc.","type":"array","items":{"type":"string"},"example":"[\n      \"Loss of Confidentiality\",\n      \"Data Compromise\",\n      \"Network Breach\"\n    ]"},"potential-threat":{"description":"The threat that the issue might cause—e.g., *Authentication Bypass*, *Denial of Service*, *Exposed Data*, *Phishing Threat*, *Unsafe Authentication*, *Vulnerable Software*, etc.","type":"string","example":"Authentication Bypass"},"references":{"description":"A set of hyperlinks and accompanying text that help the user understand and validate the issue.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"https://support.citrix.com/article/CTX267027\",\n      \"https://nvd.nist.gov/vuln/detail/CVE-2019-19781\",\n      \"https://www.us-cert.gov/ncas/alerts/aa20-031a\",\n      \"https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2573391/russian-foreign-intelligence-service-exploiting-five-publicly-known-vulnerabili/\"\n    ]"},"region":{"description":"Refers to the regional location of the asset or issue. *Examples: Northern Africa*, *South-eastern Asia*, *Central America*, etc.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Central Asia"},"remediation-effort":{"description":"Refers to the type of effort required in order to remediate a particular issue.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Certificate Deployment"},"remediation-method":{"description":"The primary approach or strategy recommended to address a specific issue.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Patch"},"remediation-steps":{"description":"A list of instructions that describe how to resolve the issue.","type":"array","items":{"type":"string"},"example":"[\"Patch the NetScaler to the latest version.\",\"If a patch is not feasible, perform \\\"work-around\\\" mitigations per Citrix's instructions.\",\"Apply the necessary security patches provided by Citrix to fix the directory traversal vulnerability.\"]"},"resolved-at":{"description":"The date at which an issue was resolved.\n*Format:* `YYYY-MM-DD`","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2022-08-03T15:18:48.452Z"},"revalidation-request-time":{"description":"Indicates the date and time at which an issue revalidation was requested.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-08-03T15:18:48.452Z"},"revalidation-requested":{"description":"Indicates whether a revalidation request is currently in progress on a specific issue.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"severity":{"description":"Refers to an issue's seriousness, indicating how urgently it should be remediated, based on the potential damage that can be caused were an attacker to exploit it.\n*Supported values:* `low`, `medium`, `high`, `critical`.","type":"string","example":"critical"},"severity-change-reason":{"description":"The user-entered reason for changing an issue's severity.","anyOf":[{"type":"string"},{"type":"null"}],"example":"This issue is not actually considered severe by our team."},"severity-score":{"description":"The severity score of an issue that quantifies the potential damage that can be caused were an attacker to exploit this issue.","type":"number","example":"10"},"snooze-expiration":{"description":"The date at which a snoozed issue is set to expire.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-09-05T00:00:00.000Z"},"summary":{"description":"A brief description that summarizes the issue.","type":"string","example":"The website is using a vulnerable version of open source JS library"},"tags":{"description":"Custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"My tag\",\n      \"Another tag\"\n    ]"},"teams":{"description":"Lists the teams associated with the queried asset, issue, or organization. This property is available only in realms where the Teams feature is enabled.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Homes IT team\",\n      \"Onboarding IT\",\n      \"Project managers\"\n    ]"},"tech-owners":{"description":"The names of the technical owners of a specific asset or organization, or of an asset or organization affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"email":{"type":"string"},"org-name":{"type":"string"}},"required":["name","email","org-name"]}},{"type":"null"}],"example":"[\n      {\n        \"name\": \"Marty McFly\",\n        \"email\": \"marty@acme.com\",\n        \"org_id\": \"org/acme.org\",\n        \"org_name\": \"Acme Corporation\"\n      }\n    ]"},"title":{"description":"A name that briefly describes the issue—e.g., *HTTP Redirection Phishing Threat*, *Bruteforce and dictionary attacks allowed*, etc.","type":"string","example":"HTTP Redirection Phishing Threat"},"tools":{"description":"Provides a breakdown of all of the known validation and exploitation tools associated with an issue.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"modification-date":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"tool-download-url":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-id":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-description":{"anyOf":[{"type":"string"},{"type":"null"}]},"is-safe":{"anyOf":[{"type":"boolean"},{"type":"null"}]},"tool-references":{"$ref":"#/components/schemas/json.any?"},"tool-visibility":{"anyOf":[{"type":"string"},{"type":"null"}]},"source-url":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-type":{"anyOf":[{"type":"string"},{"type":"null"}]},"id":{"anyOf":[{"type":"string"},{"type":"null"}]},"relation-type":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-name":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-title":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-framework":{"anyOf":[{"type":"string"},{"type":"null"}]},"issue-id":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-instructions":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}]}},"required":["modification-date","tool-download-url","tool-id","tool-description","is-safe","tool-references","tool-visibility","source-url","tool-type","id","relation-type","tool-name","tool-title","tool-framework","issue-id","tool-instructions"],"additionalProperties":false},{"type":"null"}]}},{"type":"null"}],"example":"[{\"tool_title\":\"Citrix ADC (NetScaler) Directory Traversal Scanner\",\"tool_framework\":\"metasploit\",\"source_url\":\"https%3A%2F%2Fgithub.com%2Frapid7%2Fmetasploit-framework%2Fblob%2Fmaster%2Fmodules%2Fauxiliary%2Fscanner%2Fhttp%2Fcitrix_dir_traversal.rb\",\"tool_name\":\"auxiliary_scanner/http/citrix_dir_traversal\",\"tool_type\":\"security\",\"id\":\"metasploit:auxiliary/scanner/http/citrix_dir_traversal\",\"tool_instructions\":[\"Install the module as usual\",\"Start msfconsole\",\"Do: `use auxiliary/scanner/http/citrix_dir_traversal`\",\"Do: `set RHOSTS [IP]`\",\"Do: `run`\"],\"issue_id\":\"CVE-2019-19781\",\"tool_download_url\":null,\"is_safe\":true,\"modification_date\":\"2022-01-23T15:28:32Z\",\"tool_visibility\":\"public\",\"tool_references\":[\"CVE-2019-19781\",\"URL-https://web.archive.org/web/20200111095223/https://support.citrix.com/article/CTX267027/\",\"URL-https://swarm.ptsecurity.com/remote-code-execution-in-citrix-adc/\"],\"relation_type\":\"validation\",\"tool_description\":\"This module exploits a directory traversal vulnerability (CVE-2019-19781) within Citrix ADC (NetScaler). It requests the smb.conf file located in the /vpns/cfg directory by issuing the request /vpn/../vpns/cfg/smb.conf. It then checks if the server is vulnerable by looking for the presence of a \\\"[global]\\\" directive in smb.conf, which this file should always contain.\",\"tool_id\":\"metasploit:auxiliary/scanner/http/citrix_dir_traversal\"}]"},"underground-activity":{"description":"A history or summary of how the vulnerability on a particular issue has been exploited in the real world. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"\"CVE-2019-19781 was weaponized and productized. The actor pumpedkicks (aka mont4na) allegedly exploited CVE-2019-19781 and posted a list of targets vulnerable to CVE-2019-19781. Additionally, the actor BiosHell posted a link to an exploit for CVE-2019-19781.\""}}}}}}}}}},"/v1/issues/issue/{issue_instance_id}":{"get":{"description":"Obtain details of a specific issue using its identifier.","security":[{"apiAuth":[]}],"summary":"Fetch issue details","tags":["Issues"],"parameters":[{"name":"issue_instance_id","in":"path","schema":{"type":"string"},"required":true,"description":"Unique identifier for a specific issue occurrence on an asset. This is the `id` value from the response, excluding the `issue/` prefix."}],"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"advisories":{"description":"A list of curated pieces of threat intelligence that highlight vulnerabilities actively exploited by attackers in the wild. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"advisory":{"anyOf":[{"type":"string"},{"type":"null"}]},"url":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["advisory","url"]},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"entity_id\": \"issue/1.1.1.1-cve-2019-19781\",\n        \"ti_severity_score\": 10,\n        \"confidence\": 100,\n        \"advisory\": \"CISA | Known Exploited Vulnerabilities (KEV) catalog\",\n        \"realm_id\": \"acme-corporation\",\n        \"id\": \"issue/1.1.1.1-cve-2019-19781\",\n        \"type\": \"issue\",\n        \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\"\n      }\n    ]"},"affected-asset":{"description":"The unique ID of the asset with which the issue is associated.","type":"string","example":"webapp/1.1.1.1"},"affected-asset-tags":{"description":"Custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"My tag\",\n      \"Another tag\"\n    ]"},"affected-ptr-domains":{"description":"The PTR record associated with an IP address.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"r2.acme.net"},"asset-status":{"description":"The most recent status of an asset—e.g., Changed (was modified since the previous scan), New (was discovered during the most recent scan), Normal (nothing has changed since the previous scan), Removed (was not discovered in the most recent scan).","anyOf":[{"type":"string"},{"type":"null"}],"example":"changed"},"attacker-interest":{"description":"A measurement of how attractive an issue's affected asset may be to a potential attacker. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"High"},"attractiveness":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a higher-priority target for attackers, regardless of any issues it has.","anyOf":[{"type":"number"},{"type":"null"}],"example":"4"},"attractiveness-label":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a higher-priority target for attackers, regardless of any issues it has.","anyOf":[{"type":"string"},{"type":"null"}],"example":"extreme"},"base-severity":{"description":"Refers to an issue's seriousness, indicating how urgently it should be remediated, based on the potential damage that can be caused were an attacker to exploit it. This property is available only for customers using Exploit Intelligence.\n*Supported values:* `low`, `medium`, `high`, `critical`","anyOf":[{"type":"string"},{"type":"null"}],"example":"high"},"base-severity-score":{"description":"The severity score, which is mostly inherited from the CVSS method for measuring of severity, and is the basis (about 80%) for the majority of the Enhanced Severity Score calculation. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"number"},{"type":"null"}],"example":"10"},"business-units":{"description":"[DEPRECATED] - The functional areas of the business that use the assets or the platform, or are affected by the issue.","type":"array","items":{"type":"string"},"example":"[\n      \"Marketing\"\n    ]"},"cis-controls":{"description":"Refers to the compliance control number of the CIS framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"7.6\",\n      \"3.11\",\n      \"7.5\",\n      \"16.7\"\n    ]"},"comment":{"description":"Custom text that can be added to the details of an asset or issue. Comments are typically used to make notes or personal descriptions regarding the significance of a particular asset or issue.","anyOf":[{"type":"object","properties":{"content":{"type":"string"},"last-update":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}},"required":["content","last-update"]},{"type":"null"}],"example":"Reviewed by Gary"},"comments":{"description":"Comments is a collection of custom text entries, providing the ability to record multiple notes or personal descriptions related to an asset or issue. Unlike the single 'comment' field, this allows for a running log or more detailed commentary over time.","anyOf":[{"type":"array","items":{"type":"object","properties":{"content":{"type":"string"},"created-by-name":{"anyOf":[{"type":"string"},{"type":"null"}]},"last-update":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["content","created-by-name","last-update"]}},{"type":"null"}],"example":"Reviewed by Gary"},"compliance-violations":{"description":"Refers to specific compliance frameworks that have been violated.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"NIST-800-171\",\n      \"CIS\",\n      \"ISO27001\"\n    ]"},"confidence":{"description":"Refers to the probability that an issue is valid and relevant on a scale of 0 to 100, where 0 indicates no confidence, and 100 indicates absolute confidence.","anyOf":[{"type":"number"},{"type":"null"}],"example":"90"},"confidence-level":{"description":"“Refers to the probability that an issue is valid and relevant. Possible values (from most probable to the least) are Confirmed, Likely, Potential, and Inconclusive.","anyOf":[{"type":"string"},{"type":"null"}],"example":"confirmed"},"continent":{"description":"The geographical continent in which the asset or issue is located.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Americas"},"cve-ids":{"description":"Refers to the specific CVE-ID number of the issue as established by the Mitre Corporation.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"CVE-2019-19781\"\n    ]"},"detection-complexity":{"description":"Measures the difficulty at which a vulnerable asset can be detected by a potential attacker.\n*Supported values:* `easy`, `moderate`, `hard`","type":"string","example":"easy"},"detection-method":{"description":"Indicates the method used to detect the issue.\n*Supported values:* `active`, `passive`","anyOf":[{"type":"string"},{"type":"null"}],"example":"active"},"enhanced-severity":{"description":"The severity grade (enhanced by CyCognito's Exploit Intelligence) that represents the potential damage that can be caused were an attacker to exploit this issue. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"critical"},"enhanced-severity-score":{"description":"The severity score of an issue (enhanced by CyCognito's Exploit Intelligence) that quantifies the potential damage that can be caused were an attacker to exploit this issue. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"number"},{"type":"null"}],"example":"10"},"environments":{"description":"Refers to IT environments, or the different hardware, software, infrastructure, and networks in which your assets are found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"Cryptographic Protocols\",\n      \"Operating Systems\",\n      \"Web Servers\"\n    ]"},"evidence":{"description":"Provides detailed proof supporting the detection of an issue by CyCognito, including validation steps and necessary information for verification.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n                                      \"evidence\": \"This field is designed to handle complex data structures, potentially involving multiple nested properties that vary from issue to issue.\",\n                                      \"more-details-link\": \"A URL to more details\",\n                                      \"curl-cmd\": \"The curl command\",\n                                      \"hostname\": \"The host name\"\n                                      }"},"exploitation-availability":{"description":"Indicates how easily an issue can be exploited. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"High"},"exploitation-complexity":{"description":"Measures the difficulty at which a vulnerable asset can be assessed and consequently exploited by a potential attacker, based on the complexity of the required exploitation methods. \n*Supported values:* `very easy`, `easy`, `moderate`, `hard`, `extreme`","anyOf":[{"type":"string"},{"type":"null"}],"example":"easy"},"exploitation-method":{"description":"A practical method or series of methods by which an attacker can compromise or exploit an issue on a particular asset which they have detected.","anyOf":[{"type":"string"},{"type":"null"}],"example":"No PoC"},"exploitation-score":{"description":"Specifies how difficult it would be for an attacker to exploit an asset upon detecting the issue, based on the method or methods that would be required to perform the attack. For example, a simple action like a brute-force exploitation would be considered a relatively easy exploitation method.","type":"integer","example":"5"},"first-detected":{"description":"The date and time at which CyCognito first detected the issue.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2023-01-26T13:12:57.253Z"},"id":{"description":"A unique ID for the instance of a particular issue on a specific asset. This is equivalent to the `issue_instance_id` value.","type":"string","example":"issue/webapp-1.1.1.1-cyc-js-jquery-2"},"investigating-since":{"description":"The date at which investigation on a specific issue began. \n*Format:* `YYYY-MM-DD`","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2023-08-21T13:12:57.253Z"},"investigation-status":{"description":"Indicates whether or not an asset or issue has undergone investigation by you or someone on your team.","anyOf":[{"type":"string","enum":["investigating","investigated","uninvestigated"]},{"type":"null"}],"example":"investigating"},"is-snoozed":{"description":"Indicates whether an issue has been snoozed—i.e., it has been hidden from view until a later date.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"iso27001-controls":{"description":"Refers to the compliance control number of the ISO 27001 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"iso27002-controls":{"description":"Refers to the compliance control number of the ISO 27002 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"issue-id":{"description":"An ID that identifies a particular issue—e.g., *CYC-TLS-HSTS-INSECURE*, *CVE-2022-33915*.","type":"string","example":"CYC-TLS-HSTS-INSECURE"},"issue-status":{"description":"Refers to the current status of the issue following the most recent data update (or \"scan\"). The following are the supported statuses and their definitions: \n * `new` – The issue was first detected up to 30 days before your latest data update. \n * `normal` – The issue is still outstanding. \n * `issue-removed` – The issue was not detected in the latest data update. \n * `asset-removed` – The issue's affected asset was not seen in the latest data update. \n * `asset-not-alive` – The issue's affected asset is not alive.","anyOf":[{"type":"string"},{"type":"string"},{"type":"null"}],"example":"new"},"issue-type":{"description":"The type of issue as classified by CyCognito—e.g., *abandoned asset*, *cryptographic vulnerability*, *exposed data*, *phishing threat*, *weak credentials*, etc.","type":"string","example":"Vulnerable Software"},"issue-types":{"description":"A list of issue types as classified by CyCognito—e.g., *abandoned asset*, *cryptographic vulnerability*, *exposed data*, *phishing threat*, *weak credentials*, etc.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Unsafe Authentication\",\n      \"Misconfiguration\",\n      \"Network Security\"\n    ]"},"last-detected":{"description":"The date and time at which CyCognito most recently detected the issue.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-06-17T07:02:04.181Z"},"locations":{"description":"The geographic locations (i.e., countries or regions) where the asset or issue is found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"USA\"\n    ]"},"mitre-attack-next-technique-name":{"description":"The MITRE ATT&CK technique that attackers are likely to use to continue their attack on a vulnerability.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Credential Access: Steal Web Session Cookie"},"mitre-attack-next-technique-subtitle":{"description":"Details the likely method or action under the next tactic from the MITRE ATT&CK Enterprise Matrix.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Steal Web Session Cookie"},"mitre-attack-next-technique-title":{"description":"Points to the subsequent tactic in the MITRE ATT&CK Enterprise Matrix that an adversary might pursue after successfully employing the current technique.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Credential Access"},"mitre-attack-technique-name":{"description":"The MITRE ATT&CK technique that is currently being used by attackers to exploit a vulnerability.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Initial Access: Exploit Public-Facing Application"},"mitre-attack-technique-subtitle":{"description":"Highlights the specific technique or method under the identified tactic in the MITRE ATT&CK Enterprise Matrix—e.g., *Spearphishing Attachment* under *Initial Access*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Exploit Public-Facing Application"},"mitre-attack-technique-title":{"description":"Indicates the currently prevailing tactic from the MITRE ATT&CK Enterprise Matrix that an attacker could potentially employ to exploit this issue—e.g., *Initial Access*, *Execution*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Initial Access"},"nist-800-171-controls":{"description":"Refers to the compliance control number of the NIST 800-171 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"3.3.5\",\n      \"3.12.2\",\n      \"3.11.2\"\n    ]"},"nist-800-53-controls":{"description":"Refers to the compliance control number of the NIST 800-53 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"CM-8\",\n      \"SI-2(3)\",\n      \"SI-4(16)\"\n    ]"},"organizations":{"description":"Specifies the organizations to whom the asset belongs, or those that are affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Gardens\"\n    ]"},"package":{"description":"Indicates package of the issue id.","anyOf":[{"type":"string"},{"type":"null"}],"example":"AST"},"pci-dss-controls":{"description":"Refers to the compliance control number of the PCI DSS, which is an information security standard used to handle credit card information.","anyOf":[{"type":"array","items":{"type":"string"},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"10.2.2\",\n      \"8.3.1\",\n      \"1.2.4\"\n    ]"},"platforms":{"description":"A list of platforms associated with an asset or issue.","type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"example":"[\n      \"Apache\",\n      \"CentOS\",\n      \"HTTP Protocol\",\n      \"TLS Protocol\"\n    ]"},"port":{"description":"Indicates the number of an open TCP port on the issue's affected IP asset.","anyOf":[{"type":"number"},{"type":"null"}],"example":"443"},"potential-impact":{"description":"A list of categories that describe what might happen if the issue is exploited—e.g., loss of integrity, loss of confidentiality, privacy violation, credential theft, etc.","type":"array","items":{"type":"string"},"example":"[\n      \"Loss of Confidentiality\",\n      \"Data Compromise\",\n      \"Network Breach\"\n    ]"},"potential-threat":{"description":"The threat that the issue might cause—e.g., *Authentication Bypass*, *Denial of Service*, *Exposed Data*, *Phishing Threat*, *Unsafe Authentication*, *Vulnerable Software*, etc.","type":"string","example":"Authentication Bypass"},"references":{"description":"A set of hyperlinks and accompanying text that help the user understand and validate the issue.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"https://support.citrix.com/article/CTX267027\",\n      \"https://nvd.nist.gov/vuln/detail/CVE-2019-19781\",\n      \"https://www.us-cert.gov/ncas/alerts/aa20-031a\",\n      \"https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2573391/russian-foreign-intelligence-service-exploiting-five-publicly-known-vulnerabili/\"\n    ]"},"region":{"description":"Refers to the regional location of the asset or issue. *Examples: Northern Africa*, *South-eastern Asia*, *Central America*, etc.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Central Asia"},"remediation-effort":{"description":"Refers to the type of effort required in order to remediate a particular issue.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Certificate Deployment"},"remediation-method":{"description":"The primary approach or strategy recommended to address a specific issue.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Patch"},"remediation-steps":{"description":"A list of instructions that describe how to resolve the issue.","type":"array","items":{"type":"string"},"example":"[\"Patch the NetScaler to the latest version.\",\"If a patch is not feasible, perform \\\"work-around\\\" mitigations per Citrix's instructions.\",\"Apply the necessary security patches provided by Citrix to fix the directory traversal vulnerability.\"]"},"resolved-at":{"description":"The date at which an issue was resolved.\n*Format:* `YYYY-MM-DD`","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2022-08-03T15:18:48.452Z"},"revalidation-request-time":{"description":"Indicates the date and time at which an issue revalidation was requested.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-08-03T15:18:48.452Z"},"revalidation-requested":{"description":"Indicates whether a revalidation request is currently in progress on a specific issue.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"severity":{"description":"Refers to an issue's seriousness, indicating how urgently it should be remediated, based on the potential damage that can be caused were an attacker to exploit it.\n*Supported values:* `low`, `medium`, `high`, `critical`.","type":"string","example":"critical"},"severity-change-reason":{"description":"The user-entered reason for changing an issue's severity.","anyOf":[{"type":"string"},{"type":"null"}],"example":"This issue is not actually considered severe by our team."},"severity-score":{"description":"The severity score of an issue that quantifies the potential damage that can be caused were an attacker to exploit this issue.","type":"number","example":"10"},"snooze-expiration":{"description":"The date at which a snoozed issue is set to expire.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-09-05T00:00:00.000Z"},"summary":{"description":"A brief description that summarizes the issue.","type":"string","example":"The website is using a vulnerable version of open source JS library"},"tags":{"description":"Custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"My tag\",\n      \"Another tag\"\n    ]"},"teams":{"description":"Lists the teams associated with the queried asset, issue, or organization. This property is available only in realms where the Teams feature is enabled.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Homes IT team\",\n      \"Onboarding IT\",\n      \"Project managers\"\n    ]"},"tech-owners":{"description":"The names of the technical owners of a specific asset or organization, or of an asset or organization affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"email":{"type":"string"},"org-name":{"type":"string"}},"required":["name","email","org-name"]}},{"type":"null"}],"example":"[\n      {\n        \"name\": \"Marty McFly\",\n        \"email\": \"marty@acme.com\",\n        \"org_id\": \"org/acme.org\",\n        \"org_name\": \"Acme Corporation\"\n      }\n    ]"},"title":{"description":"A name that briefly describes the issue—e.g., *HTTP Redirection Phishing Threat*, *Bruteforce and dictionary attacks allowed*, etc.","type":"string","example":"HTTP Redirection Phishing Threat"},"tools":{"description":"Provides a breakdown of all of the known validation and exploitation tools associated with an issue.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"modification-date":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"tool-download-url":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-id":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-description":{"anyOf":[{"type":"string"},{"type":"null"}]},"is-safe":{"anyOf":[{"type":"boolean"},{"type":"null"}]},"tool-references":{"$ref":"#/components/schemas/json.any?"},"tool-visibility":{"anyOf":[{"type":"string"},{"type":"null"}]},"source-url":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-type":{"anyOf":[{"type":"string"},{"type":"null"}]},"id":{"anyOf":[{"type":"string"},{"type":"null"}]},"relation-type":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-name":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-title":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-framework":{"anyOf":[{"type":"string"},{"type":"null"}]},"issue-id":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-instructions":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}]}},"required":["modification-date","tool-download-url","tool-id","tool-description","is-safe","tool-references","tool-visibility","source-url","tool-type","id","relation-type","tool-name","tool-title","tool-framework","issue-id","tool-instructions"],"additionalProperties":false},{"type":"null"}]}},{"type":"null"}],"example":"[{\"tool_title\":\"Citrix ADC (NetScaler) Directory Traversal Scanner\",\"tool_framework\":\"metasploit\",\"source_url\":\"https%3A%2F%2Fgithub.com%2Frapid7%2Fmetasploit-framework%2Fblob%2Fmaster%2Fmodules%2Fauxiliary%2Fscanner%2Fhttp%2Fcitrix_dir_traversal.rb\",\"tool_name\":\"auxiliary_scanner/http/citrix_dir_traversal\",\"tool_type\":\"security\",\"id\":\"metasploit:auxiliary/scanner/http/citrix_dir_traversal\",\"tool_instructions\":[\"Install the module as usual\",\"Start msfconsole\",\"Do: `use auxiliary/scanner/http/citrix_dir_traversal`\",\"Do: `set RHOSTS [IP]`\",\"Do: `run`\"],\"issue_id\":\"CVE-2019-19781\",\"tool_download_url\":null,\"is_safe\":true,\"modification_date\":\"2022-01-23T15:28:32Z\",\"tool_visibility\":\"public\",\"tool_references\":[\"CVE-2019-19781\",\"URL-https://web.archive.org/web/20200111095223/https://support.citrix.com/article/CTX267027/\",\"URL-https://swarm.ptsecurity.com/remote-code-execution-in-citrix-adc/\"],\"relation_type\":\"validation\",\"tool_description\":\"This module exploits a directory traversal vulnerability (CVE-2019-19781) within Citrix ADC (NetScaler). It requests the smb.conf file located in the /vpns/cfg directory by issuing the request /vpn/../vpns/cfg/smb.conf. It then checks if the server is vulnerable by looking for the presence of a \\\"[global]\\\" directive in smb.conf, which this file should always contain.\",\"tool_id\":\"metasploit:auxiliary/scanner/http/citrix_dir_traversal\"}]"},"underground-activity":{"description":"A history or summary of how the vulnerability on a particular issue has been exploited in the real world. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"\"CVE-2019-19781 was weaponized and productized. The actor pumpedkicks (aka mont4na) allegedly exploited CVE-2019-19781 and posted a list of targets vulnerable to CVE-2019-19781. Additionally, the actor BiosHell posted a link to an exploit for CVE-2019-19781.\""}}}}}}}}},"/v1/issues/issue/{issue_instance_id}/investigation-status":{"put":{"description":"Adjust the specified issue's investigation status:\n- **Investigated** – The issue has been investigated.\n- **Investigating** – The issue is currently undergoing investigation by someone in your team.\n- **Uninvestigated** – The issue has not been investigated yet.","security":[{"apiAuth":[]}],"summary":"Update issue's investigation status","tags":["Issues"],"parameters":[{"name":"issue_instance_id","in":"path","schema":{"type":"string"},"required":true,"description":"Unique identifier for a specific issue occurrence on an asset. This is the `id` value from the response, excluding the `issue/` prefix."}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"investigation-status":{"description":"Indicates whether or not an asset or issue has undergone investigation by you or someone on your team.  \n   \n*Supported values:* `investigating`, `investigated`, `uninvestigated`","type":"string","enum":["investigating","investigated","uninvestigated"]}},"required":["investigation-status"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"failed":{"description":"A list of entity IDs for which the requested action could not be completed. When the response status is 200, the list includes entity IDs where the action could not be executed, possibly due to insufficient permissions or because the entity ID is associated with multiple teams. When the response status is 400, the list contains an error message indicating that the number of provided entity IDs exceeds the maximum allowable limit.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"uniqueItems":true},"updated":{"description":"A list of entity IDs that were successfully updated as a result of the action. It confirms the successful execution of the requested operation on these entities.","type":"array","items":{"type":"string"},"uniqueItems":true}},"required":["failed","updated"]}}}}}}},"/v1/issues/actions/add/comment":{"put":{"description":"Allows you to add comments to multiple issues identified by their unique IDs. The comments are appended to the existing comment log and do not replace any existing content.","security":[{"apiAuth":[]}],"summary":"Add comments to issues","tags":["Issues"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"entity-ids":{"description":"A comma-separated list of unique issue identifiers. Each ID corresponds to the `id` field from the *Search issues* response and should be formatted as `issue/&lt;affected_asset&gt;-&lt;issue_id&gt;`.\n   \n*Example:* `issue/1.1.1.1-cve-2023-12345`, `issue/CYC-ISSUE-NAME`, `issue/WLD-ABCD1234EFGH5678`","type":"array","items":{"type":"string"},"example":["issue/CVE-1234-56789","issue/CYC-ISSUE-NAME","issue/WLD-ABCD1234EFGH5678"]},"comment":{"description":"The content of the comment to be added to the specified issues.","type":"string","example":"This is a new comment on the issue"}},"required":["entity-ids","comment"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"failed":{"description":"A list of entity IDs for which the requested action could not be completed. When the response status is 200, the list includes entity IDs where the action could not be executed, possibly due to insufficient permissions or because the entity ID is associated with multiple teams. When the response status is 400, the list contains an error message indicating that the number of provided entity IDs exceeds the maximum allowable limit.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"uniqueItems":true},"updated":{"description":"A list of entity IDs that were successfully updated as a result of the action. It confirms the successful execution of the requested operation on these entities.","type":"array","items":{"type":"string"},"uniqueItems":true}},"required":["failed","updated"]}}}}}}},"/v1/issues/actions/{action}/tags":{"put":{"description":"Add or remove custom tags from specified issues.","security":[{"apiAuth":[]}],"summary":"Handle issue tags","tags":["Issues"],"parameters":[{"name":"action","in":"path","schema":{"type":"string","enum":["add","remove","replace","remove-all"]},"required":true,"description":"Choose an action to apply to the tags on the specified entities: \n * **add** – Apply new tags in addition to the existing tags on the specified entities. \n * **remove** – Clears only the indicated tags from the specified entities. \n * **replace** – Replaces *all* of the current tags on *all* of the specified entities with the indicated tags. \n * **remove-all** – Clears *all* of the existing tags from the specified entities."}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"entity-ids":{"description":"A comma-separated list in which each item contains the unique ID for the issues whose custom tags you would like to modify. The unique ID corresponds to the `id` field (from the *Search issues* response) and should be in the format `issue/&lt;affected_asset&gt;-&lt;issue_id&gt;`.  \n   \n*Example:* `issue/1.1.1.1-cve-2023-12345`","type":"array","items":{"type":"string"},"example":["issue/CVE-1234-56789","issue/CYC-ISSUE-NAME","issue/WLD-ABCD1234EFGH5678"]},"tags":{"description":"A comma-separated list of custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","type":"array","items":{"type":"string"},"example":["My tag","Another tag"]}},"required":["entity-ids"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"failed":{"description":"A list of entity IDs for which the requested action could not be completed. When the response status is 200, the list includes entity IDs where the action could not be executed, possibly due to insufficient permissions or because the entity ID is associated with multiple teams. When the response status is 400, the list contains an error message indicating that the number of provided entity IDs exceeds the maximum allowable limit.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"uniqueItems":true},"updated":{"description":"A list of entity IDs that were successfully updated as a result of the action. It confirms the successful execution of the requested operation on these entities.","type":"array","items":{"type":"string"},"uniqueItems":true}},"required":["failed","updated"]}}}}}}},"/v1/issues/actions/archive":{"put":{"description":"Move issues to an archived state, distinguishing them from open and resolved issues.","security":[{"apiAuth":[]}],"summary":"Archive issues","tags":["Issues"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"entity-ids":{"description":"A comma-separated list in which each item contains the unique ID for the issues you would like to archive. The unique ID corresponds to the `id` field (from the *Search issues* response) and should be in the format `issue/&lt;affected_asset&gt;-&lt;issue_id&gt;`.  \n   \n*Example:* `issue/1.1.1.1-cve-2023-12345`","type":"array","items":{"type":"string"},"example":["issue/CVE-1234-56789","issue/CYC-ISSUE-NAME","issue/WLD-ABCD1234EFGH5678"]},"reporting-reason":{"description":"The reason you are archiving the specified issues.  \n *Supported values:*  \n * The issue is a false positive.  \n * This issue has already been resolved.  \n * The issue is irrelevant.  \n * The asset is not related to my organization.  \n * The risk posed by this issue is acceptable.  \n * The issue’s affected asset has been removed by a user.  \n * Other","type":"string","enum":["The issue is a false positive.","This issue has already been resolved.","The issue is irrelevant.","The asset is not related to my organization.","The risk posed by this issue is acceptable.","The issue’s affected asset has been removed by a user.","Other"],"example":"This issue has already been resolved."},"comment":{"description":"If the `reporting-reason` is *Other*, enter a comment explaining the reason you are archiving the issue.","type":"string","example":"We resolved this issue following last month's triage."}},"required":["entity-ids","reporting-reason"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"failed":{"description":"A list of entity IDs for which the requested action could not be completed. When the response status is 200, the list includes entity IDs where the action could not be executed, possibly due to insufficient permissions or because the entity ID is associated with multiple teams. When the response status is 400, the list contains an error message indicating that the number of provided entity IDs exceeds the maximum allowable limit.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"uniqueItems":true},"updated":{"description":"A list of entity IDs that were successfully updated as a result of the action. It confirms the successful execution of the requested operation on these entities.","type":"array","items":{"type":"string"},"uniqueItems":true}},"required":["failed","updated"]}}}}}}},"/v1/issues/actions/snooze":{"put":{"description":"Snooze issues for a specified duration, hiding them from your open issues list until the snooze period expires. This enables automated lifecycle control from external workflows while maintaining accurate attack surface metrics.","security":[{"apiAuth":[]}],"summary":"Snooze issues","tags":["Issues"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"entity-ids":{"description":"A comma-separated list of unique issue identifiers. Each ID corresponds to the `id` field from the *Search issues* response and should be formatted as `issue/&lt;affected_asset&gt;-&lt;issue_id&gt;`.\n   \n*Example:* `issue/1.1.1.1-cve-2023-12345`, `issue/CYC-ISSUE-NAME`, `issue/WLD-ABCD1234EFGH5678`","type":"array","items":{"type":"string"},"example":["issue/CVE-1234-56789","issue/CYC-ISSUE-NAME","issue/WLD-ABCD1234EFGH5678"]},"snooze-duration":{"description":"The number of days the issues will be snoozed.","allOf":[{"type":"number"},{"type":"number","exclusiveMinimum":0}],"example":45}},"required":["entity-ids","snooze-duration"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"failed":{"description":"A list of entity IDs for which the requested action could not be completed. When the response status is 200, the list includes entity IDs where the action could not be executed, possibly due to insufficient permissions or because the entity ID is associated with multiple teams. When the response status is 400, the list contains an error message indicating that the number of provided entity IDs exceeds the maximum allowable limit.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"uniqueItems":true},"updated":{"description":"A list of entity IDs that were successfully updated as a result of the action. It confirms the successful execution of the requested operation on these entities.","type":"array","items":{"type":"string"},"uniqueItems":true}},"required":["failed","updated"]}}}}}}},"/v1/archived-issues":{"post":{"description":"Retrieve archived issues based on set criteria. If you are comparing search results with the CyCognito app, note that <span name=\"kb-predefined-filters-api-explanation\">Predefined Filters</span> are not applied to data queried via the API by default.","security":[{"apiAuth":[]}],"summary":"Search archived issues","tags":["Issues"],"parameters":[{"name":"count","in":"query","schema":{"type":"integer"},"required":false,"description":"Defines the number of results to be retrieved. Defaults to 10 with a max limit of 1000."},{"name":"advanced-search","in":"query","schema":{"type":"string"},"required":false,"description":"Allows you to input raw CyQL in order to query assets, issues, or organizations. See our <span name=\"kb-advanced-search-link\">Advanced Search</span> documentation for more details."},{"name":"offset","in":"query","schema":{"type":"integer"},"required":false,"description":"Sets the starting index for result retrieval, influenced by the `count` parameter. By default, `offset` is 0. Example: `offset` 3 with `count` 25 fetches results from index 75 to 99."},{"name":"q","in":"query","schema":{"type":"string"},"required":false,"description":"Specifies a search term for conducting a keyword-based search and retrieving data that matches your query."},{"name":"fields","in":"query","schema":{"type":"string"},"required":false,"description":"A comma-separated list specifying the desired entity properties to appear in the response. For more information, view the response example and schema."},{"name":"sort-by","in":"query","schema":{"type":"string"},"required":false,"description":"Specifies the field by which the results should be sorted."},{"name":"sort-order","in":"query","schema":{"type":"string","enum":["asc","desc"]},"required":false,"description":"Sorts the specified field in ascending or descending order."}],"requestBody":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"field":{"description":"Field to apply the filter on. Typically, any field present in the response can be used.","allOf":[{"type":"string"}],"example":"status"},"op":{"description":"Specifies the operation to apply on the desired field.\n            \n*Supported values:*  \n            \n* `is` – Searches for values that match the specified text exactly.  \n            \n* `not` – Searches for values that **do not** match the specified text exactly.  \n            \n* `in` – Filters entities for values that include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `not-in` – Filters entities for values that do not include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `only-in` – Filters **exclusively** so that only entities with the values specified will be searched. This operator is currently available only for the `organizations` and `tags` properties for assets and issues.  \n            \n* `between` – Searches by dates that are in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `not-between` – Searches by dates that are **not** in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `within-range` – Searches by number values that are in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[60,75]`.\n            \n* `not-within-range` – Searches by number values that are **not** in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[10,59]`.\n            \n* `within-last` – Searches for date values that are within the specified time frame in days—e.g., `64` is the value for 64 days.\n            \n* `not-within-last` – Searches for date values that are **not** within the specified time frame in days—e.g., `128` is the value for 128 days.\n            \n* `contains` – Searches for a specific substring within a string value.","allOf":[{"type":"string","enum":["is","not","in","not-in","only-in","key-of","not-key-of","between","not-between","within-range","not-within-range","contains","within-last","not-within-last"]}],"example":"in"},"values":{"description":"Specifies the value or values for the field.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"example":["new"]}},"required":["field","op","values"]}}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"advisories":{"description":"A list of curated pieces of threat intelligence that highlight vulnerabilities actively exploited by attackers in the wild. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"advisory":{"anyOf":[{"type":"string"},{"type":"null"}]},"url":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["advisory","url"]},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"entity_id\": \"issue/1.1.1.1-cve-2019-19781\",\n        \"ti_severity_score\": 10,\n        \"confidence\": 100,\n        \"advisory\": \"CISA | Known Exploited Vulnerabilities (KEV) catalog\",\n        \"realm_id\": \"acme-corporation\",\n        \"id\": \"issue/1.1.1.1-cve-2019-19781\",\n        \"type\": \"issue\",\n        \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\"\n      }\n    ]"},"affected-asset":{"description":"The unique ID of the asset with which the issue is associated.","type":"string","example":"webapp/1.1.1.1"},"affected-asset-tags":{"description":"Custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"My tag\",\n      \"Another tag\"\n    ]"},"affected-ptr-domains":{"description":"The PTR record associated with an IP address.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"r2.acme.net"},"asset-status":{"description":"The most recent status of an asset—e.g., Changed (was modified since the previous scan), New (was discovered during the most recent scan), Normal (nothing has changed since the previous scan), Removed (was not discovered in the most recent scan).","anyOf":[{"type":"string"},{"type":"null"}],"example":"changed"},"attacker-interest":{"description":"A measurement of how attractive an issue's affected asset may be to a potential attacker. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"High"},"attractiveness":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a higher-priority target for attackers, regardless of any issues it has.","anyOf":[{"type":"number"},{"type":"null"}],"example":"4"},"attractiveness-label":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a higher-priority target for attackers, regardless of any issues it has.","anyOf":[{"type":"string"},{"type":"null"}],"example":"extreme"},"base-severity":{"description":"Refers to an issue's seriousness, indicating how urgently it should be remediated, based on the potential damage that can be caused were an attacker to exploit it. This property is available only for customers using Exploit Intelligence.\n*Supported values:* `low`, `medium`, `high`, `critical`","anyOf":[{"type":"string"},{"type":"null"}],"example":"high"},"base-severity-score":{"description":"The severity score, which is mostly inherited from the CVSS method for measuring of severity, and is the basis (about 80%) for the majority of the Enhanced Severity Score calculation. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"number"},{"type":"null"}],"example":"10"},"business-units":{"description":"[DEPRECATED] - The functional areas of the business that use the assets or the platform, or are affected by the issue.","type":"array","items":{"type":"string"},"example":"[\n      \"Marketing\"\n    ]"},"cis-controls":{"description":"Refers to the compliance control number of the CIS framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"7.6\",\n      \"3.11\",\n      \"7.5\",\n      \"16.7\"\n    ]"},"comment":{"description":"Custom text that can be added to the details of an asset or issue. Comments are typically used to make notes or personal descriptions regarding the significance of a particular asset or issue.","anyOf":[{"type":"object","properties":{"content":{"type":"string"},"last-update":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}},"required":["content","last-update"]},{"type":"null"}],"example":"Reviewed by Gary"},"comments":{"description":"Comments is a collection of custom text entries, providing the ability to record multiple notes or personal descriptions related to an asset or issue. Unlike the single 'comment' field, this allows for a running log or more detailed commentary over time.","anyOf":[{"type":"array","items":{"type":"object","properties":{"content":{"type":"string"},"created-by-name":{"anyOf":[{"type":"string"},{"type":"null"}]},"last-update":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["content","created-by-name","last-update"]}},{"type":"null"}],"example":"Reviewed by Gary"},"compliance-violations":{"description":"Refers to specific compliance frameworks that have been violated.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"NIST-800-171\",\n      \"CIS\",\n      \"ISO27001\"\n    ]"},"confidence":{"description":"Refers to the probability that an issue is valid and relevant on a scale of 0 to 100, where 0 indicates no confidence, and 100 indicates absolute confidence.","anyOf":[{"type":"number"},{"type":"null"}],"example":"90"},"confidence-level":{"description":"“Refers to the probability that an issue is valid and relevant. Possible values (from most probable to the least) are Confirmed, Likely, Potential, and Inconclusive.","anyOf":[{"type":"string"},{"type":"null"}],"example":"confirmed"},"continent":{"description":"The geographical continent in which the asset or issue is located.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Americas"},"cve-ids":{"description":"Refers to the specific CVE-ID number of the issue as established by the Mitre Corporation.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"CVE-2019-19781\"\n    ]"},"detection-complexity":{"description":"Measures the difficulty at which a vulnerable asset can be detected by a potential attacker.\n*Supported values:* `easy`, `moderate`, `hard`","type":"string","example":"easy"},"detection-method":{"description":"Indicates the method used to detect the issue.\n*Supported values:* `active`, `passive`","anyOf":[{"type":"string"},{"type":"null"}],"example":"active"},"enhanced-severity":{"description":"The severity grade (enhanced by CyCognito's Exploit Intelligence) that represents the potential damage that can be caused were an attacker to exploit this issue. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"critical"},"enhanced-severity-score":{"description":"The severity score of an issue (enhanced by CyCognito's Exploit Intelligence) that quantifies the potential damage that can be caused were an attacker to exploit this issue. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"number"},{"type":"null"}],"example":"10"},"environments":{"description":"Refers to IT environments, or the different hardware, software, infrastructure, and networks in which your assets are found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"Cryptographic Protocols\",\n      \"Operating Systems\",\n      \"Web Servers\"\n    ]"},"evidence":{"description":"Provides detailed proof supporting the detection of an issue by CyCognito, including validation steps and necessary information for verification.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n                                      \"evidence\": \"This field is designed to handle complex data structures, potentially involving multiple nested properties that vary from issue to issue.\",\n                                      \"more-details-link\": \"A URL to more details\",\n                                      \"curl-cmd\": \"The curl command\",\n                                      \"hostname\": \"The host name\"\n                                      }"},"exploitation-availability":{"description":"Indicates how easily an issue can be exploited. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"High"},"exploitation-complexity":{"description":"Measures the difficulty at which a vulnerable asset can be assessed and consequently exploited by a potential attacker, based on the complexity of the required exploitation methods. \n*Supported values:* `very easy`, `easy`, `moderate`, `hard`, `extreme`","anyOf":[{"type":"string"},{"type":"null"}],"example":"easy"},"exploitation-method":{"description":"A practical method or series of methods by which an attacker can compromise or exploit an issue on a particular asset which they have detected.","anyOf":[{"type":"string"},{"type":"null"}],"example":"No PoC"},"exploitation-score":{"description":"Specifies how difficult it would be for an attacker to exploit an asset upon detecting the issue, based on the method or methods that would be required to perform the attack. For example, a simple action like a brute-force exploitation would be considered a relatively easy exploitation method.","type":"integer","example":"5"},"first-detected":{"description":"The date and time at which CyCognito first detected the issue.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2023-01-26T13:12:57.253Z"},"id":{"description":"A unique ID for the instance of a particular issue on a specific asset. This is equivalent to the `issue_instance_id` value.","type":"string","example":"issue/webapp-1.1.1.1-cyc-js-jquery-2"},"investigating-since":{"description":"The date at which investigation on a specific issue began. \n*Format:* `YYYY-MM-DD`","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2023-08-21T13:12:57.253Z"},"investigation-status":{"description":"Indicates whether or not an asset or issue has undergone investigation by you or someone on your team.","anyOf":[{"type":"string","enum":["investigating","investigated","uninvestigated"]},{"type":"null"}],"example":"investigating"},"is-snoozed":{"description":"Indicates whether an issue has been snoozed—i.e., it has been hidden from view until a later date.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"iso27001-controls":{"description":"Refers to the compliance control number of the ISO 27001 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"iso27002-controls":{"description":"Refers to the compliance control number of the ISO 27002 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"issue-id":{"description":"An ID that identifies a particular issue—e.g., *CYC-TLS-HSTS-INSECURE*, *CVE-2022-33915*.","type":"string","example":"CYC-TLS-HSTS-INSECURE"},"issue-status":{"description":"Refers to the current status of the issue following the most recent data update (or \"scan\"). The following are the supported statuses and their definitions: \n * `new` – The issue was first detected up to 30 days before your latest data update. \n * `normal` – The issue is still outstanding. \n * `issue-removed` – The issue was not detected in the latest data update. \n * `asset-removed` – The issue's affected asset was not seen in the latest data update. \n * `asset-not-alive` – The issue's affected asset is not alive.","anyOf":[{"type":"string"},{"type":"string"},{"type":"null"}],"example":"new"},"issue-type":{"description":"The type of issue as classified by CyCognito—e.g., *abandoned asset*, *cryptographic vulnerability*, *exposed data*, *phishing threat*, *weak credentials*, etc.","type":"string","example":"Vulnerable Software"},"issue-types":{"description":"A list of issue types as classified by CyCognito—e.g., *abandoned asset*, *cryptographic vulnerability*, *exposed data*, *phishing threat*, *weak credentials*, etc.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Unsafe Authentication\",\n      \"Misconfiguration\",\n      \"Network Security\"\n    ]"},"last-detected":{"description":"The date and time at which CyCognito most recently detected the issue.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-06-17T07:02:04.181Z"},"locations":{"description":"The geographic locations (i.e., countries or regions) where the asset or issue is found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"USA\"\n    ]"},"mitre-attack-next-technique-name":{"description":"The MITRE ATT&CK technique that attackers are likely to use to continue their attack on a vulnerability.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Credential Access: Steal Web Session Cookie"},"mitre-attack-next-technique-subtitle":{"description":"Details the likely method or action under the next tactic from the MITRE ATT&CK Enterprise Matrix.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Steal Web Session Cookie"},"mitre-attack-next-technique-title":{"description":"Points to the subsequent tactic in the MITRE ATT&CK Enterprise Matrix that an adversary might pursue after successfully employing the current technique.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Credential Access"},"mitre-attack-technique-name":{"description":"The MITRE ATT&CK technique that is currently being used by attackers to exploit a vulnerability.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Initial Access: Exploit Public-Facing Application"},"mitre-attack-technique-subtitle":{"description":"Highlights the specific technique or method under the identified tactic in the MITRE ATT&CK Enterprise Matrix—e.g., *Spearphishing Attachment* under *Initial Access*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Exploit Public-Facing Application"},"mitre-attack-technique-title":{"description":"Indicates the currently prevailing tactic from the MITRE ATT&CK Enterprise Matrix that an attacker could potentially employ to exploit this issue—e.g., *Initial Access*, *Execution*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Initial Access"},"nist-800-171-controls":{"description":"Refers to the compliance control number of the NIST 800-171 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"3.3.5\",\n      \"3.12.2\",\n      \"3.11.2\"\n    ]"},"nist-800-53-controls":{"description":"Refers to the compliance control number of the NIST 800-53 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"CM-8\",\n      \"SI-2(3)\",\n      \"SI-4(16)\"\n    ]"},"organizations":{"description":"Specifies the organizations to whom the asset belongs, or those that are affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Gardens\"\n    ]"},"package":{"description":"Indicates package of the issue id.","anyOf":[{"type":"string"},{"type":"null"}],"example":"AST"},"pci-dss-controls":{"description":"Refers to the compliance control number of the PCI DSS, which is an information security standard used to handle credit card information.","anyOf":[{"type":"array","items":{"type":"string"},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"10.2.2\",\n      \"8.3.1\",\n      \"1.2.4\"\n    ]"},"platforms":{"description":"A list of platforms associated with an asset or issue.","type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"example":"[\n      \"Apache\",\n      \"CentOS\",\n      \"HTTP Protocol\",\n      \"TLS Protocol\"\n    ]"},"port":{"description":"Indicates the number of an open TCP port on the issue's affected IP asset.","anyOf":[{"type":"number"},{"type":"null"}],"example":"443"},"potential-impact":{"description":"A list of categories that describe what might happen if the issue is exploited—e.g., loss of integrity, loss of confidentiality, privacy violation, credential theft, etc.","type":"array","items":{"type":"string"},"example":"[\n      \"Loss of Confidentiality\",\n      \"Data Compromise\",\n      \"Network Breach\"\n    ]"},"potential-threat":{"description":"The threat that the issue might cause—e.g., *Authentication Bypass*, *Denial of Service*, *Exposed Data*, *Phishing Threat*, *Unsafe Authentication*, *Vulnerable Software*, etc.","type":"string","example":"Authentication Bypass"},"references":{"description":"A set of hyperlinks and accompanying text that help the user understand and validate the issue.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"https://support.citrix.com/article/CTX267027\",\n      \"https://nvd.nist.gov/vuln/detail/CVE-2019-19781\",\n      \"https://www.us-cert.gov/ncas/alerts/aa20-031a\",\n      \"https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2573391/russian-foreign-intelligence-service-exploiting-five-publicly-known-vulnerabili/\"\n    ]"},"region":{"description":"Refers to the regional location of the asset or issue. *Examples: Northern Africa*, *South-eastern Asia*, *Central America*, etc.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Central Asia"},"remediation-effort":{"description":"Refers to the type of effort required in order to remediate a particular issue.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Certificate Deployment"},"remediation-method":{"description":"The primary approach or strategy recommended to address a specific issue.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Patch"},"remediation-steps":{"description":"A list of instructions that describe how to resolve the issue.","type":"array","items":{"type":"string"},"example":"[\"Patch the NetScaler to the latest version.\",\"If a patch is not feasible, perform \\\"work-around\\\" mitigations per Citrix's instructions.\",\"Apply the necessary security patches provided by Citrix to fix the directory traversal vulnerability.\"]"},"resolved-at":{"description":"The date at which an issue was resolved.\n*Format:* `YYYY-MM-DD`","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2022-08-03T15:18:48.452Z"},"revalidation-request-time":{"description":"Indicates the date and time at which an issue revalidation was requested.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-08-03T15:18:48.452Z"},"revalidation-requested":{"description":"Indicates whether a revalidation request is currently in progress on a specific issue.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"severity":{"description":"Refers to an issue's seriousness, indicating how urgently it should be remediated, based on the potential damage that can be caused were an attacker to exploit it.\n*Supported values:* `low`, `medium`, `high`, `critical`.","type":"string","example":"critical"},"severity-change-reason":{"description":"The user-entered reason for changing an issue's severity.","anyOf":[{"type":"string"},{"type":"null"}],"example":"This issue is not actually considered severe by our team."},"severity-score":{"description":"The severity score of an issue that quantifies the potential damage that can be caused were an attacker to exploit this issue.","type":"number","example":"10"},"snooze-expiration":{"description":"The date at which a snoozed issue is set to expire.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-09-05T00:00:00.000Z"},"summary":{"description":"A brief description that summarizes the issue.","type":"string","example":"The website is using a vulnerable version of open source JS library"},"tags":{"description":"Custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"My tag\",\n      \"Another tag\"\n    ]"},"teams":{"description":"Lists the teams associated with the queried asset, issue, or organization. This property is available only in realms where the Teams feature is enabled.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Homes IT team\",\n      \"Onboarding IT\",\n      \"Project managers\"\n    ]"},"tech-owners":{"description":"The names of the technical owners of a specific asset or organization, or of an asset or organization affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"email":{"type":"string"},"org-name":{"type":"string"}},"required":["name","email","org-name"]}},{"type":"null"}],"example":"[\n      {\n        \"name\": \"Marty McFly\",\n        \"email\": \"marty@acme.com\",\n        \"org_id\": \"org/acme.org\",\n        \"org_name\": \"Acme Corporation\"\n      }\n    ]"},"title":{"description":"A name that briefly describes the issue—e.g., *HTTP Redirection Phishing Threat*, *Bruteforce and dictionary attacks allowed*, etc.","type":"string","example":"HTTP Redirection Phishing Threat"},"tools":{"description":"Provides a breakdown of all of the known validation and exploitation tools associated with an issue.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"modification-date":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"tool-download-url":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-id":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-description":{"anyOf":[{"type":"string"},{"type":"null"}]},"is-safe":{"anyOf":[{"type":"boolean"},{"type":"null"}]},"tool-references":{"$ref":"#/components/schemas/json.any?"},"tool-visibility":{"anyOf":[{"type":"string"},{"type":"null"}]},"source-url":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-type":{"anyOf":[{"type":"string"},{"type":"null"}]},"id":{"anyOf":[{"type":"string"},{"type":"null"}]},"relation-type":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-name":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-title":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-framework":{"anyOf":[{"type":"string"},{"type":"null"}]},"issue-id":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-instructions":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}]}},"required":["modification-date","tool-download-url","tool-id","tool-description","is-safe","tool-references","tool-visibility","source-url","tool-type","id","relation-type","tool-name","tool-title","tool-framework","issue-id","tool-instructions"],"additionalProperties":false},{"type":"null"}]}},{"type":"null"}],"example":"[{\"tool_title\":\"Citrix ADC (NetScaler) Directory Traversal Scanner\",\"tool_framework\":\"metasploit\",\"source_url\":\"https%3A%2F%2Fgithub.com%2Frapid7%2Fmetasploit-framework%2Fblob%2Fmaster%2Fmodules%2Fauxiliary%2Fscanner%2Fhttp%2Fcitrix_dir_traversal.rb\",\"tool_name\":\"auxiliary_scanner/http/citrix_dir_traversal\",\"tool_type\":\"security\",\"id\":\"metasploit:auxiliary/scanner/http/citrix_dir_traversal\",\"tool_instructions\":[\"Install the module as usual\",\"Start msfconsole\",\"Do: `use auxiliary/scanner/http/citrix_dir_traversal`\",\"Do: `set RHOSTS [IP]`\",\"Do: `run`\"],\"issue_id\":\"CVE-2019-19781\",\"tool_download_url\":null,\"is_safe\":true,\"modification_date\":\"2022-01-23T15:28:32Z\",\"tool_visibility\":\"public\",\"tool_references\":[\"CVE-2019-19781\",\"URL-https://web.archive.org/web/20200111095223/https://support.citrix.com/article/CTX267027/\",\"URL-https://swarm.ptsecurity.com/remote-code-execution-in-citrix-adc/\"],\"relation_type\":\"validation\",\"tool_description\":\"This module exploits a directory traversal vulnerability (CVE-2019-19781) within Citrix ADC (NetScaler). It requests the smb.conf file located in the /vpns/cfg directory by issuing the request /vpn/../vpns/cfg/smb.conf. It then checks if the server is vulnerable by looking for the presence of a \\\"[global]\\\" directive in smb.conf, which this file should always contain.\",\"tool_id\":\"metasploit:auxiliary/scanner/http/citrix_dir_traversal\"}]"},"underground-activity":{"description":"A history or summary of how the vulnerability on a particular issue has been exploited in the real world. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"\"CVE-2019-19781 was weaponized and productized. The actor pumpedkicks (aka mont4na) allegedly exploited CVE-2019-19781 and posted a list of targets vulnerable to CVE-2019-19781. Additionally, the actor BiosHell posted a link to an exploit for CVE-2019-19781.\""}}}}}}}}}},"/v1/resolved-issues":{"post":{"description":"Retrieve resolved issues based on set criteria. If you are comparing search results with the CyCognito app, note that <span name=\"kb-predefined-filters-api-explanation\">Predefined Filters</span> are not applied to data queried via the API by default.","security":[{"apiAuth":[]}],"summary":"Search resolved issues","tags":["Issues"],"parameters":[{"name":"count","in":"query","schema":{"type":"integer"},"required":false,"description":"Defines the number of results to be retrieved. Defaults to 10 with a max limit of 1000."},{"name":"advanced-search","in":"query","schema":{"type":"string"},"required":false,"description":"Allows you to input raw CyQL in order to query assets, issues, or organizations. See our <span name=\"kb-advanced-search-link\">Advanced Search</span> documentation for more details."},{"name":"offset","in":"query","schema":{"type":"integer"},"required":false,"description":"Sets the starting index for result retrieval, influenced by the `count` parameter. By default, `offset` is 0. Example: `offset` 3 with `count` 25 fetches results from index 75 to 99."},{"name":"q","in":"query","schema":{"type":"string"},"required":false,"description":"Specifies a search term for conducting a keyword-based search and retrieving data that matches your query."},{"name":"fields","in":"query","schema":{"type":"string"},"required":false,"description":"A comma-separated list specifying the desired entity properties to appear in the response. For more information, view the response example and schema."},{"name":"sort-by","in":"query","schema":{"type":"string"},"required":false,"description":"Specifies the field by which the results should be sorted."},{"name":"sort-order","in":"query","schema":{"type":"string","enum":["asc","desc"]},"required":false,"description":"Sorts the specified field in ascending or descending order."}],"requestBody":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"field":{"description":"Field to apply the filter on. Typically, any field present in the response can be used.","allOf":[{"type":"string"}],"example":"status"},"op":{"description":"Specifies the operation to apply on the desired field.\n            \n*Supported values:*  \n            \n* `is` – Searches for values that match the specified text exactly.  \n            \n* `not` – Searches for values that **do not** match the specified text exactly.  \n            \n* `in` – Filters entities for values that include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `not-in` – Filters entities for values that do not include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `only-in` – Filters **exclusively** so that only entities with the values specified will be searched. This operator is currently available only for the `organizations` and `tags` properties for assets and issues.  \n            \n* `between` – Searches by dates that are in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `not-between` – Searches by dates that are **not** in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `within-range` – Searches by number values that are in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[60,75]`.\n            \n* `not-within-range` – Searches by number values that are **not** in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[10,59]`.\n            \n* `within-last` – Searches for date values that are within the specified time frame in days—e.g., `64` is the value for 64 days.\n            \n* `not-within-last` – Searches for date values that are **not** within the specified time frame in days—e.g., `128` is the value for 128 days.\n            \n* `contains` – Searches for a specific substring within a string value.","allOf":[{"type":"string","enum":["is","not","in","not-in","only-in","key-of","not-key-of","between","not-between","within-range","not-within-range","contains","within-last","not-within-last"]}],"example":"in"},"values":{"description":"Specifies the value or values for the field.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"example":["new"]}},"required":["field","op","values"]}}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"advisories":{"description":"A list of curated pieces of threat intelligence that highlight vulnerabilities actively exploited by attackers in the wild. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"advisory":{"anyOf":[{"type":"string"},{"type":"null"}]},"url":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["advisory","url"]},{"type":"null"}]}},{"type":"null"}],"example":"[\n      {\n        \"entity_id\": \"issue/1.1.1.1-cve-2019-19781\",\n        \"ti_severity_score\": 10,\n        \"confidence\": 100,\n        \"advisory\": \"CISA | Known Exploited Vulnerabilities (KEV) catalog\",\n        \"realm_id\": \"acme-corporation\",\n        \"id\": \"issue/1.1.1.1-cve-2019-19781\",\n        \"type\": \"issue\",\n        \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\"\n      }\n    ]"},"affected-asset":{"description":"The unique ID of the asset with which the issue is associated.","type":"string","example":"webapp/1.1.1.1"},"affected-asset-tags":{"description":"Custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"My tag\",\n      \"Another tag\"\n    ]"},"affected-ptr-domains":{"description":"The PTR record associated with an IP address.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"r2.acme.net"},"asset-status":{"description":"The most recent status of an asset—e.g., Changed (was modified since the previous scan), New (was discovered during the most recent scan), Normal (nothing has changed since the previous scan), Removed (was not discovered in the most recent scan).","anyOf":[{"type":"string"},{"type":"null"}],"example":"changed"},"attacker-interest":{"description":"A measurement of how attractive an issue's affected asset may be to a potential attacker. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"High"},"attractiveness":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a higher-priority target for attackers, regardless of any issues it has.","anyOf":[{"type":"number"},{"type":"null"}],"example":"4"},"attractiveness-label":{"description":"A measurement of how attractive a particular asset may be to a potential attacker. For example, a server with an exposed RDP service is a higher-priority target for attackers, regardless of any issues it has.","anyOf":[{"type":"string"},{"type":"null"}],"example":"extreme"},"base-severity":{"description":"Refers to an issue's seriousness, indicating how urgently it should be remediated, based on the potential damage that can be caused were an attacker to exploit it. This property is available only for customers using Exploit Intelligence.\n*Supported values:* `low`, `medium`, `high`, `critical`","anyOf":[{"type":"string"},{"type":"null"}],"example":"high"},"base-severity-score":{"description":"The severity score, which is mostly inherited from the CVSS method for measuring of severity, and is the basis (about 80%) for the majority of the Enhanced Severity Score calculation. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"number"},{"type":"null"}],"example":"10"},"business-units":{"description":"[DEPRECATED] - The functional areas of the business that use the assets or the platform, or are affected by the issue.","type":"array","items":{"type":"string"},"example":"[\n      \"Marketing\"\n    ]"},"cis-controls":{"description":"Refers to the compliance control number of the CIS framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"7.6\",\n      \"3.11\",\n      \"7.5\",\n      \"16.7\"\n    ]"},"comment":{"description":"Custom text that can be added to the details of an asset or issue. Comments are typically used to make notes or personal descriptions regarding the significance of a particular asset or issue.","anyOf":[{"type":"object","properties":{"content":{"type":"string"},"last-update":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}},"required":["content","last-update"]},{"type":"null"}],"example":"Reviewed by Gary"},"comments":{"description":"Comments is a collection of custom text entries, providing the ability to record multiple notes or personal descriptions related to an asset or issue. Unlike the single 'comment' field, this allows for a running log or more detailed commentary over time.","anyOf":[{"type":"array","items":{"type":"object","properties":{"content":{"type":"string"},"created-by-name":{"anyOf":[{"type":"string"},{"type":"null"}]},"last-update":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["content","created-by-name","last-update"]}},{"type":"null"}],"example":"Reviewed by Gary"},"compliance-violations":{"description":"Refers to specific compliance frameworks that have been violated.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"NIST-800-171\",\n      \"CIS\",\n      \"ISO27001\"\n    ]"},"confidence":{"description":"Refers to the probability that an issue is valid and relevant on a scale of 0 to 100, where 0 indicates no confidence, and 100 indicates absolute confidence.","anyOf":[{"type":"number"},{"type":"null"}],"example":"90"},"confidence-level":{"description":"“Refers to the probability that an issue is valid and relevant. Possible values (from most probable to the least) are Confirmed, Likely, Potential, and Inconclusive.","anyOf":[{"type":"string"},{"type":"null"}],"example":"confirmed"},"continent":{"description":"The geographical continent in which the asset or issue is located.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Americas"},"cve-ids":{"description":"Refers to the specific CVE-ID number of the issue as established by the Mitre Corporation.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"CVE-2019-19781\"\n    ]"},"detection-complexity":{"description":"Measures the difficulty at which a vulnerable asset can be detected by a potential attacker.\n*Supported values:* `easy`, `moderate`, `hard`","type":"string","example":"easy"},"detection-method":{"description":"Indicates the method used to detect the issue.\n*Supported values:* `active`, `passive`","anyOf":[{"type":"string"},{"type":"null"}],"example":"active"},"enhanced-severity":{"description":"The severity grade (enhanced by CyCognito's Exploit Intelligence) that represents the potential damage that can be caused were an attacker to exploit this issue. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"critical"},"enhanced-severity-score":{"description":"The severity score of an issue (enhanced by CyCognito's Exploit Intelligence) that quantifies the potential damage that can be caused were an attacker to exploit this issue. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"number"},{"type":"null"}],"example":"10"},"environments":{"description":"Refers to IT environments, or the different hardware, software, infrastructure, and networks in which your assets are found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"Cryptographic Protocols\",\n      \"Operating Systems\",\n      \"Web Servers\"\n    ]"},"evidence":{"description":"Provides detailed proof supporting the detection of an issue by CyCognito, including validation steps and necessary information for verification.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"{\n                                      \"evidence\": \"This field is designed to handle complex data structures, potentially involving multiple nested properties that vary from issue to issue.\",\n                                      \"more-details-link\": \"A URL to more details\",\n                                      \"curl-cmd\": \"The curl command\",\n                                      \"hostname\": \"The host name\"\n                                      }"},"exploitation-availability":{"description":"Indicates how easily an issue can be exploited. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"High"},"exploitation-complexity":{"description":"Measures the difficulty at which a vulnerable asset can be assessed and consequently exploited by a potential attacker, based on the complexity of the required exploitation methods. \n*Supported values:* `very easy`, `easy`, `moderate`, `hard`, `extreme`","anyOf":[{"type":"string"},{"type":"null"}],"example":"easy"},"exploitation-method":{"description":"A practical method or series of methods by which an attacker can compromise or exploit an issue on a particular asset which they have detected.","anyOf":[{"type":"string"},{"type":"null"}],"example":"No PoC"},"exploitation-score":{"description":"Specifies how difficult it would be for an attacker to exploit an asset upon detecting the issue, based on the method or methods that would be required to perform the attack. For example, a simple action like a brute-force exploitation would be considered a relatively easy exploitation method.","type":"integer","example":"5"},"first-detected":{"description":"The date and time at which CyCognito first detected the issue.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2023-01-26T13:12:57.253Z"},"id":{"description":"A unique ID for the instance of a particular issue on a specific asset. This is equivalent to the `issue_instance_id` value.","type":"string","example":"issue/webapp-1.1.1.1-cyc-js-jquery-2"},"investigating-since":{"description":"The date at which investigation on a specific issue began. \n*Format:* `YYYY-MM-DD`","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2023-08-21T13:12:57.253Z"},"investigation-status":{"description":"Indicates whether or not an asset or issue has undergone investigation by you or someone on your team.","anyOf":[{"type":"string","enum":["investigating","investigated","uninvestigated"]},{"type":"null"}],"example":"investigating"},"is-snoozed":{"description":"Indicates whether an issue has been snoozed—i.e., it has been hidden from view until a later date.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"iso27001-controls":{"description":"Refers to the compliance control number of the ISO 27001 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"iso27002-controls":{"description":"Refers to the compliance control number of the ISO 27002 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}]},"issue-id":{"description":"An ID that identifies a particular issue—e.g., *CYC-TLS-HSTS-INSECURE*, *CVE-2022-33915*.","type":"string","example":"CYC-TLS-HSTS-INSECURE"},"issue-status":{"description":"Refers to the current status of the issue following the most recent data update (or \"scan\"). The following are the supported statuses and their definitions: \n * `new` – The issue was first detected up to 30 days before your latest data update. \n * `normal` – The issue is still outstanding. \n * `issue-removed` – The issue was not detected in the latest data update. \n * `asset-removed` – The issue's affected asset was not seen in the latest data update. \n * `asset-not-alive` – The issue's affected asset is not alive.","anyOf":[{"type":"string"},{"type":"string"},{"type":"null"}],"example":"new"},"issue-type":{"description":"The type of issue as classified by CyCognito—e.g., *abandoned asset*, *cryptographic vulnerability*, *exposed data*, *phishing threat*, *weak credentials*, etc.","type":"string","example":"Vulnerable Software"},"issue-types":{"description":"A list of issue types as classified by CyCognito—e.g., *abandoned asset*, *cryptographic vulnerability*, *exposed data*, *phishing threat*, *weak credentials*, etc.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Unsafe Authentication\",\n      \"Misconfiguration\",\n      \"Network Security\"\n    ]"},"last-detected":{"description":"The date and time at which CyCognito most recently detected the issue.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-06-17T07:02:04.181Z"},"locations":{"description":"The geographic locations (i.e., countries or regions) where the asset or issue is found.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"USA\"\n    ]"},"mitre-attack-next-technique-name":{"description":"The MITRE ATT&CK technique that attackers are likely to use to continue their attack on a vulnerability.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Credential Access: Steal Web Session Cookie"},"mitre-attack-next-technique-subtitle":{"description":"Details the likely method or action under the next tactic from the MITRE ATT&CK Enterprise Matrix.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Steal Web Session Cookie"},"mitre-attack-next-technique-title":{"description":"Points to the subsequent tactic in the MITRE ATT&CK Enterprise Matrix that an adversary might pursue after successfully employing the current technique.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Credential Access"},"mitre-attack-technique-name":{"description":"The MITRE ATT&CK technique that is currently being used by attackers to exploit a vulnerability.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Initial Access: Exploit Public-Facing Application"},"mitre-attack-technique-subtitle":{"description":"Highlights the specific technique or method under the identified tactic in the MITRE ATT&CK Enterprise Matrix—e.g., *Spearphishing Attachment* under *Initial Access*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Exploit Public-Facing Application"},"mitre-attack-technique-title":{"description":"Indicates the currently prevailing tactic from the MITRE ATT&CK Enterprise Matrix that an attacker could potentially employ to exploit this issue—e.g., *Initial Access*, *Execution*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Initial Access"},"nist-800-171-controls":{"description":"Refers to the compliance control number of the NIST 800-171 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"3.3.5\",\n      \"3.12.2\",\n      \"3.11.2\"\n    ]"},"nist-800-53-controls":{"description":"Refers to the compliance control number of the NIST 800-53 framework.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"CM-8\",\n      \"SI-2(3)\",\n      \"SI-4(16)\"\n    ]"},"organizations":{"description":"Specifies the organizations to whom the asset belongs, or those that are affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Gardens\"\n    ]"},"package":{"description":"Indicates package of the issue id.","anyOf":[{"type":"string"},{"type":"null"}],"example":"AST"},"pci-dss-controls":{"description":"Refers to the compliance control number of the PCI DSS, which is an information security standard used to handle credit card information.","anyOf":[{"type":"array","items":{"type":"string"},"uniqueItems":true},{"type":"null"}],"example":"[\n      \"10.2.2\",\n      \"8.3.1\",\n      \"1.2.4\"\n    ]"},"platforms":{"description":"A list of platforms associated with an asset or issue.","type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"example":"[\n      \"Apache\",\n      \"CentOS\",\n      \"HTTP Protocol\",\n      \"TLS Protocol\"\n    ]"},"port":{"description":"Indicates the number of an open TCP port on the issue's affected IP asset.","anyOf":[{"type":"number"},{"type":"null"}],"example":"443"},"potential-impact":{"description":"A list of categories that describe what might happen if the issue is exploited—e.g., loss of integrity, loss of confidentiality, privacy violation, credential theft, etc.","type":"array","items":{"type":"string"},"example":"[\n      \"Loss of Confidentiality\",\n      \"Data Compromise\",\n      \"Network Breach\"\n    ]"},"potential-threat":{"description":"The threat that the issue might cause—e.g., *Authentication Bypass*, *Denial of Service*, *Exposed Data*, *Phishing Threat*, *Unsafe Authentication*, *Vulnerable Software*, etc.","type":"string","example":"Authentication Bypass"},"references":{"description":"A set of hyperlinks and accompanying text that help the user understand and validate the issue.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n      \"https://support.citrix.com/article/CTX267027\",\n      \"https://nvd.nist.gov/vuln/detail/CVE-2019-19781\",\n      \"https://www.us-cert.gov/ncas/alerts/aa20-031a\",\n      \"https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2573391/russian-foreign-intelligence-service-exploiting-five-publicly-known-vulnerabili/\"\n    ]"},"region":{"description":"Refers to the regional location of the asset or issue. *Examples: Northern Africa*, *South-eastern Asia*, *Central America*, etc.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"Central Asia"},"remediation-effort":{"description":"Refers to the type of effort required in order to remediate a particular issue.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Certificate Deployment"},"remediation-method":{"description":"The primary approach or strategy recommended to address a specific issue.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Patch"},"remediation-steps":{"description":"A list of instructions that describe how to resolve the issue.","type":"array","items":{"type":"string"},"example":"[\"Patch the NetScaler to the latest version.\",\"If a patch is not feasible, perform \\\"work-around\\\" mitigations per Citrix's instructions.\",\"Apply the necessary security patches provided by Citrix to fix the directory traversal vulnerability.\"]"},"resolved-at":{"description":"The date at which an issue was resolved.\n*Format:* `YYYY-MM-DD`","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2022-08-03T15:18:48.452Z"},"revalidation-request-time":{"description":"Indicates the date and time at which an issue revalidation was requested.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-08-03T15:18:48.452Z"},"revalidation-requested":{"description":"Indicates whether a revalidation request is currently in progress on a specific issue.","anyOf":[{"type":"boolean"},{"type":"null"}],"example":"true"},"severity":{"description":"Refers to an issue's seriousness, indicating how urgently it should be remediated, based on the potential damage that can be caused were an attacker to exploit it.\n*Supported values:* `low`, `medium`, `high`, `critical`.","type":"string","example":"critical"},"severity-change-reason":{"description":"The user-entered reason for changing an issue's severity.","anyOf":[{"type":"string"},{"type":"null"}],"example":"This issue is not actually considered severe by our team."},"severity-score":{"description":"The severity score of an issue that quantifies the potential damage that can be caused were an attacker to exploit this issue.","type":"number","example":"10"},"snooze-expiration":{"description":"The date at which a snoozed issue is set to expire.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-09-05T00:00:00.000Z"},"summary":{"description":"A brief description that summarizes the issue.","type":"string","example":"The website is using a vulnerable version of open source JS library"},"tags":{"description":"Custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"My tag\",\n      \"Another tag\"\n    ]"},"teams":{"description":"Lists the teams associated with the queried asset, issue, or organization. This property is available only in realms where the Teams feature is enabled.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Homes IT team\",\n      \"Onboarding IT\",\n      \"Project managers\"\n    ]"},"tech-owners":{"description":"The names of the technical owners of a specific asset or organization, or of an asset or organization affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"email":{"type":"string"},"org-name":{"type":"string"}},"required":["name","email","org-name"]}},{"type":"null"}],"example":"[\n      {\n        \"name\": \"Marty McFly\",\n        \"email\": \"marty@acme.com\",\n        \"org_id\": \"org/acme.org\",\n        \"org_name\": \"Acme Corporation\"\n      }\n    ]"},"title":{"description":"A name that briefly describes the issue—e.g., *HTTP Redirection Phishing Threat*, *Bruteforce and dictionary attacks allowed*, etc.","type":"string","example":"HTTP Redirection Phishing Threat"},"tools":{"description":"Provides a breakdown of all of the known validation and exploitation tools associated with an issue.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"object","properties":{"modification-date":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"tool-download-url":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-id":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-description":{"anyOf":[{"type":"string"},{"type":"null"}]},"is-safe":{"anyOf":[{"type":"boolean"},{"type":"null"}]},"tool-references":{"$ref":"#/components/schemas/json.any?"},"tool-visibility":{"anyOf":[{"type":"string"},{"type":"null"}]},"source-url":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-type":{"anyOf":[{"type":"string"},{"type":"null"}]},"id":{"anyOf":[{"type":"string"},{"type":"null"}]},"relation-type":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-name":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-title":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-framework":{"anyOf":[{"type":"string"},{"type":"null"}]},"issue-id":{"anyOf":[{"type":"string"},{"type":"null"}]},"tool-instructions":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}]}},"required":["modification-date","tool-download-url","tool-id","tool-description","is-safe","tool-references","tool-visibility","source-url","tool-type","id","relation-type","tool-name","tool-title","tool-framework","issue-id","tool-instructions"],"additionalProperties":false},{"type":"null"}]}},{"type":"null"}],"example":"[{\"tool_title\":\"Citrix ADC (NetScaler) Directory Traversal Scanner\",\"tool_framework\":\"metasploit\",\"source_url\":\"https%3A%2F%2Fgithub.com%2Frapid7%2Fmetasploit-framework%2Fblob%2Fmaster%2Fmodules%2Fauxiliary%2Fscanner%2Fhttp%2Fcitrix_dir_traversal.rb\",\"tool_name\":\"auxiliary_scanner/http/citrix_dir_traversal\",\"tool_type\":\"security\",\"id\":\"metasploit:auxiliary/scanner/http/citrix_dir_traversal\",\"tool_instructions\":[\"Install the module as usual\",\"Start msfconsole\",\"Do: `use auxiliary/scanner/http/citrix_dir_traversal`\",\"Do: `set RHOSTS [IP]`\",\"Do: `run`\"],\"issue_id\":\"CVE-2019-19781\",\"tool_download_url\":null,\"is_safe\":true,\"modification_date\":\"2022-01-23T15:28:32Z\",\"tool_visibility\":\"public\",\"tool_references\":[\"CVE-2019-19781\",\"URL-https://web.archive.org/web/20200111095223/https://support.citrix.com/article/CTX267027/\",\"URL-https://swarm.ptsecurity.com/remote-code-execution-in-citrix-adc/\"],\"relation_type\":\"validation\",\"tool_description\":\"This module exploits a directory traversal vulnerability (CVE-2019-19781) within Citrix ADC (NetScaler). It requests the smb.conf file located in the /vpns/cfg directory by issuing the request /vpn/../vpns/cfg/smb.conf. It then checks if the server is vulnerable by looking for the presence of a \\\"[global]\\\" directive in smb.conf, which this file should always contain.\",\"tool_id\":\"metasploit:auxiliary/scanner/http/citrix_dir_traversal\"}]"},"underground-activity":{"description":"A history or summary of how the vulnerability on a particular issue has been exploited in the real world. This property is available only for customers using Exploit Intelligence.","anyOf":[{"type":"string"},{"type":"null"}],"example":"\"CVE-2019-19781 was weaponized and productized. The actor pumpedkicks (aka mont4na) allegedly exploited CVE-2019-19781 and posted a list of targets vulnerable to CVE-2019-19781. Additionally, the actor BiosHell posted a link to an exploit for CVE-2019-19781.\""}}}}}}}}}},"/v1/orgs":{"post":{"description":"Fetch organizations based on given criteria. If you are comparing search results with the CyCognito app, note that <span name=\"kb-predefined-filters-api-explanation\">Predefined Filters</span> are not applied to data queried via the API by default.","security":[{"apiAuth":[]}],"summary":"Retrieve organizations","tags":["Organizations"],"parameters":[{"name":"fields","in":"query","schema":{"type":"string"},"required":false,"description":"Comma-separated list of desired organization attributes. For more information, view the response example and schema."},{"name":"advanced-search","in":"query","schema":{"type":"string"},"required":false,"description":"Allows you to input raw CyQL in order to query assets, issues, or organizations. See our <span name=\"kb-advanced-search-link\">Advanced Search</span> documentation for more details."}],"requestBody":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"field":{"description":"Field to apply the filter on. Typically, any field present in the response can be used.","allOf":[{"type":"string"}],"example":"origin"},"op":{"description":"Specifies the operation to apply on the desired field.\n            \n*Supported values:*  \n            \n* `is` – Searches for values that match the specified text exactly.  \n            \n* `not` – Searches for values that **do not** match the specified text exactly.  \n            \n* `in` – Filters entities for values that include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `not-in` – Filters entities for values that do not include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `only-in` – Filters **exclusively** so that only entities with the values specified will be searched. This operator is currently available only for the `organizations` and `tags` properties for assets and issues.  \n            \n* `between` – Searches by dates that are in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `not-between` – Searches by dates that are **not** in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `within-range` – Searches by number values that are in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[60,75]`.\n            \n* `not-within-range` – Searches by number values that are **not** in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[10,59]`.\n            \n* `within-last` – Searches for date values that are within the specified time frame in days—e.g., `64` is the value for 64 days.\n            \n* `not-within-last` – Searches for date values that are **not** within the specified time frame in days—e.g., `128` is the value for 128 days.\n            \n* `contains` – Searches for a specific substring within a string value.","allOf":[{"type":"string","enum":["is","not","in","not-in","only-in","key-of","not-key-of","between","not-between","within-range","not-within-range","contains","within-last","not-within-last"]}],"example":"in"},"values":{"description":"Specifies the value or values for the field.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"example":["discovered"]}},"required":["field","op","values"]}}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"assets-count":{"description":"Represents the total number of assets attributed to the organization.","anyOf":[{"type":"integer"},{"type":"null"}],"example":"10384"},"assets-count-by-security-grade":{"description":"Provides a breakdown of assets based on their security grades, displaying the total number of assets for each grade (A, B, C, D, and F).","anyOf":[{"type":"object","properties":{"a":{"type":"integer"},"b":{"type":"integer"},"c":{"type":"integer"},"d":{"type":"integer"},"f":{"type":"integer"}},"required":["a","b","c","d","f"]},{"type":"null"}],"example":"{\n      \"a\": 23456,\n      \"b\": 1234,\n      \"c\": 345,\n      \"d\": 56,\n      \"f\": 78\n    }"},"attractiveness-label":{"description":"Represents the organization's appeal to potential attackers. Ranging from very low to extreme, it essentially mirrors the highest attractiveness level among its attributed assets. For instance, an organization with assets showcasing high-risk services might have elevated attractiveness.","anyOf":[{"type":"string"},{"type":"string"},{"type":"null"}],"example":"extreme"},"country":{"description":"The two-letter country code in which the organization's underlying IP range is currently hosted.","anyOf":[{"type":"string"},{"type":"null"}],"example":"US"},"discoverability":{"description":"Represents the organization's amount of exposure, or how easily an attacker can identify and link the organization to your enterprise. Ranging from low to extreme, it essentially mirrors the highest discoverability level among its attributed assets.","anyOf":[{"type":"string"},{"type":"string"},{"type":"null"}],"example":"extreme"},"discovery-path":{"description":"The sequence of steps involved in discovering a specific asset or organization in your attack surface. It details each step and the connections between them, illustrating how one step leads to the subsequent step in the discovery process.","anyOf":[{"type":"array","items":{"type":"object","properties":{"src":{"type":"string"},"dest":{"type":"string"},"movement-type":{"$ref":"#/components/schemas/json.any?"},"movement-data":{"$ref":"#/components/schemas/json.any?"}},"required":["src","dest","movement-type","movement-data"]}},{"type":"null"}],"example":"[{\"dest\":\"org/acme-corporation\",\"movement_data\":{\"sources\":[]},\"movement_type\":\"default\",\"src\":\"_ENTRY_\"},{\"dest\":\"ip/1.1.1.1\",\"movement_data\":{\"probability\":1,\"relation_id\":\"org-relation/acme-corporation-has-subsidiary-acme-jubilee-limited\",\"sources\":[]},\"movement_type\":\"relation\",\"src\":\"org/acme-corporation\"}]"},"domain":{"description":"The domain name associated with the organization—e.g., *studio.acme.com*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"studio.acme.com"},"first-seen":{"description":"The date and time at which CyCognito's discovery first identified the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2022-08-03T15:18:48.907Z"},"id":{"description":"A unique string that identifies the organization in your CyCognito platform.","anyOf":[{"$ref":"#/components/schemas/json.any?"},{"type":"null"}],"example":"org/acme.org"},"issues-count":{"description":"The number of issues found on a particular asset or organization.","anyOf":[{"type":"integer"},{"type":"null"}],"example":"7"},"issues-count-by-severity":{"description":"The number of issues found on a particular organization, distributed according to severity.","anyOf":[{"type":"object","properties":{"critical":{"type":"integer"},"high":{"type":"integer"},"medium":{"type":"integer"},"low":{"type":"integer"}},"required":["critical","high","medium","low"],"additionalProperties":false},{"type":"null"}],"example":"{\n      \"critical\": 23,\n      \"high\": 78,\n      \"low\": 234,\n      \"medium\": 101\n    }"},"labels":{"description":"Comprises keywords closely linked to the organization. These keywords aid in formulating hypotheses about organizations and in identifying associated domains and IP ranges.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Associates, Inc.\",\n      \"Acme AG\"\n    ]"},"last-seen":{"description":"The date and time at which CyCognito's discovery most recently identified the organization.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-08-04T09:52:00.935Z"},"name":{"description":"The name of the organization.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Acme Organization"},"origin":{"description":"Indicates whether the organization was discovered (i.e., it was identified based on CyCognito's discovery algorithms), or custom (i.e., a user created the organization manually).","anyOf":[{"type":"string"},{"type":"null"}],"example":"Discovered"},"probability":{"description":"Represents the likelihood that an organization belongs to your enterprise.","anyOf":[{"type":"number"},{"type":"null"}],"example":"100"},"references":{"description":"Contains details linked to the organization's Wikipedia, Crunchbase, and LinkedIn pages. ","anyOf":[{"type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"url":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["type","url"]}},{"type":"null"}],"example":"[\n      {\n        \"type\": \"linkedin\",\n        \"url\": \"https://us.linkedin.com/in/greenwood-yorke-22513\"\n      },\n      {\n        \"type\": \"crunchbase\",\n        \"url\": \"https://www.crunchbase.com/organization/acmecorporation\"\n      }\n    ]"},"security-grade":{"description":"Represents the overall security grade of the organization as an asset group. Unlike traditional methods, CyCognito determines this grade by analyzing various factors across the asset spectrum, not solely relying on the asset with the lowest grade in the group.","anyOf":[{"type":"string"},{"type":"null"}],"example":"C"},"security-score":{"description":"Represents the overall security score of the organization as an asset group. Unlike traditional methods, CyCognito determines this numerical score by analyzing various factors across the asset spectrum, not solely relying on the asset with the lowest security score in the group.","anyOf":[{"type":"number"},{"type":"null"}],"example":"66"},"severe-issues-count":{"description":"Refers to the number of severe issues (those with a severity level of *high* to *critical*) across all of the assets attributed to the organization.","anyOf":[{"type":"integer"},{"type":"null"}],"example":"62"},"sources":{"description":"Contains URLs related to the services or origins from which the organization data was gathered.","anyOf":[{"type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"name":{"$ref":"#/components/schemas/json.any?"},"value":{"type":"string"}},"required":["type","name","value"]}},{"type":"null"}],"example":"[\n      {\n        \"name\": \"google-search\",\n        \"type\": \"google-search\",\n        \"value\": \"http://google.com/search?q=Acme+Associates+AS&num=10&hl=en&gl=US\"\n      },\n      {\n        \"name\": \"Acme Associates AS\",\n        \"type\": \"s&p-org\",\n        \"value\": \"s&p-org\"\n      }\n    ]"},"teams":{"description":"Lists the teams associated with the queried asset, issue, or organization. This property is available only in realms where the Teams feature is enabled.","anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"example":"[\n      \"Acme Homes IT team\",\n      \"Onboarding IT\",\n      \"Project managers\"\n    ]"},"tech-owners":{"description":"The names of the technical owners of a specific asset or organization, or of an asset or organization affected by a specific issue.","anyOf":[{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"email":{"type":"string"},"org-name":{"type":"string"}},"required":["name","email","org-name"]}},{"type":"null"}],"example":"[\n      {\n        \"name\": \"Marty McFly\",\n        \"email\": \"marty@acme.com\",\n        \"org_id\": \"org/acme.org\",\n        \"org_name\": \"Acme Corporation\"\n      }\n    ]"}}}}}}}}}},"/v1/orgs/org-mgmt":{"post":{"description":"Attribute or unattribute assets from specified organizations.","security":[{"apiAuth":[]}],"summary":"Adjust organization attributions","tags":["Organizations"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"asset-ids":{"description":"A comma-separated list in which each item contains the unique ID for the assets whose organization attributions you would like to modify. The unique ID corresponds to the `id` field (from the *Retrieve assets* response) and should be in the format `&lt;asset_type&gt;/&lt;asset_id&gt;`.  \n   \n*Examples:* `ip/1.1.1.1`, `domain/acme.com`","type":"array","items":{"type":"string"},"example":["ip/1.2.3.4","ip/127.0.0.1","domain/example.com"]},"orgs-to-add":{"description":"A comma-separated list containing the names of the organizations to attribute the assets to.","type":"array","items":{"type":"string"},"example":["org1","org4"]},"orgs-to-remove":{"description":"A comma-separated list containing the names of the organizations to unattribute the assets to.","type":"array","items":{"type":"string"},"example":["org2","org3"]},"propagate":{"description":"Indicates whether the actions should propagate to other assets.","type":"boolean","example":true}},"required":["asset-ids"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"status":{"description":"When the response status is 200, the user's action to adjust organizational attributions has been successfully submitted. It always displays the string *User action submitted*.","type":"string","example":"User action submitted"}},"required":["status"]}}}}}}},"/v1/cloud-environments":{"get":{"description":"Retrieve a list of cloud environments.","security":[{"apiAuth":[]}],"summary":"Retrieve multiple cloud environment data","tags":["Cloud Connectors"],"responses":{"200":{"content":{"application/json":{"schema":{"anyOf":[{"type":"array","items":{"type":"object","properties":{"id":{"description":"A unique identifier for the cloud environment. This ID can be extrapolated from the `cloud-env-id` field (from the *Add new connector* response) by removing the `cloud-env/` prefix.","type":"string","example":"12312-3213-12341"},"test-status":{"description":"Indicates whether the connector was configured correctly or not.","type":"string","example":"Success"},"provider":{"description":"The name of the cloud service provider (e.g., AWS). **Note:** Currently only AWS is supported.","type":"string","enum":["AWS","Azure","GCP","Cloudflare","WIZ"],"example":"AWS"},"cloud-env-name":{"description":"A name used solely for identifying the cloud connector and the environment connected to it.","type":"string","example":"Acme AWS cloud environment"}},"required":["id","test-status","provider","cloud-env-name"]}},{"type":"object","properties":{"exception":{"description":"Indicates whether the specified cloud environment exists or not.","type":"string"}},"required":["exception"]}]}}}}}},"post":{"description":"Create a new cloud environment for the specified provider. **Note:** This endpoint currently only supports setting up connectors for single AWS accounts. The accompanying YAML script can be downloaded via the link generated by the *Get YAML for AWS* API endpoint.","security":[{"apiAuth":[]}],"summary":"Add new AWS connector","tags":["Cloud Connectors"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"connector-name":{"description":"A name used solely for identifying the cloud connector and the environment connected to it. It is recommended to provide a unique name which helps identify the cloud environment to which it is connected. Cloud connector names are limited to 50 characters, and may contain only alphanumeric characters and the following special characters: `-_()[]`","type":"string"},"organization-attribution":{"description":"The name of the organization that all cloud-fetched assets will be attributed to.","type":"string"},"provider":{"description":"The name of the cloud service provider (i.e., AWS).","type":"string","enum":["aws"]},"provider-details":{"description":"Details specific to the provider.","type":"object","properties":{"account-id":{"description":"Your AWS account ID. Learn how to find this 12-digit number by reading the <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html#FindingYourAWSId\">AWS documentation</a>.","type":"string"},"arn":{"description":"The Amazon Resource Name (ARN). The formatted [ARN](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) will look like: `arn:aws:iam::123456789012:role/CyCognitoCloudConnector-a123b4567c`.","type":"string"}},"required":["account-id","arn"]}},"required":["connector-name","organization-attribution","provider","provider-details"],"example":"{\n  \"connector-name\": \"Acme AWS Cloud Environment\",\n  \"organization-attribution\": \"Acme Corporation\",\n  \"provider\": \"aws\",\n  \"provider-details\": {\n    \"account-id\": \"123456789012\",\n    \"arn\": \"arn:aws:iam::123456789012:role/CyCognitoCloudConnector-a123b4567c\"\n  }\n}"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"anyOf":[{"type":"object","properties":{"cloud-env-id":{"description":"A unique identifier for the cloud environment. This ID can be extrapolated from the `cloud-env-id` field (from the *Add new connector* response) by removing the `cloud-env/` prefix (e.g., `12312-3213-12341`).","type":"string"}},"required":["cloud-env-id"]},{"type":"object","properties":{"error":{"description":"A message describing the reason for the failure.","type":"string"}},"required":["error"]}]}}}}}}},"/v1/cloud-environments/script":{"post":{"description":"Generate the YAML script required for creating new AWS connectors.","security":[{"apiAuth":[]}],"summary":"Get YAML for AWS","tags":["Cloud Connectors"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"provider":{"description":"The name of the cloud service provider (i.e., AWS).","type":"string","enum":["aws"]},"privilege":{"description":"Determines the permission level granted to the Connector ('regular' or 'least').","type":"string","enum":["regular","least"]}},"required":["provider","privilege"]}}}},"responses":{"200":{}}}},"/v1/cloud-environments/{cloud-env-id}":{"get":{"description":"Fetch data for a single cloud environment.","security":[{"apiAuth":[]}],"summary":"Retrieve single cloud environment data","tags":["Cloud Connectors"],"parameters":[{"name":"cloud-env-id","in":"path","schema":{"type":"string"},"required":true,"description":"A unique identifier for the cloud environment. This ID can be extrapolated from the `cloud-env-id` field (from the *Add new connector* response) by removing the `cloud-env/` prefix (e.g., `12312-3213-12341`)."}],"responses":{"200":{"content":{"application/json":{"schema":{"anyOf":[{"type":"object","properties":{"id":{"description":"A unique identifier for the cloud environment. This ID can be extrapolated from the `cloud-env-id` field (from the *Add new connector* response) by removing the `cloud-env/` prefix.","type":"string","example":"12312-3213-12341"},"test-status":{"description":"Indicates whether the connector was configured correctly or not.","type":"string","example":"Success"},"provider":{"description":"The name of the cloud service provider (e.g., AWS). **Note:** Currently only AWS is supported.","type":"string","enum":["AWS","Azure","GCP","Cloudflare","WIZ"],"example":"AWS"},"cloud-env-name":{"description":"A name used solely for identifying the cloud connector and the environment connected to it.","type":"string","example":"Acme AWS cloud environment"}},"required":["id","test-status","provider","cloud-env-name"]},{"type":"object","properties":{"exception":{"description":"Indicates whether the specified cloud environment exists or not.","type":"string"}},"required":["exception"]}]}}}}}}},"/v1/cloud-environments/{cloud-env-id}/test-connector":{"put":{"description":"Trigger a test to determine whether the specified cloud connector is configured correctly.","security":[{"apiAuth":[]}],"summary":"Test connector","tags":["Cloud Connectors"],"parameters":[{"name":"cloud-env-id","in":"path","schema":{"type":"string"},"required":true,"description":"A unique identifier for the cloud environment. This ID can be extrapolated from the `cloud-env-id` field (from the *Add new connector* response) by removing the `cloud-env/` prefix (e.g., `12312-3213-12341`)."}],"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"message":{"description":"A message indicating the result of the test.","type":"string","example":"Cloud environment test completed successfully."},"status":{"description":"The status of the test, either *completed* or *failed*.","type":"string","enum":["completed","failed"],"example":"completed"}},"required":["message","status"]}}}}}}},"/v1/realm":{"get":{"description":"Retrieve the date of the last data update, as well as the data update cadence (weekly, bi-weekly, monthly, or daily).","security":[{"apiAuth":[]}],"summary":"Last data update","tags":["Realm"],"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"id":{"description":"A unique identifier for the realm.","type":"string","example":"12312-3213-12341"},"full-scan-cadence":{"description":"Indicates the frequency at which realm data is being updated.","type":"string","enum":["bi-weekly","weekly","monthly","daily","N/A"],"example":"bi-weekly"},"last-full-update":{"description":"Indicates the date and time at which the realm received a data update.","type":"string","example":"Jun 21, 2024"},"last-daily-update":{"description":"Indicates the date and time at which the realm received the last data update.","type":"string","example":"Jun 21, 2024"},"assets-added-in-latest-baseline-update":{"description":"Indicates assets added in the latest baseline update. This data available for realms with Daily ports and services and without continuous updates","type":"integer","example":"300"},"ips-with-new-ports-in-last-day":{"description":"Indicates ips with new ports in last day. This data available for realms with Daily ports and services and without continuous updates","type":"integer","example":"100"},"assets-discovered-in-last-day":{"description":"Indicates assets discovered in the last day. This data available only for realms with continuous updates","type":"integer","example":"200"},"issues-detected-in-last-day":{"description":"Indicates on issues detected in the last day. This data available only for realms with continuous updates","type":"integer","example":"100"}},"required":["id","full-scan-cadence","last-full-update","last-daily-update"]}}}}}}},"/v1/realm/asset-summary":{"get":{"description":"Returns asset summary data for the current realm, including ASM package asset count, AST & EI active asset count, and number of performed rescans.","security":[{"apiAuth":[]}],"summary":"Get asset summary for the realm (customer entitlements)","tags":["Realm"],"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"realm-id":{"description":"The unique identifier of the realm.","type":"string"},"asm-package-asset-count":{"description":"Total number of assets in the ASM package (IPs, Domains, Certificates, Web Applications).","type":"integer"},"ast-ei-active-asset-count":{"description":"Total number of active assets in the AST & EI package (Active IPs and Active Web Applications).","type":"integer"},"revalidations-count":{"description":"Number of performed revalidations for this realm.","type":"integer"}},"required":["realm-id","asm-package-asset-count","ast-ei-active-asset-count","revalidations-count"]}}}}}}},"/v1/users":{"get":{"description":"Get user data for all users registered in your CyCognito account.","security":[{"apiAuth":[]}],"summary":"Get all user data","tags":["Users"],"responses":{"200":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"name":{"description":"The user's full name.","type":"string","example":"Marty McFly"},"email":{"description":"The user's email address.","type":"string","example":"marty@acme.com"},"roles":{"description":"Indicates the user's permission levels corresponding to their teams. In the following example, the user has IT user permissions in Team1, Admin permissions in Team2, and Viewer permissions in all other teams: {\"Team1\": \"it-user\", \"Team2\":\"admin\", \"\":\"\"viewer\"}`. Supported user roles are *admin*, *viewer*, *guest*, *it-user*, and *analyst-ext*. <span name=\"kb-user-roles-explanation\">Read more</span>.","type":"object","additionalProperties":{"type":"string"},"example":"{\n  \"Team1\": \"it-user\",\n  \"Team2\": \"admin\",\n  \"\": \"viewer\"\n}"},"activated":{"description":"Indicates whether or not the user has activated their account.","type":"boolean","example":"true"},"invited-at":{"description":"Indicates the date and time at which the user received an invitation to the CyCognito platform.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-05-18T09:29:26.259Z"},"invited-by":{"description":"The user who sent the invitation to the specified user.","type":"string","example":"Biff Tannen"},"last-login":{"description":"Indicates the date and time at which the user last signed in to the CyCognito platform.","anyOf":[{"type":"string","format":"date-time"},{"type":"string"},{"type":"null"}],"example":"2024-05-20T10:31.368Z"}},"required":["name","email","roles","activated","invited-by","last-login"]}}}}}}},"post":{"description":"Create a new user.","security":[{"apiAuth":[]}],"summary":"Create user","tags":["Users"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"description":"The full name of the new user.","type":"string","example":"Marty McFly"},"email":{"description":"The new user's email address.","type":"string","example":"marty@acme.com"},"roles":{"description":"Designates the new user's permission levels corresponding to their teams. In the following example, the new user will have IT user permissions in Team1, Admin permissions in Team2, and Viewer permissions in all other teams: `{\"Team1\": \"it-user\", \"Team2\":\"admin\", \"\":\"viewer\"}`. Supported user roles are *admin*, *viewer*, *guest*, *it-user*, and *analyst-ext*. <span name=\"kb-user-roles-explanation\">Read more</span>.","type":"object","additionalProperties":{"type":"string","enum":["viewer","it-user","admin","analyst","guest"]},"example":"{\n  \"Team1\": \"it-user\",\n  \"Team2\": \"admin\",\n  \"\": \"viewer\"\n}"}},"required":["name","email","roles"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"status":{"description":"Indicates whether a new user was successfully added and an invitation was sent.","type":"string","example":"New user invitation was sent"}},"required":["status"]}}}}}}},"/v1/users/{email}":{"get":{"description":"Get user data for the specified individual user.","security":[{"apiAuth":[]}],"summary":"Get individual user data","tags":["Users"],"parameters":[{"name":"email","in":"path","schema":{"type":"string"},"required":true}],"responses":{"200":{"content":{"application/json":{"schema":{"anyOf":[{"type":"object","properties":{"name":{"description":"The user's full name.","type":"string","example":"Marty McFly"},"email":{"description":"The user's email address.","type":"string","example":"marty@acme.com"},"roles":{"description":"Indicates the user's permission levels corresponding to their teams. In the following example, the user has IT user permissions in Team1, Admin permissions in Team2, and Viewer permissions in all other teams: {\"Team1\": \"it-user\", \"Team2\":\"admin\", \"\":\"\"viewer\"}`. Supported user roles are *admin*, *viewer*, *guest*, *it-user*, and *analyst-ext*. <span name=\"kb-user-roles-explanation\">Read more</span>.","type":"object","additionalProperties":{"type":"string"},"example":"{\n  \"Team1\": \"it-user\",\n  \"Team2\": \"admin\",\n  \"\": \"viewer\"\n}"},"activated":{"description":"Indicates whether or not the user has activated their account.","type":"boolean","example":"true"},"invited-at":{"description":"Indicates the date and time at which the user received an invitation to the CyCognito platform.","type":"string","format":"date-time","example":"2024-05-18T09:29:26.259Z"},"invited-by":{"description":"The user who sent the invitation to the specified user.","type":"string","example":"Biff Tannen"},"last-login":{"description":"Indicates the date and time at which the user last signed in to the CyCognito platform.","anyOf":[{"type":"string","format":"date-time"},{"type":"string"},{"type":"null"}],"example":"2024-05-20T10:31.368Z"}},"required":["name","email","roles","activated","invited-at","invited-by","last-login"]},{"type":"string"}]}}}}}},"put":{"description":"Edit single teams or roles for the specified user.","security":[{"apiAuth":[]}],"summary":"Edit single user teams or roles","tags":["Users"],"parameters":[{"name":"email","in":"path","schema":{"type":"string"},"required":true}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"roles":{"description":"Designates the new user's permission levels corresponding to their teams. In the following example, the new user will have IT user permissions in Team1, Admin permissions in Team2, and Viewer permissions in all other teams: {\"Team1\": \"it-user\", \"Team2\":\"admin\", \"\":\"viewer\"}`. Supported user roles are *admin*, *viewer*, *guest*, *it-user*, and *analyst-ext*. <span name=\"kb-user-roles-explanation\">Read more</span>.","type":"object","additionalProperties":{"type":"string","enum":["viewer","it-user","admin","analyst","guest"]},"example":"{\n  \"Team1\": \"it-user\",\n  \"Team2\": \"admin\",\n  \"\": \"viewer\"\n}"}},"required":["roles"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"status":{"description":"Indicates whether the user's role within the specified team was updated.","type":"string","example":"User was edited."}},"required":["status"]}}}}}},"delete":{"description":"Remove a CyCognito user from the current team associated with <span name=\"kb-api-key-management-link\">your API key</span>.","security":[{"apiAuth":[]}],"summary":"Delete user","tags":["Users"],"parameters":[{"name":"email","in":"path","schema":{"type":"string"},"required":true,"description":"The email of the user who you want to remove from the current team associated with <span name=\"kb-api-key-management-link\">your API key</span>."}],"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"status":{"description":"Indicates whether a user was successfully removed from the team.","type":"string","example":"User was deleted"}},"required":["status"]}}}}}}},"/v1/export/request/{type}":{"post":{"description":"Select a desired asset type to initiate a data export. The resulting *report_ID* can be subsequently used with the **Fetch export link** method (below) to fetch a download link for the complete asset data in CSV format.","security":[{"apiAuth":[]}],"summary":"Initiate export","tags":["Export Data"],"parameters":[{"name":"type","in":"path","schema":{"type":"string","enum":["ip","domain","cert","webapp","iprange","issue","org"]},"required":true,"description":"The type of the entity whose data you want to export."},{"name":"truncate-fields","in":"query","schema":{"default":true,"type":"boolean"},"required":false,"description":"Caps the number of returned fields to a maximum of 32000 characters."}],"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"report-id":{"description":"Unique identifier for the export.","type":"string","example":"a123456b-cd78-910e-1f2g-34h56i789j10"}},"required":["report-id"]}}}}}}},"/v1/export/get/{report_id}":{"get":{"description":"Use the *report_ID* obtained from the **Initiate export** method (above) to generate a download link. Once acquired, this link enables you to access and download a CSV file containing detailed data of the assets by the initially chosen asset type.","security":[{"apiAuth":[]}],"summary":"Fetch export link","tags":["Export Data"],"parameters":[{"name":"report_id","in":"path","schema":{"type":"string"},"required":true,"description":"Unique identifier for the export."}],"responses":{"200":{"description":"Returns the download link of the export (if any) and the export status.","content":{"application/json":{"schema":{"type":"object","properties":{"export-status":{"description":"Indicates the status of the export task. When the response status is 200, it reflects the current task status, which can be *done* or other applicable values. When the response status is 400, the export status is *bad-request*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"done"},"export-date":{"description":"The date and time at which the export and subsequent download link were generated.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-05-18T12:24:34.990Z"},"download-link":{"description":"A generated link that enables you to access and download a CSV file containing detailed asset data.","anyOf":[{"type":"string"},{"type":"null"}],"example":"https://link-to-download-export/1234"}},"required":["export-status","export-date"]}}}}}}},"/v1/export/issue-to-pdf/request":{"post":{"description":"Initiate the generation of a PDF report for a specified issue. This endpoint triggers the creation process and returns a unique report identifier for status tracking and retrieval. The `truncate_long_fields` parameter (default: true) controls whether long field values are truncated in the PDF for improved readability.","security":[{"apiAuth":[]}],"summary":"Initiate issue PDF export","tags":["Export Data"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"id":{"description":"The unique identifier for the issue you wish to export to PDF. This is the `id` value from the \"Search issues\" endpoint response, including the `issue/` prefix.","allOf":[{"type":"string"}],"example":"issue/1.1.1.1-cve-2023-12345"},"team":{"description":"A team name, a request without this field will yield result of the team registered to the API key","type":"string","example":"Example Team"},"truncate-long-fields":{"description":"When set to true (default), long field values will be truncated in the PDF report to improve readability. When set to false, full field values will be included.","type":"boolean","example":true}},"required":["id"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"report-id":{"description":"Unique identifier for the export.","type":"string","example":"a123456b-cd78-910e-1f2g-34h56i789j10"}},"required":["report-id"]}}}}}}},"/v1/export/issue-to-pdf/get/{report_id}":{"get":{"description":"Check the status of your issue PDF export and retrieve the download link once available. This endpoint provides the status of the PDF generation process and, upon completion, the link to download the generated PDF report.","security":[{"apiAuth":[]}],"summary":"Fetch issue PDF export link","tags":["Export Data"],"parameters":[{"name":"report_id","in":"path","schema":{"type":"string"},"required":true,"description":"Unique identifier for the export."}],"responses":{"200":{"description":"Returns the generated link that enables you to access and download the PDF file containing the detailed issue data, as well as the status of the export task.","content":{"application/json":{"schema":{"type":"object","properties":{"export-status":{"description":"Indicates the status of the export task. When the response status is 200, it reflects the current task status, which can be *done* or other applicable values. When the response status is 400, the export status is *bad-request*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"done"},"export-date":{"description":"The date and time at which the export and subsequent download link were generated.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-05-18T12:24:34.990Z"},"download-link":{"description":"A generated link that enables you to access and download a CSV file containing detailed asset data.","anyOf":[{"type":"string"},{"type":"null"}],"example":"https://link-to-download-export/1234"}},"required":["export-status","export-date"]}}}}}}},"/v1/export/assets-to-pdf/request":{"post":{"description":"Initiate the generation of a PDF report for a list of assets. This endpoint triggers the creation process and returns a unique report identifier for status tracking and retrieval. The `truncate_long_fields` parameter (default: true) controls whether long field values are truncated in the PDF for improved readability.","security":[{"apiAuth":[]}],"summary":"Initiate asset PDF export","tags":["Export Data"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"asset-ids":{"description":"A comma-separated list in which each item contains the unique ID for the assets you want to export. The unique ID corresponds to the `id` field (from the *Retrieve assets* response) and should be in the format `&lt;asset_type&gt;/&lt;asset_id&gt;`.\n                                                                     \n*Examples:* `ip/1.1.1.1`, `domain/acme.com`","type":"array","items":{"type":"string"},"example":["ip/1.2.3.4","ip/127.0.0.1","domain/example.com"]},"truncate-long-fields":{"description":"When set to true (default), long field values will be truncated in the PDF report to improve readability. When set to false, full field values will be included.","type":"boolean","example":true}},"required":["asset-ids"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"report-id":{"description":"Unique identifier for the export.","type":"string","example":"a123456b-cd78-910e-1f2g-34h56i789j10"}},"required":["report-id"]}}}}}}},"/v1/export/assets-to-pdf/get/{report_id}":{"get":{"description":"Check the status of your asset PDF export and retrieve the download link once available. This endpoint provides the status of the PDF generation process and, upon completion, the link to download the generated PDF report.","security":[{"apiAuth":[]}],"summary":"Fetch asset PDF export link","tags":["Export Data"],"parameters":[{"name":"report_id","in":"path","schema":{"type":"string"},"required":true,"description":"Unique identifier for the export."}],"responses":{"200":{"description":"Returns the generated link that enables you to access and download the PDF file containing the detailed asset data, as well as the status of the export task.","content":{"application/json":{"schema":{"type":"object","properties":{"export-status":{"description":"Indicates the status of the export task. When the response status is 200, it reflects the current task status, which can be *done* or other applicable values. When the response status is 400, the export status is *bad-request*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"done"},"export-date":{"description":"The date and time at which the export and subsequent download link were generated.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-05-18T12:24:34.990Z"},"download-link":{"description":"A generated link that enables you to access and download a CSV file containing detailed asset data.","anyOf":[{"type":"string"},{"type":"null"}],"example":"https://link-to-download-export/1234"}},"required":["export-status","export-date"]}}}}}}},"/v1/reports/executive-report/request":{"post":{"description":"Initiate the generation of Executive Summary reports. This endpoint triggers the creation process and returns a unique report identifier for status tracking and retrieval. The report can be either an Enhanced Executive Report or First-Time Executive Report.","security":[{"apiAuth":[]}],"summary":"Initiate executive report","tags":["Reports"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"report-type":{"description":"The type of executive report to generate.","type":"string","enum":["enhanced-executive-report","first-time-executive-report"],"example":"enhanced-executive-report"},"start-date":{"description":"Report start date","type":"string","example":"2024-01-01"},"end-date":{"description":"Report end date","type":"string","example":"2024-03-31"},"team":{"description":"An optional team name. When provided, the report will be generated from the perspective of that sub-team.","type":"string","example":"Example Sub-Team"}},"required":["report-type","start-date","end-date"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"report-id":{"description":"Unique identifier for the export.","type":"string","example":"a123456b-cd78-910e-1f2g-34h56i789j10"}},"required":["report-id"]}}}}}}},"/v1/reports/executive-report/get/{report_id}":{"get":{"description":"Check the status of your executive report export and retrieve the download link once available. This endpoint provides the status of the PDF generation process and, upon completion, the link to download the generated PDF report.","security":[{"apiAuth":[]}],"summary":"Fetch executive report link","tags":["Reports"],"parameters":[{"name":"report_id","in":"path","schema":{"type":"string"},"required":true,"description":"Unique identifier for the export."}],"responses":{"200":{"description":"Returns the generated link that enables you to access and download the PDF file containing the executive report, as well as the status of the export task.","content":{"application/json":{"schema":{"type":"object","properties":{"export-status":{"description":"Indicates the status of the export task. When the response status is 200, it reflects the current task status, which can be *done* or other applicable values. When the response status is 400, the export status is *bad-request*.","anyOf":[{"type":"string"},{"type":"null"}],"example":"done"},"export-date":{"description":"The date and time at which the export and subsequent download link were generated.","anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"example":"2024-05-18T12:24:34.990Z"},"download-link":{"description":"A generated link that enables you to access and download a CSV file containing detailed asset data.","anyOf":[{"type":"string"},{"type":"null"}],"example":"https://link-to-download-export/1234"}},"required":["export-status","export-date"]}}}}}}},"/v1/include-assets":{"post":{"description":"Bulk addition of new assets to your attack surface, with details such as value, asset type, organization, propagation preference, and optional description). \n*Note:* To attribute an asset to multiple organizations, you will need to create separate list entries.","security":[{"apiAuth":[]}],"summary":"Include new assets","tags":["Scope Management"],"requestBody":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"asset-type":{"description":"Specifies the category of the asset.\n*Supported values:* `ip`, `domain`, `cert`, `webapp`, `iprange`.","type":"string"},"description":{"description":"A short description of the significance of the asset.","type":"string"},"organization":{"description":"The name of an organization to attribute the asset to.","type":"string"},"propagate":{"description":"Indicates whether the inclusion should propagate to other assets.","type":"boolean"},"tags":{"description":"A comma-separated list of custom keywords or phrases added as metadata to an asset or issue by a user, which can be used to navigate, filter, and group assets and issues.","type":"array","items":{"type":"string"}},"value":{"description":"The name of the asset to be included, formatted in accordance with its asset type.","type":"string"}},"required":["asset-type","organization","value"]},"example":"[\n  {\n    \"asset_type\": \"ip\",\n    \"description\": \"An IP that was recently acquired\",\n    \"organization\": \"Acme Corporation\",\n    \"propagate\": true,\n    \"tags\": [\"Assigned to Team A\",\"Owned by Jim\"],\n    \"value\": \"1.1.1.1\"\n  },\n  {\n    \"asset_type\": \"ip\",\n    \"description\": \"An IP that was recently acquired\",\n    \"organization\": \"Acme Homes\",\n    \"propagate\": true,\n    \"tags\": \"Assigned to Team B\",\n    \"value\": \"1.1.1.2\"\n  },\n  {\n    \"asset_type\": \"domain\",\n    \"description\": \"A domain that was recently acquired\",\n    \"organization\": \"Acme Studio\",\n    \"propagate\": true,\n    \"tags\": \"Assigned to Team A\",\n    \"value\": \"studio.acme.com\"\n  },\n  {\n    \"asset_type\": \"ip-range\",\n    \"description\": \"We recently acquired the IPs in this range\",\n    \"organization\": \"Acme Corporation\",\n    \"propagate\": true,\n    \"tags\": \"Owned by Jim\",\n    \"value\": \"1.1.1.1-1.1.1.2\"\n  }\n]"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"status":{"description":"Represents the outcome of the asset inclusion request. When the response status is 200, status is *success*. When the response status is 400, status is *failed*. ","type":"string","example":"success"},"errors":{"description":"A list detailing any errors encountered during the process. When the response status is 200, this list is empty, indicating no errors occurred. When the response status is 400, this list contains the specific error messages.","type":"array","items":{"type":"string"},"example":"The domain cannot be included at this time. To proceed, either remove this domain from your inclusion request, or contact support to assist you with including it manually."}},"required":["status","errors"]}}}}}}},"/v1/revalidate":{"post":{"description":"Trigger a revalidation on selected assets or asset groups (and by association, on their related issues).","security":[{"apiAuth":[]}],"summary":"Initiate revalidation","tags":["Revalidation"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"entity-ids":{"description":"A comma-separated list in which each item contains the unique ID for the assets and issues that you would like to revalidate. The unique ID corresponds to the `id` field (from the *Retrieve assets* and *Search issues* responses) and should be in the format `&lt;asset_type&gt;/&lt;asset_id&gt;` (for assets), or `issue/&lt;affected_asset&gt;-&lt;issue_id&gt;` (for issues).","type":"array","items":{"type":"string"},"example":["ip/1.1.1.1","domain/example.com","webapp/example.com","issue/CVE-1234-56789"]}}}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"result":{"description":"Indicates the outcome of the revalidation request. When the response status is 200, displays *success*. When the response status is 400, displays *failed*.","type":"string","example":"success"},"revalidations-for-request":{"description":"The number of entity IDs included in the revalidation request.","type":"integer","example":"123"},"revalidations-left":{"description":"The remaining number of revalidations available for the realm. When the response status is 200, this number is updated post-action. When the response status is 400, it shows the initial count.","type":"integer","example":"4567"}},"required":["result","revalidations-for-request","revalidations-left"]}}}}}}},"/v1/audit-log":{"post":{"description":"Access events and activities from the audit log within defined timeframes.","security":[{"apiAuth":[]}],"summary":"Retrieve audit logs","tags":["Audit Logs"],"parameters":[{"name":"count","in":"query","schema":{"type":"integer"},"required":false,"description":"Defines the number of results to be retrieved. Defaults to 10 with a max limit of 1000."},{"name":"offset","in":"query","schema":{"type":"integer"},"required":false,"description":"Sets the starting index for result retrieval, influenced by the `count` parameter. By default, `offset` is 0. Example: `offset` 3 with `count` 25 fetches results from index 75 to 99."}],"requestBody":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"field":{"description":"Field to apply the filter on. Typically, any field present in the response can be used.","allOf":[{"type":"string"}],"example":"created-at"},"op":{"description":"Specifies the operation to apply on the desired field.\n            \n*Supported values:*  \n            \n* `is` – Searches for values that match the specified text exactly.  \n            \n* `not` – Searches for values that **do not** match the specified text exactly.  \n            \n* `in` – Filters entities for values that include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `not-in` – Filters entities for values that do not include the specified strings. Note that these should be *full strings* and not *substrings*—see `contains`.  \n            \n* `only-in` – Filters **exclusively** so that only entities with the values specified will be searched. This operator is currently available only for the `organizations` and `tags` properties for assets and issues.  \n            \n* `between` – Searches by dates that are in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `not-between` – Searches by dates that are **not** in between two specified values. Each date range should be placed in square brackets `[]`, in the format `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`, and separated by a comma—e.g., `[\"2022-01-01T00:00:00.000Z\", \"2022-12-31T23:59:59.999Z\"]`.  \n            \n* `within-range` – Searches by number values that are in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[60,75]`.\n            \n* `not-within-range` – Searches by number values that are **not** in between a specified range. Each range should be placed in square brackets `[]` and separated by a comma—e.g., `[10,59]`.\n            \n* `within-last` – Searches for date values that are within the specified time frame in days—e.g., `64` is the value for 64 days.\n            \n* `not-within-last` – Searches for date values that are **not** within the specified time frame in days—e.g., `128` is the value for 128 days.\n            \n* `contains` – Searches for a specific substring within a string value.","allOf":[{"type":"string","enum":["is","not","in","not-in","only-in","key-of","not-key-of","between","not-between","within-range","not-within-range","contains","within-last","not-within-last"]}],"example":"between"},"values":{"description":"Specifies the value or values for the field.","type":"array","items":{"$ref":"#/components/schemas/json.any?"},"example":[["2026-07-02T01:56:10.859Z","2026-07-09T01:56:10.861Z"]]}},"required":["field","op","values"]}}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"attached-file-id":{"description":"If an event involved file uploads or attachments, this field contains the unique identifier for that file, allowing for easy retrieval or reference.","anyOf":[{"type":"string"},{"type":"null"}],"example":"abcd-123456-efgh-7890"},"created-at":{"description":"A timestamp indicating when the event or action was executed. \n*Format:* `yyyy-mm-ddTHH:mm:ssZ`","type":"string","format":"date-time","example":"2024-05-18T13:09:08.557Z"},"details":{"description":"Additional context or information related to the event, providing more granularity about the executed action.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Asset tags were added to 'Acme Homes'"},"event":{"description":"A concise descriptor of the action or activity that took place, like *Asset removed* or *Team member signed in*.","type":"string","example":"Asset tags added"},"target-ids":{"description":"An array of unique identifiers associated specifically with the targeted assets affected by the event. Useful for tracing specific assets related to the action.","anyOf":[{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]},"uniqueItems":true},{"type":"array","items":{"anyOf":[{"type":"string"},{"type":"null"}]}},{"type":"null"}],"example":"[\n \"domain/example.com\"\n ]"},"target-type":{"description":"Specifies the type of entity the event is related to, such as *asset*, *issue*, or *org*. Helps in categorizing the event's context.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Asset"},"team-id":{"description":"A unique identifier assigned to the team related to the event or action. This aids in filtering events by team-specific activities.","anyOf":[{"type":"string"},{"type":"null"}],"example":"1234a5678bcd"},"team-name":{"description":"The official name of the team related to the event or action. Provides a human-readable reference for the associated team.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Acme Homes"},"user-email":{"description":"The email address associated with the user who performed the action. Useful for communication or verification purposes.","anyOf":[{"type":"string"},{"type":"null"}],"example":"marty@acme.com"},"user-id":{"description":"A unique identifier assigned to the user, aiding in distinguishing different platform users.","type":"string","example":"asdf1234qwer5678"},"user-name":{"description":"The full name of the user who performed the action.","anyOf":[{"type":"string"},{"type":"null"}],"example":"Marty McFly"},"user-role":{"description":"The specific role assigned to the user within the platform, such as Admin, User, or Guest. Determines the user's access and privileges.","anyOf":[{"type":"string"},{"type":"null"}],"example":"admin"}},"required":["attached-file-id","created-at","details","event","target-ids","target-type","team-id","team-name","user-email","user-id","user-name","user-role"],"additionalProperties":false}}}}}}}},"/v1/is-scanner-ips":{"post":{"description":"Determine if an IP address is associated with CyCognito. This check focuses on a specific 24-hour window, which is set by a provided date-time or defaults to the day of the request. Verification data is retained for 166 days, after which any requests will return as negative.","security":[{"apiAuth":[]}],"summary":"Verify IP ownership","tags":["Verify IPs"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"ips":{"description":"A comma-separated list of IP addresses to be verified.","type":"array","items":{"type":"string"},"example":["1.1.1.1","2.2.2.2"]},"date-time":{"description":"The date-time string that specifies the start of a 24-hour window during which the IP addresses will be verified. \n*Format:* `<YYYY>-<MM>-<DD>T<HH>:<mm>:<ss>.<SSS>Z`","type":"string","example":"2022-11-02T16:07:03.071Z"}},"required":["ips"]}}}},"responses":{"200":{"content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"ip":{"description":"An IP address provided by the user for verification.","type":"string","example":"1.2.3.4"},"scanner":{"description":"Indicates whether the specified IP address was utilized by CyCognito's scanning infrastructure during the time frame specified in the user's query. A value of `true` means the IP was part of CyCognito's scanning activities, while `false` indicates it was not used by CyCognito during the queried period.","type":"boolean","example":"true"}},"required":["ip","scanner"]}}}}}}}}}}