openapi: 3.2.0 info: title: Nord Security Events API version: '3' contact: name: Vakaris Noreika email: vakaris.noreika@nordsec.com description: 'Operations tagged Events across 3 of this provider''s published API definitions: nord-security-nordstellar-platform-integration-api-v1-openapi.json, nord-security-nordstellar-platform-integration-api-v2-openapi.json, nord-security-nordstellar-platform-integration-api-v3-openapi.json. Each path carries the servers of the definition it was published in.' servers: - url: https://platform-integration-api.nordstellar.com security: - Bearer: [] tags: - name: Events paths: /v1/events/combo-lists/{event-id}: get: tags: - Events summary: Retrieves combo list event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Models.ComboList' example: id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: COMBO_LIST module: LEAKED_DATA risk_level: HIGH is_resolved: false date_added: '2020-05-01T08:06:32.000Z' asset: type: EMAIL value: test@example.com tags: - CREDENTIALS passwords: - password123 - password456 - password789 '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v1/events/dark-web-forum-posts/{event-id}: get: tags: - Events summary: Retrieves dark web forum post event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Models.DarkWebForumPost' example: id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DARK_WEB_FORUM_POST module: DARK_WEB_MONITORING risk_level: INFORMATIONAL is_resolved: false date_added: '2024-03-15T10:30:00.000Z' tags: - CREDIT_CARDS - MARKETPLACE - COMBO_LIST dark_web_monitoring_rule_name: Company Credentials Monitor forum_name: DarkMarket forum_title: Credential Marketplace forum_section: Data Leaks author: anonymous_seller posted_at: '2024-03-14T22:15:00.000Z' scraped_at: '2024-03-15T01:00:00.000Z' url: https://darkmarket.example/thread/12345 content: Selling fresh credentials from recent database breach. DM for details. query: example AND tags:CREDIT_CARDS '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v1/events/dark-web-marketplace-posts/{event-id}: get: tags: - Events summary: Retrieves dark web marketplace post event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/DarkWebMarketplace.DarkWebMarketplacePost' example: id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DARK_WEB_MARKETPLACE_POST module: DARK_WEB_MONITORING risk_level: INFORMATIONAL is_resolved: false date_added: '2024-03-15T10:30:00.000Z' tags: - CREDIT_CARDS - MARKETPLACE - COMBO_LIST dark_web_monitoring_rule_name: Company Credentials Monitor marketplace_title: Credential Marketplace site_domain_name: 'example.com ' site_subdomain_url: https://example.com /malware_logs price: 10.00$ marketplace_type: Logs author: co####er [platinum] posted_at: '2024-03-14T22:15:00.000Z' scraped_at: '2024-03-15T01:00:00.000Z' url: https://darkmarket.example/thread/12345 content: 'Stealer: lumma Country: Punjab ISP: Pakistan Telecommunication Company Limited Links: animoto.com.' query: example AND tags:CREDIT_CARDS '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v1/events/dark-web-ransomware-posts/{event-id}: get: tags: - Events summary: Retrieves dark web Ransomware post event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/DarkWebRansomware.DarkWebRansomwarePost' example: id: 9e4e5325-c399-433d-a803-fdde187681f6 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DARK_WEB_RANSOMWARE_POST module: DARK_WEB_MONITORING risk_level: INFORMATIONAL is_resolved: false date_added: '2024-03-15T10:30:00.000Z' tags: - RANSOMWARE - MISSING_DOMAIN dark_web_monitoring_rule_name: Company Credentials Monitor ransomware_title: Company targeted in ransomware attack by Akira author: Akira posted_at: '2024-03-14T22:15:00.000Z' scraped_at: '2024-03-15T01:00:00.000Z' url: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ victim_information: company_name: Company name website: https://www.example.com industry: Public Safety country: name: United States iso2: US company_type: Public Company company_size: 51-200 employees revenue_range: $15,000,000.00 - $25,000,000.00 address_location: Davenport, Iowa 12345, US socials: - type: Facebook url: https://www.facebook.com/examplecompany query: example AND tags:CREDIT_CARDS '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v1/events/dark-web-telegram-posts/{event-id}: get: tags: - Events summary: Retrieves dark web Telegram post event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Models.DarkWebTelegramPost' example: id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DARK_WEB_TELEGRAM_POST module: DARK_WEB_MONITORING risk_level: INFORMATIONAL is_resolved: false date_added: '2024-03-15T10:30:00.000Z' tags: - CREDIT_CARDS - MARKETPLACE - COMBO_LIST dark_web_monitoring_rule_name: Company Credentials Monitor channel_name: DataLeaksChannel channel_title: Data Leaks & Breaches author: anonymous_seller posted_at: '2024-03-14T22:15:00.000Z' scraped_at: '2024-03-15T01:00:00.000Z' url: https://t.me/DataLeaksChannel/12345 content: Selling fresh credentials from recent database breach. DM for details. query: example AND tags:CREDIT_CARDS '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v1/events/data-breaches/{event-id}: get: tags: - Events summary: Retrieves data breach event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/DataBreach.DataBreach' example: id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DATA_BREACH module: LEAKED_DATA risk_level: HIGH is_resolved: false date_added: '2020-05-01T08:06:32.000Z' official_breach_date: '2020-01-01T08:00:00.000Z' asset: type: EMAIL value: test@example.com tags: - CREDENTIALS - PII data_keys: country,email,password description: Example.com experienced a data breach. Breach happened on the 1st of May 2020 data_breach_type: IDENTIFIED data_points: - data_key: email values: - test@example.com - data_key: password values: - password123 '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v1/events/domain-permutations/{event-id}: get: tags: - Events summary: Retrieves domain permutation event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/DomainPermutation.DomainPermutation' example: id: 1ea1494c-d1e7-4e7d-a87b-e69f4165e646 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DOMAIN_PERMUTATION module: DOMAIN_SQUATTING risk_level: HIGH is_resolved: true date_added: '2023-02-01T05:18:00.000Z' tags: - dormant_infrastructure - suspicious_infrastructure - tld-swap original_domain: example.com domain: examble.com permutation_type: dictionary detected_at: '2023-02-01T04:18:00.000Z' geo_ips: - address: 109.235.74.225 country_name: The Netherlands country_code_iso2: NL whois: name: REDACTED FOR PRIVACY organization: REDACTED FOR PRIVACY registrar: Realtime Register B.V. contacts: rtr-security-threats@realtimeregister.com registration_date: '2024-11-19' expiration_date: '2025-11-19' service_banners: http: cloudflare smtp: lotus.secure-hq.com ESMTP Postcow threat_analysis: content_similarity: null visual_similarity: null redirects: - url: http://meettelesoftas.com/ status_code: 301 ai_analysis: threats: - type: affiliate_fraud confidence: 85 evidences: - Redirect chain leads to the original domain (telesoftas.com) - Contains similar content that matches the original domain - Different organization in WHOIS with privacy protection severity: CRITICAL recommendations: - action: Monitor the domain and its activity closely rationale: High risk of affiliate fraud with potential attempts to intercept traffic to the legitimate site. name_servers: - ns2.yoursrs.com - ns1.yoursrs.com mail_servers: - lotus.secure-hq.com '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v1/events/malware-infections/{event-id}: get: tags: - Events summary: Retrieves malware infection event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/MalwareInfection.MalwareInfection' example: id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: MALWARE_INFECTION stealer_name: redline identifier: 53956e45779669337341fd33337c7328e5a85b42576152b99ferdf26d736321f module: LEAKED_DATA risk_level: HIGH is_resolved: false date_added: '2020-05-01T08:06:32.000Z' infection_date: '2020-01-01T08:00:00.000Z' asset: type: EMAIL value: test@example.com tags: - CORPORATE_CREDENTIALS - CORPORATE_COOKIES - CREDENTIALS files: - path: path/path/path/file1.txt - path: path/path/path/file2.pdf corporate_domain_cookies: - domain: expired_cookies_count: 1 valid_cookies_count: 1 cookies: - name: cache value: xnhgvsssffcsbs expires_on: '2024-05-01T08:06:32.000Z' expired_for: 1002145 - name: machine value: localhost expires_on: '2025-05-01T08:06:32.000Z' expired_for: null credentials: - url: application: Google Chrome email: test@example.com username: example password: asdjnashyssuasa is_corporate: true - url: application: Google Chrome email: email@example.com username: Username password: Jonam@321 is_corporate: false corporate_auto_fills: - name: website value: browser: Firefox - name: mobilePhone value: '12354789' browser: Internet Explorer credit_cards: - card_holder_name: Name Surname card_number: xxxx-xxxx-xxxx cvv: '123' expires_on: 01/01 device_info: ip: 192.16.0.1 hardware_id: 191C0049FB5931205A5AFF3CD86DE984E machine_id: dddc5250b54c430eb942eb21e3df0fe5 os: Windows 11 Home (10.0.22631) x64 user_name: PICA system_name: User location: zip_code: '4789456' country: MA location_name: Casablanca, Casablanca-Settat language: en-GB time_zone: (UTC+01:00) Casablanca date: '2020-05-01T08:06:32.000Z' '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v1/events/open-ports/{event-id}: get: tags: - Events summary: Retrieves open port event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Models.OpenPort' example: id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73 type: OPEN_PORT module: EXTERNAL_VULNERABILITIES risk_level: INFORMATIONAL is_resolved: false date_added: '2020-05-01T08:06:32.000Z' asset: type: IP value: 192.168.0.1 tags: - cdn port_number: 80 transport_protocol: tcp service: Apache httpd service_data: 'HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 09:10:21 GMT Server: Apache/2.4.57 (Ubuntu)' title: CDR, Construction Daily Reports '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v1/events/vulnerabilities/{event-id}: get: tags: - Events summary: Retrieves vulnerability event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Models.Vulnerability' example: id: 55cfd1a8-9285-4fd9-bdfe-15a217d77d1f type: VULNERABILITY module: EXTERNAL_VULNERABILITIES risk_level: HIGH is_resolved: false date_added: '2020-05-01T08:06:32.000Z' asset: type: IP value: 192.168.0.1 tags: - CLOUD cve_identifier: CVE-2020-1234 port_number: 443 port_transport_protocol: tcp port_service: nginx cvss2: 7.5 cvss3: null epss: 0.04983 description: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly propose_action: HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS). references: - https://example.com/vulnerability/1 - https://example.com/vulnerability/2 '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v1/events/{event-id}/is_resolved: patch: tags: - Events summary: Resolves an event parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/Resolve.EventState' responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Resolve.CommandResult' example: id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf is_resolved: true '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v2/events/attack-surface-dns-vulnerabilities/{event-id}: get: tags: - Events summary: Retrieves attack surface DNS vulnerability event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/AttackSurfaceVulnerability.AttackSurfaceDnsVulnerability' example: id: 11111111-1111-1111-1111-111111111111 type: ATTACK_SURFACE_DNS_VULNERABILITY project_id: 22222222-2222-2222-2222-222222222222 asset_id: 33333333-3333-3333-3333-333333333333 asset_value: example.com title: DNSSEC Not Configured description: The domain does not have DNSSEC configured, which could allow DNS spoofing attacks. is_verified: true source_type: DNS vulnerability_type: MISCONFIGURATION tags: - dns - dnssec - security impact_description: Without DNSSEC, attackers could potentially redirect users to malicious sites through DNS cache poisoning. remediation_instructions: Enable DNSSEC for your domain by configuring DS records with your domain registrar. references: - https://www.example.com/dnssec-guide risk_level: MEDIUM cve_id: null cwe_ids: [] cvss2_score: 0 cvss3_score: 0 cvss_vector: '' epss_score: 0 evidence_url: null evidence_data: null evidence_curl_command: null evidence_http_request: null evidence_http_response: null evidence_network_data: DNS query results showing missing DNSSEC records evidence_file_path: null evidence_target: example.com evidence_host: null evidence_port: null evidence_scheme: null evidence_raw_response: null evidence_extracted_data: [] is_resolved: false detected_at: '2024-01-01T00:00:00.000Z' updated_at: '2024-01-02T00:00:00.000Z' module: ATTACK_SURFACE '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v2/events/attack-surface-network-service-vulnerabilities/{event-id}: get: tags: - Events summary: Retrieves attack surface network service vulnerability event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/AttackSurfaceVulnerability.AttackSurfaceNetworkServiceVulnerability' example: id: 11111111-1111-1111-1111-111111111111 type: ATTACK_SURFACE_NETWORK_SERVICE_VULNERABILITY project_id: 22222222-2222-2222-2222-222222222222 asset_id: 33333333-3333-3333-3333-333333333333 asset_value: 192.168.1.100 title: Outdated SSH Service description: The SSH service is running an outdated version with known vulnerabilities. is_verified: true source_type: NETWORK_SERVICE vulnerability_type: BACKDOOR tags: - ssh - outdated - network-service impact_description: Attackers could exploit known vulnerabilities in the outdated SSH version to gain unauthorized access. remediation_instructions: Update SSH to the latest stable version and ensure automatic updates are enabled. references: - https://www.example.com/security.html risk_level: HIGH cve_id: CVE-2023-12345 cwe_ids: - CWE-327 cvss2_score: 7.5 cvss3_score: 9.8 cvss_vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H epss_score: 0.85 evidence_url: null evidence_data: null evidence_curl_command: null evidence_http_request: null evidence_http_response: null evidence_network_data: SSH-2.0-OpenSSH_7.4 evidence_file_path: null evidence_target: 192.168.1.100:22 evidence_host: 192.168.1.100 evidence_port: '22' evidence_scheme: ssh evidence_raw_response: null evidence_extracted_data: [] is_resolved: false detected_at: '2024-01-01T00:00:00.000Z' updated_at: '2024-01-02T00:00:00.000Z' port: 22 network_service_name: SSH protocol: TCP product: OpenSSH version: '7.4' is_active: true module: ATTACK_SURFACE '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v2/events/attack-surface-web-application-vulnerabilities/{event-id}: get: tags: - Events summary: Retrieves attack surface web application vulnerability event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/AttackSurfaceVulnerability.AttackSurfaceWebApplicationVulnerability' example: id: 11111111-1111-1111-1111-111111111111 type: ATTACK_SURFACE_WEB_APPLICATION_VULNERABILITY project_id: 22222222-2222-2222-2222-222222222222 asset_id: 33333333-3333-3333-3333-333333333333 asset_value: https://example.com title: SQL Injection Vulnerability description: The web application is vulnerable to SQL injection attacks in the login form. is_verified: true source_type: WEB_APPLICATION vulnerability_type: BACKDOOR tags: - sql-injection - web - critical impact_description: Attackers could gain unauthorized access to the database and extract sensitive information. remediation_instructions: Use parameterized queries or prepared statements to prevent SQL injection. Implement input validation and sanitization. references: - https://example.com/attacks/SQL_Injection risk_level: CRITICAL cve_id: null cwe_ids: - CWE-89 cvss2_score: 9 cvss3_score: 9.8 cvss_vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H epss_score: 0.95 evidence_url: https://example.com/login evidence_data: null evidence_curl_command: curl -X POST https://example.com/login -d "username=' OR '1'='1&password=test" evidence_http_request: 'POST /login HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded username='' OR ''1''=''1&password=test' evidence_http_response: 'HTTP/1.1 200 OK Content-Type: text/html Welcome Admin' evidence_network_data: null evidence_file_path: null evidence_target: https://example.com/login evidence_host: example.com evidence_port: '443' evidence_scheme: https evidence_raw_response: null evidence_extracted_data: - Admin access granted - 'Database query: SELECT * FROM users WHERE username='''' OR ''1''=''1''' is_resolved: false detected_at: '2024-01-01T00:00:00.000Z' updated_at: '2024-01-02T00:00:00.000Z' port: 443 module: ATTACK_SURFACE '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v2/events/combo-lists/{event-id}: get: tags: - Events summary: Retrieves combo list event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Models.ComboList' example: id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: COMBO_LIST module: LEAKED_DATA risk_level: HIGH is_resolved: false date_added: '2020-05-01T08:06:32.000Z' asset: type: EMAIL value: test@example.com tags: - CREDENTIALS passwords: - password123 - password456 - password789 '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v2/events/dark-web-forum-posts/{event-id}: get: tags: - Events summary: Retrieves dark web forum post event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Models.DarkWebForumPost' example: id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DARK_WEB_FORUM_POST module: DARK_WEB_MONITORING risk_level: INFORMATIONAL is_resolved: false date_added: '2024-03-15T10:30:00.000Z' tags: - CREDIT_CARDS - MARKETPLACE - COMBO_LIST dark_web_monitoring_rule_name: Company Credentials Monitor forum_name: DarkMarket forum_title: Credential Marketplace forum_section: Data Leaks author: anonymous_seller posted_at: '2024-03-14T22:15:00.000Z' scraped_at: '2024-03-15T01:00:00.000Z' url: https://darkmarket.example/thread/12345 content: Selling fresh credentials from recent database breach. DM for details. query: example AND tags:CREDIT_CARDS '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v2/events/dark-web-marketplace-posts/{event-id}: get: tags: - Events summary: Retrieves dark web marketplace post event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/DarkWebMarketplace.DarkWebMarketplacePost' example: id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DARK_WEB_MARKETPLACE_POST module: DARK_WEB_MONITORING risk_level: INFORMATIONAL is_resolved: false date_added: '2024-03-15T10:30:00.000Z' tags: - CREDIT_CARDS - MARKETPLACE - COMBO_LIST dark_web_monitoring_rule_name: Company Credentials Monitor marketplace_title: Credential Marketplace site_domain_name: 'example.com ' site_subdomain_url: https://example.com /malware_logs price: 10.00$ marketplace_type: Logs author: co####er [platinum] posted_at: '2024-03-14T22:15:00.000Z' scraped_at: '2024-03-15T01:00:00.000Z' url: https://darkmarket.example/thread/12345 content: 'Stealer: lumma Country: Punjab ISP: Pakistan Telecommunication Company Limited Links: animoto.com.' query: example AND tags:CREDIT_CARDS '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v2/events/dark-web-ransomware-posts/{event-id}: get: tags: - Events summary: Retrieves dark web Ransomware post event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/DarkWebRansomware.DarkWebRansomwarePost' example: id: 9e4e5325-c399-433d-a803-fdde187681f6 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DARK_WEB_RANSOMWARE_POST module: DARK_WEB_MONITORING risk_level: INFORMATIONAL is_resolved: false date_added: '2024-03-15T10:30:00.000Z' tags: - RANSOMWARE - MISSING_DOMAIN dark_web_monitoring_rule_name: Company Credentials Monitor ransomware_title: Company targeted in ransomware attack by Akira author: Akira posted_at: '2024-03-14T22:15:00.000Z' scraped_at: '2024-03-15T01:00:00.000Z' url: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ victim_information: company_name: Company name website: https://www.example.com industry: Public Safety country: name: United States iso2: US company_type: Public Company company_size: 51-200 employees revenue_range: $15,000,000.00 - $25,000,000.00 address_location: Davenport, Iowa 12345, US socials: - type: Facebook url: https://www.facebook.com/examplecompany query: example AND tags:CREDIT_CARDS '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v2/events/dark-web-telegram-posts/{event-id}: get: tags: - Events summary: Retrieves dark web Telegram post event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Models.DarkWebTelegramPost' example: id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DARK_WEB_TELEGRAM_POST module: DARK_WEB_MONITORING risk_level: INFORMATIONAL is_resolved: false date_added: '2024-03-15T10:30:00.000Z' tags: - CREDIT_CARDS - MARKETPLACE - COMBO_LIST dark_web_monitoring_rule_name: Company Credentials Monitor channel_name: DataLeaksChannel channel_title: Data Leaks & Breaches author: anonymous_seller posted_at: '2024-03-14T22:15:00.000Z' scraped_at: '2024-03-15T01:00:00.000Z' url: https://t.me/DataLeaksChannel/12345 content: Selling fresh credentials from recent database breach. DM for details. query: example AND tags:CREDIT_CARDS '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v2/events/data-breaches/{event-id}: get: tags: - Events summary: Retrieves data breach event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/DataBreach.DataBreach' example: id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DATA_BREACH module: LEAKED_DATA risk_level: HIGH is_resolved: false date_added: '2020-05-01T08:06:32.000Z' official_breach_date: '2020-01-01T08:00:00.000Z' asset: type: EMAIL value: test@example.com tags: - CREDENTIALS - PII data_keys: country,email,password description: Example.com experienced a data breach. Breach happened on the 1st of May 2020 data_breach_type: IDENTIFIED data_points: - data_key: email values: - test@example.com - data_key: password values: - password123 '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v2/events/domain-permutations/{event-id}: get: tags: - Events summary: Retrieves domain permutation event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/DomainPermutation.DomainPermutation' example: id: 1ea1494c-d1e7-4e7d-a87b-e69f4165e646 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DOMAIN_PERMUTATION module: DOMAIN_SQUATTING risk_level: HIGH is_resolved: true date_added: '2023-02-01T05:18:00.000Z' tags: - dormant_infrastructure - suspicious_infrastructure - tld-swap original_domain: example.com domain: examble.com permutation_type: dictionary detected_at: '2023-02-01T04:18:00.000Z' geo_ips: - address: 109.235.74.225 country_name: The Netherlands country_code_iso2: NL whois: name: REDACTED FOR PRIVACY organization: REDACTED FOR PRIVACY registrar: Realtime Register B.V. contacts: rtr-security-threats@realtimeregister.com registration_date: '2024-11-19' expiration_date: '2025-11-19' service_banners: http: cloudflare smtp: lotus.secure-hq.com ESMTP Postcow threat_analysis: content_similarity: null visual_similarity: null redirects: - url: http://meettelesoftas.com/ status_code: 301 ai_analysis: threats: - type: affiliate_fraud confidence: 85 evidences: - Redirect chain leads to the original domain (telesoftas.com) - Contains similar content that matches the original domain - Different organization in WHOIS with privacy protection severity: CRITICAL recommendations: - action: Monitor the domain and its activity closely rationale: High risk of affiliate fraud with potential attempts to intercept traffic to the legitimate site. name_servers: - ns2.yoursrs.com - ns1.yoursrs.com mail_servers: - lotus.secure-hq.com '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v2/events/malware-infections/{event-id}: get: tags: - Events summary: Retrieves malware infection event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/MalwareInfection.MalwareInfection' example: id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: MALWARE_INFECTION stealer_name: redline identifier: 53956e45779669337341fd33337c7328e5a85b42576152b99ferdf26d736321f module: LEAKED_DATA risk_level: HIGH is_resolved: false date_added: '2020-05-01T08:06:32.000Z' infection_date: '2020-01-01T08:00:00.000Z' asset: type: EMAIL value: test@example.com tags: - CORPORATE_CREDENTIALS - CORPORATE_COOKIES - CREDENTIALS files: - path: path/path/path/file1.txt - path: path/path/path/file2.pdf corporate_domain_cookies: - domain: expired_cookies_count: 1 valid_cookies_count: 1 cookies: - name: cache value: xnhgvsssffcsbs expires_on: '2024-05-01T08:06:32.000Z' expired_for: 1002145 - name: machine value: localhost expires_on: '2025-05-01T08:06:32.000Z' expired_for: null credentials: - url: application: Google Chrome email: test@example.com username: example password: asdjnashyssuasa is_corporate: true - url: application: Google Chrome email: email@example.com username: Username password: Jonam@321 is_corporate: false corporate_auto_fills: - name: website value: browser: Firefox - name: mobilePhone value: '12354789' browser: Internet Explorer credit_cards: - card_holder_name: Name Surname card_number: xxxx-xxxx-xxxx cvv: '123' expires_on: 01/01 device_info: ip: 192.16.0.1 hardware_id: 191C0049FB5931205A5AFF3CD86DE984E machine_id: dddc5250b54c430eb942eb21e3df0fe5 os: Windows 11 Home (10.0.22631) x64 user_name: PICA system_name: User location: zip_code: '4789456' country: MA location_name: Casablanca, Casablanca-Settat language: en-GB time_zone: (UTC+01:00) Casablanca date: '2020-05-01T08:06:32.000Z' '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v2/events/{event-id}/is_resolved: patch: tags: - Events summary: Resolves an event parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/Resolve.EventState' responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Resolve.CommandResult' example: id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf is_resolved: true '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/attack-surface-dns-vulnerabilities/{event-id}: get: tags: - Events summary: Retrieves attack surface DNS vulnerability event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/AttackSurfaceVulnerability.AttackSurfaceDnsVulnerability' example: id: 11111111-1111-1111-1111-111111111111 type: ATTACK_SURFACE_DNS_VULNERABILITY project_id: 22222222-2222-2222-2222-222222222222 asset_id: 33333333-3333-3333-3333-333333333333 asset_value: example.com title: DNSSEC Not Configured description: The domain does not have DNSSEC configured, which could allow DNS spoofing attacks. is_verified: true source_type: DNS vulnerability_type: MISCONFIGURATION tags: - dns - dnssec - security impact_description: Without DNSSEC, attackers could potentially redirect users to malicious sites through DNS cache poisoning. remediation_instructions: Enable DNSSEC for your domain by configuring DS records with your domain registrar. references: - https://www.example.com/dnssec-guide risk_level: MEDIUM cve_id: null cwe_ids: [] cvss2_score: 0 cvss3_score: 0 cvss_vector: '' epss_score: 0 evidence_url: null evidence_data: null evidence_curl_command: null evidence_http_request: null evidence_http_response: null evidence_network_data: DNS query results showing missing DNSSEC records evidence_file_path: null evidence_target: example.com evidence_host: null evidence_port: null evidence_scheme: null evidence_raw_response: null evidence_extracted_data: [] is_resolved: false detected_at: '2024-01-01T00:00:00.000Z' updated_at: '2024-01-02T00:00:00.000Z' module: ATTACK_SURFACE '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/attack-surface-network-service-vulnerabilities/{event-id}: get: tags: - Events summary: Retrieves attack surface network service vulnerability event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/AttackSurfaceVulnerability.AttackSurfaceNetworkServiceVulnerability' example: id: 11111111-1111-1111-1111-111111111111 type: ATTACK_SURFACE_NETWORK_SERVICE_VULNERABILITY project_id: 22222222-2222-2222-2222-222222222222 asset_id: 33333333-3333-3333-3333-333333333333 asset_value: 192.168.1.100 title: Outdated SSH Service description: The SSH service is running an outdated version with known vulnerabilities. is_verified: true source_type: NETWORK_SERVICE vulnerability_type: BACKDOOR tags: - ssh - outdated - network-service impact_description: Attackers could exploit known vulnerabilities in the outdated SSH version to gain unauthorized access. remediation_instructions: Update SSH to the latest stable version and ensure automatic updates are enabled. references: - https://www.example.com/security.html risk_level: HIGH cve_id: CVE-2023-12345 cwe_ids: - CWE-327 cvss2_score: 7.5 cvss3_score: 9.8 cvss_vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H epss_score: 0.85 evidence_url: null evidence_data: null evidence_curl_command: null evidence_http_request: null evidence_http_response: null evidence_network_data: SSH-2.0-OpenSSH_7.4 evidence_file_path: null evidence_target: 192.168.1.100:22 evidence_host: 192.168.1.100 evidence_port: '22' evidence_scheme: ssh evidence_raw_response: null evidence_extracted_data: [] is_resolved: false detected_at: '2024-01-01T00:00:00.000Z' updated_at: '2024-01-02T00:00:00.000Z' port: 22 network_service_name: SSH protocol: TCP product: OpenSSH version: '7.4' is_active: true module: ATTACK_SURFACE '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/attack-surface-web-application-vulnerabilities/{event-id}: get: tags: - Events summary: Retrieves attack surface web application vulnerability event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/AttackSurfaceVulnerability.AttackSurfaceWebApplicationVulnerability' example: id: 11111111-1111-1111-1111-111111111111 type: ATTACK_SURFACE_WEB_APPLICATION_VULNERABILITY project_id: 22222222-2222-2222-2222-222222222222 asset_id: 33333333-3333-3333-3333-333333333333 asset_value: https://example.com title: SQL Injection Vulnerability description: The web application is vulnerable to SQL injection attacks in the login form. is_verified: true source_type: WEB_APPLICATION vulnerability_type: BACKDOOR tags: - sql-injection - web - critical impact_description: Attackers could gain unauthorized access to the database and extract sensitive information. remediation_instructions: Use parameterized queries or prepared statements to prevent SQL injection. Implement input validation and sanitization. references: - https://example.com/attacks/SQL_Injection risk_level: CRITICAL cve_id: null cwe_ids: - CWE-89 cvss2_score: 9 cvss3_score: 9.8 cvss_vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H epss_score: 0.95 evidence_url: https://example.com/login evidence_data: null evidence_curl_command: curl -X POST https://example.com/login -d "username=' OR '1'='1&password=test" evidence_http_request: 'POST /login HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded username='' OR ''1''=''1&password=test' evidence_http_response: 'HTTP/1.1 200 OK Content-Type: text/html Welcome Admin' evidence_network_data: null evidence_file_path: null evidence_target: https://example.com/login evidence_host: example.com evidence_port: '443' evidence_scheme: https evidence_raw_response: null evidence_extracted_data: - Admin access granted - 'Database query: SELECT * FROM users WHERE username='''' OR ''1''=''1''' is_resolved: false detected_at: '2024-01-01T00:00:00.000Z' updated_at: '2024-01-02T00:00:00.000Z' port: 443 module: ATTACK_SURFACE '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/combo-lists/{event-id}: get: tags: - Events summary: Retrieves combo list event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Models.ComboList' example: id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: COMBO_LIST module: LEAKED_DATA risk_level: HIGH is_resolved: false date_added: '2020-05-01T08:06:32.000Z' asset: type: EMAIL value: test@example.com tags: - CREDENTIALS passwords: - password123 - password456 - password789 '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/consumer-credentials/{event-id}: get: tags: - Events summary: Retrieves consumer credential event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid - name: reveal-passwords in: query description: When `true`, includes the consumer credential passwords in the response. Default value `false`. required: true schema: type: boolean responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Models.ConsumerCredential' example: id: 9bc12d33-7d10-4c1b-9e76-19a89f5e9bb1 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: CONSUMER_CREDENTIAL module: LEAKED_DATA risk_level: INFORMATIONAL is_resolved: false consumer: alice@example.com asset_id: 3b6b2d77-1e8c-4a8a-9c64-d2e7c4dafbef asset_value: example.com malware_stealer_name: lumma-c2 source_name: malware-log-2025-11-01.txt source_type: MALWARE_INFECTION date_added: '2025-11-01T08:06:32.000Z' infection_date: '2025-10-28T14:23:00.000Z' tags: - CREDENTIALS url: https://app.example.com/login email: alice@example.com username: null passwords: - hunter2 - password123 '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/dark-web-forum-posts/{event-id}: get: tags: - Events summary: Retrieves dark web forum post event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Models.DarkWebForumPost' example: id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DARK_WEB_FORUM_POST module: DARK_WEB_MONITORING risk_level: INFORMATIONAL is_resolved: false date_added: '2024-03-15T10:30:00.000Z' tags: - CREDIT_CARDS - MARKETPLACE - COMBO_LIST dark_web_monitoring_rule_name: Company Credentials Monitor forum_name: DarkMarket forum_title: Credential Marketplace forum_section: Data Leaks author: anonymous_seller posted_at: '2024-03-14T22:15:00.000Z' scraped_at: '2024-03-15T01:00:00.000Z' url: https://darkmarket.example/thread/12345 content: Selling fresh credentials from recent database breach. DM for details. query: example AND tags:CREDIT_CARDS '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/dark-web-marketplace-posts/{event-id}: get: tags: - Events summary: Retrieves dark web marketplace post event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/DarkWebMarketplace.DarkWebMarketplacePostV3' example: id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DARK_WEB_MARKETPLACE_POST module: DARK_WEB_MONITORING risk_level: INFORMATIONAL is_resolved: false date_added: '2024-03-15T10:30:00.000Z' tags: - CREDIT_CARDS - MARKETPLACE - COMBO_LIST dark_web_monitoring_rule_name: Company Credentials Monitor marketplace_title: Credential Marketplace site_domain_name: 'example.com ' site_subdomain_url: https://example.com /malware_logs price: 10.00$ marketplace_type: Logs author: co####er [platinum] posted_at: '2024-03-14T22:15:00.000Z' scraped_at: '2024-03-15T01:00:00.000Z' url: https://darkmarket.example/thread/12345 content: 'Stealer: lumma Country: Punjab ISP: Pakistan Telecommunication Company Limited Links: animoto.com.' query: example AND tags:CREDIT_CARDS '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/dark-web-ransomware-posts/{event-id}: get: tags: - Events summary: Retrieves dark web Ransomware post event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/DarkWebRansomware.DarkWebRansomwarePost' example: id: 9e4e5325-c399-433d-a803-fdde187681f6 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DARK_WEB_RANSOMWARE_POST module: DARK_WEB_MONITORING risk_level: INFORMATIONAL is_resolved: false date_added: '2024-03-15T10:30:00.000Z' tags: - RANSOMWARE - MISSING_DOMAIN dark_web_monitoring_rule_name: Company Credentials Monitor ransomware_title: Company targeted in ransomware attack by Akira author: Akira posted_at: '2024-03-14T22:15:00.000Z' scraped_at: '2024-03-15T01:00:00.000Z' url: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ victim_information: company_name: Company name website: https://www.example.com industry: Public Safety country: name: United States iso2: US company_type: Public Company company_size: 51-200 employees revenue_range: $15,000,000.00 - $25,000,000.00 address_location: Davenport, Iowa 12345, US socials: - type: Facebook url: https://www.facebook.com/examplecompany query: example AND tags:CREDIT_CARDS '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/dark-web-telegram-posts/{event-id}: get: tags: - Events summary: Retrieves dark web Telegram post event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Models.DarkWebTelegramPost' example: id: d7443de3-ad45-4ec5-91d2-d465b0fe2f73 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DARK_WEB_TELEGRAM_POST module: DARK_WEB_MONITORING risk_level: INFORMATIONAL is_resolved: false date_added: '2024-03-15T10:30:00.000Z' tags: - CREDIT_CARDS - MARKETPLACE - COMBO_LIST dark_web_monitoring_rule_name: Company Credentials Monitor channel_name: DataLeaksChannel channel_title: Data Leaks & Breaches author: anonymous_seller posted_at: '2024-03-14T22:15:00.000Z' scraped_at: '2024-03-15T01:00:00.000Z' url: https://t.me/DataLeaksChannel/12345 content: Selling fresh credentials from recent database breach. DM for details. query: example AND tags:CREDIT_CARDS '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/data-breaches/{event-id}: get: tags: - Events summary: Retrieves data breach event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/DataBreach.DataBreach' example: id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DATA_BREACH module: LEAKED_DATA risk_level: HIGH is_resolved: false date_added: '2020-05-01T08:06:32.000Z' official_breach_date: '2020-01-01T08:00:00.000Z' asset: type: EMAIL value: test@example.com tags: - CREDENTIALS - PII data_keys: country,email,password description: Example.com experienced a data breach. Breach happened on the 1st of May 2020 data_breach_type: IDENTIFIED data_points: - data_key: email values: - test@example.com - data_key: password values: - password123 '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/domain-permutations/{event-id}: get: tags: - Events summary: Retrieves domain permutation event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/DomainPermutation.DomainPermutation' example: id: 1ea1494c-d1e7-4e7d-a87b-e69f4165e646 project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: DOMAIN_PERMUTATION module: DOMAIN_SQUATTING risk_level: HIGH is_resolved: true date_added: '2023-02-01T05:18:00.000Z' tags: - dormant_infrastructure - suspicious_infrastructure - tld-swap original_domain: example.com domain: examble.com permutation_type: dictionary detected_at: '2023-02-01T04:18:00.000Z' geo_ips: - address: 109.235.74.225 country_name: The Netherlands country_code_iso2: NL whois: name: REDACTED FOR PRIVACY organization: REDACTED FOR PRIVACY registrar: Realtime Register B.V. contacts: rtr-security-threats@realtimeregister.com registration_date: '2024-11-19' expiration_date: '2025-11-19' service_banners: http: cloudflare smtp: lotus.secure-hq.com ESMTP Postcow threat_analysis: content_similarity: null visual_similarity: null redirects: - url: http://meettelesoftas.com/ status_code: 301 ai_analysis: threats: - type: affiliate_fraud confidence: 85 evidences: - Redirect chain leads to the original domain (telesoftas.com) - Contains similar content that matches the original domain - Different organization in WHOIS with privacy protection severity: CRITICAL recommendations: - action: Monitor the domain and its activity closely rationale: High risk of affiliate fraud with potential attempts to intercept traffic to the legitimate site. name_servers: - ns2.yoursrs.com - ns1.yoursrs.com mail_servers: - lotus.secure-hq.com '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/malware-infections/{event-id}: get: tags: - Events summary: Retrieves malware infection event details. parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/MalwareInfection.MalwareInfection' example: id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf project_id: 1e4d2e74-1c31-4116-a33d-8806e1b3ef29 type: MALWARE_INFECTION stealer_name: redline identifier: 53956e45779669337341fd33337c7328e5a85b42576152b99ferdf26d736321f module: LEAKED_DATA risk_level: HIGH is_resolved: false date_added: '2020-05-01T08:06:32.000Z' infection_date: '2020-01-01T08:00:00.000Z' asset: type: EMAIL value: test@example.com tags: - CORPORATE_CREDENTIALS - CORPORATE_COOKIES - CREDENTIALS files: - path: path/path/path/file1.txt - path: path/path/path/file2.pdf corporate_domain_cookies: - domain: expired_cookies_count: 1 valid_cookies_count: 1 cookies: - name: cache value: xnhgvsssffcsbs expires_on: '2024-05-01T08:06:32.000Z' expired_for: 1002145 - name: machine value: localhost expires_on: '2025-05-01T08:06:32.000Z' expired_for: null credentials: - url: application: Google Chrome email: test@example.com username: example password: asdjnashyssuasa is_corporate: true - url: application: Google Chrome email: email@example.com username: Username password: Jonam@321 is_corporate: false corporate_auto_fills: - name: website value: browser: Firefox - name: mobilePhone value: '12354789' browser: Internet Explorer credit_cards: - card_holder_name: Name Surname card_number: xxxx-xxxx-xxxx cvv: '123' expires_on: 01/01 device_info: ip: 192.16.0.1 hardware_id: 191C0049FB5931205A5AFF3CD86DE984E machine_id: dddc5250b54c430eb942eb21e3df0fe5 os: Windows 11 Home (10.0.22631) x64 user_name: PICA system_name: User location: zip_code: '4789456' country: MA location_name: Casablanca, Casablanca-Settat language: en-GB time_zone: (UTC+01:00) Casablanca date: '2020-05-01T08:06:32.000Z' '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com /v3/events/{event-id}/is_resolved: patch: tags: - Events summary: Resolves an event parameters: - name: event-id in: path description: Unique identifier of the event required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/Resolve.EventState' responses: '200': description: The request has succeeded content: application/json: schema: $ref: '#/components/schemas/Resolve.CommandResult' example: id: 52c6fd64-8e91-46f2-ba5a-8761e103f9cf is_resolved: true '400': description: The server cannot or will not process the request due to an error made by the client. content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-400-bad-request title: Bad Request status: 400 instance: /v1/resource/123 errors: FIELD A: - ERROR 1 - ERROR 2 FIELD B: - ERROR 3 '401': description: The server has received and understood the request but is unable to authenticate it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-401-unauthorized title: Unauthorized status: 401 detail: User unauthorized. instance: /v1/resource/123 '403': description: The server has received and understood the request but is unable to authorize it. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-403-forbidden title: Forbidden status: 403 detail: The user is not allowed to do an action for the specified resource. instance: /v1/resource/123 '500': description: The server has encountered a situation it does not know how to handle. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: https://datatracker.ietf.org/doc/html/rfc9110#name-500-internal-server-error title: Internal Server Error status: 500 detail: Something went wrong instance: /v1/resource/123 servers: - url: https://platform-integration-api.nordstellar.com components: schemas: DarkWebRansomware.DarkWebRansomwarePost: required: - author - dark_web_monitoring_rule_name - date_added - id - is_resolved - module - posted_at - project_id - query - ransomware_title - risk_level - scraped_at - tags - type - url - victim_information type: object properties: id: type: string format: uuid project_id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventType' module: $ref: '#/components/schemas/Models.ModuleType' risk_level: $ref: '#/components/schemas/Models.RiskLevel' is_resolved: type: boolean date_added: type: - string - 'null' format: date-time tags: type: array items: type: string dark_web_monitoring_rule_name: type: string ransomware_title: type: string author: type: string posted_at: type: - string - 'null' format: date-time scraped_at: type: - string - 'null' format: date-time url: type: string victim_information: $ref: '#/components/schemas/DarkWebRansomware.Victim' query: type: string additionalProperties: false DataBreach.DataPoint: required: - data_key - values type: object properties: data_key: type: string values: type: array items: type: string additionalProperties: false MalwareInfection.CreditCard: required: - card_holder_name - card_number - cvv - expires_on type: object properties: card_holder_name: type: string card_number: type: string cvv: type: string expires_on: type: - string - 'null' additionalProperties: false DomainPermutation.Redirect: required: - status_code - url type: object properties: url: type: string status_code: type: integer format: int32 additionalProperties: false MalwareInfection.DeviceInfo: required: - hardware_id - ip - machine_id - os - system_name - user_name type: object properties: ip: type: string hardware_id: type: string machine_id: type: string os: type: string user_name: type: string system_name: type: string additionalProperties: false ValidationProblemDetails: required: - detail - instance - status - title type: object properties: type: type: - string - 'null' description: A URI reference that identifies the type of the problem. title: type: string description: A short summary of the type of the problem. status: maximum: 599 minimum: 400 type: integer description: The HTTP status code generated by the origin server for this occurrence of the problem. format: int32 detail: type: string description: An explanation specific to this occurrence of the problem. instance: type: string description: A unique identifier of this occurrence of the problem. Include it in your support request. errors: type: object additionalProperties: type: array items: type: string description: A map of problems with the request that need to be solved by the requester, wherein the key is the source of the problem, and the value is its details. additionalProperties: {} description: Error information that describes why the request has failed. Format conforms to IETF's RFC 9457. externalDocs: description: RFC 9457 "Problem Details for HTTP APIs" by Internet Engineering Task Force url: https://datatracker.ietf.org/doc/html/rfc9457 DarkWebMarketplace.DarkWebMarketplacePost: required: - author - content - dark_web_monitoring_rule_name - date_added - id - is_resolved - marketplace_title - marketplace_type - module - posted_at - price - project_id - query - risk_level - scraped_at - site_domain_name - site_subdomain_url - tags - type - url type: object properties: id: type: string format: uuid project_id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventType' module: $ref: '#/components/schemas/Models.ModuleType' risk_level: $ref: '#/components/schemas/Models.RiskLevel' is_resolved: type: boolean date_added: type: - string - 'null' format: date-time tags: type: array items: type: string dark_web_monitoring_rule_name: type: string marketplace_title: type: string site_domain_name: type: string site_subdomain_url: type: string price: type: string marketplace_type: $ref: '#/components/schemas/DarkWebMarketplace.MarketplaceType' author: type: string posted_at: type: - string - 'null' format: date-time scraped_at: type: - string - 'null' format: date-time url: type: string content: type: string query: type: string additionalProperties: false DarkWebMarketplace.MarketplaceType: enum: - Unspecified - Logs - CreditCards type: string DomainPermutation.ThreatAnalysis: required: - content_similarity - visual_similarity type: object properties: content_similarity: type: - number - 'null' format: double visual_similarity: type: - number - 'null' format: double additionalProperties: false DarkWebRansomware.SocialMediaType: enum: - Unspecified - Facebook - Linkedin - Twitter - Crunchbase - Instagram - Youtube - Github - Reddit - Discord - Pinterest - Tiktok type: string DarkWebRansomware.Social: required: - type - url type: object properties: type: $ref: '#/components/schemas/DarkWebRansomware.SocialMediaType' url: type: string additionalProperties: false DomainPermutation.AiAnalysis: required: - recommendations - threats type: object properties: threats: type: array items: $ref: '#/components/schemas/DomainPermutation.Threat' recommendations: type: array items: $ref: '#/components/schemas/DomainPermutation.Recommendation' additionalProperties: false Models.Vulnerability: required: - asset - cve_identifier - cvss2 - cvss3 - date_added - description - epss - id - is_resolved - module - port_number - port_service - port_transport_protocol - propose_action - references - risk_level - tags - type type: object properties: id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventType' module: $ref: '#/components/schemas/Models.ModuleType' risk_level: $ref: '#/components/schemas/Models.RiskLevel' is_resolved: type: boolean date_added: type: - string - 'null' format: date-time asset: $ref: '#/components/schemas/Models.Asset' tags: type: array items: type: string cve_identifier: type: string port_number: type: integer format: int32 port_transport_protocol: type: - string - 'null' port_service: type: - string - 'null' cvss2: type: - number - 'null' format: double cvss3: type: - number - 'null' format: double epss: type: - number - 'null' format: double description: type: - string - 'null' propose_action: type: - string - 'null' references: type: array items: type: string additionalProperties: false DataBreach.DataBreachType: enum: - UNKNOWN - IDENTIFIED - UNIDENTIFIED - COLLECTION type: string Models.Asset: required: - type - value type: object properties: type: $ref: '#/components/schemas/Models.AssetType' value: type: string additionalProperties: false MalwareInfection.Cookie: required: - expired_for - expires_on - name - value type: object properties: name: type: string value: type: string expires_on: type: - string - 'null' format: date-time expired_for: type: - number - 'null' format: double additionalProperties: false DataBreach.DataBreach: required: - asset - data_keys - date_added - id - is_resolved - module - official_breach_date - project_id - risk_level - tags - type type: object properties: id: type: string format: uuid project_id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventType' module: $ref: '#/components/schemas/Models.ModuleType' risk_level: $ref: '#/components/schemas/Models.RiskLevel' is_resolved: type: boolean date_added: type: - string - 'null' format: date-time official_breach_date: type: - string - 'null' format: date-time asset: $ref: '#/components/schemas/Models.Asset' tags: type: array items: type: string data_keys: type: string description: type: - string - 'null' data_breach_type: $ref: '#/components/schemas/DataBreach.DataBreachType' data_points: type: array items: $ref: '#/components/schemas/DataBreach.DataPoint' additionalProperties: false MalwareInfection.File: required: - path type: object properties: path: type: string additionalProperties: false DomainPermutation.ServiceBanners: required: - http - smtp type: object properties: http: type: - string - 'null' smtp: type: - string - 'null' additionalProperties: false Models.DarkWebTelegramPost: required: - author - channel_name - channel_title - content - dark_web_monitoring_rule_name - date_added - id - is_resolved - module - posted_at - project_id - query - risk_level - scraped_at - tags - type - url type: object properties: id: type: string format: uuid project_id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventType' module: $ref: '#/components/schemas/Models.ModuleType' risk_level: $ref: '#/components/schemas/Models.RiskLevel' is_resolved: type: boolean date_added: type: - string - 'null' format: date-time tags: type: array items: type: string dark_web_monitoring_rule_name: type: string channel_name: type: string channel_title: type: string author: type: string posted_at: type: string format: date-time scraped_at: type: string format: date-time url: type: string content: type: string query: type: string additionalProperties: false Models.OpenPort: required: - asset - date_added - id - is_resolved - module - port_number - risk_level - service - service_data - tags - title - transport_protocol - type type: object properties: id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventType' module: $ref: '#/components/schemas/Models.ModuleType' risk_level: $ref: '#/components/schemas/Models.RiskLevel' is_resolved: type: boolean date_added: type: - string - 'null' format: date-time asset: $ref: '#/components/schemas/Models.Asset' tags: type: array items: type: string port_number: type: integer format: int32 transport_protocol: type: - string - 'null' service: type: - string - 'null' service_data: type: - string - 'null' title: type: - string - 'null' additionalProperties: false Models.ComboList: required: - asset - date_added - id - is_resolved - module - passwords - project_id - risk_level - tags - type type: object properties: id: type: string format: uuid project_id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventType' module: $ref: '#/components/schemas/Models.ModuleType' risk_level: $ref: '#/components/schemas/Models.RiskLevel' is_resolved: type: boolean date_added: type: - string - 'null' format: date-time asset: $ref: '#/components/schemas/Models.Asset' tags: type: array items: type: string passwords: type: array items: type: string additionalProperties: false DomainPermutation.DomainPermutation: required: - ai_analysis - date_added - detected_at - domain - geo_ips - id - is_resolved - mail_servers - module - name_servers - original_domain - permutation_type - project_id - redirects - risk_level - service_banners - tags - threat_analysis - type - whois type: object properties: id: type: string format: uuid project_id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventType' module: $ref: '#/components/schemas/Models.ModuleType' risk_level: $ref: '#/components/schemas/Models.RiskLevel' is_resolved: type: boolean date_added: type: - string - 'null' format: date-time tags: type: array items: type: string original_domain: type: string domain: type: string permutation_type: type: string detected_at: type: string format: date-time geo_ips: type: array items: $ref: '#/components/schemas/DomainPermutation.GeoIp' whois: $ref: '#/components/schemas/DomainPermutation.WhoisInfo' service_banners: $ref: '#/components/schemas/DomainPermutation.ServiceBanners' threat_analysis: $ref: '#/components/schemas/DomainPermutation.ThreatAnalysis' redirects: type: array items: $ref: '#/components/schemas/DomainPermutation.Redirect' ai_analysis: $ref: '#/components/schemas/DomainPermutation.AiAnalysis' name_servers: type: array items: type: string mail_servers: type: array items: type: string additionalProperties: false DarkWebRansomware.Country: required: - iso2 - name type: object properties: name: type: string iso2: type: string additionalProperties: false Models.EventType: enum: - UNKNOWN - DATA_BREACH - COMBO_LIST - MALWARE_INFECTION - OPEN_PORT - VULNERABILITY - DARK_WEB_FORUM_POST - DARK_WEB_TELEGRAM_POST - DOMAIN_PERMUTATION - DARK_WEB_RANSOMWARE_POST - DARK_WEB_MARKETPLACE_POST type: string MalwareInfection.DomainCookies: required: - cookies - domain - expired_cookies_count - valid_cookies_count type: object properties: domain: type: string expired_cookies_count: type: integer format: int32 valid_cookies_count: type: integer format: int32 cookies: type: array items: $ref: '#/components/schemas/MalwareInfection.Cookie' additionalProperties: false Resolve.EventState: type: object properties: is_resolved: type: - boolean - 'null' additionalProperties: false MalwareInfection.Autofill: required: - browser - name - value type: object properties: name: type: string value: type: string browser: type: string additionalProperties: false Models.RiskLevel: enum: - UNKNOWN - INFORMATIONAL - LOW - MEDIUM - HIGH - CRITICAL type: string DarkWebRansomware.Victim: required: - address_location - company_name - company_size - company_type - country - industry - revenue_range - socials - website type: object properties: company_name: type: string website: type: string industry: type: string country: $ref: '#/components/schemas/DarkWebRansomware.Country' company_type: type: string company_size: type: string revenue_range: type: string address_location: type: string socials: type: array items: $ref: '#/components/schemas/DarkWebRansomware.Social' additionalProperties: false ProblemDetails: required: - detail - instance - status - title type: object properties: type: type: - string - 'null' description: A URI reference that identifies the type of the problem. title: type: string description: A short summary of the type of the problem. status: maximum: 599 minimum: 400 type: integer description: The HTTP status code generated by the origin server for this occurrence of the problem. format: int32 detail: type: string description: An explanation specific to this occurrence of the problem. instance: type: string description: A unique identifier of this occurrence of the problem. Include it in your support request. additionalProperties: {} description: Error information that describes why the request has failed. Format conforms to IETF's RFC 9457. externalDocs: description: RFC 9457 "Problem Details for HTTP APIs" by Internet Engineering Task Force url: https://datatracker.ietf.org/doc/html/rfc9457 DomainPermutation.WhoisInfo: required: - contacts - expiration_date - name - organization - registrar - registration_date type: object properties: name: type: - string - 'null' organization: type: - string - 'null' registrar: type: - string - 'null' contacts: type: - string - 'null' registration_date: type: - string - 'null' expiration_date: type: - string - 'null' additionalProperties: false DomainPermutation.Threat: required: - confidence - evidences - severity - type type: object properties: type: type: string confidence: type: number format: double evidences: type: array items: type: string severity: $ref: '#/components/schemas/Models.RiskLevel' additionalProperties: false MalwareInfection.Credentials: required: - application - email - is_corporate - password - url - username type: object properties: url: type: string application: type: string email: type: string username: type: string password: type: string is_corporate: type: boolean additionalProperties: false Models.AssetType: enum: - UNKNOWN - EMAIL - PHONE - IP - DARK_WEB_MONITORING_RULE - DOMAIN type: string DomainPermutation.GeoIp: required: - address - country_code_iso2 type: object properties: address: type: string country_name: type: - string - 'null' country_code_iso2: type: - string - 'null' additionalProperties: false Models.DarkWebForumPost: required: - author - content - dark_web_monitoring_rule_name - date_added - forum_name - forum_section - forum_title - id - is_resolved - module - posted_at - project_id - query - risk_level - scraped_at - tags - type - url type: object properties: id: type: string format: uuid project_id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventType' module: $ref: '#/components/schemas/Models.ModuleType' risk_level: $ref: '#/components/schemas/Models.RiskLevel' is_resolved: type: boolean date_added: type: - string - 'null' format: date-time tags: type: array items: type: string dark_web_monitoring_rule_name: type: string forum_name: type: string forum_title: type: string forum_section: type: string author: type: string posted_at: type: string format: date-time scraped_at: type: string format: date-time url: type: string content: type: string query: type: string additionalProperties: false DomainPermutation.Recommendation: required: - action - rationale type: object properties: action: type: - string - 'null' rationale: type: - string - 'null' additionalProperties: false Models.ModuleType: enum: - UNKNOWN - LEAKED_DATA - EXTERNAL_VULNERABILITIES - DARK_WEB_MONITORING - DOMAIN_SQUATTING type: string MalwareInfection.MalwareInfection: required: - asset - corporate_auto_fills - corporate_domain_cookies - credentials - credit_cards - date_added - device_info - files - id - identifier - infection_date - is_resolved - location - module - project_id - risk_level - stealer_name - tags - type type: object properties: id: type: string format: uuid project_id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventType' stealer_name: type: - string - 'null' identifier: type: string module: $ref: '#/components/schemas/Models.ModuleType' risk_level: $ref: '#/components/schemas/Models.RiskLevel' is_resolved: type: boolean date_added: type: - string - 'null' format: date-time infection_date: type: - string - 'null' format: date-time asset: $ref: '#/components/schemas/Models.Asset' tags: type: array items: type: string files: type: array items: $ref: '#/components/schemas/MalwareInfection.File' corporate_domain_cookies: type: array items: $ref: '#/components/schemas/MalwareInfection.DomainCookies' credentials: type: array items: $ref: '#/components/schemas/MalwareInfection.Credentials' corporate_auto_fills: type: array items: $ref: '#/components/schemas/MalwareInfection.Autofill' credit_cards: type: array items: $ref: '#/components/schemas/MalwareInfection.CreditCard' device_info: $ref: '#/components/schemas/MalwareInfection.DeviceInfo' location: $ref: '#/components/schemas/MalwareInfection.Location' additionalProperties: false MalwareInfection.Location: required: - country - date - language - location_name - time_zone - zip_code type: object properties: zip_code: type: string country: type: string location_name: type: string language: type: string time_zone: type: string date: type: - string - 'null' format: date-time additionalProperties: false Resolve.CommandResult: type: object properties: event_projection_id: type: string format: uuid is_resolved: type: boolean additionalProperties: false Models.EventTypeV2: enum: - UNKNOWN - DATA_BREACH - COMBO_LIST - MALWARE_INFECTION - DARK_WEB_FORUM_POST - DARK_WEB_TELEGRAM_POST - DOMAIN_PERMUTATION - DARK_WEB_RANSOMWARE_POST - DARK_WEB_MARKETPLACE_POST - ATTACK_SURFACE_WEB_APPLICATION_VULNERABILITY - ATTACK_SURFACE_NETWORK_SERVICE_VULNERABILITY - ATTACK_SURFACE_DNS_VULNERABILITY type: string Models.ModuleTypeV2: enum: - UNKNOWN - LEAKED_DATA - DARK_WEB_MONITORING - DOMAIN_SQUATTING - ATTACK_SURFACE type: string AttackSurfaceVulnerability.AttackSurfaceWebApplicationVulnerability: required: - asset_id - asset_value - cve_id - cvss2_score - cvss3_score - cvss_vector - cwe_ids - description - detected_at - epss_score - evidence_curl_command - evidence_data - evidence_extracted_data - evidence_file_path - evidence_host - evidence_http_request - evidence_http_response - evidence_network_data - evidence_port - evidence_raw_response - evidence_scheme - evidence_target - evidence_url - id - impact_description - is_resolved - is_verified - module - port - project_id - references - remediation_instructions - risk_level - source_type - tags - title - type - updated_at - vulnerability_type type: object properties: id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventTypeV2' project_id: type: string format: uuid asset_id: type: string format: uuid asset_value: type: string title: type: string description: type: string is_verified: type: boolean source_type: $ref: '#/components/schemas/AttackSurfaceVulnerability.AttackSurfaceVulnerabilitySourceType' vulnerability_type: $ref: '#/components/schemas/AttackSurfaceVulnerability.AttackSurfaceVulnerabilityType' tags: type: array items: type: string impact_description: type: string remediation_instructions: type: string references: type: array items: type: string risk_level: $ref: '#/components/schemas/Models.RiskLevel' cve_id: type: - string - 'null' cwe_ids: type: array items: type: string cvss2_score: type: number format: double cvss3_score: type: number format: double cvss_vector: type: string epss_score: type: number format: double evidence_url: type: - string - 'null' evidence_data: type: - string - 'null' evidence_curl_command: type: - string - 'null' evidence_http_request: type: - string - 'null' evidence_http_response: type: - string - 'null' evidence_network_data: type: - string - 'null' evidence_file_path: type: - string - 'null' evidence_target: type: - string - 'null' evidence_host: type: - string - 'null' evidence_port: type: - string - 'null' evidence_scheme: type: - string - 'null' evidence_raw_response: type: - string - 'null' evidence_extracted_data: type: array items: type: string is_resolved: type: boolean detected_at: type: string format: date-time updated_at: type: - string - 'null' format: date-time port: type: - integer - 'null' format: int32 module: $ref: '#/components/schemas/Models.ModuleTypeV2' additionalProperties: false AttackSurfaceVulnerability.AttackSurfaceNetworkServiceVulnerability: required: - asset_id - asset_value - cve_id - cvss2_score - cvss3_score - cvss_vector - cwe_ids - description - detected_at - epss_score - evidence_curl_command - evidence_data - evidence_extracted_data - evidence_file_path - evidence_host - evidence_http_request - evidence_http_response - evidence_network_data - evidence_port - evidence_raw_response - evidence_scheme - evidence_target - evidence_url - id - impact_description - is_active - is_resolved - is_verified - module - network_service_name - port - product - project_id - protocol - references - remediation_instructions - risk_level - source_type - tags - title - type - updated_at - version - vulnerability_type type: object properties: id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventTypeV2' project_id: type: string format: uuid asset_id: type: string format: uuid asset_value: type: string title: type: string description: type: string is_verified: type: boolean source_type: $ref: '#/components/schemas/AttackSurfaceVulnerability.AttackSurfaceVulnerabilitySourceType' vulnerability_type: $ref: '#/components/schemas/AttackSurfaceVulnerability.AttackSurfaceVulnerabilityType' tags: type: array items: type: string impact_description: type: string remediation_instructions: type: string references: type: array items: type: string risk_level: $ref: '#/components/schemas/Models.RiskLevel' cve_id: type: - string - 'null' cwe_ids: type: array items: type: string cvss2_score: type: number format: double cvss3_score: type: number format: double cvss_vector: type: string epss_score: type: number format: double evidence_url: type: - string - 'null' evidence_data: type: - string - 'null' evidence_curl_command: type: - string - 'null' evidence_http_request: type: - string - 'null' evidence_http_response: type: - string - 'null' evidence_network_data: type: - string - 'null' evidence_file_path: type: - string - 'null' evidence_target: type: - string - 'null' evidence_host: type: - string - 'null' evidence_port: type: - string - 'null' evidence_scheme: type: - string - 'null' evidence_raw_response: type: - string - 'null' evidence_extracted_data: type: array items: type: string is_resolved: type: boolean detected_at: type: string format: date-time updated_at: type: - string - 'null' format: date-time port: type: - integer - 'null' format: int32 network_service_name: type: string protocol: type: string product: type: string version: type: string is_active: type: boolean module: $ref: '#/components/schemas/Models.ModuleTypeV2' additionalProperties: false AttackSurfaceVulnerability.AttackSurfaceVulnerabilityType: enum: - UNSPECIFIED - CVE - SERVICE_DETECTION - SSL_PROTOCOL - SSL_CERTIFICATE - SSL_COMPLIANCE - DNS_SPOOFING - DNS_SPF - DNS_DMARC - DEFAULT_CREDENTIALS - AUTH_BYPASS - MISCONFIGURATION - EXPOSURE - XSS - SQL_INJECTION - REMOTE_CODE_EXECUTION - LOCAL_FILE_INCLUSION - REMOTE_FILE_INCLUSION - SERVER_SIDE_REQUEST_FORGERY - XML_EXTERNAL_ENTITY - INFORMATION_DISCLOSURE - COMPLIANCE - EXPLOIT - DETECTION - PATH_TRAVERSAL - FILE_UPLOAD - OPEN_REDIRECT - SERVER_SIDE_TEMPLATE_INJECTION - DESERIALIZATION - BACKDOOR - TAKEOVER - COMMAND_INJECTION - INSECURE_DIRECT_OBJECT_REFERENCE - CROSS_SITE_REQUEST_FORGERY - UNAUTHENTICATED_ACCESS - TOKEN_LEAK - CLOUD_MISCONFIGURATION - INTERNET_OF_THINGS - PASSIVE_CVE type: string AttackSurfaceVulnerability.AttackSurfaceDnsVulnerability: required: - asset_id - asset_value - cve_id - cvss2_score - cvss3_score - cvss_vector - cwe_ids - description - detected_at - epss_score - evidence_curl_command - evidence_data - evidence_extracted_data - evidence_file_path - evidence_host - evidence_http_request - evidence_http_response - evidence_network_data - evidence_port - evidence_raw_response - evidence_scheme - evidence_target - evidence_url - id - impact_description - is_resolved - is_verified - module - project_id - references - remediation_instructions - risk_level - source_type - tags - title - type - updated_at - vulnerability_type type: object properties: id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventTypeV2' project_id: type: string format: uuid asset_id: type: string format: uuid asset_value: type: string title: type: string description: type: string is_verified: type: boolean source_type: $ref: '#/components/schemas/AttackSurfaceVulnerability.AttackSurfaceVulnerabilitySourceType' vulnerability_type: $ref: '#/components/schemas/AttackSurfaceVulnerability.AttackSurfaceVulnerabilityType' tags: type: array items: type: string impact_description: type: string remediation_instructions: type: string references: type: array items: type: string risk_level: $ref: '#/components/schemas/Models.RiskLevel' cve_id: type: - string - 'null' cwe_ids: type: array items: type: string cvss2_score: type: number format: double cvss3_score: type: number format: double cvss_vector: type: string epss_score: type: number format: double evidence_url: type: - string - 'null' evidence_data: type: - string - 'null' evidence_curl_command: type: - string - 'null' evidence_http_request: type: - string - 'null' evidence_http_response: type: - string - 'null' evidence_network_data: type: - string - 'null' evidence_file_path: type: - string - 'null' evidence_target: type: - string - 'null' evidence_host: type: - string - 'null' evidence_port: type: - string - 'null' evidence_scheme: type: - string - 'null' evidence_raw_response: type: - string - 'null' evidence_extracted_data: type: array items: type: string is_resolved: type: boolean detected_at: type: string format: date-time updated_at: type: - string - 'null' format: date-time module: $ref: '#/components/schemas/Models.ModuleTypeV2' additionalProperties: false AttackSurfaceVulnerability.AttackSurfaceVulnerabilitySourceType: enum: - WEB_APPLICATION - NETWORK_SERVICE - DNS type: string DarkWebMarketplace.MarketplaceTypeV3: enum: - Unspecified - Logs - CreditCards - Hosts - Send - WebMail - Leads - Accounts - Other type: string DarkWebMarketplace.DarkWebMarketplacePostV3: required: - author - content - dark_web_monitoring_rule_name - date_added - id - is_resolved - marketplace_title - marketplace_type - module - posted_at - price - project_id - query - risk_level - scraped_at - site_domain_name - site_subdomain_url - tags - type - url type: object properties: id: type: string format: uuid project_id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventTypeV3' module: $ref: '#/components/schemas/Models.ModuleTypeV2' risk_level: $ref: '#/components/schemas/Models.RiskLevel' is_resolved: type: boolean date_added: type: - string - 'null' format: date-time tags: type: array items: type: string dark_web_monitoring_rule_name: type: string marketplace_title: type: string site_domain_name: type: string site_subdomain_url: type: string price: type: string marketplace_type: $ref: '#/components/schemas/DarkWebMarketplace.MarketplaceTypeV3' author: type: string posted_at: type: - string - 'null' format: date-time scraped_at: type: - string - 'null' format: date-time url: type: string content: type: string query: type: string additionalProperties: false Models.ConsumerCredentialSourceType: enum: - COMBO_LIST - MALWARE_INFECTION type: string Models.ConsumerCredential: required: - asset_id - asset_value - consumer - date_added - email - id - infection_date - is_resolved - malware_stealer_name - module - passwords - project_id - risk_level - source_name - source_type - tags - type - url - username type: object properties: id: type: string format: uuid project_id: type: string format: uuid type: $ref: '#/components/schemas/Models.EventTypeV3' module: $ref: '#/components/schemas/Models.ModuleType' risk_level: $ref: '#/components/schemas/Models.RiskLevel' is_resolved: type: boolean consumer: type: string asset_id: type: string format: uuid asset_value: type: string malware_stealer_name: type: - string - 'null' source_name: type: string source_type: $ref: '#/components/schemas/Models.ConsumerCredentialSourceType' date_added: type: - string - 'null' format: date-time infection_date: type: - string - 'null' format: date-time tags: type: array items: type: string url: type: string email: type: - string - 'null' username: type: - string - 'null' passwords: type: - array - 'null' items: type: string additionalProperties: false Models.EventTypeV3: enum: - UNKNOWN - DATA_BREACH - COMBO_LIST - MALWARE_INFECTION - DARK_WEB_FORUM_POST - DARK_WEB_TELEGRAM_POST - DOMAIN_PERMUTATION - DARK_WEB_RANSOMWARE_POST - DARK_WEB_MARKETPLACE_POST - ATTACK_SURFACE_WEB_APPLICATION_VULNERABILITY - ATTACK_SURFACE_NETWORK_SERVICE_VULNERABILITY - ATTACK_SURFACE_DNS_VULNERABILITY - CONSUMER_CREDENTIAL type: string securitySchemes: Bearer: type: http description: Please enter a valid token. scheme: Bearer bearerFormat: JWT x-refined-from: - nord-security-nordstellar-platform-integration-api-v1-openapi.json - nord-security-nordstellar-platform-integration-api-v2-openapi.json - nord-security-nordstellar-platform-integration-api-v3-openapi.json