BLblackkitetech
Findings

Get an email security finding of a company.

Changed on

Potential email servers and SMTP misconfigurations like open relay, unauthenticated logins, restricted relay, and SMTP 'Verify' vulnerabilities are collected from the online services like MxToolbox and eMailSecurityGrader. This category has 6% effect on total scan score.<br/><br/> For storage optimization, the system <b>permanently</b> deletes all findings that haven't been detected by the Black Kite scanner for over a year. Findings with manually changed statuses or associated tickets are excluded.

get/api/v2/companies/{id}/findings/emailsecurity/{findingId}

Request

Path parameters

idinteger required

The id of the company that includes finding.

findingIdinteger required

The id of the target finding.

Response

Success

FindingIdinteger

The unique identifier of this finding.

Domainstring

The domain which this finding is related.

Severity'Info' | 'Low' | 'Medium' | 'High' | 'Critical'

The severity of a finding.

Status'Active' | 'FalsePositive' | 'Suppressed' | 'Acknowledged' | 'Deleted' | 'Remediated'

The status of this finding.

  • Active, means the finding is still active with no review as of yet.
  • FalsePositive, means the finding is considered to be false alarm.
  • Suppressed, means the finding is suppressed, similar to FalsePositive.
  • Acknowledged, means the finding is accepted, for example will not be fixed.
  • Deleted, means the finding is deleted, similar to FalsePositive.
  • Remediated, means the finding is mitigated.
FindingDatestring date-time

The date that Black Kite first seen the finding.

LastCheckDatestring date-time

The date that Black Kite last checked the finding.

ControlIdstring

The unique identifier of the control that this finding relates to.

Output'Info' | 'Passed' | 'Warning' | 'Failed'

This field is valid for all findings under the following categories; DNSHealth, EmailSecurity, SslTlsStrength, ApplicationSecurity, DDoSResiliency, NetworkSecurity, InformationDisclosure. Since there are certain checklists applied in those categories, an additional status field is incorporated to denote if the result of the checklist item is FAILED or PASSED.

  • Info, means the finding is a checklist item and it's not considered as a weakness. No penalty point.
  • Passed, means the finding is a checklist item and the target complies with it. No penalty point.
  • Warning, means the finding is a checklist item and the target doesn't comply with it.
  • Failed, means the finding is a checklist item and the target doesn't comply with it.
Titlestring

A title for the finding. Same with the security control's title referenced by the ControlId.

Detailstring

A short detail specific to the finding. Possibly HTML formatted.

ConfidenceLevel'Low' | 'Medium' | 'High' | 'VeryHigh' nullable

The confidence level of this finding.

UpdateDatestring date-time nullable

The date that the finding was last updated.

IsRsiFindingboolean

Indicates whether this finding contributes to the company's Ransomware Susceptibility Index (RSI) score.

CwssScorenumber float nullable

The Common Weakness Scoring System score of the finding.

CweListstring[]

The CWE ids related to the security control of the finding. Empty when the control has no CWE mapping.

Example response

{
  "FindingId": 2590965999,
  "Domain": "acmeinc.com",
  "Severity": "Medium",
  "Status": "Active",
  "FindingDate": "2021-08-09T08:30:30.682Z",
  "LastCheckDate": "2021-08-09T08:30:30.682Z",
  "ControlId": "FRADOM-001",
  "Ticket": {
    "Status": "Assigned",
    "Owner": "John Doe"
  },
  "Output": "Failed",
  "Title": "X-Content-Type-Options HTTP Header",
  "Detail": "X-Content-Type-Options header not found",
  "ConfidenceLevel": "High",
  "UpdateDate": "2021-08-09T08:30:30.682Z",
  "IsRsiFinding": true,
  "CweList": [
    "CWE-693"
  ]
}

Changes

  • 1fa174efb09aRevision changes
    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status