BLblackkitetech
Findings

Get a hacktivist share finding of a company.

Changed on

Hackers publicize their targets in underground forums or on the darkweb. Black Kite collects information from hundreds of darkweb forums, criminal sites, and hacktivist sites and filters the results for information pertaining to the company. This category has 5% effect on total scan score.<br/><br/> For storage optimization, the system <b>permanently</b> deletes all findings that haven't been detected by the Black Kite scanner for over a year. Findings with manually changed statuses or associated tickets are excluded.

get/api/v2/companies/{id}/findings/hacktivistshares/{findingId}

Request

Path parameters

idinteger required

The id of the company that includes finding.

findingIdinteger required

The id of the target finding.

Response

Success

FindingIdinteger

The unique identifier of this finding.

Domainstring

The domain which this finding is related.

Severity'Info' | 'Low' | 'Medium' | 'High' | 'Critical'

The severity of a finding.

Status'Active' | 'FalsePositive' | 'Suppressed' | 'Acknowledged' | 'Deleted' | 'Remediated'

The status of this finding.

  • Active, means the finding is still active with no review as of yet.
  • FalsePositive, means the finding is considered to be false alarm.
  • Suppressed, means the finding is suppressed, similar to FalsePositive.
  • Acknowledged, means the finding is accepted, for example will not be fixed.
  • Deleted, means the finding is deleted, similar to FalsePositive.
  • Remediated, means the finding is mitigated.
ControlIdstring

The unique identifier of the control that this finding relates to.

FindingDatestring date-time

The date that Black Kite first seen the finding.

LastCheckDatestring date-time

The date that Black Kite last checked the finding.

FindingTitlestring

A title for the finding. Same with the security control's title referenced by the ControlId.

ScreenshotUrlstring nullable

The URL of the possibly fraudulent application screenshot.

ShareUrlstring

The URL of the possibly hacktivist share.

Assetstring nullable

The specific asset the hacktivist share is related to.

Urlstring nullable

The URL parsed out of the share snippet (or exploit description), if available.

Source'Stealer Log' | 'Deep Web'

The type of the possibly hacktivist share.

RiskLevel'Low' | 'Medium' | 'High'

The risk level of the possibly hacktivist share.

Snippetstring

Some part of the hacktivist share.

ConfidenceLevel'Low' | 'Medium' | 'High' | 'VeryHigh' nullable

The confidence level of this finding.

UpdateDatestring date-time nullable

The date that the finding was last updated.

IsRsiFindingboolean

Indicates whether this finding contributes to the company's Ransomware Susceptibility Index (RSI) score.

Example response

{
  "FindingId": 2590965999,
  "Domain": "acmeinc.com",
  "Severity": "Medium",
  "Status": "Active",
  "ControlId": "FRADOM-001",
  "Ticket": {
    "Status": "Assigned",
    "Owner": "John Doe"
  },
  "FindingDate": "2021-08-09T08:30:30.682Z",
  "LastCheckDate": "2021-08-09T08:30:30.682Z",
  "FindingTitle": "X-Content-Type-Options HTTP Header",
  "ScreenshotUrl": "https://image.normshield.com/api/v1/ss?f=2018_05_31_b64735ed3c444499b779f59a041101a5.png",
  "ShareUrl": "https://acmeinc.share1xx.com/",
  "Asset": "acmeinc.com",
  "Url": "https://login.acmeinc.com/signin",
  "Source": "Stealer Log",
  "RiskLevel": "Low",
  "Snippet": "... information is of a commercially sensitive nature or is deemed confidential ...",
  "Exploit": {
    "Source": "hacktivistshares_sourceservice.com",
    "ExploitabilityScore": 1.2,
    "CveId": "CVE-2019-15846",
    "Cvss": 2,
    "CweId": "CWE-119",
    "Description": "For more information: https://www..."
  },
  "ConfidenceLevel": "High",
  "UpdateDate": "2021-08-09T08:30:30.682Z",
  "IsRsiFinding": true
}

Changes

  • c8b3ed8cc984Revision changes
    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status