Get a specific finding by ID

get/org/findings/{finding_id}

Request

  • Base URL: https://api.blumira.com/public-api/v1
  • URL: https://api.blumira.com/public-api/v1/org/findings/{finding_id}
  • Auth: HTTP bearer

Path parameters

finding_idstring uuid required

Finding ID of the object, e.g., "00110011-0000-0000-0000-000000000000"

Headers

Authorizationstring required

Bearer followed by JWT, e.g., "Bearer eyJh...enA"

Response

A specific finding with the given ID

analysisstring

Finding analysis

blockedboolean

Whether the finding is blocked. Optional; present on details.

categoryinteger

Numeric category ID (e.g. for category_name). Optional; present on details.

confirmation_completedstring date-time nullable

When confirmation was completed. Optional; present on details.

createdstring date-time

When the finding was created

escalation_completedstring date-time nullable

When escalation was completed. Optional; present on details.

finding_idstring uuid

ID of finding

jurisdictioninteger

Numeric jurisdiction ID (e.g. for jurisdiction_name). Optional; present on details.

match_idstring uuid nullable

ID of the BDF match associated with this finding (used for evidence). Omitted or null if not available.

matchedstring date-time nullable

When the finding was matched. Optional; present on details.

mitigation_completedstring date-time nullable

When mitigation was completed. Optional; present on details.

modifiedstring date-time

When the finding was modified

namestring

Name of the finding

org_idstring uuid

ID of org associated with this finding

org_namestring nullable

Name of org associated with this finding (null for POC org path)

priorityinteger

Priority of finding (range 1-5)

promoted_to_idstring uuid nullable

ID of the finding this was promoted to, if any. Optional; present on details.

seconds_in_statusinteger

Seconds the finding has been in its current status. Optional; present on details.

seconds_to_statusinteger

Seconds until a status transition (if applicable). Optional; present on details.

short_idstring

Short identifier for the finding

statusinteger

Numeric status code (e.g., 40 = Resolved)

status_modifiedstring date-time nullable

When the status was last modified. Optional; present on details.

status_namestring

Status of the finding (e.g., "Open", "Analysis in Progress", "Resolved", etc.)

typeinteger

Numeric type ID (e.g. for type_name). Optional; present on details.

type_namestring

Type of finding (e.g, "Suspect", "Threat", etc.)

ui_action_typeinteger

ID of action that the UI should take when rendering this finding. Optional; present on details. Also expanded as ui_action object.

Example response

{
  "analysis": "Blumira has detected a portscan from 192.168.26.121 to 192.168.2.203 over 1, 4, 37, 9, and 2 others port(s) from an advanced raw query detector.",
  "created": "2015-07-07T15:49:51.230",
  "finding_id": "aff08432-80ae-8fbe-bcd0-399beb09c6f1",
  "modified": "2015-07-07T15:49:51.230",
  "name": "Active Directory Domain Admin Created",
  "org_id": "aff08432-80ae-8fbe-bcd0-399beb09c6f1",
  "org_name": "My Organization",
  "priority": 4,
  "short_id": "F-24-16-B4B6",
  "status": 40,
  "status_name": "Open",
  "type_name": "Suspect",
  "ui_action_type": 20
}

Changes

No recorded changes to this operation across all 1 revision of this API.