Threat Hunting
Adversary Investigation

CensEye: Create a pivot analysis job

Create an asynchronous CensEye pivot analysis job for a host, web property, or certificate. The job extracts default pivot fields from the target asset and counts matching documents for each field-value pair. Poll the job status endpoint to track progress, then retrieve results when complete.<br><br>Use this endpoint to start an analysis of a suspicious host, web property, or certificate that finds the rare attributes it shares with other assets, so you can uncover related attacker infrastructure.<br><br>To use this endpoint, your organization must have access to the Adversary Investigation module.<br><br>This endpoint costs 44 credits to execute for a host, 28 credits to execute for a web property, and 7 credits to execute for a certificate.

post/v3/threat-hunting/censeye/jobs

Request

  • Base URL
    https://api.platform.censys.io
  • URL
    https://api.platform.censys.io/v3/threat-hunting/censeye/jobs
  • Auth
    HTTP bearer

Query parameters

organization_idstring uuid required

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555

Headers

X-Organization-IDstring uuid

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Example:11111111-2222-3333-4444-555555555555

Request body

Example request

{
  "target": {
    "certificate_id": "3daf2843a77b6f4e6af43cd9b6f6746053b8c928e056e8a724808db8905a94cf",
    "host_id": "8.8.8.8",
    "webproperty_id": "example.com:443"
  }
}

Response

OK

Example response

{
  "result": {
    "job_id": "550e8400-e29b-41d4-a716-446655440000",
    "result_count": 42,
    "state": "completed",
    "target": {
      "certificate_id": "3daf2843a77b6f4e6af43cd9b6f6746053b8c928e056e8a724808db8905a94cf",
      "host_id": "8.8.8.8",
      "webproperty_id": "example.com:443"
    }
  }
}

Changes

No recorded changes to this operation across all 2 revisions of this API.