Threat Hunting
Adversary Investigation

List active threats

Retrieve a list of active threats observed by Censys by aggregating threat IDs across hosts and web properties. Use this endpoint to see currently active threats so you can prioritize which malicious infrastructure to hunt or block first.<br><br>Threats are active if their fingerprint has been identified on hosts or web properties by Censys scans. This information is also available on the Explore Threats page in the Platform web UI.<br><br>This endpoint is available to organizations that have access to the Adversary Investigation module.

get/v3/threat-hunting/threats

Request

  • Base URL
    https://api.platform.censys.io
  • URL
    https://api.platform.censys.io/v3/threat-hunting/threats
  • Auth
    HTTP bearer

Query parameters

organization_idstring uuid required

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555
querystring

Optional CenQL filter to constrain threats list

Example:*

Headers

X-Organization-IDstring uuid

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Example:11111111-2222-3333-4444-555555555555

Response

OK

Changes

No recorded changes to this operation across all 2 revisions of this API.