CEcensys
Threat Hunting
Adversary Investigation

CensEye: Retrieve value counts to discover pivots

Get counts of web assets for specific field-value pairs and combinations of field-value pairs. This is similar to the CensEye functionality available in the Platform web UI, but it allows you to define specific fields of interest rather than the default fields leveraged by the tool in the UI.<br><br>Each array can only target fields within the same nested object and may contain at most 5 field-value pairs. For example, you can combine host.services.port=80 and host.services.protocol=SSH in the same array, but you cannot combine host.services.port=80 and host.location.country="United States" in the same array. You can input multiple arrays of objects in each API call.<br><br>Use this endpoint to see how many assets share a given field value, so you can tell which attributes are rare enough to pivot on and which are too common to be useful.<br><br>To use this endpoint, your organization must have access to the Adversary Investigation module. This endpoint costs 1 credit per count condition (array of objects) included in the API call.

post/v3/threat-hunting/value-counts

Request

  • Base URL
    https://api.platform.censys.io
  • URL
    https://api.platform.censys.io/v3/threat-hunting/value-counts
  • Auth
    HTTP bearer

Query parameters

organization_idstring uuid required

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555

Headers

X-Organization-IDstring uuid

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Example:11111111-2222-3333-4444-555555555555

Request body

querystring

CenQL query string to filter documents

Example request

{
  "and_count_conditions": [
    {
      "field_value_pairs": [
        {
          "field": "host.services.port",
          "value": "80"
        }
      ]
    }
  ]
}

Response

OK

Changes

No recorded changes to this operation across all 2 revisions of this API.