CEcensys
Threat Hunting
Adversary Investigation

Get threat history for a web property

Retrieve historical threat observations for a web property. This endpoint returns time ranges during which threats were detected on the host.<br><br>Use this endpoint to see when a hostname and port was associated with threats, to confirm whether a domain was hosting malicious content at the time of an alert.<br><br>You can define a specific time frame of interest. If you do not specify a time frame, this endpoint will search the historical dataset that is available to your account.<br><br>You can filter by threat name.<br><br>This endpoint is available to organizations that have access to the Adversary Investigation module.

get/v3/threat-hunting/web/{webproperty_id}/observations/threats

Request

  • Base URL
    https://api.platform.censys.io
  • URL
    https://api.platform.censys.io/v3/threat-hunting/web/{webproperty_id}/observations/threats
  • Auth
    HTTP bearer

Path parameters

webproperty_idstring required

A web property identifier in hostname:port format.

Example:platform.censys.io:80

Query parameters

organization_idstring uuid required

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555
start_timestring

Start of date range (RFC3339 format, e.g., 2024-01-01T00:00:00Z). If not specified, defaults to the maximum query window back from the end time.

Example:2024-01-01T00:00:00Z
end_timestring

End of date range (RFC3339 format, e.g., 2024-01-31T23:59:59Z). If not specified, defaults to now. Cannot be in the future.

Example:2024-01-31T23:59:59Z
page_sizeinteger

Number of results per page (max 100)

Example:50
page_tokenstring

Pagination token from previous response

threat_namestring

Filter by threat name

Example:Acunetix
order_bystring[] nullable

Order observations by these fields. Multiple values can be provided to sort by multiple fields (e.g., ['threat_name DESC']).

Headers

X-Organization-IDstring uuid

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Example:11111111-2222-3333-4444-555555555555

Response

A list of threat observation ranges

Changes

No recorded changes to this operation across all 2 revisions of this API.