--- title: "GetMalwareDetectionIoC fetches an IoC by UUID." method: GET path: "/v1/namespaces/{tenant_meta.namespace}/malware-detection-iocs/{uuid}" tags: ["MalwareDetectionIoCService"] --- # GetMalwareDetectionIoC fetches an IoC by UUID. `GET /v1/namespaces/{tenant_meta.namespace}/malware-detection-iocs/{uuid}` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/malware-detection-iocs/{uuid}` - Auth: none declared ## Path parameters - `tenant_meta.namespace` string, required - `uuid` string, required ## Query parameters - `get_parameters.mask` string ## Response `200` A successful response. - V1MalwareDetectionIoC: MalwareDetectionIoC represents an Indicator of Compromise. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1MalwareDetectionIoCSpec, required - `change_log` object: Change log with ISO timestamp keys. - `confirmed_by` string: Who confirmed the IoC. - `created_by` string, required: Who created this IoC. - `description` string: Description of the IoC. - `detection_rules` string[]: Rules that produced this IoC, for example YARA rule names. Merged across sightings rather than replaced. - `filename` string: File the IoC was extracted from, relative to the package root. - `first_seen_at` string, date-time: When this IoC was first observed. Distinct from meta.create_time, which is when this record was written and does not survive a data migration. - `last_seen_at` string, date-time: When this IoC was last observed in a package. Distinct from meta.update_time, which also moves on edits that are not sightings. - `review_status` 'IOC_REVIEW_STATUS_UNSPECIFIED' | 'IOC_REVIEW_STATUS_PENDING_REVIEW' | 'IOC_REVIEW_STATUS_AUTO_REVIEWED' | 'IOC_REVIEW_STATUS_HUMAN_REVIEWED': IOCReviewStatus records who established the IoC status, independent of what that status is. Automated short-circuit decisions require human_reviewed. - IOC_REVIEW_STATUS_UNSPECIFIED: No review stage has been set. - IOC_REVIEW_STATUS_PENDING_REVIEW: Newly ingested; no reviewer has looked at it yet. - IOC_REVIEW_STATUS_AUTO_REVIEWED: Set by an automated classifier or enrichment source. - IOC_REVIEW_STATUS_HUMAN_REVIEWED: Set by a human researcher. - `status` 'IOC_STATUS_UNSPECIFIED' | 'IOC_STATUS_MALICIOUS' | 'IOC_STATUS_BENIGN' | 'IOC_STATUS_UNKNOWN' | 'IOC_STATUS_SUSPICIOUS': IOCStatus represents the confirmation status of an IoC. - `type` 'IOC_TYPE_UNSPECIFIED' | 'IOC_TYPE_URL' | 'IOC_TYPE_IP' | 'IOC_TYPE_DOMAIN' | 'IOC_TYPE_FILENAME' | 'IOC_TYPE_FILEPATH' | 'IOC_TYPE_DIGEST_SHA1' | 'IOC_TYPE_DIGEST_SHA256' | 'IOC_TYPE_DIGEST_SHA512' | 'IOC_TYPE_DIGEST_MD5' | 'IOC_TYPE_WALLET_ADDRESS' | 'IOC_TYPE_REGISTRY_ACCOUNT_NAME' | 'IOC_TYPE_REGISTRY_ACCOUNT_EMAIL' | 'IOC_TYPE_DEPENDENCY', required: IOCType classifies the type of Indicator of Compromise. - `value` string, required: Value of the IoC. Immutable for the same reason as type. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the IoC record. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/malware-detection-iocs/:uuid/get.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)