Findings

:: Legacy Route :: This resource returns a list of findings for latest analysis for a given TOE.

::Legacy Route please use findings_paginated:: This use case describes how the Findings API is used to retrieve a list of findings for the latest analysis for a TOE. The toe_id is passed in the API request. In this scenario, all findings for that TOE are returned in the response. To limit or filter the data returned in the response, you can use various parameters in the API request:

Filter by an asset value: You can use the asset_value parameter to search for findings with high, medium, or low asset value.
Filter by severity: You can use the severity parameter to search for findings with high, medium, or low severity.
Filter by asset value and severity: You can use asset_value and severity parameters to search for findings with high, medium, or low asset value and severity.
Filter by multiple asset values: You can use the asset_value parameter multiple times to search for findings with multiple asset values.

get/v1/findings/{toe_id}

Request

Base URL
https://api.sandbox.riskrecon.com
URL
https://api.sandbox.riskrecon.com/v1/findings/{toe_id}
Auth
HTTP bearer

Path parameters

toe_idstring required

Example:5976423a-ee35-11e3-8569-14109ff1a304

Filter by the Toe ID.

Query parameters

risk_policyboolean

Example:true

Filter findings based on customer risk policy. This can be setup at https://portal.riskrecon.com/portal/risk-policy.

security_domainstring

Example:software_patching

Filter results by the Security Domain.

security_criteriastring

Example:patching_app_server

Filter results by the Security Criteria.

asset_value[]string[]

This parameter filters finding results by asset_values. An example of a query string with multiple asset_values would look like:

?asset_value[]=high&asset_value[]=low

[
  "high"
]

asset_value_numeric[]string[]

Filter results by asset_value_numeric. An example of a query string with multiple asset_value_numeric values would look like ?asset_value_numeric[]=1&asset_value_numeric[]=3

[
  "1"
]

priority[]integer[]

Filter results by priority. An example of a query string with multiple priority values would look like ?priority[]=1&priority[]=3.

[
  1
]

severity[]string[]

Filter results by severity. An example of a query string with multiple severities would look like ?severity[]=low&severity[]=medium&severity[]=high.

[
  "high"
]

Response

country_iso_codestring nullable

The country ISO code if available.

first_seenstring nullable

The date the finding was first discovered.

tech_countrystring nullable

The tech country associated with host if provided.

shared_ipstring nullable

The use of shared ip address hosting.

registrant_streetstring nullable

The registrant street associated with host if available.

security_criteriastring

The security_criteria associated with the finding.

continent_codestring nullable

The continent code if available.

registrar_expire_datestring nullable

The registrar_expire_date if available.

registrar_abuse_phonestring nullable

The registrar_abuse_phone if available.

tech_streetstring nullable

The tech street associated with host if available.

state_namestring nullable

The state name associated with host if available or applicable.

finding_extra_data_valuestring nullable

Any additional data associated with the finding.

toe_idstring uuid

The unique identifier for the Target Of Evaluation (TOE).

finding_data_valuestring nullable

The type of finding data.

servicestring nullable

The type of service detected. This could be dns, email, web or blank.

is_webstring

Was a web server found? The value could be 0 or 1.

admin_orgstring nullable

The admin org if available.

industrystring nullable

The industry if available.

longitudestring nullable

The latitude associated with host if available.

registrarstring nullable

The registrar if available.

severitystring

The severity for the finding.

hosting_typestring

The hosting type can be internal or external hosting.

admin_phone_extstring nullable

The admin phone extension if available or applicable.

admin_countrystring nullable

The name of the admin country if available.

registrant_emailstring nullable

The registrant_email if available.

record_load_timestampstring

The timestamp for when record was loaded.

admin_namestring nullable

The admin_name if available.

asset_valuestring

asset value associated with host. high, medium, low or idle

admin_zipstring nullable

The admin_zip if available.

auto_statusstring nullable

The auto status of the finding.

finding_contextstring nullable

Any additional context related to the finding.

tech_zipstring nullable

The tech_zip if available or applicable.

form_field_types_detectedstring nullable

Any form fields detected.

admin_citystring nullable

The admin city name if available.

finding_idstring

The unique identifier for the finding.

registrant_countrystring nullable

The name of registrant_country if available.

analysis_idstring

The analysis_id associated with the finding.

host_namestring nullable

The name of the host.

registrar_ianastring nullable

The registrar_iana if available.

findingstring nullable

High level finding information.

registrar_abuse_emailstring nullable

The registrar_abuse_email if available.

expires_onstring nullable

The expires_on date if applicable.

registrar_idstring nullable

The registrar_id if available.

tech_orgstring nullable

The tech_org if available.

analyst_statusstring nullable

The analyst status of the finding.

ip_addressstring

The ip address associated with host.

tech_emailstring nullable

The tech_email if available.

finding_detailstring nullable

The details about the finding.

state_abbrevstring nullable

The state_abbrev if available or applicable.

admin_phonestring nullable

The admin_phone if available.

domain_namestring nullable

The domain name if available.

postal_codestring nullable

The postal code associated with host if available.

vendorstring nullable

vendor if available

security_domainstring

The security_domain category for the finding.

registrant_phonestring nullable

The registrant_phone if available.

registrant_namestring nullable

The registrant_phone if available.

finding_typestring nullable

The type of finding.

latitudestring nullable

The longitude associated with host if available.

hosting_providerstring nullable

The hosting provider if available.

priorityinteger

The finding priority based on the asset_value and severity.

last_seenstring

The date the finding was last seen.

country_namestring nullable

The name of country if available.

false_positivestring nullable

Was the finding determined to be a false positive?

registrant_orgstring nullable

The registrant_org if available.

registrant_phone_extstring nullable

The registrant_phone_ext if available or applicable.

finding_auto_commentsstring

The finding_auto_comments if available or applicable.

scanstring

The scan number.

tech_phonestring nullable

The tech_phone if available.

name_serverstring nullable

The name server if available.

tech_citystring nullable

The tech city name if available.

tech_namestring nullable

The tech name if available.

admin_streetstring nullable

The admin street associated with host if available.

auth_detectedstring nullable

Any authentication detected?

admin_emailstring nullable

The admin_email if available.

continent_namestring nullable

The continent if available.

finding_subtypestring nullable

The finding subtype.

finding_data_descriptionstring nullable

The finding data description.

finding_short_descriptionstring nullable

The finding data description.

severity_numericstring

The numeric severity for a finding.

registry_tech_idstring nullable

The registry_tech_id if available.

metro_codestring nullable

The metro_code if available.

asset_value_numericstring

The numeric asset_value associated with a findings host.

registrant_zipstring nullable

The registrant_zip if available.

city_namestring nullable

The city name if available.

registrant_citystring nullable

The registrant_city if available.

how_to_fix_itstring nullable

How to fix the finding.

support_sitestring nullable

The support site if available.

who_should_fix_itstring nullable

Who should fix the finding.

Example response

[
  {
    "country_iso_code": "AW",
    "first_seen": "2021-10-01T22:18:57+00:00",
    "tech_country": "Luxembourg",
    "shared_ip": "40.14.1.146",
    "registrant_street": "11185 street",
    "security_criteria": "threatintel_phishing_site",
    "continent_code": "SA",
    "registrar_expire_date": "2021-10-01T22:18:57+00:00",
    "registrar_abuse_phone": "+44348154931",
    "tech_street": "Sampson street",
    "state_name": "NY",
    "finding_extra_data_value": "shared_hosting",
    "toe_id": "5976423a-ee35-11e3-8569-14109ff1a304",
    "finding_data_value": "shared_hosting",
    "service": "dns",
    "is_web": "0",
    "admin_org": "Riskrecon, Co.",
    "industry": "Industrials",
    "longitude": "46.9302",
    "registrar": "Riskrecon, Co.",
    "severity": "high",
    "hosting_type": "internal",
    "admin_phone_ext": "5323",
    "admin_country": "Luxembourg",
    "registrant_email": "jordan.jacobi@wilkinson.name",
    "record_load_timestamp": "2022-02-09 21:04:47.429380",
    "admin_name": "domain administrator",
    "asset_value": "high",
    "admin_zip": "12348",
    "auto_status": "fail",
    "finding_context": "The domain is missing one or more domain hijacking flags (clientTransferProhibited, clientDeleteProhibited, clientUpdateProhibited).",
    "tech_zip": "12348",
    "form_field_types_detected": "token;email address",
    "admin_city": "Aileen",
    "finding_id": "5976423a-ee35-11e3-8569-14109ff1a304",
    "registrant_country": "Luxembourg",
    "analysis_id": "12345",
    "host_name": "riskrecon.com",
    "registrar_iana": "12349832749",
    "finding": "DNS Hijacking protection configuration",
    "registrar_abuse_email": "jordan.jacobi@wilkinson.name",
    "expires_on": "2022-09-08 00:00:00 UTC",
    "registrar_id": "12349832749",
    "tech_org": "Riskrecon, Co.",
    "analyst_status": "fail",
    "ip_address": "40.14.1.146",
    "tech_email": "jordan.jacobi@wilkinson.name",
    "finding_detail": "shared_hosting",
    "state_abbrev": "NY",
    "admin_phone": "+44348154931",
    "domain_name": "thiel.name",
    "postal_code": "75524",
    "vendor": "Riskrecon, Co.",
    "security_domain": "patching_app_server",
    "registrant_phone": "+44348154931",
    "registrant_name": "domain administrator",
    "finding_type": "dns",
    "latitude": "-112.3351",
    "hosting_provider": "Riskrecon, Co.",
    "priority": 5,
    "last_seen": "2020-10-10",
    "country_name": "Luxembourg",
    "false_positive": "false",
    "registrant_org": "Riskrecon, Co.",
    "registrant_phone_ext": "5323",
    "finding_auto_comments": "Certificate subject is invalid",
    "scan": "1",
    "tech_phone": "+44348154931",
    "name_server": "thiel.name",
    "tech_city": "Aileen",
    "tech_name": "Riskrecon, Co.",
    "admin_street": "Sampson street",
    "auth_detected": "no",
    "admin_email": "jordan.jacobi@wilkinson.name",
    "continent_name": "South America",
    "finding_subtype": "application server",
    "finding_data_description": "Missing Security Headers",
    "finding_short_description": "Missing Security Headers",
    "severity_numeric": "3.5",
    "registry_tech_id": "5",
    "metro_code": "12345",
    "asset_value_numeric": "3.5",
    "registrant_zip": "75524",
    "city_name": "Aileen",
    "registrant_city": "Aileen",
    "how_to_fix_it": "Add security headers",
    "support_site": "https://support.riskrecon.com",
    "who_should_fix_it": "Security Team"
  }
]

Changes

No recorded changes to this operation across all 1 revision of this API.