---
title: "Get Signature"
method: GET
path: "/projects/{project_id}/signatures/{signature_id}"
tags: ["Signatures"]
---

# Get Signature

`GET /projects/{project_id}/signatures/{signature_id}`

## Request

- Base URL: `https://api.securitytrails.com/v2`
- URL: `https://api.securitytrails.com/v2/projects/{project_id}/signatures/{signature_id}`
- Auth: none declared

Fetch data for a signature by its `signature_id`. The signature does not need to be related to an exposure in your project.

Use `additional_fields` to specify additional enrichments to include in the response.

## Path parameters

- `project_id` string, required: The ID of the project
- `signature_id` string, required: Exposure with this signature ID found on the asset

## Query parameters

- `additional_fields` string[], nullable: A list of additional fields to include in the response. You may specify this field multiple times or pass a comma-separated list from: `summary`, `mechanics`, `threat`, `scoring`, `taxonomy`, `remediation`, `incident_response`, `verification`, `references`, `keywords`, `vulnerabilities`, `technologies`, `detections`, or `all`. By default only the basic signature fields are returned.

## Response `200`

Successful Response

- SignatureDetailsResponse
  - `data` SignatureDetails, required
    - `id` string, required
    - `name` string
    - `description` string, nullable
    - `severity` union, required
      - 'informational' | 'moderate' | 'critical'
      - string
    - `added_at` string, date-time, nullable: Date when this signature was added to ASI
    - `references` SignatureReference[], nullable
      - `url` string, required
      - `title` string, nullable
      - `category` string, nullable
      - `source` string, nullable
    - `vulnerabilities` VulnerabilityDetails[]
      - `name` string, required
      - `cve_id` string, required: The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability.
      - `cwe_ids` string[]: Common Weakness Enumeration (CWE) IDs associated with this vulnerability
      - `cvss_score` number, nullable
      - `slug` string, required: The unique identifier for this vulnerability
      - `epss_score` number, nullable
      - `references` string[]
      - `cvss_version` string, nullable
      - `cvss_metrics` string, nullable
      - `cvss` CvssScores
        - `v2` CvssScore
          - `score` number, nullable
          - `vector` string, nullable
        - `v3` CvssScore
          - `score` number, nullable
          - `vector` string, nullable
        - `v4` CvssScore
          - `score` number, nullable
          - `vector` string, nullable
    - `updated_at` string, date-time, nullable
    - `severity_score` integer, nullable
    - `primary_detection_id` string, nullable
    - `tags` string[], nullable
    - `cve_ids` string[], nullable
    - `detection_count` integer, nullable
    - `vulnerability_count` integer, nullable
    - `technology_count` integer, nullable
    - `available_includes` string[], nullable
    - `summary` SignatureSummary
      - `executive` string, nullable
    - `mechanics` SignatureMechanics
      - `root_cause_explanation` string, nullable
      - `prerequisites` Prerequisite[], nullable
        - `required` boolean, nullable
        - `condition` string, nullable
      - `exposure_flow` ExposureFlowStep[], nullable
        - `step_number` integer, nullable
        - `description` string, nullable
        - `detailed_description` string, nullable
        - `detail_confidence` string, nullable
      - `attacker_gains` string[], nullable
      - `impact` ImpactRating
        - `confidentiality` string, nullable
        - `integrity` string, nullable
        - `availability` string, nullable
    - `threat` SignatureThreat
      - `exploitation_observed` boolean, nullable
      - `lifecycle_stage` string, nullable
      - `campaign_overview` string, nullable
      - `activity_timeline` ActivityTimelineEvent[], nullable
        - `date` string, nullable
        - `event` string, nullable
      - `tactics_and_techniques` string, nullable
      - `target_profile` string, nullable
      - `co_occurring_actors` CoOccurringEntities
        - `count` integer, nullable
        - `note` string, nullable
        - `top` string[], nullable
      - `co_occurring_malware` CoOccurringEntities
        - `count` integer, nullable
        - `note` string, nullable
        - `top` string[], nullable
    - `scoring` SignatureScoring
      - `score` integer, nullable
      - `factors` ScoringFactor[], nullable
        - `factor` string, nullable
        - `detail` string, nullable
      - `rationale` string[], nullable
      - `source` string, nullable
    - `taxonomy` SignatureTaxonomy
      - `category` string, nullable
      - `mitre` MitreTaxonomy
        - `tactics` string[], nullable
        - `techniques` string[], nullable
        - `sub_techniques` string[], nullable
      - `tags` TagTaxonomy
        - `impact` string[], nullable
        - `environment` string[], nullable
        - `risk_context` string[], nullable
      - `common_network_ports` integer[], nullable
    - `remediation` SignatureRemediation
      - `primary_action` string, nullable
      - `loe_estimate` string, nullable
      - `tasks` RemediationTask[], nullable
        - `title` string, nullable
        - `category` string, nullable
        - `description` string, nullable
        - `depends_on` unknown[], nullable
          - unknown
        - `effort_hours` number, nullable
        - `rollback_step` string, nullable
        - `service_impact` string, nullable
        - `acceptance_criteria` string[], nullable
      - `runbook` RunbookStep[], nullable
        - `title` string, nullable
        - `context` string, nullable
        - `priority` string, nullable
        - `action_items` ActionItem[], nullable
          - `action` string, nullable
          - `detail` string, nullable
          - `commands` string[], nullable
          - `sub_steps` string[], nullable
      - `risks` RemediationRisk[], nullable
        - `risk` string, nullable
        - `impact` string, nullable
        - `category` string, nullable
      - `mitigations` Mitigation[], nullable
        - `mitigation` string, nullable
        - `risk_category` string, nullable
        - `steps` string[], nullable
      - `controls` CompensatingControl[], nullable
        - `control_id` integer, nullable
        - `control_heading` string, nullable
        - `control_type` string, nullable
        - `control_function` string, nullable
        - `action` string, nullable
        - `rationale` string, nullable
        - `deploy_time` string, nullable
        - `covers_steps` integer[], nullable
        - `false_positive_risk` string, nullable
      - `post_remediation_checks` PostRemediationCheck[], nullable
        - `check_number` integer, nullable
        - `name` string, nullable
        - `context` string, nullable
        - `action_items` ActionItem[], nullable
          - `action` string, nullable
          - `detail` string, nullable
          - `commands` string[], nullable
          - `sub_steps` string[], nullable
        - `expected_result` string, nullable
        - `fail_condition` string, nullable
        - `if_failed` string, nullable
    - `incident_response` SignatureIncidentResponse
      - `ir_applicable` boolean, nullable
      - `triage_assessment` TriageAssessment
        - `severity_context` string, nullable
        - `exploitation_status` string, nullable
      - `containment_actions` ContainmentAction[], nullable
        - `action_id` integer, nullable
        - `scope` string, nullable
        - `action` string, nullable
        - `rollback_notes` string, nullable
      - `investigation_checklist` InvestigationStep[], nullable
        - `step_number` integer, nullable
        - `action` string, nullable
        - `purpose` string, nullable
        - `tools` string[], nullable
        - `expected_findings` string, nullable
      - `eradication_and_recovery` EradicationAndRecovery
        - `eradication_steps` string[], nullable
        - `recovery_steps` string[], nullable
        - `verification_actions` string[], nullable
      - `indicators_of_compromise` IndicatorOfCompromise[], nullable
        - `indicator_type` string, nullable
        - `description` string, nullable
        - `detection_method` string, nullable
        - `confidence` string, nullable
      - `post_incident_actions` string[], nullable
    - `verification` SignatureVerification
      - `steps` VerificationStep[], nullable
        - `step_number` integer, nullable
        - `title` string, nullable
        - `description` string, nullable
        - `commands` string[], nullable
        - `look_for` string[], nullable
        - `vulnerable_indicator` string, nullable
        - `not_vulnerable_indicator` string, nullable
        - `inconclusive` string, nullable
    - `technologies` SignatureTechnology[], nullable
      - `name` string, nullable
      - `vendor` string, nullable
      - `product` string, nullable
      - `technology_type` string, nullable
      - `description` string, nullable
      - `known_aliases` string[], nullable
      - `known_cpes` string[], nullable
      - `primary_cpe` string, nullable
      - `cpe_count` integer, nullable
    - `detections` SignatureDetection[], nullable
      - `detection_id` string, nullable
      - `tool_name` string, nullable
      - `behavior` DetectionBehavior
        - `detection_summary` string, nullable
        - `protocols` string[], nullable
        - `probe_details` ProbeDetail[], nullable
          - `protocol` string, nullable
          - `method` string, nullable
          - `path` string, nullable
          - `headers` unknown[], nullable
            - unknown
          - `payload_structure` string, nullable
          - `probe_description` string, nullable
          - `target_description` string, nullable
        - `request_sequence` RequestSequenceStep[], nullable
          - `step` integer, nullable
          - `description` string, nullable
        - `requests` DetectionRequest[], nullable
          - `sequence_number` integer, nullable
          - `method` string, nullable
          - `target_path` string, nullable
          - `custom_headers` unknown[], nullable
            - unknown
          - `has_body` boolean, nullable
          - `body_description` string, nullable
          - `notes` string, nullable
        - `response_checks` ResponseCheck[], nullable
          - `check_type` string, nullable
          - `description` string, nullable
          - `evidence_sought` string, nullable
        - `matcher_count` integer, nullable
        - `safety_profile` string[], nullable
        - `false_positive_assessment` FalsePositiveAssessment
          - `confidence` string, nullable
          - `reasoning` string, nullable
          - `scenarios` string[], nullable
        - `false_negative_assessment` FalseNegativeAssessment
          - `reasoning` string, nullable
          - `scenarios` string[], nullable
    - `keywords` string[], nullable
  - `meta` ApiMeta, required
    - `params` object, nullable
    - `counts` ApiCount
      - `total` integer, nullable
      - `returned` integer, required
    - `pagination` PaginationResponse
      - `next_cursor` string, nullable: An opaque value which should be passed as the `cursor` to retrieve the nextpage of results
      - `limit` integer, nullable: The number of items returned
      - `total` integer, nullable
      - `sort` array[], nullable: The sort order of the results
        - unknown[]
          - unknown
    - `request_id` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/securitytrails/apis/asi-project-api.md) - [All operations](https://skmtc.dev/securitytrails/apis/asi-project-api/llms.txt) - [OpenAPI document](https://skmtc.dev/securitytrails/apis/asi-project-api/revisions/71340c041238?raw)