--- title: "Return vulnerability data stored in index \"initial-access\"" method: GET path: "/index/initial-access" tags: ["indices"] --- # Return vulnerability data stored in index "initial-access" `GET /index/initial-access` ## Request - Base URL: `https://api.vulncheck.com/v3` - URL: `https://api.vulncheck.com/v3/index/initial-access` - Auth: API key in header `Authorization` - TypeScript: (a function with typed inputs; its response is checked against the schema) ### Overview This endpoint allows you to retrieve a paginated list of all documents from the initial-access index. \ By default, a maximum of 100 documents are shown per page. **Index Description:** VulnCheck Initial Access Intelligence ### Paging Over Large Data (cursor) In order to allow users to iterate over large index datasets, this endpoint provides a server-side "cursor" mechanism. To use the cursor, first call `GET /index/initial-access?start_cursor`, the response will have a `next_cursor` id that clients will need to pass as a query parameter to the next request like `GET /index/initial-access?cursor=` ## Query parameters - `page` integer - `limit` integer - `cursor` string - `start_cursor` 'true' - `order` 'asc' | 'desc' - `sort` string - `cve` string - `alias` string - `iava` string - `jvndb` string - `ilvn` string - `threat_actor` string - `mitre_id` string - `misp_id` string - `ransomware` string - `botnet` string - `published` string - `date` string - `updatedAtStartDate` string - `updatedAtEndDate` string - `lastModStartDate` string - `lastModEndDate` string - `pubStartDate` string - `pubEndDate` string ## Response `200` OK - RenderResponseWithMetadataArrayApiInitialAccessPaginatePagination - `_benchmark` number: Benchmark is the server-side processing time for the request in seconds. Example: 0.122322 = approximately 122 milliseconds - `_meta` PaginatePagination: Meta is the metadata related to the endpoint response - `cursor` string: Cursor is an opaque string representing the current page position for cursor-based pagination. Contains encoded information about sort values and position markers. Use this value with the 'cursor' query parameter to resume pagination from this point. - `first_item` integer: FirstItem is the 1-indexed position of the first item on the current page. Example: Page 1 with limit 100 → FirstItem = 1 Page 2 with limit 100 → FirstItem = 101 - `index` string: Index name being queried, corresponding to the VulnCheck data feed. Examples: "exploits", "vulncheck-nvd2", "ipintel-3d", "malicious-vscode-exts" - `last_item` integer: LastItem is the 1-indexed position of the last item on the current page. Accounts for partial pages. Example: Page with 50 items → LastItem = FirstItem + 49 On the final page, LastItem equals TotalRows. - `limit` integer: Limit is the maximum number of items returned in this response. Range: 1-100 for standard indices, 1-10 for large indices. Default: 100 (or 10 for indices marked as "large" in metadata) - `matches` PaginateMatch[]: Matches shows the active filter values applied to the current query. Each match includes the field name and the value being filtered on. Helps users understand which filters are currently active. - `field` string: Field is the name of the field being filtered on. - `value` string: Value is the filter value being applied to the field. - `max_pages` integer: MaxPages is the maximum number of pages allowed for offset-based pagination. Performance limit to prevent expensive deep pagination. Default: 6 pages. When TotalPages > MaxPages, cursor-based pagination should be used instead. - `next_cursor` string: NextCursor is an opaque string for fetching the next page in cursor-based pagination. When empty or null, indicates no more pages are available. More efficient than offset pagination for large datasets and real-time data. - `opensearch_query` object: OSQuery contains the raw OpenSearch query JSON used internally. Only included when show_query=true parameter is set. Useful for debugging complex queries and understanding performance. - `order` string: Order specifies the sort direction: "asc" (ascending) or "desc" (descending). Default: "desc" for most time-based indices to show newest items first. - `page` integer: Page is the current page number for offset-based pagination (1-indexed). First page = 1, second page = 2, etc. Used with Limit to calculate database offset. For cursor-based pagination, this field may be omitted or estimated. - `pages` string[]: Pages contains page numbers to display in pagination UI (e.g., [1, 2, "...", 45]). Only populated when ShowPages=true. Includes ellipsis ("...") for gaps. Limited by MaxPages to prevent overwhelming UI with too many page links. - `parameters` PaginateParam[]: Params describes available query parameters for this index. Each parameter includes name, format constraints, and filtering capabilities. Used for building dynamic query UIs and input validation. - `filtering` string: Filtering indicates the type of filtering this parameter supports. Examples: "exact", "range", "wildcard", "boolean" - `format` string: Format describes the expected parameter format or pattern. Examples: "CVE-YYYY-N{4-7}", "YYYY-MM-DD", "numeric" - `name` string: Name is the query parameter name (e.g., "cve", "date", "limit"). - `show_pages` boolean: ShowPages controls whether the Pages array should be calculated and included. Set to true for UI pagination controls, false for API-only usage to save processing. - `show_query` boolean: ShowQuery indicates whether the raw OpenSearch query should be included. When true, OSQuery field will be populated with the internal query structure. - `sort` string: Sort field used for ordering results. Available fields vary by index. Common values: "_timestamp", "date_added", "_id", "lastSeen" Affects cursor generation and ensures pagination consistency. - `timestamp` string: Timestamp when the query was executed in UTC (ISO 8601 format). Used for debugging, cache management, and determining data freshness. Example: "2024-02-23T20:35:43.732591251Z" - `total_documents` integer: TotalRows is the total number of documents matching the query across all pages. Used for calculating total_pages and building pagination UI elements. Note: May be capped for performance on very large result sets. - `total_pages` integer: TotalPages is the total number of pages based on TotalRows and Limit. Calculated as: ceil(TotalRows / Limit). Used for pagination UI and validation. Example: 1000 items with limit 100 = 10 total pages. - `truncated` boolean: Truncated is true when a cursor page holds fewer records than Limit because it reached the response size cap, or because it would otherwise end between records that sort equally. More records follow: keep requesting with NextCursor. - `warnings` string[]: Warnings contains any non-fatal issues encountered during query processing. Examples: deprecated parameters, performance concerns, or data quality notes. - `data` ApiInitialAccess[]: Data is the data returned by the endpoint - `artifacts` ApiInitialAccessArtifact[]: Artifacts holds the set of available artifacts for this vulnerability, such as exploit, shodan queries, PCAP traces, and others. - `artifactName` string: ArtifactName is a title to associate with this artifact. - `artifactsURL` string[]: ArtifactsURL are URLs to the available artifact. - `baiduQueries` string[]: ... - `baiduRawQueries` string[]: ... - `censysLegacyQueries` string[]: CensysLegacyQueries are legacy queries for examining potential Internet-exposed devices & applications with Censys in URL form. - `censysLegacyRawQueries` string[]: CensysLegacyRawQueries are raw legacy queries for examining potential Internet-exposed devices & applications with Censys. - `censysQueries` string[]: CensysQueries are queries for examining potential Internet-exposed devices & applications with Censys in URL form. - `censysRawQueries` string[]: CensysRawQueries are raw queries for examining potential Internet-exposed devices & applications with Censys. - `chain` string[]: Chain can represent the chain of exploitation. - `cloneSSHURL` string: CloneSSHURL is the git URL to clone the artifact with. - `dateAdded` string: DateAdded is when this artifact entry was first added to the InitialAccess data set. - `driftnetQueries` string[]: DriftnetQueries are queries for examining Internet exposed services with Driftnet. - `driftnetRawQueries` string[]: DriftnetRawQueries are queries for examining Internet exposed services with Driftnet. - `exploit` boolean: Exploit indicates whether or not an exploit is available in this artifact. - `fofaQueries` string[]: FOFAQueries are raw queries for examining potential Internet-exposed devices & applications with FOFA. - `fofaRawQueries` string[] - `goexploit` ApiInitialAccessGoExploit: GoExploit holds metadata about the VulnCheck Go exploit module for this artifact, if one exists. - `assetDetection` boolean: AssetDetection indicates whether the module can detect the presence of the asset. - `cpe` string[]: CPE lists the CPE strings for products targeted by this exploit module. - `customFlags` ApiInitialAccessGoExploitCustomFlag[]: CustomFlags lists any additional flags exposed by the exploit module. - `default` string: Default is the flag's default value, serialized as a string. - `name` string: Name is the flag name. - `type` string: Type is the flag's value type (string, int, uint, bool). - `usage` string: Usage is the flag's help text. - `defaultPort` integer: DefaultPort is the default port the exploit targets. - `exploitType` string: ExploitType is the category of exploit (e.g. CodeExecution, InformationDisclosure). - `exploitation` boolean: Exploitation indicates whether the module can exploit the vulnerability. - `protocol` string: Protocol is the network protocol the exploit targets (e.g. HTTP, TCP). - `supportedC2` string[]: SupportedC2 lists the C2 server types supported by the exploit module. - `versionScanner` boolean: VersionScanner indicates whether the module can determine if the target is vulnerable without sending an exploit payload. - `googleQueries` string[]: google queries - `googleRawQueries` string[]: raw google queries - `greynoiseQueries` string[]: GreynoiseQueries are queries for finding the vulnerability via honeypot data. - `mitreAttackTechniques` string[]: MITRE ATT&CK techniques - `nmapScript` boolean: NmapScript indicates whether or not an nmap script for scanning environment exists in this artifact. - `pcap` boolean: PCAP indicates whether of not a package capture of the exploit PoC exploiting a vulnerable system exists in this artifact. - `product` string[]: Product are the software that has the vulnerability. - `related` string[]: Related is a set of related cves. - `shodanQueries` string[]: ShodanQueries are queries for examining potential Internet-exposed devices & applications with Shodan in URL form. - `shodanRawQueries` string[]: ShodanRawQueries are raw queries for examining potential Internet-exposed devices & applications with Shodan. - `sigmaRule` boolean: SigmaRule indicates whether or not a Sigma rule designed to detect the exploitation of the vulnerability over the network exists in this artifact. - `snortRule` boolean: SnortRule indicates whether or not a Snort rule designed to detect the exploitation of the vulnerability over the network exists in this artifact. - `suricataRule` boolean: SuricataRule indicates whether or not a Suricata rule designed to detect the exploitation of the vulnerability over the network exists in this artifact. - `targetDocker` boolean: TargetDocker indicates whether or not there is an available docker image with the vulnerability. - `targetEncryptedComms` string: Encrypted communications? - `targetService` string: TargetService indicates the service (HTTP, FTP, etc) that this exploit targets. - `vcTargetIntelQuery` string[]: VCTargetIntelQuery are URLs to the VulnCheck target intel index for this artifact's vendor/product. - `vendor` string: Vendor of the vulnerable product - `versionScanner` boolean: VersionScanner indicates whether or not the exploit PoC can determine if target system is vulnerable without sending exploit payload in this artifact. - `yara` boolean: YARA indicates whether or not a YARA rule designed to detect the exploit on an endpoint exists in this artifact. - `zeroday` boolean: Zeroday indicates whether or not it is a VulnCheck zeroday. - `zoomEyeQueries` string[]: ZoomEyeQueries are raw queries for examining potential Internet-exposed devices & applications with ZoomEye. - `zoomEyeRawQueries` string[] - `cve` string: CVE identifier for the given initial access record. - `id` string: ID is the unique identifier for this initial access record. - `inKEV` boolean: InKEV is true if this artifact is in CISA's Known Exploited Vulnerabilities (KEV) data set; otherwise, false. - `inVCKEV` boolean: InVCKEV is true if this artifact is in VulnCheck's Known Exploited Vulnerabilities (VCKEV) data set; otherwise, false. - `vulnerable_cpes` string[]: VulnerableCPEs is the list of vulnerable CPE strings associated with this CVE and artifact(s). ## Other responses - `404`: Not Found - `500`: Internal Server Error --- [API](https://skmtc.dev/vulncheck/apis/vulncheck-api.md) - [All operations](https://skmtc.dev/vulncheck/apis/vulncheck-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vulncheck/apis/vulncheck-api/revisions/7c714606affe?raw)