GET: Insecure Systems Finding Details

Ingrid

https://api.bitsighttech.com/ratings/v1/companies/company_guid/findings?risk_vector=insecure_systems

Get an organization’s Insecure Systems finding details.

Parameters

For details specific to Insecure Systems, use the ?risk_vector=insecure_systems parameter. Other query parameters are listed in GET: Finding Details.

Example Request

curl https://api.bitsighttech.com/ratings/v1/companies/a940bb61-33c4-42c9-9231-c8194c305db3/findings?risk_vector=insecure_systems -u api_token:

Example Response

{
  "links":{
    "next":null,
    "previous":null
  },
  "count":13,
  "results":[
    […]
    {
      "temporary_id":"A9Jq47BBje9af792864beec391ad7c979da67673ec",
      "pcap_id":"UENBUHBjYXBQQ0FQcGNhcBOSSRTXE8YdG7wF5P1j_0CHKbTTR_8mQXRlxhbUvm4pvuvr2UrfTgurtPLSvWdE39Pup3kRfq95kPw9I3v-R3M=",
      "affects_rating":false,
      "assets":[
        {
          "asset":"137.117.206.1",
          "identifier":null,
          "category":"low",
          "importance":0.0,
          "is_ip":true
        }
      ],
      "details":{
        "cvss":{
          "base":[ ]
        },
        "check_pass":"",
        "diligence_annotations":{
          "message":"Service: Netbios",
          "risks":[
            "Hijack - Domain owners can interact with endpoints potentially hijacking NTLM creds."
          ],
          "source_ip":"137.117.206.1"
        },
        "geo_ip_location":"NL",
        "country":"Netherlands",
        "grade":"BAD",
        "remediations":[ ],
        "sample_timestamp":"2022-09-13T09:33:40Z",
        "sample_count":1,
        "vulnerabilities":[ ],
        "dest_port":445,
        "rollup_end_date":"2022-09-13",
        "rollup_start_date":"2022-09-13",
        "searchable_details":"Service: Netbios",
        "src_port":1025
      },
      "evidence_key":"137.117.206.1",
      "first_seen":"2022-09-13",
      "last_seen":"2022-09-13",
      "related_findings":[ ],
      "risk_category":"Diligence",
      "risk_vector":"insecure_systems",
      "risk_vector_label":"Insecure Systems",
      "rolledup_observation_id":"CkdF7UmgfzbspiRFxA8eKA==",
      "severity":10.0,
      "severity_category":"severe",
      "tags":[ ],
      "remediation_history":{
        "last_requested_refresh_date":"2024-06-19",
          "last_refresh_status_date":"2024-06-23",
          "last_refresh_status_label":"failed",
        "last_refresh_status_reason": "asset_not_found",
          "last_refresh_reason_code":"asset unreachable",
          "last_refresh_requester": "1e10564d-fawa-4331-0000-6f7588b55a98",
        "result_finding_date": null
      },
      "asset_overrides":[ ],
      "duration":null,
      "comments":null,
      "remaining_decay":null,
      "remediated":null
    }
  ]
}

Response Attributes

Field					Description
links Object					Navigation for multiple pages of results. See pagination.
	next String				The URL for navigating to the next page of results.
	previous String				The URL for navigating to the previous page of results.
count Integer					The number of findings.
results Array					Findings and their details.
	Object				A finding.
		temporary_id String			A temporary identifier for this finding.
		pcap_id String			The packet capture (PCAP or libpcap) ID.
		affects_rating Boolean			`true` = This finding has an impact on the risk vector letter grade.
		assets Array			Asset details.
			Object		An asset (IP address or domain).
				asset String	The asset associated with this finding.
				identifier Null	This is not applicable to Insecure System findings.
				category String	The Bitsight-calculated asset importance.
				importance Decimal	For internal Bitsight use.
				is_ip Boolean	true = The asset is an IP address.
		details Object			Details of this finding.
			cvss Object		If the finding has an associated vulnerability, this contains the CVSS score.
				base Array	CVSS scores of vulnerabilities associated with this finding.
			check_pass String		For internal Bitsight use.
			diligence_annotations Object		Diligence finding details.
				message String	The display name of this finding.
				risks Array	A description of the risks involved with this system.
				source_ip String	The IP address of this insecure system.
			geo_ip_location String		A 2-letter ISO country code indicating this finding’s country of origin.
			country String		This finding’s country of origin.
			grade String		The finding grade.
			remediations Array		Information about the finding and instructions to remediate it, if any.
			sample_timestamp String [`YYYY-MM-DDTHH:MM:SSZ`]		The date and time when this finding was observed.
			sample_count Integer
			vulnerabilities Array		Not applicable to Insecure System findings.
			dest_port Integer		A compromised device was observed to be sending traffic from this port.
			rollup_end_date String [`YYYY-MM-DD`]		The date when this finding was last observed.
			rollup_start_date String [`YYYY-MM-DD`]		The date when this finding was first observed.
			searchable_details String		Details that can be searched in the Bitsight platform.
			src_port Integer		The port where traffic from a compromised device was observed.
		evidence_key String			The asset (domain or IP address) that’s attributed to this finding.
		first_seen String [`YYYY-MM-DD`]			The date when this finding was first observed.
		last_seen String [`YYYY-MM-DD`]			The date when this finding was last observed.
		related_findings Array			Findings and their details.
		risk_category String			The risk category.
		risk_vector String			The risk vector slug name.
		risk_vector_label String			The risk vector display name.
		rolledup_observation_id String			A stable and randomized identifier for findings. It is assigned to a finding when one or more observations with largely similar key properties occur in close succession.
		severity Decimal			This finding’s Bitsight severity.
		severity_category String			This finding’s Bitsight severity.
		tags Array			Infrastructure tags identifying the asset.
		remediation_history Object			If `?expand=remediation_history` parameter is set, the remediation history of the finding is included.
			last_requested_refresh_date String [`YYYY‑MM‑DD`]		The date when a finding rescan that included this finding was last requested.
				last_refresh_status_date String [`YYYY‑MM‑DD`]	The date when a rescan of the remediation status of this finding was last requested.
				last_refresh_status_label String	The current rescan status of this finding.
			last_refresh_status_reason String		The rescan status.
				last_refresh_reason_code String	The reason code for the rescan status.
				last_refresh_requester String [`user_guid`]	The unique identifier of the user who requested the rescan.
			result_finding_date String [`YYYY-MM-DD`]		The first seen date of the finding that resulted from the rescan, if applicable.
		asset_overrides Array			User-assigned asset importance details.
		duration Null			For internal Bitsight use.
		comments String			A thread of finding comments.
		remaining_decay Integer [`Calendar Days`]			The remaining finding lifetime.
		remediated Boolean			`true` = The finding is remediated.

February 28, 2025: Added last_refresh_status_reason, last_refresh_reason_code, last_refresh_requester, and result_finding_date response attributes.
September 25, 2023: Published.