Compromised Device Search

POSThttps://api.deepinfo.com/v1/cti/compromised-devices

Searches compromised (infostealer-infected) devices linked to your employees.

Authentication

Send your API key in the apikey request header.

Query Parameters

ParameterRequiredDescription
page_sizeOptional
Min 25, max 100. Default 100.
Example25
pageOptional
Min 1, max 800. Default 1.
Example1

Request Body

ParameterTypeRequiredDescription
filtersobjectOptional
See Filtering below
sortarrayOptional
List of {field, order}
application/json
{}

Filtering

Example body:

JSON
{
  "filters": {
    "must": [
      {
        "name": "compromised_device.hardware_id",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "compromised_device.hardware_id",
      "order": "desc"
    }
  ]
}

See Getting Started → Search & Filters for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators eq in startswith endswith contains_any contains_all exists

FieldDescription
compromised_device.hardware_idThe hardware ID the infostealer recorded for the infected device, which identifies one machine across logs.
compromised_device.user_info.usernameThe operating-system user name on the infected device, as the stealer log recorded it.
compromised_device.user_info.machine_nameThe computer name of the infected device; the platform shows it as MACHINE.
compromised_device.user_info.countryThe country the infected device was in when the log was made, as the stealer recorded it.
compromised_device.user_info.locationThe location the stealer log gives for the device, such as a city or region.
compromised_device.user_info.zip_codeThe postal code the stealer log gives for the device's location.
compromised_device.user_info.languageThe system language of the infected device; the platform shows it as LANGUAGE.
compromised_device.user_info.time_zoneThe time zone set on the infected device; the platform shows it as TIMEZONE.
compromised_device.user_info.operating_systemThe operating system of the infected device, such as a Windows version; the platform shows it as OS.
compromised_device.user_info.screen_resolutionThe screen resolution of the infected device, as the stealer recorded it.
compromised_device.user_info.ip_addressThe IP address the infected device had when the data was stolen; the platform shows it as IP.
compromised_device.user_info.keyboard_layoutsThe keyboard layouts installed on the infected device, a list of language codes.
compromised_device.system_info.ramThe amount of memory (RAM) of the infected device, as text.
compromised_device.system_info.cpuThe processor (CPU) model of the infected device.
compromised_device.system_info.gpuThe graphics cards (GPU) of the infected device, a list.
compromised_device.system_info.installed_antivirusThe antivirus products found on the infected device, a list; the platform shows it as AV.
compromised_device.installed_softwares.nameThe name of a program installed on the infected device.
compromised_device.installed_softwares.versionThe version of a program installed on the infected device.
compromised_device.installed_softwares.categoryThe category of a program installed on the infected device.
compromised_device.installed_browsers.nameThe name of a web browser installed on the infected device.
compromised_device.installed_browsers.versionThe version of a web browser installed on the infected device.
account.idThe ID of the employee account the device is linked to, the id returned by Compromised Employee Account Search.
account.emailThe email address of the employee account the device is linked to.
leaked_data.stealer_docsThe names of the files the infostealer took from the device, a list.
leaked_data.passwords.urlThe address of the login page a stolen password was saved for.
leaked_data.passwords.fqdnThe full host name of the login page a stolen password was saved for, such as login.acme.example.
leaked_data.passwords.domainThe registered domain of the login page a stolen password was saved for, such as acme.example.
leaked_data.passwords.usernameThe user name or email address saved with a stolen password. Responses mask personal values.
leaked_data.passwords.passwordThe stolen password itself. Responses show it masked.
leaked_data.passwords.leak_source_typeWhere the stolen password came from, such as the kind of stealer log.
leaked_data.passwords.source_applicationThe application the password was stolen from, such as a web browser.
leaked_data.tokens.raw_valueThe stolen token itself, such as a session or API token. Responses show it masked.
leaked_data.tokens.token_typeThe kind of stolen token, such as a session token or an API key.
leaked_data.tokens.possible_issuerThe service that probably issued the stolen token; the platform shows it as ISSUER.
leaked_data.tokens.associated_userThe user the stolen token belongs to; the platform shows it as USER.
leaked_data.tokens.websiteThe website the stolen token is used on.
leaked_data.tokens.categoryThe category of the stolen token's service.
leaked_data.tokens.risk_reasonWhy the stolen token got its risk level, in words.
leaked_data.tokens.source_applicationThe application the token was stolen from, such as a web browser.
leaked_data.auto_fills.field_nameThe name of a form field whose saved (autofill) value was stolen, such as email or phone.
leaked_data.auto_fills.field_valueThe stolen autofill value. Responses mask personal values.
leaked_data.auto_fills.data_typeThe kind of data in a stolen autofill value, such as an email address or a phone number.
leaked_data.auto_fills.source_applicationThe application the autofill value was stolen from, such as a web browser.
leaked_data.auto_fills.source_nameThe name of the browser profile or source the autofill value was read from.
leaked_data.cookies.domainA domain the infected device had cookies for, such as acme.example.
leaked_data.cookies.subdomainsThe subdomains of that domain the device had cookies for, a list.
leaked_data.sensitive_cookies.domainThe domain a stolen sensitive cookie (one that can open a session) belongs to.
leaked_data.sensitive_cookies.nameThe name of a stolen sensitive cookie.
leaked_data.sensitive_cookies.valueThe value of a stolen sensitive cookie. Responses show it masked.
leaked_data.sensitive_cookies.pathThe path a stolen sensitive cookie applies to, such as /.
leaked_data.sensitive_cookies.cookie_typeThe kind of stolen cookie, such as a session or authentication cookie.
leaked_data.sensitive_cookies.risk_reasonWhy the stolen cookie got its risk level, in words.
leaked_data.sensitive_cookies.source_applicationThe application the cookie was stolen from, such as a web browser.
leaked_data.documents.nameThe file name of a document the infostealer took from the device.
leaked_data.documents.creatorThe author recorded in a stolen document's properties. Responses mask personal values.
leaked_data.documents.last_modified_byThe last editor recorded in a stolen document's properties. Responses mask personal values.
leaked_data.documents.contentThe text of a stolen document. Responses do not show it.
leaked_data.documents.languageThe language of a stolen document's text.
leaked_data.documents.sensitive_data_scoreA score of how much sensitive data a stolen document holds.
leaked_data.documents.sensitive_data_typeThe kinds of sensitive data found in a stolen document, a list.
compromise_summary.corporate_email_addressYour organization's email addresses found on the device, a list.
compromise_summary.other_email_addressesThe other email addresses found on the device, a list.
compromise_summary.same_password_rateHow often the same password is reused among the device's stolen passwords, as text.
compromise_summary.accessed_internal_resourcesInternal resources of your organization the device had stolen access to, such as internal login pages, a list.
compromise_summary.corporate_riskA short assessment of the risk to your organization; the platform shows it as CORPORATE RISK.
compromise_summary.financial_riskA short assessment of the financial risk; the platform shows it as FINANCIAL RISK.
compromise_summary.identity_theft_riskA short assessment of the identity theft risk; the platform shows it as IDENTITY THEFT.
compromise_summary.corporate_espionageA short assessment of the corporate espionage risk.
compromise_summary.ransomware_threatA short assessment of the ransomware threat; the platform shows it as RANSOMWARE THREAT.
compromise_summary.phishing_riskA short assessment of the phishing risk; the platform shows it as PHISHING RISK.
compromise_summary.session_hijacking_riskA short assessment of the session hijacking risk, from the stolen cookies and tokens; the platform shows it as SESSION HIJACKING.

Operators eq in gte lte exists

FieldDescription
compromised_device.log_dateWhen the infostealer log of this device was created, that is, when the data was stolen.
leaked_data.sensitive_cookies.expiration_timestampWhen the stolen cookie expires. A cookie that has not expired can still open a session.
leaked_data.documents.created_dateWhen a stolen document was created, from its properties.
leaked_data.documents.modified_dateWhen a stolen document was last changed, from its properties.
compromise_summary.password_countThe number of passwords stolen from the device; the platform shows it as PASSWORDS.
compromise_summary.token_countThe number of tokens stolen from the device; the platform shows it as TOKEN.
compromise_summary.autofill_countThe number of autofill values stolen from the device; the platform shows it as AUTOFILL.
compromise_summary.cookie_countThe number of cookies stolen from the device.
compromise_summary.sensitive_cookie_countThe number of sensitive cookies (ones that can open a session) stolen from the device; the platform shows it as COOKIE.

Operators eq exists

FieldDescription
leaked_data.passwords.is_corporatetrue when the stolen password is for one of your organization's own services.
leaked_data.sensitive_cookies.securetrue when the stolen cookie is sent over HTTPS only.
leaked_data.sensitive_cookies.http_onlytrue when the stolen cookie is hidden from page scripts (HttpOnly).
leaked_data.sensitive_cookies.include_subdomainstrue when the stolen cookie also applies to the domain's subdomains.

Operators eq in exists

FieldDescription
leaked_data.tokens.risk_levelHow risky the stolen token is: low, medium, high or critical.
leaked_data.sensitive_cookies.risk_levelHow risky the stolen cookie is: low, medium, high or critical.
compromise_summary.risk_levelThe device's overall risk level: low, medium, high or critical.

Sortable Fields

FieldDescription
compromised_device.hardware_idThe hardware ID the infostealer recorded for the infected device, which identifies one machine across logs.
compromised_device.log_dateWhen the infostealer log of this device was created, that is, when the data was stolen.
compromised_device.user_info.usernameThe operating-system user name on the infected device, as the stealer log recorded it.
compromised_device.user_info.machine_nameThe computer name of the infected device; the platform shows it as MACHINE.
compromised_device.user_info.countryThe country the infected device was in when the log was made, as the stealer recorded it.
compromised_device.user_info.languageThe system language of the infected device; the platform shows it as LANGUAGE.
compromised_device.user_info.operating_systemThe operating system of the infected device, such as a Windows version; the platform shows it as OS.
compromised_device.user_info.screen_resolutionThe screen resolution of the infected device, as the stealer recorded it.
compromised_device.user_info.ip_addressThe IP address the infected device had when the data was stolen; the platform shows it as IP.
compromise_summary.password_countThe number of passwords stolen from the device; the platform shows it as PASSWORDS.
compromise_summary.token_countThe number of tokens stolen from the device; the platform shows it as TOKEN.
compromise_summary.autofill_countThe number of autofill values stolen from the device; the platform shows it as AUTOFILL.
compromise_summary.cookie_countThe number of cookies stolen from the device.
compromise_summary.sensitive_cookie_countThe number of sensitive cookies (ones that can open a session) stolen from the device; the platform shows it as COOKIE.
compromise_summary.same_password_rateHow often the same password is reused among the device's stolen passwords, as text.
compromise_summary.risk_levelThe device's overall risk level: low, medium, high or critical.
compromise_summary.corporate_riskA short assessment of the risk to your organization; the platform shows it as CORPORATE RISK.
compromise_summary.financial_riskA short assessment of the financial risk; the platform shows it as FINANCIAL RISK.
compromise_summary.identity_theft_riskA short assessment of the identity theft risk; the platform shows it as IDENTITY THEFT.
compromise_summary.corporate_espionageA short assessment of the corporate espionage risk.
compromise_summary.ransomware_threatA short assessment of the ransomware threat; the platform shows it as RANSOMWARE THREAT.
compromise_summary.phishing_riskA short assessment of the phishing risk; the platform shows it as PHISHING RISK.
compromise_summary.session_hijacking_riskA short assessment of the session hijacking risk, from the stolen cookies and tokens; the platform shows it as SESSION HIJACKING.

Response Fields

FieldType
pageinteger
page_sizeinteger
result_countinteger
resultsarray of object
results[].idstring
results[].accountobject
results[].compromised_deviceobject
results[].leaked_dataobject
results[].compromise_summaryobject

Paginated. See Getting Started → Pagination.

Response Schema

FieldTypeExample
pagenumber1
page_sizenumber25
result_countnumber0
resultsarray

Examples

Selecting one loads it into the request and response panels.

Reference updated