List IoC profiles of a compromise family

GET

/compromised-host/campaigns/{id}/profiles

Linked IP addresses, domains, and URLs of the selected family with their role, protocols, and actual network replay method. Source values, confidence, and dates remain internal PTI metadata.

Contract

Parameter	Value
Section	compromised-host
Authentication	CookieAuth
Consumes	not required
Produces	application/json

Parameters

11 parameters

Name	Location	Required	Type	Description
id	path	yes	integer	IoC family ID
count	query	yes	integer	Records per page (10–100)
page	query	yes	integer	Page number, starting at 1
input	query	no	string	Search by IoC value, role, behavior, or protocol
type	query	no	string	Comma-separated IoC types: ip, domain, url
role	query	no	string	Comma-separated roles: c2, payload_delivery
protocol	query	no	string	Comma-separated protocols: dns, http, https, tcp
behavior	query	no	string	Comma-separated replay methods
exchange	query	no	string	Comma-separated exchange templates: family, universal
key	query	no	string	Sort field: primaryArtifact, role, protocols, behavior, exchangeTemplate
order	query	no	string	Sort direction: asc or desc

Responses

5 responses

Status	Description	Type
200	Page of IoC profiles and the family summary	object
400	Invalid ID, pagination, or filter	object
401	Unauthorized	object
404	Family not found	object
500	Failed to read or parse the family file	object

Response 200: object

{
  "cursor": {
    "count": 0,
    "currentPage": 0,
    "totalPages": 0,
    "totalRows": 0
  },
  "data": [
    {
      "artifacts": [
        {
          "derived": true,
          "port": 0,
          "type": "<string>",
          "value": "<string>"
        }
      ],
      "behavior": "<string>",
      "exchangeTemplate": "<string>",
      "id": "<string>",
      "networkTemplateId": "<string>",
      "networkTemplateVariant": "<string>",
      "primaryArtifact": {
        "derived": true,
        "port": 0,
        "type": "<string>",
        "value": "<string>"
      },
      "protocols": [
        "<string>"
      ],
      "role": "<string>"
    }
  ],
  "summary": {
    "artifactCounts": {
      "<key>": 0
    },
    "behaviorCounts": {
      "<key>": 0
    },
    "exchangeCounts": {
      "<key>": 0
    },
    "profileCount": 0,
    "protocolCounts": {
      "<key>": 0
    },
    "roleCounts": {
      "<key>": 0
    },
    "scenarioCount": 0
  }
}

{ "data": {}, "error": "<string>" }
{ "data": {}, "error": "<string>" }
{ "data": {}, "error": "<string>" }
{ "data": {}, "error": "<string>" }