title | string | Page title fromtag</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>Meta description of the page</td>
</tr>
<tr>
<td><code>content</code></td>
<td>string</td>
<td>Text content of the page</td>
</tr>
<tr>
<td><code>status_code</code></td>
<td>int</td>
<td>HTTP status code, from 100 to 599</td>
</tr>
<tr>
<td><code>headers</code></td>
<td>object</td>
<td>Relevant HTTP headers</td>
</tr>
<tr>
<td><code>technologies</code></td>
<td>list of string</td>
<td>Detected web technologies, default []</td>
</tr>
</tbody>
</table>
</div>
<h3 id="whois">Whois</h3>
<p><code>whois</code></p>
<p>Represents WHOIS domain registration information.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>domain</code></td>
<td>domain</td>
<td><strong>primary</strong>, required, Domain information</td>
</tr>
<tr>
<td><code>registry_domain_id</code></td>
<td>string</td>
<td>Registry Domain ID (unique identifier)</td>
</tr>
<tr>
<td><code>registrar</code></td>
<td>string</td>
<td>Domain registrar name</td>
</tr>
<tr>
<td><code>organization</code></td>
<td>organization</td>
<td>Organization associated with the domain</td>
</tr>
<tr>
<td><code>city</code></td>
<td>string</td>
<td>City where the domain is registered</td>
</tr>
<tr>
<td><code>country</code></td>
<td>string</td>
<td>Country where the domain is registered</td>
</tr>
<tr>
<td><code>email</code></td>
<td>email</td>
<td>Contact email for the domain</td>
</tr>
<tr>
<td><code>creation_date</code></td>
<td>string</td>
<td>Date when the domain was created</td>
</tr>
<tr>
<td><code>expiration_date</code></td>
<td>string</td>
<td>Date when the domain expires</td>
</tr>
</tbody>
</table>
</div>
<h2 id="security--access">Security & Access</h2>
<h3 id="cve">CVE</h3>
<p><code>cve</code>, detected</p>
<p>A public CVE record, which findings and vulnerabilities may name.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>id</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Such as CVE-2021-44228</td>
</tr>
<tr>
<td><code>url</code></td>
<td>url</td>
<td>The record’s page</td>
</tr>
<tr>
<td><code>severity</code></td>
<td>string</td>
<td>As the record rates it, one of info, low, medium, high, critical</td>
</tr>
<tr>
<td><code>cvss</code></td>
<td>float</td>
<td>Base score, 0 to 10, from 0 to 10</td>
</tr>
<tr>
<td><code>cvss_vector</code></td>
<td>string</td>
<td>Such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H</td>
</tr>
<tr>
<td><code>cwe</code></td>
<td>string</td>
<td>The weakness class, such as CWE-502</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>The record’s summary</td>
</tr>
<tr>
<td><code>published</code></td>
<td>datetime</td>
<td>When the record was published</td>
</tr>
<tr>
<td><code>known_exploited</code></td>
<td>bool</td>
<td>Listed in CISA’s Known Exploited Vulnerabilities</td>
</tr>
<tr>
<td><code>kev_added</code></td>
<td>datetime</td>
<td>When CISA listed it as exploited</td>
</tr>
<tr>
<td><code>epss</code></td>
<td>float</td>
<td>Probability of exploitation in the next 30 days, 0 to 1 (FIRST), from 0 to 1</td>
</tr>
<tr>
<td><code>epss_percentile</code></td>
<td>float</td>
<td>Share of all CVEs scored lower, 0 to 1, from 0 to 1</td>
</tr>
<tr>
<td><code>references</code></td>
<td>list of string</td>
<td>Advisories and links</td>
</tr>
</tbody>
</table>
</div>
<h3 id="credential">Credential</h3>
<p><code>credential</code>, detected</p>
<p>A login at a service with the password or hash found for it, or a found key, token, JWT or SSH key known by its fingerprint.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>username</code></td>
<td>string</td>
<td><strong>primary</strong>, Login name, empty for a bare key</td>
</tr>
<tr>
<td><code>service</code></td>
<td>string</td>
<td>What the credential opens, a site, a host, a provider</td>
</tr>
<tr>
<td><code>kind</code></td>
<td>string</td>
<td>What kind of credential it is, one of password, api_key, token, jwt, ssh_key, private_key, other</td>
</tr>
<tr>
<td><code>value</code></td>
<td>string</td>
<td>secret, masked until shown, The key, token or private key as it was found</td>
</tr>
<tr>
<td><code>fingerprint</code></td>
<td>string</td>
<td>The first twelve hex characters of the key’s SHA-256, its identity</td>
</tr>
<tr>
<td><code>prefix</code></td>
<td>string</td>
<td>The first four characters of the key, or the SSH algorithm, to tell it apart</td>
</tr>
<tr>
<td><code>status</code></td>
<td>string</td>
<td>Whether it still works, one of active, revoked, compromised, unknown</td>
</tr>
<tr>
<td><code>url</code></td>
<td>url</td>
<td>Where it signs in</td>
</tr>
<tr>
<td><code>found_in</code></td>
<td>string</td>
<td>Where it was found, a leak, a repository, a paste</td>
</tr>
<tr>
<td><code>first_seen</code></td>
<td>datetime</td>
<td>When it was first seen</td>
</tr>
<tr>
<td><code>last_seen</code></td>
<td>datetime</td>
<td>When it was last seen</td>
</tr>
<tr>
<td><code>password</code></td>
<td>string</td>
<td>secret, masked until shown, The password as it was found, in a leak or a paste</td>
</tr>
<tr>
<td><code>password_hash</code></td>
<td>string</td>
<td>secret, masked until shown, The hash as it leaked</td>
</tr>
<tr>
<td><code>hash_type</code></td>
<td>string</td>
<td>Algorithm of the leaked hash</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>Notes about the credential</td>
</tr>
</tbody>
</table>
</div>
<h3 id="device">Device</h3>
<p><code>device</code></p>
<p>Represents a device with hardware, software, and network information.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>device_id</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Unique device identifier</td>
</tr>
<tr>
<td><code>type</code></td>
<td>string</td>
<td>Type of device (mobile, desktop, server, etc.)</td>
</tr>
<tr>
<td><code>manufacturer</code></td>
<td>string</td>
<td>Device manufacturer</td>
</tr>
<tr>
<td><code>model</code></td>
<td>string</td>
<td>Device model</td>
</tr>
<tr>
<td><code>os</code></td>
<td>string</td>
<td>Operating system</td>
</tr>
<tr>
<td><code>os_version</code></td>
<td>string</td>
<td>Operating system version</td>
</tr>
<tr>
<td><code>browser</code></td>
<td>string</td>
<td>Browser used</td>
</tr>
<tr>
<td><code>browser_version</code></td>
<td>string</td>
<td>Browser version</td>
</tr>
<tr>
<td><code>screen_resolution</code></td>
<td>string</td>
<td>Screen resolution</td>
</tr>
<tr>
<td><code>user_agent</code></td>
<td>string</td>
<td>User agent string</td>
</tr>
<tr>
<td><code>mac_address</code></td>
<td>string</td>
<td>MAC address</td>
</tr>
<tr>
<td><code>ip_addresses</code></td>
<td>list of string</td>
<td>IP addresses associated with device</td>
</tr>
<tr>
<td><code>first_seen</code></td>
<td>string</td>
<td>First time device was observed</td>
</tr>
<tr>
<td><code>last_seen</code></td>
<td>string</td>
<td>Last time device was observed</td>
</tr>
<tr>
<td><code>location</code></td>
<td>string</td>
<td>Geographic location</td>
</tr>
<tr>
<td><code>is_mobile</code></td>
<td>bool</td>
<td>Whether device is mobile</td>
</tr>
<tr>
<td><code>is_tablet</code></td>
<td>bool</td>
<td>Whether device is a tablet</td>
</tr>
<tr>
<td><code>is_desktop</code></td>
<td>bool</td>
<td>Whether device is a desktop</td>
</tr>
<tr>
<td><code>associated_users</code></td>
<td>list of string</td>
<td>Users associated with device</td>
</tr>
<tr>
<td><code>source</code></td>
<td>string</td>
<td>Source of device information</td>
</tr>
</tbody>
</table>
</div>
<h3 id="finding">Finding</h3>
<p><code>finding</code></p>
<p>Something noticed that still needs checking, by hand or from a scanner report, linked to a vulnerability once confirmed.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>title</code></td>
<td>string</td>
<td><strong>primary</strong>, required, What was noticed</td>
</tr>
<tr>
<td><code>status</code></td>
<td>string</td>
<td>Where the check stands, one of unverified, investigating, confirmed, false_positive, default unverified</td>
</tr>
<tr>
<td><code>severity</code></td>
<td>string</td>
<td>How bad it would be, one of info, low, medium, high, critical</td>
</tr>
<tr>
<td><code>location</code></td>
<td>string</td>
<td>Where it was seen: a URL, host:port, a path</td>
</tr>
<tr>
<td><code>source</code></td>
<td>string</td>
<td>What noticed it: a scanner (nuclei, nmap) or a person</td>
</tr>
<tr>
<td><code>rule</code></td>
<td>string</td>
<td>The scanner’s rule or template that matched</td>
</tr>
<tr>
<td><code>evidence</code></td>
<td>string</td>
<td>What shows it: the matched text, values pulled out, a request</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>What it means</td>
</tr>
<tr>
<td><code>references</code></td>
<td>list of string</td>
<td>Links about it</td>
</tr>
<tr>
<td><code>tags</code></td>
<td>list of string</td>
<td>Words to sort it by</td>
</tr>
<tr>
<td><code>observed_at</code></td>
<td>datetime</td>
<td>When it was first seen</td>
</tr>
<tr>
<td><code>last_seen</code></td>
<td>datetime</td>
<td>When a report last held it</td>
</tr>
<tr>
<td><code>missing_since</code></td>
<td>datetime</td>
<td>When a report of the same target first came without it</td>
</tr>
</tbody>
</table>
</div>
<h3 id="malware">Malware</h3>
<p><code>malware</code></p>
<p>Represents malware with family, capabilities, and threat intelligence.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>name</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Malware name or identifier</td>
</tr>
<tr>
<td><code>family</code></td>
<td>string</td>
<td>Malware family</td>
</tr>
<tr>
<td><code>type</code></td>
<td>string</td>
<td>Type of malware (trojan, ransomware, etc.)</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>Malware description</td>
</tr>
<tr>
<td><code>first_seen</code></td>
<td>string</td>
<td>First time malware was observed</td>
</tr>
<tr>
<td><code>last_seen</code></td>
<td>string</td>
<td>Last time malware was observed</td>
</tr>
<tr>
<td><code>is_active</code></td>
<td>bool</td>
<td>Whether malware is currently active</td>
</tr>
<tr>
<td><code>threat_level</code></td>
<td>string</td>
<td>Threat level assessment</td>
</tr>
<tr>
<td><code>targets</code></td>
<td>list of string</td>
<td>Target platforms or systems</td>
</tr>
<tr>
<td><code>capabilities</code></td>
<td>list of string</td>
<td>Malware capabilities</td>
</tr>
<tr>
<td><code>indicators</code></td>
<td>list of string</td>
<td>IOCs (Indicators of Compromise)</td>
</tr>
<tr>
<td><code>c2_servers</code></td>
<td>list of string</td>
<td>Command and control servers</td>
</tr>
<tr>
<td><code>distribution_methods</code></td>
<td>list of string</td>
<td>Distribution methods</td>
</tr>
<tr>
<td><code>evasion_techniques</code></td>
<td>list of string</td>
<td>Evasion techniques used</td>
</tr>
<tr>
<td><code>persistence_mechanisms</code></td>
<td>list of string</td>
<td>Persistence mechanisms</td>
</tr>
<tr>
<td><code>encryption_methods</code></td>
<td>list of string</td>
<td>Encryption methods used</td>
</tr>
<tr>
<td><code>source</code></td>
<td>string</td>
<td>Source of malware information</td>
</tr>
<tr>
<td><code>analysis_report</code></td>
<td>string</td>
<td>Link to analysis report</td>
</tr>
<tr>
<td><code>sample_hashes</code></td>
<td>list of string</td>
<td>Sample file hashes</td>
</tr>
</tbody>
</table>
</div>
<h3 id="reputation-score">Reputation Score</h3>
<p><code>reputationscore</code></p>
<p>Represents a reputation score for an entity with historical data and trends.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>entity_id</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Entity identifier</td>
</tr>
<tr>
<td><code>entity_type</code></td>
<td>string</td>
<td>Type of entity (domain, IP, email, etc.)</td>
</tr>
<tr>
<td><code>score</code></td>
<td>float</td>
<td>Reputation score (0-100)</td>
</tr>
<tr>
<td><code>score_type</code></td>
<td>string</td>
<td>Type of score (trust, spam, malware, etc.)</td>
</tr>
<tr>
<td><code>provider</code></td>
<td>string</td>
<td>Reputation provider</td>
</tr>
<tr>
<td><code>last_updated</code></td>
<td>string</td>
<td>Last update timestamp</td>
</tr>
<tr>
<td><code>confidence</code></td>
<td>float</td>
<td>Confidence in the score</td>
</tr>
<tr>
<td><code>factors</code></td>
<td>list of string</td>
<td>Factors contributing to score</td>
</tr>
<tr>
<td><code>category</code></td>
<td>string</td>
<td>Category (good, suspicious, malicious, etc.)</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>Description of reputation</td>
</tr>
<tr>
<td><code>source</code></td>
<td>string</td>
<td>Source of reputation data</td>
</tr>
<tr>
<td><code>historical_scores</code></td>
<td>list of object</td>
<td>Historical score data</td>
</tr>
<tr>
<td><code>trend</code></td>
<td>string</td>
<td>Score trend (improving, declining, stable)</td>
</tr>
<tr>
<td><code>risk_level</code></td>
<td>string</td>
<td>Risk level assessment</td>
</tr>
<tr>
<td><code>recommendations</code></td>
<td>list of string</td>
<td>Recommendations based on score</td>
</tr>
</tbody>
</table>
</div>
<h3 id="risk-profile">Risk Profile</h3>
<p><code>riskprofile</code></p>
<p>Represents a comprehensive risk assessment profile for an entity.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>entity_id</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Entity identifier</td>
</tr>
<tr>
<td><code>entity_type</code></td>
<td>string</td>
<td>Type of entity</td>
</tr>
<tr>
<td><code>overall_risk_score</code></td>
<td>float</td>
<td>Overall risk score (0-100)</td>
</tr>
<tr>
<td><code>risk_level</code></td>
<td>string</td>
<td>Risk level (low, medium, high, critical)</td>
</tr>
<tr>
<td><code>assessment_date</code></td>
<td>string</td>
<td>Date of risk assessment</td>
</tr>
<tr>
<td><code>last_updated</code></td>
<td>string</td>
<td>Last update timestamp</td>
</tr>
<tr>
<td><code>risk_factors</code></td>
<td>list of string</td>
<td>Identified risk factors</td>
</tr>
<tr>
<td><code>threat_actors</code></td>
<td>list of string</td>
<td>Associated threat actors</td>
</tr>
<tr>
<td><code>attack_vectors</code></td>
<td>list of string</td>
<td>Potential attack vectors</td>
</tr>
<tr>
<td><code>vulnerabilities</code></td>
<td>list of string</td>
<td>Identified vulnerabilities</td>
</tr>
<tr>
<td><code>exposure_surface</code></td>
<td>string</td>
<td>Exposure surface description</td>
</tr>
<tr>
<td><code>data_classification</code></td>
<td>string</td>
<td>Data classification level</td>
</tr>
<tr>
<td><code>compliance_risks</code></td>
<td>list of string</td>
<td>Compliance-related risks</td>
</tr>
<tr>
<td><code>financial_impact</code></td>
<td>string</td>
<td>Potential financial impact</td>
</tr>
<tr>
<td><code>reputation_impact</code></td>
<td>string</td>
<td>Potential reputation impact</td>
</tr>
<tr>
<td><code>operational_impact</code></td>
<td>string</td>
<td>Potential operational impact</td>
</tr>
<tr>
<td><code>mitigation_strategies</code></td>
<td>list of string</td>
<td>Recommended mitigation strategies</td>
</tr>
<tr>
<td><code>monitoring_recommendations</code></td>
<td>list of string</td>
<td>Monitoring recommendations</td>
</tr>
<tr>
<td><code>source</code></td>
<td>string</td>
<td>Source of risk assessment</td>
</tr>
<tr>
<td><code>assessor</code></td>
<td>string</td>
<td>Risk assessor</td>
</tr>
<tr>
<td><code>confidence</code></td>
<td>float</td>
<td>Confidence in assessment</td>
</tr>
<tr>
<td><code>next_review_date</code></td>
<td>string</td>
<td>Next review date</td>
</tr>
</tbody>
</table>
</div>
<h3 id="session">Session</h3>
<p><code>session</code></p>
<p>Represents a user session with device and activity information.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>session_id</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Unique session identifier</td>
</tr>
<tr>
<td><code>user_id</code></td>
<td>string</td>
<td>User identifier</td>
</tr>
<tr>
<td><code>service</code></td>
<td>string</td>
<td>Service or platform</td>
</tr>
<tr>
<td><code>start_time</code></td>
<td>string</td>
<td>Session start timestamp</td>
</tr>
<tr>
<td><code>end_time</code></td>
<td>string</td>
<td>Session end timestamp</td>
</tr>
<tr>
<td><code>duration</code></td>
<td>int</td>
<td>Session duration in seconds</td>
</tr>
<tr>
<td><code>ip_address</code></td>
<td>string</td>
<td>IP address used for session</td>
</tr>
<tr>
<td><code>user_agent</code></td>
<td>string</td>
<td>User agent string</td>
</tr>
<tr>
<td><code>location</code></td>
<td>string</td>
<td>Geographic location</td>
</tr>
<tr>
<td><code>device_type</code></td>
<td>string</td>
<td>Type of device used</td>
</tr>
<tr>
<td><code>browser</code></td>
<td>string</td>
<td>Browser used</td>
</tr>
<tr>
<td><code>os</code></td>
<td>string</td>
<td>Operating system</td>
</tr>
<tr>
<td><code>is_active</code></td>
<td>bool</td>
<td>Whether session is currently active</td>
</tr>
<tr>
<td><code>is_suspicious</code></td>
<td>bool</td>
<td>Whether session is suspicious</td>
</tr>
<tr>
<td><code>activities</code></td>
<td>list of string</td>
<td>Activities performed during session</td>
</tr>
<tr>
<td><code>source</code></td>
<td>string</td>
<td>Source of session information</td>
</tr>
</tbody>
</table>
</div>
<h3 id="vulnerability">Vulnerability</h3>
<p><code>vulnerability</code></p>
<p>A confirmed weakness: what it affects, how bad it is and how to fix it.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>name</code></td>
<td>string</td>
<td><strong>primary</strong>, required, The weakness, such as SQL injection in the login form</td>
</tr>
<tr>
<td><code>status</code></td>
<td>string</td>
<td>Where the fix stands, one of open, mitigated, fixed, accepted, default open</td>
</tr>
<tr>
<td><code>severity</code></td>
<td>string</td>
<td>How bad it is, one of info, low, medium, high, critical</td>
</tr>
<tr>
<td><code>cvss</code></td>
<td>float</td>
<td>Base score, 0 to 10, from 0 to 10</td>
</tr>
<tr>
<td><code>cvss_vector</code></td>
<td>string</td>
<td>Such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</td>
</tr>
<tr>
<td><code>cwe</code></td>
<td>string</td>
<td>The weakness class, such as CWE-89</td>
</tr>
<tr>
<td><code>cve</code></td>
<td>string</td>
<td>The public record it is, such as CVE-2021-44228, when it has one</td>
</tr>
<tr>
<td><code>affected</code></td>
<td>string</td>
<td>What it affects: a URL, a host, a component and version</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>How it works and what it allows</td>
</tr>
<tr>
<td><code>remediation</code></td>
<td>string</td>
<td>How to fix or mitigate it</td>
</tr>
<tr>
<td><code>references</code></td>
<td>list of string</td>
<td>Advisories, reports, links</td>
</tr>
<tr>
<td><code>discovered_at</code></td>
<td>datetime</td>
<td>When it was confirmed</td>
</tr>
<tr>
<td><code>fixed_at</code></td>
<td>datetime</td>
<td>When it was fixed</td>
</tr>
</tbody>
</table>
</div>
<h3 id="weapon">Weapon</h3>
<p><code>weapon</code></p>
<p>Represents a weapon with detailed specifications and forensic information.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>name</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Weapon name or identifier</td>
</tr>
<tr>
<td><code>type</code></td>
<td>string</td>
<td>Weapon category (handgun, rifle, shotgun, knife, etc.), one of firearm, melee, explosive, bladed, blunt, chemical, biological, radiological, nuclear, other</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>Weapon description</td>
</tr>
<tr>
<td><code>manufacturer</code></td>
<td>string</td>
<td>Weapon manufacturer</td>
</tr>
<tr>
<td><code>model</code></td>
<td>string</td>
<td>Weapon model</td>
</tr>
<tr>
<td><code>caliber</code></td>
<td>string</td>
<td>Caliber or ammunition type</td>
</tr>
<tr>
<td><code>serial_number</code></td>
<td>string</td>
<td>Weapon serial number</td>
</tr>
<tr>
<td><code>year_manufactured</code></td>
<td>int</td>
<td>Year weapon was manufactured</td>
</tr>
<tr>
<td><code>country_of_origin</code></td>
<td>string</td>
<td>Country where weapon was manufactured</td>
</tr>
<tr>
<td><code>legal_status</code></td>
<td>string</td>
<td>Legal status (legal, illegal, restricted, etc.)</td>
</tr>
<tr>
<td><code>registration_status</code></td>
<td>string</td>
<td>Registration status</td>
</tr>
<tr>
<td><code>condition</code></td>
<td>string</td>
<td>Physical condition of the weapon</td>
</tr>
<tr>
<td><code>modifications</code></td>
<td>list of string</td>
<td>Any modifications made to the weapon</td>
</tr>
<tr>
<td><code>accessories</code></td>
<td>list of string</td>
<td>Attached accessories</td>
</tr>
<tr>
<td><code>capacity</code></td>
<td>string</td>
<td>Magazine capacity or ammunition capacity</td>
</tr>
<tr>
<td><code>barrel_length</code></td>
<td>string</td>
<td>Barrel length</td>
</tr>
<tr>
<td><code>overall_length</code></td>
<td>string</td>
<td>Overall weapon length</td>
</tr>
<tr>
<td><code>weight</code></td>
<td>string</td>
<td>Weapon weight</td>
</tr>
<tr>
<td><code>action_type</code></td>
<td>string</td>
<td>Action type (semi-automatic, bolt-action, etc.)</td>
</tr>
<tr>
<td><code>firing_mode</code></td>
<td>string</td>
<td>Firing mode (single shot, burst, full auto, etc.)</td>
</tr>
<tr>
<td><code>safety_features</code></td>
<td>list of string</td>
<td>Safety features present</td>
</tr>
<tr>
<td><code>source</code></td>
<td>string</td>
<td>Source of weapon information</td>
</tr>
<tr>
<td><code>location_found</code></td>
<td>string</td>
<td>Location where weapon was found</td>
</tr>
<tr>
<td><code>date_found</code></td>
<td>string</td>
<td>Date weapon was found</td>
</tr>
<tr>
<td><code>evidence_number</code></td>
<td>string</td>
<td>Evidence number or case reference</td>
</tr>
<tr>
<td><code>owner</code></td>
<td>string</td>
<td>Registered owner or possessor</td>
</tr>
<tr>
<td><code>purchase_date</code></td>
<td>string</td>
<td>Date weapon was purchased</td>
</tr>
<tr>
<td><code>purchase_location</code></td>
<td>string</td>
<td>Location where weapon was purchased</td>
</tr>
<tr>
<td><code>price</code></td>
<td>float</td>
<td>Purchase price</td>
</tr>
<tr>
<td><code>notes</code></td>
<td>string</td>
<td>Additional notes or observations</td>
</tr>
</tbody>
</table>
</div>
<h2 id="files--documents">Files & Documents</h2>
<h3 id="document">Document</h3>
<p><code>document</code></p>
<p>Represents a document with metadata, security, and content information.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>title</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Document title</td>
</tr>
<tr>
<td><code>doc_type</code></td>
<td>string</td>
<td>Type of document (PDF, DOC, etc.)</td>
</tr>
<tr>
<td><code>file_size</code></td>
<td>int</td>
<td>File size in bytes</td>
</tr>
<tr>
<td><code>created_date</code></td>
<td>string</td>
<td>Document creation date</td>
</tr>
<tr>
<td><code>modified_date</code></td>
<td>string</td>
<td>Document last modified date</td>
</tr>
<tr>
<td><code>author</code></td>
<td>string</td>
<td>Document author</td>
</tr>
<tr>
<td><code>subject</code></td>
<td>string</td>
<td>Document subject</td>
</tr>
<tr>
<td><code>keywords</code></td>
<td>list of string</td>
<td>Document keywords</td>
</tr>
<tr>
<td><code>language</code></td>
<td>string</td>
<td>Document language</td>
</tr>
<tr>
<td><code>page_count</code></td>
<td>int</td>
<td>Number of pages</td>
</tr>
<tr>
<td><code>hash_md5</code></td>
<td>string</td>
<td>MD5 hash</td>
</tr>
<tr>
<td><code>hash_sha1</code></td>
<td>string</td>
<td>SHA1 hash</td>
</tr>
<tr>
<td><code>hash_sha256</code></td>
<td>string</td>
<td>SHA256 hash</td>
</tr>
<tr>
<td><code>source_url</code></td>
<td>string</td>
<td>Source URL if downloaded</td>
</tr>
<tr>
<td><code>location</code></td>
<td>string</td>
<td>File location or path</td>
</tr>
<tr>
<td><code>is_encrypted</code></td>
<td>bool</td>
<td>Whether document is encrypted</td>
</tr>
<tr>
<td><code>is_password_protected</code></td>
<td>bool</td>
<td>Whether document is password protected</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>Document description</td>
</tr>
<tr>
<td><code>source</code></td>
<td>string</td>
<td>Source of document information</td>
</tr>
</tbody>
</table>
</div>
<h3 id="file">File</h3>
<p><code>file</code>, detected</p>
<p>Represents a file with metadata, type information, and security assessment.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>filename</code></td>
<td>string</td>
<td><strong>primary</strong>, required, File name</td>
</tr>
<tr>
<td><code>file_type</code></td>
<td>string</td>
<td>File type or extension</td>
</tr>
<tr>
<td><code>file_size</code></td>
<td>int</td>
<td>File size in bytes</td>
</tr>
<tr>
<td><code>created_date</code></td>
<td>string</td>
<td>File creation date</td>
</tr>
<tr>
<td><code>modified_date</code></td>
<td>string</td>
<td>File last modified date</td>
</tr>
<tr>
<td><code>accessed_date</code></td>
<td>string</td>
<td>File last accessed date</td>
</tr>
<tr>
<td><code>path</code></td>
<td>string</td>
<td>File path</td>
</tr>
<tr>
<td><code>hash_md5</code></td>
<td>string</td>
<td>MD5 hash</td>
</tr>
<tr>
<td><code>hash_sha1</code></td>
<td>string</td>
<td>SHA1 hash</td>
</tr>
<tr>
<td><code>hash_sha256</code></td>
<td>string</td>
<td>SHA256 hash</td>
</tr>
<tr>
<td><code>is_executable</code></td>
<td>bool</td>
<td>Whether file is executable</td>
</tr>
<tr>
<td><code>is_archive</code></td>
<td>bool</td>
<td>Whether file is an archive</td>
</tr>
<tr>
<td><code>is_image</code></td>
<td>bool</td>
<td>Whether file is an image</td>
</tr>
<tr>
<td><code>is_video</code></td>
<td>bool</td>
<td>Whether file is a video</td>
</tr>
<tr>
<td><code>is_audio</code></td>
<td>bool</td>
<td>Whether file is an audio file</td>
</tr>
<tr>
<td><code>is_text</code></td>
<td>bool</td>
<td>Whether file is a text file</td>
</tr>
<tr>
<td><code>mime_type</code></td>
<td>string</td>
<td>MIME type</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>File description</td>
</tr>
<tr>
<td><code>source</code></td>
<td>string</td>
<td>Source of file information</td>
</tr>
<tr>
<td><code>is_malicious</code></td>
<td>bool</td>
<td>Whether file is malicious</td>
</tr>
<tr>
<td><code>malware_family</code></td>
<td>string</td>
<td>Malware family if malicious</td>
</tr>
<tr>
<td><code>threat_level</code></td>
<td>string</td>
<td>Threat level assessment</td>
</tr>
</tbody>
</table>
</div>
<h3 id="photo">Photo</h3>
<p><code>photo</code></p>
<p>A photograph, attached as a file or linked, with what its metadata says about when and where.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>title</code></td>
<td>string</td>
<td><strong>primary</strong>, required, What to call the photo, the picture itself is attached as a file or linked</td>
</tr>
<tr>
<td><code>url</code></td>
<td>url</td>
<td>Where the photo is online, when it is</td>
</tr>
<tr>
<td><code>hash</code></td>
<td>string</td>
<td>Hash of the file</td>
</tr>
<tr>
<td><code>taken_at</code></td>
<td>datetime</td>
<td>When the photo was taken</td>
</tr>
<tr>
<td><code>camera</code></td>
<td>string</td>
<td>Camera or phone model from the metadata</td>
</tr>
<tr>
<td><code>latitude</code></td>
<td>float</td>
<td>Latitude from the metadata</td>
</tr>
<tr>
<td><code>longitude</code></td>
<td>float</td>
<td>Longitude from the metadata</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>What the photo shows</td>
</tr>
</tbody>
</table>
</div>
<h3 id="script">Script</h3>
<p><code>script</code></p>
<p>Represents a script or code file with analysis and security information.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>script_id</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Unique script identifier</td>
</tr>
<tr>
<td><code>name</code></td>
<td>string</td>
<td>Script name</td>
</tr>
<tr>
<td><code>language</code></td>
<td>string</td>
<td>Programming language</td>
</tr>
<tr>
<td><code>type</code></td>
<td>string</td>
<td>Type of script (JavaScript, Python, etc.)</td>
</tr>
<tr>
<td><code>content</code></td>
<td>string</td>
<td>Script content</td>
</tr>
<tr>
<td><code>file_path</code></td>
<td>string</td>
<td>File path if stored</td>
</tr>
<tr>
<td><code>url</code></td>
<td>string</td>
<td>URL if loaded from web</td>
</tr>
<tr>
<td><code>hash_md5</code></td>
<td>string</td>
<td>MD5 hash</td>
</tr>
<tr>
<td><code>hash_sha1</code></td>
<td>string</td>
<td>SHA1 hash</td>
</tr>
<tr>
<td><code>hash_sha256</code></td>
<td>string</td>
<td>SHA256 hash</td>
</tr>
<tr>
<td><code>file_size</code></td>
<td>int</td>
<td>File size in bytes</td>
</tr>
<tr>
<td><code>created_date</code></td>
<td>string</td>
<td>Creation date</td>
</tr>
<tr>
<td><code>modified_date</code></td>
<td>string</td>
<td>Last modified date</td>
</tr>
<tr>
<td><code>author</code></td>
<td>string</td>
<td>Script author</td>
</tr>
<tr>
<td><code>version</code></td>
<td>string</td>
<td>Script version</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>Script description</td>
</tr>
<tr>
<td><code>dependencies</code></td>
<td>list of string</td>
<td>Script dependencies</td>
</tr>
<tr>
<td><code>functions</code></td>
<td>list of string</td>
<td>Functions defined in script</td>
</tr>
<tr>
<td><code>is_malicious</code></td>
<td>bool</td>
<td>Whether script is malicious</td>
</tr>
<tr>
<td><code>malware_family</code></td>
<td>string</td>
<td>Malware family if malicious</td>
</tr>
<tr>
<td><code>threat_level</code></td>
<td>string</td>
<td>Threat level assessment</td>
</tr>
<tr>
<td><code>source</code></td>
<td>string</td>
<td>Source of script information</td>
</tr>
<tr>
<td><code>obfuscated</code></td>
<td>bool</td>
<td>Whether script is obfuscated</td>
</tr>
<tr>
<td><code>minified</code></td>
<td>bool</td>
<td>Whether script is minified</td>
</tr>
</tbody>
</table>
</div>
<h2 id="financial-data">Financial Data</h2>
<h3 id="bank-account">Bank Account</h3>
<p><code>bankaccount</code></p>
<p>Represents a bank account with financial and security information.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>account_number</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Bank account number</td>
</tr>
<tr>
<td><code>bank_name</code></td>
<td>string</td>
<td>Bank name</td>
</tr>
<tr>
<td><code>account_type</code></td>
<td>string</td>
<td>Type of account (checking, savings, etc.)</td>
</tr>
<tr>
<td><code>routing_number</code></td>
<td>string</td>
<td>Bank routing number</td>
</tr>
<tr>
<td><code>iban</code></td>
<td>string</td>
<td>International Bank Account Number</td>
</tr>
<tr>
<td><code>swift_code</code></td>
<td>string</td>
<td>SWIFT/BIC code</td>
</tr>
<tr>
<td><code>country</code></td>
<td>string</td>
<td>Country where account is held</td>
</tr>
<tr>
<td><code>currency</code></td>
<td>string</td>
<td>Account currency</td>
</tr>
<tr>
<td><code>balance</code></td>
<td>float</td>
<td>Account balance</td>
</tr>
<tr>
<td><code>account_holder</code></td>
<td>string</td>
<td>Account holder name</td>
</tr>
<tr>
<td><code>status</code></td>
<td>string</td>
<td>Account status (active, closed, etc.)</td>
</tr>
<tr>
<td><code>opened_date</code></td>
<td>string</td>
<td>Account opening date</td>
</tr>
<tr>
<td><code>closed_date</code></td>
<td>string</td>
<td>Account closing date</td>
</tr>
<tr>
<td><code>is_joint</code></td>
<td>bool</td>
<td>Whether account is joint</td>
</tr>
<tr>
<td><code>associated_individuals</code></td>
<td>list of string</td>
<td>Individuals associated with account</td>
</tr>
<tr>
<td><code>source</code></td>
<td>string</td>
<td>Source of account information</td>
</tr>
<tr>
<td><code>is_compromised</code></td>
<td>bool</td>
<td>Whether account has been compromised</td>
</tr>
<tr>
<td><code>breach_source</code></td>
<td>string</td>
<td>Source of breach if compromised</td>
</tr>
</tbody>
</table>
</div>
<h3 id="credit-card">Credit Card</h3>
<p><code>creditcard</code>, detected</p>
<p>Represents a credit card with financial details and security status.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>card_number</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Credit card number</td>
</tr>
<tr>
<td><code>card_type</code></td>
<td>string</td>
<td>Type of card (Visa, Mastercard, etc.)</td>
</tr>
<tr>
<td><code>issuer</code></td>
<td>string</td>
<td>Card issuer bank</td>
</tr>
<tr>
<td><code>expiry_date</code></td>
<td>string</td>
<td>Card expiry date</td>
</tr>
<tr>
<td><code>cvv</code></td>
<td>string</td>
<td>Card verification value</td>
</tr>
<tr>
<td><code>cardholder_name</code></td>
<td>string</td>
<td>Cardholder name</td>
</tr>
<tr>
<td><code>billing_address</code></td>
<td>string</td>
<td>Billing address</td>
</tr>
<tr>
<td><code>credit_limit</code></td>
<td>float</td>
<td>Credit limit</td>
</tr>
<tr>
<td><code>available_credit</code></td>
<td>float</td>
<td>Available credit</td>
</tr>
<tr>
<td><code>status</code></td>
<td>string</td>
<td>Card status (active, suspended, etc.)</td>
</tr>
<tr>
<td><code>issued_date</code></td>
<td>string</td>
<td>Card issue date</td>
</tr>
<tr>
<td><code>is_virtual</code></td>
<td>bool</td>
<td>Whether card is virtual</td>
</tr>
<tr>
<td><code>is_prepaid</code></td>
<td>bool</td>
<td>Whether card is prepaid</td>
</tr>
<tr>
<td><code>is_business</code></td>
<td>bool</td>
<td>Whether card is business card</td>
</tr>
<tr>
<td><code>associated_accounts</code></td>
<td>list of string</td>
<td>Associated bank accounts</td>
</tr>
<tr>
<td><code>source</code></td>
<td>string</td>
<td>Source of card information</td>
</tr>
<tr>
<td><code>is_compromised</code></td>
<td>bool</td>
<td>Whether card has been compromised</td>
</tr>
<tr>
<td><code>breach_source</code></td>
<td>string</td>
<td>Source of breach if compromised</td>
</tr>
<tr>
<td><code>last_used</code></td>
<td>string</td>
<td>Last time card was used</td>
</tr>
</tbody>
</table>
</div>
<h2 id="leaks">Leaks</h2>
<h3 id="breach">Breach</h3>
<p><code>breach</code></p>
<p>Represents a data breach incident with affected accounts and details.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>name</code></td>
<td>string</td>
<td><strong>primary</strong>, required, The name of the breach or service</td>
</tr>
<tr>
<td><code>title</code></td>
<td>string</td>
<td>Title of the breach</td>
</tr>
<tr>
<td><code>domain</code></td>
<td>string</td>
<td>Domain of the breached service</td>
</tr>
<tr>
<td><code>breachdate</code></td>
<td>string</td>
<td>Date of the breach</td>
</tr>
<tr>
<td><code>addeddate</code></td>
<td>string</td>
<td>Date breach was added to HIBP</td>
</tr>
<tr>
<td><code>modifieddate</code></td>
<td>string</td>
<td>Date breach was last modified</td>
</tr>
<tr>
<td><code>pwncount</code></td>
<td>int</td>
<td>Number of accounts affected</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>Description of the breach</td>
</tr>
<tr>
<td><code>logopath</code></td>
<td>string</td>
<td>Logo path for the breach</td>
</tr>
<tr>
<td><code>dataclasses</code></td>
<td>list of string</td>
<td>Types of data compromised</td>
</tr>
<tr>
<td><code>isverified</code></td>
<td>bool</td>
<td>Whether the breach is verified</td>
</tr>
<tr>
<td><code>isfabricated</code></td>
<td>bool</td>
<td>Whether the breach is fabricated</td>
</tr>
<tr>
<td><code>issensitive</code></td>
<td>bool</td>
<td>Whether the breach is sensitive</td>
</tr>
<tr>
<td><code>isretired</code></td>
<td>bool</td>
<td>Whether the breach is retired</td>
</tr>
<tr>
<td><code>isspamlist</code></td>
<td>bool</td>
<td>Whether the breach is a spam list</td>
</tr>
<tr>
<td><code>ismalware</code></td>
<td>bool</td>
<td>Whether the breach is related to malware</td>
</tr>
<tr>
<td><code>isstealerlog</code></td>
<td>bool</td>
<td>Whether the breach is a stealer log</td>
</tr>
<tr>
<td><code>issubscriptionfree</code></td>
<td>bool</td>
<td>Whether the breach is subscription free</td>
</tr>
<tr>
<td><code>breach</code></td>
<td>object</td>
<td>Full breach data as returned by the API</td>
</tr>
</tbody>
</table>
</div>
<h3 id="leak">Leak</h3>
<p><code>leak</code></p>
<p>Represents a data leak or breach with associated data.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>name</code></td>
<td>string</td>
<td><strong>primary</strong>, required, The name of the leak or breached service</td>
</tr>
<tr>
<td><code>leak</code></td>
<td>list of object</td>
<td>List of data leaks found</td>
</tr>
</tbody>
</table>
</div>
<h2 id="crypto">Crypto</h2>
<h3 id="crypto-transaction">Crypto Transaction</h3>
<p><code>cryptowallettransaction</code></p>
<p>Represents a cryptocurrency transaction.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>source</code></td>
<td>cryptowallet</td>
<td>required, Source wallet</td>
</tr>
<tr>
<td><code>target</code></td>
<td>cryptowallet</td>
<td>Target wallet</td>
</tr>
<tr>
<td><code>hash</code></td>
<td>string</td>
<td><strong>primary</strong>, Transaction hash</td>
</tr>
<tr>
<td><code>currency</code></td>
<td>string</td>
<td>Currency moved, the source wallet’s unless given</td>
</tr>
<tr>
<td><code>value</code></td>
<td>float</td>
<td>Transaction value in cryptocurrency</td>
</tr>
<tr>
<td><code>amount</code></td>
<td>float</td>
<td>Transaction amount in cryptocurrency</td>
</tr>
<tr>
<td><code>amount_usd</code></td>
<td>float</td>
<td>Transaction amount in USD</td>
</tr>
<tr>
<td><code>date</code></td>
<td>string</td>
<td>Transaction date</td>
</tr>
<tr>
<td><code>hop</code></td>
<td>int</td>
<td>Hop distance from original wallet</td>
</tr>
<tr>
<td><code>timestamp</code></td>
<td>string</td>
<td>Transaction timestamp (unix epoch)</td>
</tr>
<tr>
<td><code>block_number</code></td>
<td>int</td>
<td>Block number</td>
</tr>
<tr>
<td><code>block_hash</code></td>
<td>string</td>
<td>Block hash</td>
</tr>
<tr>
<td><code>nonce</code></td>
<td>int</td>
<td>Transaction nonce</td>
</tr>
<tr>
<td><code>transaction_index</code></td>
<td>int</td>
<td>Transaction index in block</td>
</tr>
<tr>
<td><code>gas</code></td>
<td>int</td>
<td>Gas provided</td>
</tr>
<tr>
<td><code>gas_price</code></td>
<td>int</td>
<td>Gas price in wei</td>
</tr>
<tr>
<td><code>gas_used</code></td>
<td>int</td>
<td>Gas used</td>
</tr>
<tr>
<td><code>cumulative_gas_used</code></td>
<td>int</td>
<td>Cumulative gas used</td>
</tr>
<tr>
<td><code>input</code></td>
<td>string</td>
<td>Input data</td>
</tr>
<tr>
<td><code>contract_address</code></td>
<td>string</td>
<td>Contract address</td>
</tr>
<tr>
<td><code>method_id</code></td>
<td>string</td>
<td>Method ID</td>
</tr>
<tr>
<td><code>function_name</code></td>
<td>string</td>
<td>Function name</td>
</tr>
<tr>
<td><code>confirmations</code></td>
<td>int</td>
<td>Number of confirmations</td>
</tr>
<tr>
<td><code>is_error</code></td>
<td>bool</td>
<td>Whether the transaction resulted in an error</td>
</tr>
<tr>
<td><code>txreceipt_status</code></td>
<td>string</td>
<td>Transaction receipt status</td>
</tr>
<tr>
<td><code>error_message</code></td>
<td>string</td>
<td>Error message if transaction failed</td>
</tr>
</tbody>
</table>
</div>
<h3 id="crypto-wallet">Crypto Wallet</h3>
<p><code>cryptowallet</code>, detected</p>
<p>Represents a cryptocurrency wallet.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>address</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Wallet address</td>
</tr>
<tr>
<td><code>currency</code></td>
<td>string</td>
<td>BTC, ETH, LTC, TRX, SOL and so on, told from the address when the shape gives it away</td>
</tr>
<tr>
<td><code>node_id</code></td>
<td>string</td>
<td>Wallet Explorer node ID</td>
</tr>
</tbody>
</table>
</div>
<h3 id="nft">NFT</h3>
<p><code>cryptonft</code></p>
<p>Represents a Non-Fungible Token (NFT) held or minted by a wallet.</p>
<div class="cs-table-wrap" tabindex="0" role="region" aria-label="Table">
<table>
<thead>
<tr>
<th>Field</th>
<th>Kind</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>wallet</code></td>
<td>cryptowallet</td>
<td>required, Source wallet</td>
</tr>
<tr>
<td><code>contract_address</code></td>
<td>string</td>
<td>required, Address of the NFT smart contract (ERC-721/1155)</td>
</tr>
<tr>
<td><code>token_id</code></td>
<td>string</td>
<td><strong>primary</strong>, required, Unique token ID of the NFT within the contract</td>
</tr>
<tr>
<td><code>chain</code></td>
<td>string</td>
<td>ethereum, polygon, base and so on, ethereum unless said</td>
</tr>
<tr>
<td><code>collection_name</code></td>
<td>string</td>
<td>Name of the NFT collection</td>
</tr>
<tr>
<td><code>metadata_url</code></td>
<td>url</td>
<td>URL to the metadata JSON or IPFS resource</td>
</tr>
<tr>
<td><code>image_url</code></td>
<td>url</td>
<td>URL to the image or media representing the NFT</td>
</tr>
<tr>
<td><code>name</code></td>
<td>string</td>
<td>Name or title of the NFT</td>
</tr>
<tr>
<td><code>description</code></td>
<td>string</td>
<td>Text description of the NFT</td>
</tr>
<tr>
<td><code>owner_address</code></td>
<td>string</td>
<td>Current owner of the NFT</td>
</tr>
<tr>
<td><code>creator_address</code></td>
<td>string</td>
<td>Original minter or creator address</td>
</tr>
<tr>
<td><code>last_transfer_date</code></td>
<td>string</td>
<td>Date of last transfer or update (ISO format)</td>
</tr>
<tr>
<td><code>node_id</code></td>
<td>string</td>
<td>NFT node ID in the Explorer graph</td>
</tr>
</tbody>
</table>
</div>
</div>
<nav class="cs-pager" aria-label="Page navigation">
<a class="cs-pager-link cs-pager-prev" href="/gosint/reference/cli/">
<span class="cs-pager-d mono-dim">← Previous</span>
<span class="cs-pager-t">Command line</span>
</a>
<a class="cs-pager-link cs-pager-next" href="/gosint/reference/transforms/">
<span class="cs-pager-d mono-dim">Next →</span>
<span class="cs-pager-t">Transforms</span>
</a>
</nav>
</article>
</main>
<aside class="cs-toc" aria-label="On this page">
<div class="cs-toc-h">On this page</div>
<nav id="TableOfContents">
<ul>
<li><a href="#global">Global</a>
<ul>
<li><a href="#event">Event</a></li>
<li><a href="#location">Location</a></li>
<li><a href="#phrase">Phrase</a></li>
<li><a href="#vehicle">Vehicle</a></li>
</ul>
</li>
<li><a href="#identities--entities">Identities & Entities</a>
<ul>
<li><a href="#affiliation">Affiliation</a></li>
<li><a href="#alias">Alias</a></li>
<li><a href="#individual">Individual</a></li>
<li><a href="#username">Username</a></li>
</ul>
</li>
<li><a href="#organization">Organization</a>
<ul>
<li><a href="#organization-1">Organization</a></li>
</ul>
</li>
<li><a href="#communication--contact">Communication & Contact</a>
<ul>
<li><a href="#email">Email</a></li>
<li><a href="#gravatar">Gravatar</a></li>
<li><a href="#message">Message</a></li>
<li><a href="#phone">Phone</a></li>
<li><a href="#social-account">Social Account</a></li>
</ul>
</li>
<li><a href="#network">Network</a>
<ul>
<li><a href="#asn">ASN</a></li>
<li><a href="#cidr">CIDR</a></li>
<li><a href="#dns-record">DNS Record</a></li>
<li><a href="#domain">Domain</a></li>
<li><a href="#git-repository">Git Repository</a></li>
<li><a href="#host">Host</a></li>
<li><a href="#ip">IP</a></li>
<li><a href="#port">Port</a></li>
<li><a href="#ssl-certificate">SSL Certificate</a></li>
<li><a href="#technology">Technology</a></li>
<li><a href="#web-tracker">Web Tracker</a></li>
<li><a href="#website">Website</a></li>
<li><a href="#whois">Whois</a></li>
</ul>
</li>
<li><a href="#security--access">Security & Access</a>
<ul>
<li><a href="#cve">CVE</a></li>
<li><a href="#credential">Credential</a></li>
<li><a href="#device">Device</a></li>
<li><a href="#finding">Finding</a></li>
<li><a href="#malware">Malware</a></li>
<li><a href="#reputation-score">Reputation Score</a></li>
<li><a href="#risk-profile">Risk Profile</a></li>
<li><a href="#session">Session</a></li>
<li><a href="#vulnerability">Vulnerability</a></li>
<li><a href="#weapon">Weapon</a></li>
</ul>
</li>
<li><a href="#files--documents">Files & Documents</a>
<ul>
<li><a href="#document">Document</a></li>
<li><a href="#file">File</a></li>
<li><a href="#photo">Photo</a></li>
<li><a href="#script">Script</a></li>
</ul>
</li>
<li><a href="#financial-data">Financial Data</a>
<ul>
<li><a href="#bank-account">Bank Account</a></li>
<li><a href="#credit-card">Credit Card</a></li>
</ul>
</li>
<li><a href="#leaks">Leaks</a>
<ul>
<li><a href="#breach">Breach</a></li>
<li><a href="#leak">Leak</a></li>
</ul>
</li>
<li><a href="#crypto">Crypto</a>
<ul>
<li><a href="#crypto-transaction">Crypto Transaction</a></li>
<li><a href="#crypto-wallet">Crypto Wallet</a></li>
<li><a href="#nft">NFT</a></li>
</ul>
</li>
</ul>
</nav>
<a class="cs-toc-edit" href="https://github.com/YouSysAdmin/gosint/edit/master/docs/content/reference/entity-types.md" target="_blank" rel="noopener">Edit this page <span class="mono">↗</span></a>
</aside>
</div>
<div class="cs-search" id="cs-search" data-index="/gosint/index.json" hidden>
<div class="cs-search-backdrop" data-search-close></div>
<div class="cs-search-dialog" role="dialog" aria-modal="true" aria-label="Search documentation">
<div class="cs-search-field">
<svg class="cs-ico cs-search-field-ico" aria-hidden="true" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"/><path d="m21 21-4.3-4.3"/></svg>
<input type="search" class="cs-search-input" placeholder="Search the docs..." autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" aria-label="Search the documentation"/>
<button type="button" class="cs-search-close" data-search-close aria-label="Close search"><kbd>Esc</kbd></button>
</div>
<ul class="cs-search-results" role="listbox" aria-label="Search results"></ul>
<div class="cs-search-empty" hidden>No matches.</div>
<div class="cs-search-foot">
<span><kbd>↑</kbd><kbd>↓</kbd> navigate</span>
<span><kbd>↵</kbd> open</span>
<span><kbd>esc</kbd> close</span>
</div>
</div>
</div>
<footer class="cs-footer">
<div class="cs-footer-inner">
<div class="cs-footer-brand">
<div class="cs-footer-wordmark">gosint</div>
</div>
<div class="cs-footer-cols">
<div>
<div class="cs-footer-h">Docs</div>
<ul>
<li><a href="/gosint/getting-started/">Getting started</a></li><li><a href="/gosint/guide/">Guide</a></li><li><a href="/gosint/administration/">Administration</a></li>
</ul>
</div>
<div>
<div class="cs-footer-h">Reference</div>
<ul>
<li><a href="/gosint/extending/">Extending</a></li><li><a href="/gosint/reference/">Reference</a></li>
</ul>
</div>
<div>
<div class="cs-footer-h">Project</div>
<ul>
<li><a href="https://github.com/YouSysAdmin/gosint/releases" target="_blank" rel="noopener">Releases</a></li>
<li><a href="https://github.com/YouSysAdmin/gosint/issues" target="_blank" rel="noopener">Issues</a></li>
</ul>
</div>
</div>
</div>
<div class="cs-footer-bar">
<span class="mono-dim">Released under the MIT license.</span>
<span class="mono-dim cs-footer-credit">built with <a href="https://gohugo.io" target="_blank" rel="noopener">hugo</a> and <a href="https://yousysadmin.github.io/hugo-docs-theme/" target="_blank" rel="noopener">docs</a></span>
</div>
</footer>
</body>
</html> |