Get host rollup

get https://{sandfly-api-host}/v4/hostsrollup/{host_id}

Get a host and associated host data by host ID.

Responses

Response body

object

host

object

required

Host object containing what was discovered about a host as it was added to the system inventory.

active

boolean

required

Is this host active (valid credentials and login)?

authentication_status

string

required

What is the state of the authentication? ok, failed, error

credentials_id

string

required

credentials_id to use for this host.

data

object

required

date_first_seen

string | null

required

Date first saw this host.

date_last_seen

string | null

required

Last time we saw this host.

date_last_scan

string | null

required

Last time we successfully connected to and authenticated to this host.

override_directory

string

required

Directory to run scan from instead of the node configuration values.

first_seen_ip_addr

string | null

required

First IP address we saw for this host.

host_id

string

required

A unique ID for this host (ssh key fingerprint), or the host_name if we saw no SSH.

host_sequence_id

integer

required

Alternative integer ID assigned to this host.

hostname

string

required

Hostname of host.

string

required

Alias for host_id.

jump_hosts

array of strings

required

List of jump_host names for this host.

Host.jump_hosts*

last_seen_ip_addr

string | null

required

Last IP address we saw for this host.

last_scan_duration_seconds

integer | null

Duration of last scan operation, in seconds.

object | null

required

Operating system data collected.

queue_name

string

required

Queue name.

results

object

required

run_id

string

required

ssh

object

required

ssh_key_fingerprint

string | null

required

SSH fingerprint of remote host.

ssh_port

integer

required

Defaults to 22

SSH port for host.

tags

array of strings

required

A list of tags for this host.

Host.tags*

verify_host_key

boolean

required

Defaults to false

Should we verify the host key?

version

integer

required

Version type for this record.

ssh_summary

object

required

SSH key attributes related to a host.

zones

array of objects

zones

object

name

string

required

Name of this SSH zone.

description

string

required

Description for this SSH zone.

hosts_count

integer

required

Number of hosts in this zone.

permitted_keys_count

integer

required

The number of keys this zone allows on hosts.

violation_host_count

integer

required

The number of hosts in this zone that current have one or more keys in violation of zone policies.

banned_keys_count

integer

required

The number of banned key entries found on hosts in this zone.

integer

required

Database-assigned ID of this SSH zone.

create_date

date-time

required

Date this SSH zone was created.

modification_date

date-time

required

Date this SSH zone was last modified.

users_with_key

integer | null

required

≥ 0

Total users with this key.

key_first_seen

date-time

First time a key associated with this host was seen.

key_last_seen

date-time

Most recent time a key associated with this host was seen.

users_current

integer

≥ 0

Number of users on this host that currently have an SSH key.

users_total

integer

≥ 0

Number of all-time users on this host that have, or in the past have had, an SSH key.

keys_current

integer

≥ 0

Current number of SSH keys on this host.

keys_total

integer

≥ 0

Total number of SSH keys this host has had.

has_duplicate_keys

boolean

required

Does this key appear more then once in the key file.

banned_key_violation

boolean

required

Indicates the presence of a banned SSH key on this host.

zone_violation_keys

integer

required

Number of keys on this host in violation of the SSH security zone policies covering this host.

users_timeline

array of objects

required

Timeline of users with keys on this host.

users_timeline*

object

begin

date-time

required

Begin date of this time interval.

end

date-time

required

End date of this time interval.

count

integer

required

Number of data points during this time interval.

users

array of objects

required

users*

object

username

string

required

Username.

first_seen

date-time

required

Time this user was first seen with an SSH key.

last_seen

date-time

required

Most recent time this user was seen with an SSH key.

has_duplicate_keys

boolean

required

This username has duplicate authorized_key entries for a key.

zone_violation_hosts

integer

required

Indicates the number of hosts on which the user has a key in violation of SSH security zones.

banned_key_violation

boolean

required

Indicates this user has a banned key.

key_entries

array of objects

required

key_entries*

object

active

boolean

required

This key is currently in an authorized_keys file.

is_duplicate

boolean

required

This key has duplicate entries.

entry_num

integer

required

Which position in the authorized_keys file this key appears in.

key_file

string

required

File path of the authorized_keys file where this key appears.

key_file_created

date-time

required

Create time of the file in which this key appears.

key_file_modified

date-time

required

Modification time of the file in which this key appears.

options

string

required

Key options.

comment

string

required

Key comment.

banned_key_violation

boolean

required

Indicates this is a banned key.

zone_violation

boolean

required

This key entry is in violation of an SSH security zone covering the host that the key is found on.

integer

required

Database-assigned SSH key ID.

friendly_name

string

required

Generated (but globally consistent for this key) friendly name for key.

key_type

string

required

OpenSSH key type identifiers

ssh-ed25519 ssh-dss ssh-rsa ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 sk-ecdsa-sha2-nistp256@openssh.com sk-ssh-ed25519@openssh.com unknown

hash

object

required

key_value

string

required

The public key.

first_seen

date-time | null

required

Time when this key was first seen on a host during a scan. If a user directly added the key to Sandfly and it hasn't yet been found on any scanned host, the value will be null.

last_seen

date-time | null

required

Time when this key was most recently seen on a host during a scan. If a user directly added the key to Sandfly and it hasn't yet been found on any scanned host, the value will be null.

key_tags

array

required

SSH key tags.

key_tags*

key_bits

integer

required

Number of bits in the key.

key_parse_error

boolean

required

Flag indicating that the key data was unable to be parsed as a valid SSH public key.

whitelists_count

integer

required

Number of whitelists applied to this host.

result_profiles_count

integer

required

Number of result profiles applied to this host.

recon_status

object

required

Status of the recon sandflies that contribute to host information displayed in the UI. Each property is a sandfly name, and the value is 'ok' if the sandfly is active, 'missing_results' means that even though the sandfly is active, there were no results in the database for this host (if there hasn't been a recent scan of the host, the results may have expired and been deleted), and 'sandfly_inactive' means the sandfly is inactive.

Has additional fields

Language

Credentials

Bearer

JWT

URL


xxxxxxxxxx
1
curl --request GET \
2
     --url https://sandfly-api-host/v4/hostsrollup/host_id \
3
     --header 'accept: application/json'

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200Host information retrieved

400Error with get request.

404Host not found.

defaultUnexpected error