Get SSH public key details for a host

get deprecatedhttps://{sandfly-api-host}/v4/sshhunter/hosts/{host_id}

Get details of a host with SSH public keys from SSH Hunter. Deprecated in favor of GET /v4/hostsrollup/{host_id}, which includes all of the same data.

Responses

Response body

object

data

object

required

SSH key attributes related to a host.

zones

array of objects

required

zones*

object

name

string

required

Name of this SSH zone.

description

string

required

Description for this SSH zone.

hosts_count

integer

required

Number of hosts in this zone.

permitted_keys_count

integer

required

The number of keys this zone allows on hosts.

violation_host_count

integer

required

The number of hosts in this zone that current have one or more keys in violation of zone policies.

banned_keys_count

integer

required

The number of banned key entries found on hosts in this zone.

integer

required

Database-assigned ID of this SSH zone.

create_date

date-time

required

Date this SSH zone was created.

modification_date

date-time

required

Date this SSH zone was last modified.

node_name

string

required

Hostname of host.

tags

array of strings

required

A list of tags for this host.

tags*

host_id

string

required

Unique ID of the host this summary record is for.

host_sequence_id

integer

required

Host sequence ID.

target_address

string

required

date_first_seen

date-time

required

Date and time this host was first seen.

date_last_seen

date-time

required

Date and time this host was last seen.

last_seen_ip_addr

string

required

IP address this host was last seen on.

os_info_arch

string

required

OS architecture.

os_info_machine

string

required

OS machine.

os_info_os_release_name

string

required

OS release name.

os_info_os_release_pretty_name

string

required

Human friendly OS release name.

os_info_release

string

required

OS release.

results_alert

integer

required

≥ 0

Total alert results on this host.

results_error

integer

required

≥ 0

Total error results on this host.

results_pass

integer

required

≥ 0

Total pass results on this host.

results_total

integer

required

≥ 0

Total results on this host.

users_with_key

integer | null

required

≥ 0

Total users with this key.

key_first_seen

date-time

First time a key associated with this host was seen.

key_last_seen

date-time

Most recent time a key associated with this host was seen.

users_current

integer

≥ 0

Number of users on this host that currently have an SSH key.

users_total

integer

≥ 0

Number of all-time users on this host that have, or in the past have had, an SSH key.

keys_current

integer

≥ 0

Current number of SSH keys on this host.

keys_total

integer

≥ 0

Total number of SSH keys this host has had.

has_duplicate_keys

boolean

required

Does this key appear more then once in the key file.

banned_key_violation

boolean

required

Indicates the presence of a banned SSH key on this host.

zone_violation_keys

integer

required

Number of keys on this host in violation of the SSH security zone policies covering this host.

users_timeline

array of objects

required

Timeline of users with keys on this host.

users_timeline*

object

begin

date-time

required

Begin date of this time interval.

end

date-time

required

End date of this time interval.

count

integer

required

Number of data points during this time interval.

users

array of objects

required

users*

object

username

string

required

Username.

first_seen

date-time

required

Time this user was first seen with an SSH key.

last_seen

date-time

required

Most recent time this user was seen with an SSH key.

has_duplicate_keys

boolean

required

This username has duplicate authorized_key entries for a key.

zone_violation_hosts

integer

required

Indicates the number of hosts on which the user has a key in violation of SSH security zones.

banned_key_violation

boolean

required

Indicates this user has a banned key.

key_entries

array of objects

required

key_entries*

object

active

boolean

required

This key is currently in an authorized_keys file.

is_duplicate

boolean

required

This key has duplicate entries.

entry_num

integer

required

Which position in the authorized_keys file this key appears in.

key_file

string

required

File path of the authorized_keys file where this key appears.

key_file_created

date-time

required

Create time of the file in which this key appears.

key_file_modified

date-time

required

Modification time of the file in which this key appears.

options

string

required

Key options.

comment

string

required

Key comment.

banned_key_violation

boolean

required

Indicates this is a banned key.

zone_violation

boolean

required

This key entry is in violation of an SSH security zone covering the host that the key is found on.

integer

required

Database-assigned SSH key ID.

friendly_name

string

required

Generated (but globally consistent for this key) friendly name for key.

key_type

string

required

OpenSSH key type identifiers

ssh-ed25519 ssh-dss ssh-rsa ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 sk-ecdsa-sha2-nistp256@openssh.com sk-ssh-ed25519@openssh.com unknown

hash

object

required

key_value

string

required

The public key.

first_seen

date-time | null

required

Time when this key was first seen on a host during a scan. If a user directly added the key to Sandfly and it hasn't yet been found on any scanned host, the value will be null.

last_seen

date-time | null

required

Time when this key was most recently seen on a host during a scan. If a user directly added the key to Sandfly and it hasn't yet been found on any scanned host, the value will be null.

key_tags

array

required

SSH key tags.

key_tags*

key_bits

integer

required

Number of bits in the key.

key_parse_error

boolean

required

Flag indicating that the key data was unable to be parsed as a valid SSH public key.

402

Product license does not allow SSH Hunter features.

Language

Credentials

Bearer

JWT

URL


xxxxxxxxxx
1
curl --request GET \
2
     --url https://sandfly-api-host/v4/sshhunter/hosts/host_id \
3
     --header 'accept: application/json'

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200SSH host details retrieved.

defaultUnexpected error