Get SSH public key details

get https://{sandfly-api-host}/v4/sshhunter/key/{id}

Get details of an SSH public key from SSH Hunter.

Responses

Response body

object

key_use_timeline

array of objects

required

key_use_timeline*

object

begin

date-time

required

Begin date of this time interval.

end

date-time

required

End date of this time interval.

count

integer

required

Number of data points during this time interval.

key_users

array of objects

required

key_users*

object

username

string

required

Username.

hosts_with_key

integer

required

Number of hosts on which this user has the SSH key or keys.

key_first_seen

date-time

First time the SSH key associated with this user was seen.

key_last_seen

date-time

Most recent time the SSH key associated with this user was seen.

has_duplicate_keys

boolean

required

The SSH key associated with this user has duplicate entries in an authorized_keys file.

banned_key_violation

boolean

required

Indicates this user has a banned key.

zone_violation_hosts

integer

The number of hosts on which this user has a key in violation of security zone policy.

key_hosts

array of objects

required

key_hosts*

object

node_name

string

required

Hostname of host.

tags

array of strings

required

A list of tags for this host.

tags*

host_id

string

required

Unique ID of the host this summary record is for.

host_sequence_id

integer

required

Host sequence ID.

target_address

string

required

date_first_seen

date-time

required

Date and time this host was first seen.

date_last_seen

date-time

required

Date and time this host was last seen.

last_seen_ip_addr

string

required

IP address this host was last seen on.

os_info_arch

string

required

OS architecture.

os_info_machine

string

required

OS machine.

os_info_os_release_name

string

required

OS release name.

os_info_os_release_pretty_name

string

required

Human friendly OS release name.

os_info_release

string

required

OS release.

results_alert

integer

required

≥ 0

Total alert results on this host.

results_error

integer

required

≥ 0

Total error results on this host.

results_pass

integer

required

≥ 0

Total pass results on this host.

results_total

integer

required

≥ 0

Total results on this host.

users_with_key

integer | null

required

≥ 0

Total users with this key.

key_first_seen

date-time

First time a key associated with this host was seen.

key_last_seen

date-time

Most recent time a key associated with this host was seen.

users_current

integer

≥ 0

Number of users on this host that currently have an SSH key.

users_total

integer

≥ 0

Number of all-time users on this host that have, or in the past have had, an SSH key.

keys_current

integer

≥ 0

Current number of SSH keys on this host.

keys_total

integer

≥ 0

Total number of SSH keys this host has had.

has_duplicate_keys

boolean

required

Does this key appear more then once in the key file.

banned_key_violation

boolean

required

Indicates the presence of a banned SSH key on this host.

zone_violation_keys

integer

required

Number of keys on this host in violation of the SSH security zone policies covering this host.

host_tags_common

array of strings

required

Tags that appear on every host this key is associated with.

host_tags_common*

key_zones

array of objects

required

The list of SSH security zones which permit this key to appear on hosts and zones that this key was found in.

key_zones*

object

key_permitted

boolean

Indicates if this key is permitted in this zone. If a zone is listed where the key is NOT permitted, it means that this key was found on a host in the zone in violation of the zone's policy; this key is the cause of a zone violation in that zone.

name

string

required

Name of this SSH zone.

description

string

required

Description for this SSH zone.

hosts_count

integer

required

Number of hosts in this zone.

permitted_keys_count

integer

required

The number of keys this zone allows on hosts.

violation_host_count

integer

required

The number of hosts in this zone that current have one or more keys in violation of zone policies.

banned_keys_count

integer

required

The number of banned key entries found on hosts in this zone.

integer

required

Database-assigned ID of this SSH zone.

create_date

date-time

required

Date this SSH zone was created.

modification_date

date-time

required

Date this SSH zone was last modified.

num_hosts_with_alerts

integer

required

Number of hosts with this key that have alerts.

num_hosts_current

integer

required

Number of hosts that currently have this key.

num_users_current

integer

required

Number of distinct usernames that currently have this key.

num_hosts_total

integer

required

Total number of hosts that have ever had this key.

num_users_total

integer

required

Total number of distinct usernames that have ever had this key.

hosts_deleted

boolean

required

The hosts that had this key are no longer in the Sandfly database.

has_duplicate_keys

boolean

required

One or more authorized_keys files with this key have duplicate entries for this key.

host_tags_all

array of strings

required

All tags that appear on any host this key is associated with.

host_tags_all*

zone_violation_hosts

integer

required

Number of hosts with this key that currently have an SSH Security Zone violation.

permitted_zones_count

integer

required

Number of SSH Security Zones that permit this key to appear on hosts.

integer

required

Database-assigned SSH key ID.

friendly_name

string

required

Generated (but globally consistent for this key) friendly name for key.

key_type

string

required

OpenSSH key type identifiers

ssh-ed25519 ssh-dss ssh-rsa ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 sk-ecdsa-sha2-nistp256@openssh.com sk-ssh-ed25519@openssh.com unknown

hash

object

required

md5

string

required

MD5 hash of the public key value.

sha1

string

required

SHA1 hash of the public key value.

sha256

string

required

SHA256 hash of the public key value.

sha512

string

required

SHA512 hash of the public key value.

key_value

string

required

The public key.

first_seen

date-time | null

required

Time when this key was first seen on a host during a scan. If a user directly added the key to Sandfly and it hasn't yet been found on any scanned host, the value will be null.

last_seen

date-time | null

required

Time when this key was most recently seen on a host during a scan. If a user directly added the key to Sandfly and it hasn't yet been found on any scanned host, the value will be null.

key_tags

array

required

SSH key tags.

key_tags*

key_bits

integer

required

Number of bits in the key.

key_parse_error

boolean

required

Flag indicating that the key data was unable to be parsed as a valid SSH public key.

402

Product license does not allow SSH Hunter features.

Language

Credentials

Bearer

JWT

URL


xxxxxxxxxx
1
curl --request GET \
2
     --url https://sandfly-api-host/v4/sshhunter/key/id \
3
     --header 'accept: application/json'

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200SSH key details retrieved.

defaultUnexpected error