Retrieve a detection

Request

Security

x-api-key

Path

idstringrequired

Unique identifier for the detection

curl -i -X GET \
  'https://eu1.api.pushsecurity.com/v1/detections/{id}' \
  -H 'x-api-key: YOUR_API_KEY_HERE'

Responses

Headers

any

Bodyapplication/json

idstring

Identifier of the detection

Example:"c478966c-f927-411c-b919-179832d3d50c"

employeeIdstring

Identifier for the employee that triggered the detection.

Example:"37cda962-7e78-49bc-8721-1becd16276a3"

employeeobject(Employee)

This object represents an employee in your organization.

browserIdstring

Identifier of the browser that was used when the detection was triggered.

Example:"2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0"

severityany(SeverityType)

The severity of the detection

Enum:"LOW""MEDIUM""HIGH""CRITICAL"

detectionTypeany(DetectionType)

The type of detection

Enum:"BLOCKED_URL""CUSTOM""PHISHING""MALICIOUS_BROWSER_EXTENSION""MALWARE_DELIVERY""STOLEN_CREDENTIALS"

Example:"PHISHING"

responseany(ResponseType)

The response for the detection

Enum:"BLOCKED""EMPLOYEE_IGNORED_WARNING""EMPLOYEE_WARNED""NOT_BLOCKED"

creationTimestampinteger

When the detection was created. Formatted as a UNIX timestamp (in seconds).

Example:1698604061

archivedboolean

Whether the detection has been archived.

Example:true

classificationstring or null

The classification of the detection.

Enum:"TRUE_POSITIVE""BENIGN_TRUE_POSITIVE""FALSE_POSITIVE"

Example:"FALSE_POSITIVE"

eventsArray of objects(DetectionChildEvent)

The events associated with the detection.

timelineEventsArray of objects(DetectionTimelineEvent)

The timeline of browser activity that led to the detection. Only the most recent 1,000 events are returned.

Response

{
  "id": "c478966c-f927-411c-b919-179832d3d50c",
  "employeeId": "37cda962-7e78-49bc-8721-1becd16276a3",
  "employee": {
    "id": "2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0",
    "email": "john.hill@example.com",
    "firstName": "John",
    "lastName": "Hill",
    "department": "Security Engineering",
    "location": "New York",
    "licensed": true,
    "chatopsEnabled": true,
    "creationTimestamp": 1698669223
  },
  "browserId": "2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0",
  "severity": "LOW",
  "detectionType": "PHISHING",
  "response": "BLOCKED",
  "creationTimestamp": 1698604061,
  "archived": true,
  "classification": "FALSE_POSITIVE",
  "events": [
    {
      "id": "c478966c-f927-411c-b919-179832d3d50c",
      "creationTimestamp": 1698604061,
      "detectionEventType": "PHISHING_TOOL_DETECTED",
      "detectionEventName": "string",
      "accountId": "37cda962-7e78-49bc-8721-1becd16276a3",
      "appType": "PUSH_SECURITY",
      "phishingToolIndicator": "AITM_TOOL_EVILGINX_01",
      "controlMode": "INFORM",
      "description": "Phishing attempt detected",
      "clonedLoginPageIndicator": "MICROSOFT_01",
      "extensionId": "dljjddkmmcminffjbcmeccgfbjlhmhlm",
      "extensionName": "Example Extension",
      "profileEmail": "john.hill@example.com",
      "maliciousBrowserExtensionIndicator": "EXTENSION_ID",
      "customIndicator": "TORRENT_MAGNET_LINK",
      "response": "BLOCKED",
      "email": "john.hill@example.com",
      "url": "https://example.com/phishing",
      "matchedUrl": "https://example.com/phishing",
      "referrerUrl": "https://mail.google.com",
      "clonedLoginPageUrls": [
        "https://example.com/phishing"
      ],
      "sourceIpAddress": "8.158.25.38",
      "metadata": "{\"source_type\": \"Telegram\", \"breach_type\": \"Stealer Malware Logs\", \"breach_publication_date\": \"2025-04-01\"}",
      "experimental": false,
      "domainCategories": [
        {
          "code": 39,
          "name": "Gambling"
        }
      ],
      "screenshotCaptured": true
    }
  ],
  "timelineEvents": [
    {
      "traceOrder": 42,
      "eventTimestamp": 1698604061,
      "kind": "TAB_OPENED",
      "detectionEventType": "PHISHING_TOOL_DETECTED",
      "url": "https://example.com/phishing",
      "domain": "example.com",
      "domainCategories": [
        {
          "code": 39,
          "name": "Gambling"
        }
      ],
      "appType": "PUSH_SECURITY",
      "indicator": "MICROSOFT_01",
      "response": "BLOCKED"
    }
  ]
}