Get Tactics Detection

get

https://api.greynoise.io/v3/workspaces/{workspace_id}/tactics/{detection_id}

Retrieve a single Tactics detection, including its complete ordered
command timeline, its full set of touched file paths, and a
per-protocol summary of the unique destination IPs the session
contacted.

Commands and file paths are paginated independently, 500 per page:

commands_page slices commands and command_events together -
they are parallel views of one sequence. command_count is the total
across every page and commands_has_more signals a further page.
artifacts_page slices artifacts, sorted by path for stable
paging. artifact_count is the total across every page and
artifacts_has_more signals a further page.

Advancing one does not affect the other. The list of destination IPs is
served by its own endpoint; this response carries only their per-
protocol counts in dest_ips.

Responses

Language

Credentials

Header

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200OK - detection returned.

400Bad request - a path parameter, query parameter, or request body was invalid. Validation errors raised by the Tactics backend are returned as a plain-text message; errors raised by the API gateway use the JSON {"message": ...} shape.

401Unauthorized. Please check your API key.

403Forbidden - the workspace is not entitled to Tactics (or, for the host artifact content endpoint, not entitled to file contents), or the authenticated user does not have access to the requested workspace. Contact [email protected] to enable Tactics for your workspace.

404Not found - no detection or file matched the request. Returned as a plain-text message by the Tactics backend.

500Unexpected error while serving the request. Errors raised by the Tactics backend are returned as a plain-text message; errors raised by the API gateway use the JSON {"message": ...} shape.