HomeDocumentationAPI Reference
Log In
API Reference

Search artifacts

Search the aggregated artifact list: one entry per scanned artifact (process, file, user, ...) regardless of how many sandflies matched it, with the list of matching sandfly names denormalized onto each entry. The per-(sandfly, artifact) view of the same data remains available at POST /results.

Set host_counts to have each entry report how many hosts share the artifact; that form is limited to pages of 200 artifacts and its counts are capped per hash.

Body Params
filter
object

Filter in the same shape as the result search filter. See ArtifactSearchFilterItemField for the fields this endpoint exposes.

integer

Maximum entries per page (default 100, max 10000).

integer

1-based page number.

boolean

Include host_counts on every artifact returned: how many hosts share it, by each match hash. Opt-in because it is the one part of the search whose cost grows with how widespread the artifacts are, and capped per hash so a widespread artifact reports a floor rather than an exact number (see ArtifactHostCounts). Only available for pages of up to 200 artifacts; a larger size with this set is rejected. The artifact detail endpoint always reports these counts, and without a cap.

Responses

Language
Credentials
Bearer
JWT
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json