v4

Types

View as markdown

The fields of every response and event type, and the enumerations they use.

Lookup types

Models in com.synthient.model are immutable records named after the API's JSON fields, read through accessor methods such as IpInfo.ip(). Fields the API always sends are non-null, and a response missing one throws SynthientException. Optional fields are @Nullable and are null when the API omits them. Lists and maps are unmodifiable. Timestamps are decoded to Instant and durations to Duration. Fields with a documented value set are Strings so that values the API adds later still decode; see Enumerations. Canonical constructors exist for tests and may gain parameters in minor releases as the API adds fields.

IpInfo

The intelligence Synthient holds for an IP address. See the IP API for how each field is derived.

  • Name
    ip
    Type
    String
    Description

    The address that was looked up, as canonicalized by the API.

  • Name
    network
    Type
    Network
    Description

    The network the address belongs to, or null when unknown.

  • Name
    location
    Type
    Location
    Description

    The geolocation of the address, or null when unknown.

  • Name
    intelligence
    Type
    Intelligence
    Description

    Risk, category, and provider data for the address, or null when the API has none.

Network

  • Name
    asn
    Type
    long
    Description

    The autonomous system number.

  • Name
    isp
    Type
    String
    Description

    The internet service provider.

  • Name
    type
    Type
    String
    Description

    The kind of network, one of NetworkType. See Enumerations.

  • Name
    org
    Type
    String
    Description

    The organization, or null when unknown.

  • Name
    domain
    Type
    String
    Description

    The organization's domain, or null when unknown.

  • Name
    abuseEmail
    Type
    String
    Description

    The abuse contact email, or null when unknown.

  • Name
    abusePhone
    Type
    String
    Description

    The abuse contact phone number, or null when unknown.

Location

  • Name
    country
    Type
    String
    Description

    The country code.

  • Name
    state
    Type
    String
    Description

    The state or region.

  • Name
    city
    Type
    String
    Description

    The city.

  • Name
    timezone
    Type
    String
    Description

    The IANA time zone.

  • Name
    latitude
    Type
    double
    Description

    The latitude in degrees.

  • Name
    longitude
    Type
    double
    Description

    The longitude in degrees.

  • Name
    geoHash
    Type
    String
    Description

    The geohash of the coordinates.

Intelligence

Synthient's assessment of an address. See Methodology for how it is built.

  • Name
    riskScore
    Type
    int
    Description

    The risk score, from 0 to 100.

  • Name
    devices
    Type
    List<Device>
    Description

    The devices seen behind the address.

  • Name
    behavior
    Type
    List<String>
    Description

    The behaviors observed from the address.

  • Name
    categories
    Type
    List<String>
    Description

    The service categories of the address.

  • Name
    providers
    Type
    List<Provider>
    Description

    The proxy and VPN providers seen using the address.

Provider

A proxy or VPN provider seen using an IP address.

  • Name
    name
    Type
    String
    Description

    The provider name. The API names this field provider. See Service Tags.

  • Name
    type
    Type
    String
    Description

    The kind of service.

  • Name
    lastSeen
    Type
    Instant
    Description

    When the provider was last seen using the address.

Device

A device seen behind an IP address.

  • Name
    os
    Type
    String
    Description

    The operating system, one of OperatingSystem. See Enumerations.

  • Name
    version
    Type
    String
    Description

    The operating system version.

  • Name
    lastSeen
    Type
    Instant
    Description

    When the device was last seen.

Domain types

DomainInfo

Proxy traffic to a domain over the last 30 days.

  • Name
    domain
    Type
    String
    Description

    The domain that was looked up.

  • Name
    status
    Type
    String
    Description

    Whether the domain had events in the last 24 hours, one of DomainStatus.

  • Name
    stats
    Type
    DomainStats
    Description

    Aggregate event counts.

  • Name
    timeSeries
    Type
    List<TimeSeriesPoint>
    Description

    Daily event and distinct source address counts.

  • Name
    uniqueIps
    Type
    UniqueIps
    Description

    Counts of the distinct source addresses.

  • Name
    topSubdomains
    Type
    List<SubdomainCount>
    Description

    The most targeted subdomains.

  • Name
    topPorts
    Type
    List<PortCount>
    Description

    The most targeted ports.

  • Name
    geoDistribution
    Type
    List<CountryCount>
    Description

    Event counts by source country.

  • Name
    hourDowHeatmap
    Type
    List<List<Long>>
    Description

    Event counts as 7 rows of 24 hours, in UTC, indexed as hourDowHeatmap().get(day).get(hour). Row 0 is Monday, so row d is DayOfWeek.of(d + 1).

  • Name
    activityStats
    Type
    ActivityStats
    Description

    The hourly activity pattern.

  • Name
    recentEvents
    Type
    List<DomainEvent>
    Description

    The most recent events, up to the requested limit.

  • Name
    topAsn
    Type
    AsnCount
    Description

    The source network with the most events, or null when there were none.

DomainStats

  • Name
    totalEvents30d
    Type
    long
    Description

    Events in the last 30 days.

  • Name
    events24h
    Type
    long
    Description

    Events in the last 24 hours.

UniqueIps

The distinct source addresses seen for a domain.

  • Name
    value24h
    Type
    long
    Description

    Distinct source addresses in the last 24 hours.

  • Name
    value30d
    Type
    long
    Description

    Distinct source addresses in the last 30 days.

  • Name
    sparkline24h
    Type
    List<Long>
    Description

    Distinct source addresses per hour over the last 24 hours.

TimeSeriesPoint

The event counts for one day.

  • Name
    date
    Type
    Instant
    Description

    The start of the day in UTC.

  • Name
    events
    Type
    long
    Description

    Events that day.

  • Name
    uniqueIps
    Type
    long
    Description

    Distinct source addresses that day.

AsnCount

  • Name
    asn
    Type
    long
    Description

    The autonomous system number.

  • Name
    events
    Type
    long
    Description

    Events from that network.

SubdomainCount

  • Name
    subdomain
    Type
    String
    Description

    The subdomain.

  • Name
    count
    Type
    long
    Description

    The number of events that targeted it.

PortCount

  • Name
    port
    Type
    int
    Description

    The port.

  • Name
    count
    Type
    long
    Description

    The number of events that targeted it.

CountryCount

  • Name
    countryCode
    Type
    String
    Description

    The country code.

  • Name
    uniqueIps
    Type
    long
    Description

    Distinct source addresses from that country.

  • Name
    events
    Type
    long
    Description

    Events from that country.

ActivityStats

The hourly activity pattern of a domain, in UTC.

  • Name
    peakHour
    Type
    int
    Description

    The busiest hour of the day, from 0 to 23.

  • Name
    quietHour
    Type
    int
    Description

    The quietest hour of the day, from 0 to 23.

  • Name
    medianPerHour
    Type
    long
    Description

    The median number of events per hour.

  • Name
    p95PerHour
    Type
    long
    Description

    The 95th percentile of events per hour.

  • Name
    cadence
    Type
    String
    Description

    A sentence describing the activity pattern, one of Cadence. See Enumerations.

DomainEvent

A proxy request to a domain.

  • Name
    timestamp
    Type
    Instant
    Description

    When the request was seen.

  • Name
    sourceIp
    Type
    String
    Description

    The full proxy exit address that carried the request. The API names the field source_ip_masked, but the address is not masked.

  • Name
    targetSubdomain
    Type
    String
    Description

    The subdomain that was requested.

  • Name
    port
    Type
    int
    Description

    The port that was requested.

  • Name
    countryCode
    Type
    String
    Description

    The country of the source address.

Account types

Account

The account that owns the API key.

  • Name
    firstName
    Type
    String
    Description

    The account holder's first name.

  • Name
    lastName
    Type
    String
    Description

    The account holder's last name.

  • Name
    email
    Type
    String
    Description

    The account holder's email address.

  • Name
    organization
    Type
    Organization
    Description

    The organization the key belongs to.

  • Name
    scopes
    Type
    List<String>
    Description

    The scopes the key grants, each one of Scope. See Enumerations.

  • Name
    lookupQuota
    Type
    LookupQuota
    Description

    The organization's lookup credits.

  • Name
    apiKey
    Type
    AccountApiKey
    Description

    The key used for the request, or null when the API omits it.

Organization

  • Name
    id
    Type
    String
    Description

    The organization's ID.

  • Name
    name
    Type
    String
    Description

    The organization's name.

  • Name
    relation
    Type
    String
    Description

    The account's role in the organization, one of Relation. See Enumerations.

LookupQuota

An organization's lookup credits.

  • Name
    credits
    Type
    long
    Description

    The number of lookup credits remaining.

  • Name
    resetsIn
    Type
    Duration
    Description

    The time until the credits reset.

AccountApiKey

The API key used for a request. It does not include the secret.

  • Name
    id
    Type
    String
    Description

    The key's ID.

  • Name
    name
    Type
    String
    Description

    The key's name.

  • Name
    createdAt
    Type
    Instant
    Description

    When the key was created.

Export types

ExportPage

One page of a feed's exports, newest first.

  • Name
    stream
    Type
    String
    Description

    The feed's stream name.

  • Name
    exports
    Type
    List<Export>
    Description

    The exports on this page. The API names this field feeds.

  • Name
    nextCursor
    Type
    String
    Description

    The cursor of the next page, to pass to listExports, or null on the last page.

Export

A Parquet export of a feed.

  • Name
    id
    Type
    String
    Description

    The ID to pass to exportMeta, download, and downloadUrl. On the first page, the newest hourly export may have the ID ExportId.LATEST.

  • Name
    kind
    Type
    String
    Description

    Whether the export covers an hour or a day, one of ExportKind.

  • Name
    date
    Type
    LocalDate
    Description

    The UTC day the export covers.

  • Name
    hour
    Type
    Integer
    Description

    The UTC hour the export covers, or null for a daily export.

  • Name
    sizeBytes
    Type
    long
    Description

    The size of the Parquet file in bytes.

  • Name
    rowCount
    Type
    long
    Description

    The number of rows in the file.

  • Name
    checksum
    Type
    String
    Description

    The hex-encoded SHA-256 of the Parquet file.

  • Name
    createdAt
    Type
    Instant
    Description

    When the export was written.

  • Name
    downloadPath
    Type
    String
    Description

    The API path that redirects to the file.

ExportMeta

The metadata of a Parquet export.

  • Name
    id
    Type
    String
    Description

    The export ID.

  • Name
    stream
    Type
    String
    Description

    The feed's stream name.

  • Name
    kind
    Type
    String
    Description

    Whether the export covers an hour or a day, one of ExportKind.

  • Name
    format
    Type
    String
    Description

    The file format, "parquet".

  • Name
    date
    Type
    Instant
    Description

    The start of the hour or day the export covers.

  • Name
    hour
    Type
    Integer
    Description

    The UTC hour the export covers, or null for a daily export.

  • Name
    rows
    Type
    long
    Description

    The number of rows in the file.

  • Name
    size
    Type
    long
    Description

    The size of the Parquet file in bytes.

  • Name
    checksum
    Type
    String
    Description

    The hex-encoded SHA-256 of the Parquet file.

  • Name
    createdAt
    Type
    Instant
    Description

    When the export was written.

  • Name
    schema
    Type
    ParquetSchema
    Description

    The Parquet columns.

ParquetSchema

  • Name
    fields
    Type
    List<ParquetColumn>
    Description

    The columns in file order.

ParquetColumn

  • Name
    name
    Type
    String
    Description

    The column name.

  • Name
    type
    Type
    String
    Description

    The column type, one of ParquetType. See Enumerations.

Event types

Stream events carry the fields described in the Firehose and Helios documentation, renamed to camelCase. Timestamps are decoded to Instant with a fixed unit per event type: Unix seconds for proxy, torrent, and JA4T events, and Unix milliseconds for anonymizer and Helios HTTP, HTTPS, and DNS events. The unit is never guessed from the size of the value. An event that is missing a required field throws SynthientException and ends the stream.

ProxyEvent

A proxy sighting from proxies(). Every field may be absent and is then null.

  • Name
    ip
    Type
    String
    Description

    The proxy's address.

  • Name
    provider
    Type
    String
    Description

    The proxy provider.

  • Name
    type
    Type
    String
    Description

    The kind of service, one of ProxyType. See Enumerations.

  • Name
    timestamp
    Type
    Instant
    Description

    When the proxy was seen.

  • Name
    countryCode
    Type
    String
    Description

    The ISO 3166-1 alpha-2 country of the address.

  • Name
    asn
    Type
    Long
    Description

    The autonomous system number of the address.

AnonymizerEvent

An address range used by a VPN or other anonymizing service, from anonymizers(). Every field may be absent and is then null.

  • Name
    rangeStart
    Type
    String
    Description

    The first address of the range.

  • Name
    rangeEnd
    Type
    String
    Description

    The last address of the range.

  • Name
    provider
    Type
    String
    Description

    The service provider.

  • Name
    type
    Type
    String
    Description

    The kind of service, one of ProxyType. See Enumerations.

  • Name
    timestamp
    Type
    Instant
    Description

    When the range was seen.

  • Name
    countryCode
    Type
    String
    Description

    The ISO 3166-1 alpha-2 country of rangeStart.

  • Name
    asn
    Type
    Long
    Description

    The autonomous system number of rangeStart.

TorrentEvent

A torrent from torrents(). Every field may be absent and is then null.

  • Name
    infoHash
    Type
    String
    Description

    The hex-encoded SHA-1 info hash.

  • Name
    name
    Type
    String
    Description

    The torrent's name.

  • Name
    magnetUri
    Type
    String
    Description

    The torrent's magnet link.

  • Name
    totalSize
    Type
    Long
    Description

    The total size of the torrent's files in bytes.

  • Name
    pieceLength
    Type
    Long
    Description

    The piece length in bytes.

  • Name
    fileCount
    Type
    Integer
    Description

    The number of files in the torrent.

  • Name
    timestamp
    Type
    Instant
    Description

    When the torrent was seen.

  • Name
    files
    Type
    List<TorrentFile>
    Description

    The files in the torrent.

  • Name
    peers
    Type
    List<TorrentPeer>
    Description

    The peers seen sharing the torrent.

TorrentFile

A file in a torrent. Every field may be absent and is then null.

  • Name
    path
    Type
    String
    Description

    The file's path in the torrent.

  • Name
    length
    Type
    Long
    Description

    The file size in bytes.

TorrentPeer

A peer seen sharing a torrent. Every field may be absent and is then null.

  • Name
    ip
    Type
    String
    Description

    The peer's address.

  • Name
    port
    Type
    Integer
    Description

    The peer's port.

  • Name
    encrypted
    Type
    Boolean
    Description

    Whether the peer used an encrypted connection.

  • Name
    source
    Type
    String
    Description

    Where the peer was found: DHT, PEX, or a tracker.

Ja4tEvent

A TCP fingerprint seen from a proxy, from ja4t(). Every field may be absent and is then null.

  • Name
    ip
    Type
    String
    Description

    The proxy's address.

  • Name
    ja4t
    Type
    String
    Description

    The JA4T fingerprint.

  • Name
    provider
    Type
    String
    Description

    The proxy provider.

  • Name
    type
    Type
    String
    Description

    The kind of service, one of ProxyType. See Enumerations.

  • Name
    timestamp
    Type
    Instant
    Description

    When the fingerprint was seen.

  • Name
    countryCode
    Type
    String
    Description

    The ISO 3166-1 alpha-2 country of the address.

  • Name
    asn
    Type
    Long
    Description

    The autonomous system number of the address.

HeliosMeta

The proxy a Helios honeypot request came through. Every field may be absent and is then null.

  • Name
    proxyIp
    Type
    String
    Description

    The proxy's exit address.

  • Name
    server
    Type
    String
    Description

    The honeypot server that received the request.

  • Name
    poolId
    Type
    String
    Description

    The proxy pool.

  • Name
    provider
    Type
    String
    Description

    The proxy provider.

HeliosHttpEvent

An HTTP request received by a Helios honeypot through a proxy.

  • Name
    timestamp
    Type
    Instant
    Description

    When the request was received.

  • Name
    tunnelId
    Type
    BigInteger
    Description

    The proxy tunnel. It is an unsigned 64-bit value that can exceed Long.MAX_VALUE.

  • Name
    domain
    Type
    String
    Description

    The tunnel's destination domain.

  • Name
    port
    Type
    int
    Description

    The tunnel's destination port.

  • Name
    protocol
    Type
    String
    Description

    Always "http".

  • Name
    meta
    Type
    HeliosMeta
    Description

    The proxy the request came through.

  • Name
    details
    Type
    HttpRequestDetails
    Description

    The parsed request, or null when absent.

  • Name
    raw
    Type
    String
    Description

    The raw request bytes as base64, or null when absent. The SDK does not decode it.

try (EventStream<HeliosHttpEvent> events = client.heliosHttp().stream()) {
    for (HeliosHttpEvent event : events) {
        String raw = event.raw();
        if (raw != null) {
            byte[] request = Base64.getDecoder().decode(raw);
            System.out.println(event.tunnelId() + " " + request.length);
        }
    }
}

HttpRequestDetails

A parsed HTTP request. Every field may be absent and is then null.

  • Name
    method
    Type
    String
    Description

    The request method.

  • Name
    uri
    Type
    String
    Description

    The request target.

  • Name
    version
    Type
    String
    Description

    The HTTP version.

  • Name
    headers
    Type
    Map<String, String>
    Description

    The request headers.

HeliosHttpsEvent

A TLS handshake received by a Helios honeypot through a proxy.

  • Name
    timestamp
    Type
    Instant
    Description

    When the handshake was received.

  • Name
    tunnelId
    Type
    BigInteger
    Description

    The proxy tunnel. It is an unsigned 64-bit value that can exceed Long.MAX_VALUE.

  • Name
    domain
    Type
    String
    Description

    The tunnel's destination domain.

  • Name
    port
    Type
    int
    Description

    The tunnel's destination port.

  • Name
    protocol
    Type
    String
    Description

    Always "https".

  • Name
    meta
    Type
    HeliosMeta
    Description

    The proxy the handshake came through.

  • Name
    details
    Type
    TlsClientHello
    Description

    The parsed ClientHello, or null when the sensor could not parse it.

  • Name
    raw
    Type
    String
    Description

    Always null, because the HTTPS sensors do not capture handshake bytes.

TlsClientHello

A parsed TLS ClientHello. Every field may be absent and is then null: fields the sensor could not parse are absent, and new fields may appear.

  • Name
    recordVersion
    Type
    String
    Description

    The record layer version.

  • Name
    handshakeVersion
    Type
    String
    Description

    The handshake version.

  • Name
    clientRandom
    Type
    String
    Description

    The hex-encoded 32-byte client random.

  • Name
    sessionId
    Type
    String
    Description

    The hex-encoded session ID.

  • Name
    sessionIdLength
    Type
    Integer
    Description

    The session ID length in bytes.

  • Name
    sni
    Type
    String
    Description

    The server name indication.

  • Name
    cipherSuites
    Type
    List<TlsCodeName>
    Description

    The offered cipher suites.

  • Name
    compressionMethods
    Type
    List<Integer>
    Description

    The offered compression methods.

  • Name
    extensions
    Type
    List<TlsExtension>
    Description

    The extensions in wire order.

  • Name
    supportedGroups
    Type
    List<TlsCodeName>
    Description

    The supported groups.

  • Name
    signatureAlgorithms
    Type
    List<TlsCodeName>
    Description

    The signature algorithms.

  • Name
    alpn
    Type
    List<String>
    Description

    The application protocols.

  • Name
    supportedVersions
    Type
    List<String>
    Description

    The supported TLS versions.

  • Name
    ecPointFormats
    Type
    List<String>
    Description

    The elliptic curve point formats.

  • Name
    keyShareGroups
    Type
    List<String>
    Description

    The key share groups.

  • Name
    pskKeyExchangeModes
    Type
    List<String>
    Description

    The pre-shared key exchange modes.

  • Name
    compressCertificate
    Type
    List<String>
    Description

    The certificate compression algorithms.

  • Name
    hasGrease
    Type
    Boolean
    Description

    Whether GREASE values were present.

  • Name
    applicationSettings
    Type
    Boolean
    Description

    Whether the application settings extension was present.

  • Name
    delegatedCredentials
    Type
    Boolean
    Description

    Whether the delegated credentials extension was present.

  • Name
    encryptThenMac
    Type
    Boolean
    Description

    Whether the encrypt-then-MAC extension was present.

  • Name
    extendedMasterSecret
    Type
    Boolean
    Description

    Whether the extended master secret extension was present.

  • Name
    postHandshakeAuth
    Type
    Boolean
    Description

    Whether the post-handshake authentication extension was present.

  • Name
    renegotiationInfo
    Type
    Boolean
    Description

    Whether the renegotiation info extension was present.

  • Name
    signedCertificateTimestamps
    Type
    Boolean
    Description

    Whether the signed certificate timestamps extension was present.

  • Name
    statusRequest
    Type
    Boolean
    Description

    Whether the status request extension was present.

TlsCodeName

A TLS code point and its name. GREASE values are named like GREASE(0x0a0a). Every field may be absent and is then null.

  • Name
    code
    Type
    Integer
    Description

    The code point.

  • Name
    name
    Type
    String
    Description

    The code point's name.

TlsExtension

A TLS extension in a ClientHello. Every field may be absent and is then null.

  • Name
    code
    Type
    Integer
    Description

    The extension type.

  • Name
    name
    Type
    String
    Description

    The extension name.

  • Name
    length
    Type
    Integer
    Description

    The extension data length in bytes.

HeliosDnsEvent

A DNS tunnel opened to a Helios honeypot through a proxy. Its domain is the tunnel's destination, not a DNS query name.

  • Name
    timestamp
    Type
    Instant
    Description

    When the tunnel was opened.

  • Name
    tunnelId
    Type
    BigInteger
    Description

    The proxy tunnel. It is an unsigned 64-bit value that can exceed Long.MAX_VALUE.

  • Name
    domain
    Type
    String
    Description

    The tunnel's destination domain, not a DNS query name.

  • Name
    port
    Type
    int
    Description

    The tunnel's destination port.

  • Name
    protocol
    Type
    String
    Description

    Always "dns".

  • Name
    meta
    Type
    HeliosMeta
    Description

    The proxy the tunnel came through.

HeliosAdbEvent

A command run on a Helios Android Debug Bridge honeypot. It has no timestamp because the sensor sends none.

  • Name
    session
    Type
    String
    Description

    The session ID as 32 hex characters.

  • Name
    sequentialId
    Type
    long
    Description

    The command's position in the session, starting at 1.

  • Name
    command
    Type
    String
    Description

    The command text. Invalid UTF-8 bytes are replaced with U+FFFD.

  • Name
    hash
    Type
    String
    Description

    The hex-encoded SHA-256 the sensor assigns to the session's payload. It is not a hash of command: every command in a session shares it, and sessions that replay the same script share it too.

Enumerations

Fields with a documented value set are Strings, so values the API adds later still decode. A final class in com.synthient.model holds a String constant for each known value. The SDK documents every set as open, so handle unknown values instead of assuming the constants are exhaustive. Compare with equals:

Network network = client.lookupIp("8.8.8.8").network();
if (network != null && NetworkType.RESIDENTIAL.equals(network.type())) {
    System.out.println("residential network: " + network.isp());
}

NetworkType

The known values of Network.type().

ConstantValue
MOBILEMOBILE
SATELLITESATELLITE
IN_FLIGHT_WIFIIN_FLIGHT_WIFI
RESIDENTIALRESIDENTIAL
CORPORATECORPORATE
ACADEMICACADEMIC
DATACENTERDATACENTER
GOVERNMENTGOVERNMENT

ProxyType

The known values of the type of ProxyEvent, AnonymizerEvent, and Ja4tEvent.

ConstantValue
FREE_VPNFREE_VPN
COMMERCIAL_VPNCOMMERCIAL_VPN
ENTERPRISE_VPNENTERPRISE_VPN
MOBILE_PROXYMOBILE_PROXY
BLOCKCHAIN_PROXYBLOCKCHAIN_PROXY
RESIDENTIAL_PROXYRESIDENTIAL_PROXY
PUBLIC_PROXYPUBLIC_PROXY
DATACENTER_PROXYDATACENTER_PROXY
TOR_NODETOR_NODE
PRIVATE_RELAYPRIVATE_RELAY
BOTNETBOTNET
SEARCH_ENGINESEARCH_ENGINE
AI_CRAWLERAI_CRAWLER
SOCIAL_MEDIASOCIAL_MEDIA
UPTIME_MONITORUPTIME_MONITOR
LINK_PREVIEWLINK_PREVIEW
SEO_CRAWLERSEO_CRAWLER
WEB_ARCHIVERWEB_ARCHIVER
WEBHOOK_PROVIDERWEBHOOK_PROVIDER
PAYMENT_PROCESSORPAYMENT_PROCESSOR
INTERNET_SCANNERINTERNET_SCANNER

OperatingSystem

The known values of Device.os().

ConstantValue
ANDROIDAndroid
CHROME_OSChrome OS
FREEBSDFreeBSD
IOSiOS
LINUXLinux
MAC_OS_XMac OS X
WINDOWSWindows

Scope

The known values of Account.scopes(). BASIC authorizes lookups and account(). Each feed has one scope for its exports and one for its stream, as listed under Feeds. See Authentication for how scopes are granted.

ConstantValue
BASICBASIC
PROXY_FEEDSPROXY_FEEDS
PROXY_FIREHOSEPROXY_FIREHOSE
ANONYMIZERS_FEEDANONYMIZERS_FEED
ANONYMIZERS_STREAMANONYMIZERS_STREAM
JA3_FEEDJA3_FEED
JA3_STREAMJA3_STREAM
TORRENTS_FEEDTORRENTS_FEED
TORRENTS_STREAMTORRENTS_STREAM
HONEYPOT_HTTP_FEEDHONEYPOT_HTTP_FEED
HONEYPOT_HTTP_STREAMHONEYPOT_HTTP_STREAM
HONEYPOT_HTTPS_FEEDHONEYPOT_HTTPS_FEED
HONEYPOT_HTTPS_STREAMHONEYPOT_HTTPS_STREAM
HONEYPOT_ADB_FEEDHONEYPOT_ADB_FEED
HONEYPOT_ADB_STREAMHONEYPOT_ADB_STREAM
HONEYPOT_DNS_FEEDHONEYPOT_DNS_FEED
HONEYPOT_DNS_STREAMHONEYPOT_DNS_STREAM
JA4_FEEDJA4_FEED
JA4_STREAMJA4_STREAM
JA4T_FEEDJA4T_FEED
JA4T_STREAMJA4T_STREAM
ADMIN_PROXIESADMIN_PROXIES

Relation

The known values of Organization.relation().

ConstantValue
OWNEROWNER
ADMINADMIN
MEMBERMEMBER

DomainStatus

The known values of DomainInfo.status().

ConstantValueMeaning
ACTIVEactiveThe domain had events in the last 24 hours.
INACTIVEinactiveThe domain had no events in the last 24 hours, or has never been observed.

Cadence

The known values of ActivityStats.cadence().

ConstantValue
NO_ACTIVITYNo activity in the last 30 days.
EVENActivity is evenly distributed across the day.
WEEKDAY_BUSINESS_HOURSActivity follows a weekday business-hours pattern.
WEEKENDActivity follows a weekend pattern.
BURSTYActivity is burst-driven with significant peaks.

ExportKind

The known values of Export.kind() and ExportMeta.kind().

ConstantValue
HOURLYhourly
DAILYdaily

ParquetType

The known values of ParquetColumn.type().

ConstantValue
STRINGstring
INT64int64
UINT32uint32
UINT64uint64
BOOLbool
BYTESbytes
Previous
Next