Skip to main content
GET
Get Device by ID

Authorizations

X-API-KEY
string
header
required
X-CONNECTION-ID
string
header
required

Path Parameters

device_id
string<uuid>
required

Response

Successful Response

ad_info
DeviceADInfo · object | null
required

Active Directory placement -- organisational unit and site -- where the tool reports it.

first_seen
string<date-time> | null
required

When the tool first registered this device. The tool's own timestamp, not when Leen synced it.

id
string<uuid>
required

Leen's identifier for this device.

installed_software
string[] | null
required

Software the tool reported as installed.

last_seen
string<date-time> | null
required

When the tool last had contact with the device. Use it to tell a decommissioned machine from one that simply has no findings.

source_vendors
DeviceVendor · object[]
required

The tool this device came from, and that tool's identifier for it. A list because the shape allows several; today a device carries exactly one.

status
enum<string>
required

Device state as the tool reports it. quarantined means the tool has isolated it; deleted means the tool no longer returns it.

Available options:
active,
offline,
quarantined,
unknown,
deleted
cloud_metadata
AWSMetadata · object | null

CloudMetadata, currently only AWS is supported

fqdns
string[] | null

Fully qualified domain names for this device.

hostnames
string[] | null

Hostnames the tool knows this device by. A device can have several.

identities
DeviceIdentity · object[] | null

Accounts associated with the device, such as its last logged-in user.

ipv4s
string[] | null

IPv4 addresses the tool last observed. Not necessarily current.

ipv6s
string[] | null

IPv6 addresses the tool last observed.

mac_addresses
string[] | null

MAC addresses of the device's interfaces.

os_major_version
string | null

Major version, split out of os_version so it can be filtered on.

os_minor_version
string | null

Minor version, split out of os_version.

os_version
string | null

Full operating system version string, as the tool reports it.

platform
enum<string> | null

Operating system family, normalised across tools.

Available options:
mac,
windows,
linux,
unknown
tags
DeviceTags · object[] | null

Tags the tool carries for this device.

vendor_data
Vendor Data · object | null

Vendor specific pass through data, values can vary based on vendor