What this endpoint does

Searches for metadata about specific breach datasets and stealer malware log collections indexed in Identity Intelligence. Provide one or more dump names to check whether they are included in the corpus and retrieve details about the underlying data breach or compromise. Dump names appear in the dump.name field of detection records returned by the Identity: Detections endpoint, making this useful for investigating the provenance of specific credential exposures.

Response data

Each matching dump includes a human-readable description of the breach event, the type of data source (e.g., SQL dump, malware logs), the date Recorded Future ingested the data, and a breaches array with affected domain, breach timeframe, and site description. For stealer malware log sources, dumps may also include compromise metadata such as exfiltration date, operating system details, and malware information.