What this endpoint does

Retrieves all stolen credentials exfiltrated from a specific compromised machine, identified by its computer name (e.g., "DESKTOP-27EL3CU"). This enables incident responders to pivot from a known infected device to discover every credential the malware harvested from it, across all websites and services the user accessed. Computer names can be found in the dump.compromise.computer_name field of records returned by the Identity: Detections endpoint. Note that "hostname" here refers to the machine's computer name, not a domain or FQDN.

Response data

Returns identities grouped by subject (email or username), each containing credential records with the targeted login service (URL and domain), password hash values and complexity indicators, stolen browser cookies, the responsible malware family, and detailed compromise metadata including the victim's operating system, geolocation, infrastructure IP, and exfiltration date.