What this endpoint does

Generates a comprehensive incident report for a single stealer malware infection, showing every credential the malware harvested from the compromised machine. The source parameter is the file path string found in dump.source from Identity: Detections or dumps[].source from Identity: Lookup. Important: the include_details field must be explicitly set to true or false in every request — omitting it causes a 400 error despite the spec describing it as optional.

Response data

Returns the full scope of one infection event — every credential the malware exfiltrated, with partially masked domains, logins, and passwords. When include_details=true, also returns machine context: malware family, OS, username, timezone, exfiltration date, and source IP. Paginated via next_offset when the infection yielded more credentials than one page can hold.