1. data exfiltration
Anzenna Public API
  • How To Use the Anzenna Public API
  • data exfiltration
    • Query database exfiltration events
      POST
    • List file delete events
      POST
    • List file movement activities
      POST
    • Get file movement activity by id
      GET
    • List files used with data exfiltration.
      POST
    • Get a specific data exfiltration file
      GET
    • List git events
      POST
    • Get a specific git event by id
      GET
    • List git repositories
      POST
    • Get a specific git repository
      GET
  • api key
    • Get API key information
      GET
  • login events
    • List login events
      POST
    • Get a login event by ID
      GET
  • browser applications
    • Query all browser applications
      POST
    • Get a browser application by id
      GET
    • List browser application instances
      POST
  • browser history
    • List browser history entries
      POST
  • data sharing
    • List file sharing instances
      POST
    • Query database share grants
      POST
    • Query database share user additions
      POST
    • List documents
      POST
    • Get document by id
      GET
  • devices
    • List devices
    • Get a device
    • List USB device connection events
    • Get a USB connection event
  • device policies
    • List device policies
    • Get a device policy
  • device applications
    • List device applications
    • Get a device application
    • Query device application instances.
  • device infections
    • List device infections
    • Get a device infection
  • ide applications
    • List IDE applications
    • Get an IDE application
  • ide application instances
    • Query IDE application instances.
  • mcp servers
    • List MCP servers
    • Get an MCP server
    • Query MCP server installations
  • mfa
    • Query all mfa statuses
    • Get an MFA status by id
  • oauth applications
    • Query all OAuth applications
    • Get an OAuth application by id
    • Query all OAuth application instances
  • passwords
    • Query all password reuse instances
  • people
    • Query all people
    • Get departure analysis for a person
    • Get a person by id
    • Add a category to multiple people
    • Remove a category from multiple people
  • account
    • List accounts
    • Get an account by id
  • phishing interactions
    • Query all phishing interactions
  • email flows
    • Query all outbound email events
    • Get an outbound email event by id
  • company wide risk trends
    • Get company risk trends
  • high risk organizations
    • Get number of high risk organizations
  • detections
    • Get key finding detections
    • Get detection details
    • List users associated with a given detection
  • events
    • List security events
  • shadow it
    • Query all Shadow IT instances
  • web host
    • Query all web host resources
    • Get a web host resource by id
  • advanced query
    • Execute an advanced query
  • sources
    • Query raw events
  • allowlist
    • Query all allowlists
    • Create a new allowlist
    • Delete an allowlist
    • Update an allowlist
  • anomalies
    • Get an anomaly by ID
  • groups
    • List groups
  • investigations
    • Query all investigations
    • Get an investigation by id
    • Get detection investigation prompts
    • Get global investigation prompts
    • Get user investigation prompts
  • rdp connections
    • Query all remote machines
    • Get a remote machine by id
  • risk registers
    • Query all risk registers
    • Query all risk register catalog entries
  • shadow ai
    • Query all Shadow AI instances
    • Get a Shadow AI instance by id
  • training
    • List training campaigns
    • Create a training campaign
  • webhooks
    • Receive a webhook event
  • ai audits
    • Query all AI audit events
    • Get an AI audit event by id
  • dlp policies
    • List DLP policies
    • Get a DLP policy by id
    • List DLP policy detectors
  • remediations
    • Execute a remediation
  • dlp alerts
    • Query all DLP alerts
    • Get a DLP alert by id
  1. data exfiltration

Get file movement activity by id

GET
/data-exfiltration/file-movements/{id}
Get file movement

Request

Authorization
Path Params

Responses

🟢200OK
application/json
Successful operation
Bodyapplication/json

🟠401Unauthorized
🟠403Forbidden
Request Request Example
Shell
JavaScript
Java
Swift
curl --location '/data-exfiltration/file-movements/'
Response Response Example
{
    "allowlisted": true,
    "app_classification": "string",
    "corporate_determination_method": "authenticated_user",
    "destination_is_internal": true,
    "destination_path": "string",
    "device": {
        "activation_lock": "unspecified",
        "active_usb_connections": {
            "composite_count": 0,
            "hid_count": 2,
            "kvm_count": 0,
            "max_usb_risk_level": 1,
            "network_adapter_count": 0,
            "storage_count": 1,
            "unknown_count": 0
        },
        "antivirus": "unspecified",
        "apps_installed": 47,
        "disk_encryption": "unspecified",
        "employee_email": "joe.smith@example.com",
        "employee_name": "Joe Smith",
        "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
        "last_seen": "2021-01-01T00:00:00Z",
        "last_usb_usage": "2021-01-01T00:00:00Z",
        "local_user_accounts": [
            {
                "admin": true,
                "name": "John Doe",
                "user_id": "S-1-5-21-1234567890-1234567890-1234567890-1001",
                "username": "john.doe"
            }
        ],
        "mac_addresses": [
            "00:1B:44:11:3A:B7"
        ],
        "mdm": "unspecified",
        "model": "MacBook Pro",
        "name": "Joe's Mac",
        "platform": "windows",
        "risk_factors": [
            {
                "magnitude": 40,
                "type": "sensitive_file"
            }
        ],
        "risk_score": 9.2,
        "serial_number": "C02X1234DC79",
        "sources": [
            "unspecified"
        ]
    },
    "device_id": "3bafab7b-4400-4bcf-8e6e-09f954699940",
    "exfil_detection_reason": "directory_overlap",
    "exfiltration_suspected": true,
    "file": {
        "ai_classification": "file_name_binary",
        "allowlisted": true,
        "checksum": "string",
        "classifications": [
            {
                "confidence": 0,
                "confidences": [
                    0
                ],
                "count": 0,
                "detector_key": "string",
                "head_id": "string",
                "kind": "string",
                "score": 0
            }
        ],
        "dlp_policy_ids": [
            "string"
        ],
        "dlp_policy_names": [
            "string"
        ],
        "dlp_result": {
            "policies": [
                {
                    "fired_rules": [
                        "ssn_present",
                        "bulk_customer_records"
                    ],
                    "policy_id": "8CA67511-744C-4D74-B26E-7281CF88712F",
                    "policy_name": "Customer PII protection",
                    "positive": true,
                    "score": 0.82,
                    "verdict": "allow"
                }
            ],
            "score": 0.82,
            "verdict": "allow"
        },
        "dlp_sensitive": true,
        "download_count": 0,
        "file_extension": "string",
        "file_type": "string",
        "high_prevalence": true,
        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
        "matched_categories": [
            "string"
        ],
        "matched_entities": [
            "string"
        ],
        "name": "string",
        "risk_factors": [
            {
                "magnitude": 40,
                "type": "sensitive_file"
            }
        ],
        "rsync_download_count": 0,
        "rsync_upload_count": 0,
        "scp_download_count": 5,
        "scp_upload_count": 5,
        "sensitivity_result": {
            "entities": [
                {
                    "classification": "PII_SSN",
                    "confidences": [
                        0
                    ],
                    "count": 0,
                    "head_id": "string",
                    "standalone_sensitive": true
                }
            ],
            "has_standalone_sensitive": true,
            "risk_level": "unspecified",
            "sensitivity": 0.74
        },
        "size": 0,
        "top_sensitive_classifications": [
            "string"
        ],
        "upload_count": 0,
        "usb_download_count": 0,
        "usb_upload_count": 0
    },
    "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
    "file_name": "string",
    "high_prevalence": true,
    "host_user_account": "string",
    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
    "movement_type": "airdrop",
    "network_origin": {
        "geographic_location": {
            "city": "San Francisco",
            "country": "United States",
            "country_code": "US",
            "latitude": 0,
            "longitude": 0,
            "region": "California",
            "timezone": "America/Los_Angeles"
        },
        "ip": "203.0.113.45",
        "network": {
            "asn": "AS15169",
            "asn_name": "Google LLC",
            "host_type": [
                "HOSTING",
                "ANYCAST"
            ]
        },
        "privacy": {
            "privacy_mode": [
                "VPN"
            ],
            "service_name": "NordVPN"
        }
    },
    "origin": "company_domain_environment",
    "person_email": "string",
    "person_id": "8CA67511-744C-4D74-B26E-7281CF88712F",
    "person_name": "string",
    "process": {
        "command": "string",
        "parent_process_id": "string",
        "process_group_id": "string",
        "pwd": "string",
        "target_process_id": "string",
        "username": "string"
    },
    "remote_host": "dropbox.com",
    "remote_ip": "string",
    "risk_factors": [
        {
            "magnitude": 40,
            "type": "sensitive_file"
        }
    ],
    "risk_score": 9.2,
    "shadow_it_host_data": {
        "interaction_types": [
            "ai_access_enforcement"
        ],
        "login_count": 0
    },
    "source_path": "string",
    "timestamp": "2023-10-01T12:00:00Z",
    "vector": "airdrop",
    "web_host": {
        "allowlisted": true,
        "employee_email": "joe.smith@example.com",
        "employee_name": "Joe Smith",
        "event_types": [
            "corporate_email_login"
        ],
        "external_id": "chatgpt.com",
        "host": "chatgpt.com",
        "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
        "last_seen": "2021-01-01T00:00:00Z",
        "login_count": 42,
        "risk_score": 9.2
    }
}
Modified at 2026-07-24 15:31:52
Previous
List file movement activities
Next
List files used with data exfiltration.
Built with