List file movement activities
POST
/data-exfiltration/file-movements
device (Device): The device the file movement is onperson (Person): The person who owns the device the file movement is onfile (DataExfilFile): The file being movedRequest
Body Params application/jsonRequired
Responses
Request Request Example
Shell
JavaScript
Java
Swift
curl --location '/data-exfiltration/file-movements' \
--header 'Content-Type: application/json' \
--data '{
"distinct_count": "string",
"distinct_on": "host_name",
"include_total_count": true,
"limit": 10,
"offset": 0,
"query": "name='\''WINPC-4291'\'' AND status IN ('\''active'\'', '\''pending'\'')",
"sort": "name desc, id"
}'Response Response Example
{
"distinct_values": [
{
"count": 0,
"value": null
}
],
"pagination": {
"count": 0,
"total_count": 1000
},
"items": [
{
"allowlisted": true,
"app_classification": "string",
"corporate_determination_method": "authenticated_user",
"destination_is_internal": true,
"destination_path": "string",
"device": {
"activation_lock": "unspecified",
"active_usb_connections": {
"composite_count": 0,
"hid_count": 2,
"kvm_count": 0,
"max_usb_risk_level": 1,
"network_adapter_count": 0,
"storage_count": 1,
"unknown_count": 0
},
"antivirus": "unspecified",
"apps_installed": 47,
"disk_encryption": "unspecified",
"employee_email": "joe.smith@example.com",
"employee_name": "Joe Smith",
"id": "8CA67511-744C-4D74-B26E-7281CF88712F",
"last_seen": "2021-01-01T00:00:00Z",
"last_usb_usage": "2021-01-01T00:00:00Z",
"local_user_accounts": [
{
"admin": true,
"name": "John Doe",
"user_id": "S-1-5-21-1234567890-1234567890-1234567890-1001",
"username": "john.doe"
}
],
"mac_addresses": [
"00:1B:44:11:3A:B7"
],
"mdm": "unspecified",
"model": "MacBook Pro",
"name": "Joe's Mac",
"platform": "windows",
"risk_factors": [
{
"magnitude": 40,
"type": "sensitive_file"
}
],
"risk_score": 9.2,
"serial_number": "C02X1234DC79",
"sources": [
"unspecified"
]
},
"device_id": "3bafab7b-4400-4bcf-8e6e-09f954699940",
"exfil_detection_reason": "directory_overlap",
"exfiltration_suspected": true,
"file": {
"ai_classification": "file_name_binary",
"allowlisted": true,
"checksum": "string",
"classifications": [
{
"confidence": 0,
"confidences": [
0
],
"count": 0,
"detector_key": "string",
"head_id": "string",
"kind": "string",
"score": 0
}
],
"dlp_policy_ids": [
"string"
],
"dlp_policy_names": [
"string"
],
"dlp_result": {
"policies": [
{
"fired_rules": [
"ssn_present",
"bulk_customer_records"
],
"policy_id": "8CA67511-744C-4D74-B26E-7281CF88712F",
"policy_name": "Customer PII protection",
"positive": true,
"score": 0.82,
"verdict": "allow"
}
],
"score": 0.82,
"verdict": "allow"
},
"dlp_sensitive": true,
"download_count": 0,
"file_extension": "string",
"file_type": "string",
"high_prevalence": true,
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"matched_categories": [
"string"
],
"matched_entities": [
"string"
],
"name": "string",
"risk_factors": [
{
"magnitude": 40,
"type": "sensitive_file"
}
],
"rsync_download_count": 0,
"rsync_upload_count": 0,
"scp_download_count": 5,
"scp_upload_count": 5,
"sensitivity_result": {
"entities": [
{
"classification": "PII_SSN",
"confidences": [
0
],
"count": 0,
"head_id": "string",
"standalone_sensitive": true
}
],
"has_standalone_sensitive": true,
"risk_level": "unspecified",
"sensitivity": 0.74
},
"size": 0,
"top_sensitive_classifications": [
"string"
],
"upload_count": 0,
"usb_download_count": 0,
"usb_upload_count": 0
},
"file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
"file_name": "string",
"high_prevalence": true,
"host_user_account": "string",
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"movement_type": "airdrop",
"network_origin": {
"geographic_location": {
"city": "San Francisco",
"country": "United States",
"country_code": "US",
"latitude": 0,
"longitude": 0,
"region": "California",
"timezone": "America/Los_Angeles"
},
"ip": "203.0.113.45",
"network": {
"asn": "AS15169",
"asn_name": "Google LLC",
"host_type": [
"HOSTING",
"ANYCAST"
]
},
"privacy": {
"privacy_mode": [
"VPN"
],
"service_name": "NordVPN"
}
},
"origin": "company_domain_environment",
"person_email": "string",
"person_id": "8CA67511-744C-4D74-B26E-7281CF88712F",
"person_name": "string",
"process": {
"command": "string",
"parent_process_id": "string",
"process_group_id": "string",
"pwd": "string",
"target_process_id": "string",
"username": "string"
},
"remote_host": "dropbox.com",
"remote_ip": "string",
"risk_factors": [
{
"magnitude": 40,
"type": "sensitive_file"
}
],
"risk_score": 9.2,
"shadow_it_host_data": {
"interaction_types": [
"ai_access_enforcement"
],
"login_count": 0
},
"source_path": "string",
"timestamp": "2023-10-01T12:00:00Z",
"vector": "airdrop",
"web_host": {
"allowlisted": true,
"employee_email": "joe.smith@example.com",
"employee_name": "Joe Smith",
"event_types": [
"corporate_email_login"
],
"external_id": "chatgpt.com",
"host": "chatgpt.com",
"id": "8CA67511-744C-4D74-B26E-7281CF88712F",
"last_seen": "2021-01-01T00:00:00Z",
"login_count": 42,
"risk_score": 9.2
}
}
]
}Modified at 2026-07-24 15:31:52