import { ClientSDK, RequestOptions } from "../lib/sdks.js"; import * as operations from "../models/operations/index.js"; export declare class ThreatHunting extends ClientSDK { /** * CensEye: List jobs * * @remarks * List CensEye pivot analysis jobs for the current organization. Results are paginated. Optionally filter by asset (host, web property, or certificate). */ listCenseyeJobs(request: operations.V3ThreathuntingCenseyeJobsListRequest, options?: RequestOptions): Promise; /** * CensEye: Create a pivot analysis job * * @remarks * Create an asynchronous CensEye pivot analysis job for a host, web property, or certificate. The job extracts default pivot fields from the target asset and counts matching documents for each field-value pair. Poll the job status endpoint to track progress, then retrieve results when complete.

To use this endpoint, your organization must have access to the Adversary Investigation module.

This endpoint costs 44 credits to execute for a host, 28 credits to execute for a web property, and 7 credits to execute for a certificate. */ createCenseyeJob(request: operations.V3ThreathuntingCenseyeJobsCreateRequest, options?: RequestOptions): Promise; /** * CensEye: Get job status * * @remarks * Retrieve the current status of a CensEye pivot analysis job. Use this to poll for completion before fetching results.

To use this endpoint, your organization must have access to the Adversary Investigation module. */ getCenseyeJob(request: operations.V3ThreathuntingCenseyeJobsGetRequest, options?: RequestOptions): Promise; /** * CensEye: Get job results * * @remarks * Retrieve the results of a completed CensEye pivot analysis job. Each result contains a count and the field-value pairs that were analyzed. Results may be empty if the job is still running.

Results are paginated. Use the `next_page_token` from the response to fetch subsequent pages.

To use this endpoint, your organization must have access to the Adversary Investigation module. */ getCenseyeJobResults(request: operations.V3ThreathuntingCenseyeJobResultsRequest, options?: RequestOptions): Promise; /** * Get host history for a certificate * * @remarks * Retrieve the historical observations of hosts associated with a certificate. This is useful for threat hunting, detection engineering, and timeline generation. Certificate history is also visible to Adversary Investigation users in the Platform UI on the [certificate timeline](https://docs.censys.com/docs/platform-threat-hunting-use-cert-history-to-build-better-detections#/).

You can define a specific time frame of interest. If you do not specify a time frame, this endpoint will search the historical dataset that is available to your account. You may also filter results by port and transport protocol.

This endpoint is available to organizations that have access to the Adversary Investigation module. It costs 5 credits per page of results. */ getHostObservationsWithCertificate(request: operations.V3ThreathuntingGetHostObservationsWithCertificateRequest, options?: RequestOptions): Promise; /** * Live Discovery: Initiate a new scan * * @remarks * Initiate a scan to look for a currently unobserved service at a specific IP and port (`ip:port`) or hostname and port (`hostname:port`). This is equivalent to the [Live Discovery](https://docs.censys.com/docs/platform-threat-hunting-use-live-scan-and-rescan-to-validate-infrastructure#/) feature available in the UI, but you can also target web properties in addition to hosts.

The scan may take several minutes to complete. The response will contain a scan ID that you can use to [monitor the scan's status](https://docs.censys.com/reference/v3-threathunting-scans-get#/). After the scan completes, perform a lookup on the target asset to retrieve detailed scan information.

This endpoint is available to organizations that have access to the Adversary Investigation module. It costs 15 credits to execute this endpoint. */ createTrackedScan(request: operations.V3ThreathuntingScansDiscoveryRequest, options?: RequestOptions): Promise; /** * Get scan status * * @remarks * Retrieve the current status of a scan by its ID. This endpoint works for both [Live Discovery scans](https://docs.censys.com/reference/v3-threathunting-scans-discovery#/) and [Live Rescans](https://docs.censys.com/reference/v3-globaldata-scans-rescan#/).

If the scan was successful, perform a lookup on the target asset to retrieve detailed scan information.

This endpoint is available to all Enterprise customers. This endpoint does not cost any credits to execute. */ getTrackedScanThreatHunting(request: operations.V3ThreathuntingScansGetRequest, options?: RequestOptions): Promise; /** * List active threats * * @remarks * Retrieve a list of active threats observed by Censys by aggregating threat IDs across hosts and web properties. Threats are active if their fingerprint has been identified on hosts or web properties by Censys scans. This information is also available on the [Explore Threats page in the Platform web UI](https://platform.censys.io/threats).

This endpoint is available to organizations that have access to the Adversary Investigation module. */ listThreats(request: operations.V3ThreathuntingThreatsListRequest, options?: RequestOptions): Promise; /** * CensEye: Retrieve value counts to discover pivots * * @remarks * Get counts of web assets for specific field-value pairs and combinations of field-value pairs. This is similar to the [CensEye functionality](https://docs.censys.com/docs/platform-threat-hunting-use-censeye-to-build-detections#/) available in the Platform web UI, but it allows you to define specific fields of interest rather than the [default fields](https://docs.censys.com/docs/platform-threat-hunting-use-censeye-to-build-detections#default-pivot-fields) leveraged by the tool in the UI.

Each array can only target fields within the same nested object and may contain at most 5 field-value pairs. For example, you can combine `host.services.port=80` and `host.services.protocol=SSH` in the same array, but you cannot combine `host.services.port=80` and `host.location.country="United States"` in the same array. You can input multiple arrays of objects in each API call.

To use this endpoint, your organization must have access to the Adversary Investigation module. This endpoint costs 1 credit per count condition (array of objects) included in the API call. */ valueCounts(request: operations.V3ThreathuntingValueCountsRequest, options?: RequestOptions): Promise; } //# sourceMappingURL=threathunting.d.ts.map