In addition to the baseline event fields (source/destination, CVE, signature, HTTP details — see Example Canary Records), vulncheck-canaries records carry a set of enrichment fields when available for that event. These are derived from the payload and the attacking source itself, and surface tooling, infrastructure, and reputation context an analyst would otherwise have to derive by hand.
Enrichment fields follow the standard omitempty contract: a field is only present on a record if it was populated for that event.
| Field | Type | Description |
|---|---|---|
| payload_tlsh | string | TLSH fuzzy hash of the observed payload, useful for clustering similar/related payloads across events |
| payload_tooling | array of strings | Attacker tooling identified in the payload (e.g. wget, curl) |
| Field | Type | Description |
|---|---|---|
| tech_vertical | array of strings | Industry vertical(s) the targeted system/vulnerability is associated with |
| Field | Type | Description |
|---|---|---|
| c2_location | array of strings | C2 / attacker-infrastructure indicators (IPs, URLs) extracted from the payload |
| c2_frequency_3d | array of objects (src, count) | Extracted C2/attacker-infrastructure sources and how many times each was observed across all canaries in the last 3 days |
| Field | Type | Description |
|---|---|---|
| src_ip_type_findings | array of strings | Reputation/type findings for the source IP (e.g. potentially vulnerable) |
| src_ip_freq_3d | integer | Number of times this source IP was observed across all VulnCheck sources in the last 3 days |
| src_ip_freq_3d_canary | integer | Number of times this source IP was observed hitting canaries specifically in the last 3 days |
The vulncheck-canaries index always stores these fields internally, but the API only returns a field when it has a non-empty value for that event. This is a live record pulled from vulncheck-canaries on 2026-08-14:
{
"src_ip": "107.173.241.217",
"src_port": 42008,
"src_country": "US",
"src_asn": "AS36352",
"src_as_name": "HostPapa",
"src_as_domain": "colocrossing.com",
"dst_country": "US",
"cve": "CVE-2017-9841",
"signature_id": 12700264,
"signature": "VULNCHECK PHPUnit CVE-2017-9841 Exploit Attempt",
"category": "Web Application Attack",
"severity": 1,
"http": {
"url": "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php",
"http_user_agent": "libredtail-http",
"http_request_body": "PD9waHAgZWNobyhtZDUoIkhlbGxvIFBIUFVuaXQiKSk7",
"http_method": "GET",
"protocol": "HTTP/1.1"
},
"timestamp": "2026-08-14T19:26:18.557Z",
"payload_tlsh": "86721ca931993231be5a3e88be653d183b45b0173ca7916d47d5dcc82e87bf8261338d",
"payload_tooling": ["curl", "wget"],
"c2_location": [
"217.60.195.113",
"18.233.226.235",
"https://217.60.195.113/sh"
],
"src_ip_type_findings": ["proxy"],
"src_ip_freq_3d": 31,
"src_ip_freq_3d_canary": 31,
"c2_frequency_3d": [
{ "src": "217.60.195.113", "count": 3499 }
]
}
Here, the attacking IP is fingerprinted as a proxy (src_ip_type_findings), the payload identifies curl/wget as the delivery tooling, and c2_location surfaces the staging host (217.60.195.113) the exploit pulls its second-stage payload from — a host also seen 3,499 times across all canaries in the last 3 days (c2_frequency_3d).
tech_vertical wasn't populated on this event, but does appear on others, e.g.:
{
"cve": "CVE-2026-31816",
"signature": "VULNCHECK CVE-2026-31816 Budibase Authentication Bypass (Plugin Upload Successful Exploitation Response)",
"tech_vertical": ["technology"]
}
There is no dedicated query parameter for enrichment fields today; they are returned alongside the standard fields on any vulncheck-canaries query (see Query Parameters) and can be inspected in the response for events where the enrichment pipeline populated them.