--- updatedAt: 2026-09-30T16:03:51.000Z agentTools: projectIndex: https://docs.censys.com/llms.txt --- # Adversary Investigation The Adversary Investigation module is an add-on to the Censys Platform that allows organizations to detect, analyze, and track threat infrastructure with speed and precision. The threat dataset available within the module enriches assets with threat-specific data that provides additional context for investigations. The module enables you to explore the threat dataset with structured tools, historical context, and workflows. These capabilities help you validate threats in real time and uncover hidden clusters of malicious assets. You can also pivot across current and historical data to identify shared traits across infrastructure. The Adversary Investigation module includes: * AI Investigations: Comprehensively analyze indicators and discover related infrastructure using an AI investigator that checks each entity's history, pivots to potentially related assets, and profiles web resources. The investigator then connects the results, ranks what matters, and hands you a formatted report of findings. - Comprehensive and searchable threat dataset: The threat dataset maps malware, threat actors, and tactics to services or endpoints running on exposed hosts and web properties. This data enables you to investigate and track malicious activity across the internet. It helps identify infrastructure used to distribute malware and link it to known threat actors. Users with access to the Adversary Investigation module can search and pivot across all Censys threat data. The threat dataset also includes JA3, JA4, and JARM data. Threat data is presented on a centralized dashboard on the Explore Threats page (see below) and users with access to the Adversary Investigation module can see threat data throughout the entire Platform UI. Threat data is also retrievable via the API. - Tracked Threats page: Provides you with a centralized view into internet-facing infrastructure linked to malware and threat actors. Use interactive visualizations, curated threat profiles, and simplified filtering to quickly identify relevant threats. - CensEye automated pivoting tool: CensEye helps you identify web assets on the internet that share a specific key-value pair with the asset you are currently viewing. It extracts data values like HTTP headers, SSH banners, and TLS certificate information, then shows how many other assets present the same value. This allows you to pivot into related infrastructure and begin building queries based on shared characteristics. Once you identify related assets, you can group and monitor them using collections. - Expanded open directory data, open directory explorer, and suspicious directory threats: Additional contextual metadata about assets with open directories. This information can be explored in an intuitive interactive UI, raw data in the Platform web console, and retrieved via API. Open directories that meet certain criteria are tagged as Suspicious Directory threats that can be searched and tracked like all other threats. - Investigation Manager: Build node-based pivot trees to discover, visualize, and understand connections between assets in the Censys datasets. - Live Discovery: Run fresh scans on specific ports to view side-by-side comparisons of scan results. These comparisons help you to instantly validate infrastructure behavior, detect configuration changes, and confirm asset persistence without waiting for scheduled Censys scans. - Certificate history: The Certificate Timeline provides a visual history of when a certificate presented itself on hosts and web properties. This visualization gives you historical context that simplifies the detection of patterns, trends, and anomalies that could signal malicious behavior. ## Video overview

## Prerequisites * Organization must be on the [Censys Core tier](https://docs.censys.com/docs/data-access-tiers-entitlements). * Organization must purchase Adversary Investigation module. ## Credit consumption Actions taken in the Adversary Investigation module or that target Adversary Investigation data within the Platform UI do not deduct from your organization's credit balance. Usage of Adversary Investigation-specific APIs will deduct from your credit balance. Credit costs for Adversary Investigation APIs vary. Reference the table below for more information. | API endpoint | Cost | | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------- | | Initiate Live Discovery scan | 15 | | Get host history for a certificate | 1 per page of results | | Get scan status | 0 | | CensEye: Retrieve value counts to discover pivots | 1 credit per count condition (array of objects) | | CensEye: Create a pivot analysis job | Varies. 44 for a host, 28 for a web property, 7 for a certificate |