Data formats

Rumble consumes and produces a handful of data formats. This page provides examples of these formats and describes the fields and use cases for each.

Formats

Scan data

The raw output produced by the Rumble Explorer and the Rumble Scanner is the scan data. This is newline-delimited JSON that represents the unprocessed output of the scan engine. This format is returned when downloading the task data for an explorer-run scan and correlates to the scan.rumble.gz file created by the command-line scanner. The Rumble Inventory view is built by processing scan data in chronological order to create the current state at a given point in time.

Scan data can be imported into an existing site through the Inventory Import menu of the web console and through the --import parameter of the command-line scanner. Each line of the file is a JSON object that specifies a type and a 64-bit Unix timestamp.

The example below is the raw scan data for a single Apple Mac Mini:

{"type":"config","ts":1597259738842951567,"probes":["arp","bacnet","dns","dtls","echo","ike","ipmi","mdns","memcache","mssql","natpmp","netbios","ntp","openvpn","pca","rdns","rpcbind","sip","snmp","ssdp","syn","tftp","ubnt","wlan-list","wsd"],"addresses":["192.168.0.1","192.168.30.1","192.168.40.1"],"networks":["192.168.0.1/24","192.168.30.1/24","192.168.40.1/24"],"params":{"arp-fast":"false","bacnet-port":"47808","clock-offset":"0","dns-port":"53","dns-resolve-name":"www.google.com","dns-trace-domain":"helper.rumble.network","dtls-ports":"443,3391,4433,5246,5349,5684","excludes":"","ike-port":"500","ipmi-port":"623","max-group-size":"4096","max-host-rate":"40","max-sockets":"512","mdns-port":"5353","memcache-port":"11211","mssql-port":"1434","nameservers":"","natpmp-port":"5351","netbios-port":"137","nopcap":"false","ntp-port":"123","openvpn-ports":"1194","passes":"1","pca-port":"5632","probes":"arp,bacnet,dns,dtls,echo,ike,ipmi,mdns,memcache,mssql,natpmp,netbios,ntp,openvpn,pca,rdns,rpcbind,sip,snmp,ssdp,syn,connect,tftp,ubnt,wlan-list,wsd","rate":"1000","rdns-max-concurrent":"64","rpcbind-port":"111","rpcbind-port-nfs":"2049","screenshots":"true","sip-port":"5060","skip-broadcast":"true","snmp-comms":"public,private","snmp-poll-interval":"300","snmp-port":"161","snmp-timeout":"5","snmp-v3-auth-passphrase":"","snmp-v3-auth-protocol":"none","snmp-v3-context":"","snmp-v3-privacy-passphrase":"","snmp-v3-privacy-protocol":"none","snmp-v3-username":"","ssdp-port":"1900","syn-max-retries":"2","syn-udp-trace-port":"65535","tcp-ports":"1300,5554,8020,20034,47001,41080,2601,2604,2638,5060,7181,10202,4679,2181,34205,13,2323,5601,18881,50070,139,1129,2199,2375,4444,902,1440,2103,32913,1311,9524,8028,8883,13364,37718,512,3200,5683,10203,81,1091,5222,8081,13838,37777,1,5672,8095,65535,21,540,548,1102,27080,28017,34443,40007,6060,6542,8300,27888,4786,9443,2049,3050,5984,46823,12221,1352,6405,26122,7210,41025,1103,1530,1883,8834,443,9100,45230,1234,3128,5432,12397,111,993,3780,5250,6112,524,5247,20031,1211,1755,5985,6070,8880,1241,3690,6002,1035,4000,8080,9081,2362,23,587,921,8903,31001,143,2598,3273,6101,8812,10628,25,113,513,1720,2533,6905,32764,38080,5040,20010,6001,6660,8471,82,2222,5093,6262,6379,8545,384,5168,20222,7579,998,3057,3217,6106,9391,9,2380,5520,9060,19300,30718,49,84,161,5900,10001,8009,19,617,2100,5580,38292,85,6667,10443,42,2121,5986,23791,515,1199,10008,16993,631,2083,8443,9527,13500,27017,30000,41523,554,5061,4659,8333,9855,5355,7001,1000,1220,5521,11234,20000,6988,3351,7547,7,1900,7778,9160,31099,1030,10616,7902,8090,12174,1533,135,5631,623,5038,9300,19888,14330,109,1433,15672,1581,3790,5632,9999,80,2381,4840,7800,61616,1101,1128,1494,3311,9092,11000,110,995,1098,5800,523,8087,10098,28784,407,7777,9090,19810,34963,50000,502,1100,8161,8180,9152,11099,2379,8023,88,1582,20101,16102,16992,1583,5814,5938,20111,11211,636,27000,1158,5400,5920,7443,9530,20171,8800,9099,7474,8222,10000,2082,8902,50013,689,771,7080,8098,8686,22,1024,12345,105,9080,9111,47002,4433,44818,4848,6080,7071,8303,62078,705,873,6000,7077,8503,9495,34964,5666,17200,5433,7801,11333,12401,12203,25025,264,2525,3628,9809,26000,50090,9000,2967,137,4730,5051,8899,10050,52302,8400,53,389,402,4443,7700,62514,1090,5353,6082,6661,40317,8089,17185,912,5405,28222,465,4445,6503,8014,57772,23472,1080,7021,8088,22222,5000,9084,18264,8888,6050,7144,41524,69,1811,44334,102,6502,1521,2809,9471,888,5351,5498,123,34962,8205,9042,2947,3389,5555,10080,10162,9200,500,1089,7510,15200,2207,3500,8008,9418,3460,6504,7770,25000,55553,179,783,8012,9595,46824,7580,5560,49152,83,903,1604,3632,4322,4567,445,8030,9390,3817,8901,10051,9002,27019,910,1099,3000,3299,222,7787,37,2000,3306,48899,7879,79,1723,3037,3312,8000,23943","tftp-ports":"69","ubnt-port":"10001","verbose":"true","wlan-list-poll-interval":"300","wsd-port":"3702"},"scan_targets":{"networks":["192.168.0.5/32"],"enable_dns":true,"enable_ip6":false,"inputs":["192.168.0.5"],"dns_timeout":2000000000,"concurrency":24},"version":"1.10.0 (build 20200804052508) [eae4e551f9f0ce5ab3bf0a1410b2ed5098db097e]"}
{"type":"status","ts":1597259758851278069,"level":"info","source":"connect","msg":"waiting on TCP probes to complete"}
{"type":"stats","ts":1597259769858733899,"stats":{"elapsed":31,"progress":94,"rateLimitTime":24246445895,"recv":546,"recvBytes":37404,"recvError":10,"recvRate":17,"resultCount":22,"secondsLeft":1,"sent":503,"sentBytes":36833,"sentError":0,"sentRate":16,"startTime":1597259738843056937}}
{"type":"result","ts":1597259738844372618,"host":"192.168.0.5","port":"0","proto":"icmp","probe":"echo","info":{"icmp.addrs":"192.168.0.5","icmp.rtts":"541214","ip.flags":"DF","ip.id":"0","ip.tos":"0","ip.ttl":"64"}}
{"type":"result","ts":1597259739077542717,"host":"192.168.0.5","port":"137","name":"MACMINI-EE7C7B","proto":"udp","probe":"netbios","info":{"netbios.domain":"WORKGROUP","netbios.mac":"f0:18:98:ee:7c:7b","netbios.macDateAdded":"2017-12-23","netbios.macVendor":"Apple, Inc."}}
{"type":"result","ts":1597259739219939211,"host":"192.168.0.5","port":"137","proto":"udp","probe":"netbios","info":{"netbios.addrs":"192.168.0.5"}}
{"type":"result","ts":1597259739471688048,"host":"192.168.0.5","port":"0","proto":"arp","probe":"arp","info":{"arp.mac":"f0:18:98:ee:7c:7b","arp.macDateAdded":"2017-12-23","arp.macVendor":"Apple, Inc.","source":"arp"}}
{"type":"result","ts":1597259739826114224,"host":"192.168.0.5","port":"5353","name":"Developers-Mac-mini","proto":"udp","probe":"mdns","info":{"mdns.replies":"5.0.168.192.in-addr.arpa.=PTR,Developers-Mac-mini.local."}}
{"type":"result","ts":1597259740197709484,"host":"192.168.0.5","port":"445","proto":"tcp","probe":"connect","info":{"ntlmssp.dnsComputer":"Developers-Mac-mini.local","ntlmssp.dnsDomain":"local","ntlmssp.negotiationFlags":"0x62898235","ntlmssp.netbiosComputer":"DEVELOPERS-MAC-MINI","ntlmssp.netbiosDomain":"MACMINI-EE7C7B","ntlmssp.ntlmRevision":"15","ntlmssp.targetName":"MACMINI-EE7C7B","ntlmssp.timestamp":"0x01d670dd06500880","ntlmssp.version":"6.1.7600","protocol":"smb1\tsmb2\tsmb3","smb.capabilities":"0x00000066","smb.dialect":"0x0302","smb.guid":"ff12583f-5ba1-53b8-8ff3-a48a394056f7","smb.nativeLM":"@(#)PROGRAM:smbd  PROJECT:smbx-499.60.1","smb.nativeOS":"Darwin","smb.sessionID":"0x9551b7cb00000001","smb.signing":"required","source":"mdns"}}

The data contains four types of object:

  • Scan config: The {"type":"config"} object contains the full set of parameters for the scan as well as the version of the scan engine, and on Windows, the version of npcap installed. This record is used to determine the scan targets, which is used by the analysis engine to determine whether a given IP address was in scope.

  • Scan status: The {"type":"status"} object contains diagnostic output from the scan engine. This can highlight issues that occurred while the scan was running.

  • Scan stats: The {"type":"stats"} object represents point in time statistics for the scan. This will include the number of packets sent, received, and the progress estimate.

  • Scan result: The {"type":"result"} object is target response for a specific probe. This can include TCP SYN+ACK replies, ICMP replies, or the result of application-layer probes, such as SNMP query responses, or HTTP screenshots. Scan Results are analyzed and correlated to create to the Asset Data format.

The scan stats sub-fields are defined below:

Field Description
cpu CPU Core Percent * 100. 100% of one core would be 100000.
elapsed The number of seconds since the scan started.
fdcount The number of open file descriptors.
memory The current memory usage in bytes.
progress The estimated progress as a percentage (90 = 90%).
rateLimitTime The number of Unix nanoseconds spent idling in the rate limiter.
recv The number of packets received from the network.
recvBytes The number of bytes received from the network.
recvError The number of errors receiving from the network.
recvRate The average packet receive rate for the scan.
resultCount The total number of findings from the scan.
routines The number of internal goroutines in the scan engine.
secondsLeft The estimated seconds left to complete the scan.
sent The number of packets sent the network.
sentBytes The number of bytes sent the network.
sentError The number of errors sending to the network.
sentRate The average packet send rate for the scan.
startTime The Unix timestamp in nanoseconds of when the scan started.

The scan result object type contains the following fields in addition to type and ts:

Field Description
host The IP address associated with the response.
name An optional hostname returned as part of this response.
port The TCP or UDP port or zero for other protocols.
proto The transport protocol, one of arp, icmp, tcp, or udp.
probe The specific internal probe name that returned this response.
info The result details object where all keys and values are strings.

The info object contains probe-specific response data. The key names are typically in the format of probe.subfield, with a few exceptions, and the values are always strings, even for numeric and array content. Multiple values for a key are represented as a tab-delimited array. Empty values are never reported for info keys. A given scan may return multiple result objects for a single probe, sometimes with duplicate values. These responses are correlated, deduplicated, and merged during the next phase of processing.

Asset data

The correlated and fingerprinted assets shown in the web console Inventory view and in the assets.jsonl file produced by the Rumble Scanner are the asset data. This data represents the state of each unique asset at a point in time and is built up by processing one or more sets of scan data.

Rumble supports a few variants of the asset data, including line-delimited JSON (JSONL), standard JSON documents, and a simplified CSV export. The JSONL format is the easiest to work with as it supports incremental processing without having to load the entire response into memory.

The example below is the correlated asset data for a scan of a single Apple Mac Mini:

{"id":"b73f8e09-78a6-4d2b-979d-e63908f28251","created_at":1597259778,"updated_at":1597259778,"organization_id":"b7fb13a7-701d-4ca5-b0e6-6f28f06cc866","site_id":"52d60c51-8dee-4f09-94e5-2dee30050a25","alive":true,"last_seen":1597259750,"first_seen":1597259738,"detected_by":"arp","type":"Desktop","os":"Apple macOS","os_version":"10.15","hw":"Apple Mac Mini (Late 2018)","addresses":["192.168.0.5"],"addresses_extra":["fe80::1c9d:c567:8db1:d79b"],"macs":["f0:18:98:ee:7c:7b"],"mac_vendors":["Apple, Inc."],"names":["MACMINI-EE7C7B","DEVELOPERS-MAC-MINI","DEVELOPERS-MAC-MINI.LOCAL"],"tags":{},"domains":[],"services":{"192.168.0.5/0/arp/":{"arp.mac":"f0:18:98:ee:7c:7b","arp.macDateAdded":"2017-12-23","arp.macVendor":"Apple, Inc.","source":"arp","ts":"1597259739"},"192.168.0.5/0/icmp/":{"icmp.addrs":"192.168.0.5","icmp.rtts":"541214","ip.flags":"DF","ip.id":"0","ip.tos":"0","ip.ttl":"64","ts":"1597259738"},"192.168.0.5/137/udp/":{"netbios.addrs":"192.168.0.5","netbios.domain":"WORKGROUP","netbios.mac":"f0:18:98:ee:7c:7b","netbios.macDateAdded":"2017-12-23","netbios.macVendor":"Apple, Inc.","protocol":"netbios","ts":"1597259739"},"192.168.0.5/22/tcp/":{"banner":"SSH-2.0-OpenSSH_7.9","ip.flags":"DF","ip.id":"0","ip.tos":"0","ip.ttl":"64","protocol":"ssh","service.cpe23":"cpe:/a:openbsd:openssh:7.9","service.family":"OpenSSH","service.vendor":"OpenBSD","service.version":"7.9","source":"mdns","ssh.hostKey.data":"AAAAB3NzaC1yc2EAAAADAQABAAABAQCjGYTFcSp2Fs/R8dboLYiQ6PPrulZYanYH3SCYYr5QgC1SIF3AURGYTMnUDAS+tTI/Pquwowkgiq3rtfsQMAsCrahbPahwiOLTupsuLNp3evXYYSf8ZQFyBN8iz5cys06u+yczqWG7Fu8mgpS8zwCwN7yRrbFWd8+Hp6GgfUU4Z6jUQoZu7iajpbSXlTA9OYKXQIZOm8qc4mPLT/uHw9nxNmExWA1V/2ZeoS59NGSV8zFMKb52SOXKhkvHAIUVh5NJDAudxK4uP4eG6dxr8btYtVKIOYKlsLdSBSfHvSCvVVlb7DKJBiMXG+qspt33Zd73o4S9ICh2OaSbVt7h/NZ3","ssh.hostKey.md5":"75:9b:a2:e6:10:da:72:8a:11:91:3f:a1:43:14:7f:2e","ssh.hostKey.sha256":"SHA256:xVJfddKBJ9E5jstVCj0zY8763Rnxy2pqpzaLZXO+cHc","ssh.hostKey.type":"ssh-rsa","syn.rtt":"542019","tcp.options":"MSS:05b4","tcp.ts":"2009546838","tcp.urg":"0","tcp.win":"65535","ts":"1597259740"},"192.168.0.5/3031/tcp/":{"source":"mdns","ts":"1597259740"},"192.168.0.5/3283/tcp/":{"source":"mdns","ts":"1597259740"},"192.168.0.5/445/tcp/":{"ip.flags":"DF","ip.id":"0","ip.tos":"0","ip.ttl":"64","ntlmssp.dnsComputer":"Developers-Mac-mini.local","ntlmssp.dnsDomain":"local","ntlmssp.negotiationFlags":"0x62898235","ntlmssp.netbiosComputer":"DEVELOPERS-MAC-MINI","ntlmssp.netbiosDomain":"MACMINI-EE7C7B","ntlmssp.ntlmRevision":"15","ntlmssp.targetName":"MACMINI-EE7C7B","ntlmssp.timestamp":"0x01d670dd06500880","ntlmssp.version":"6.1.7600","protocol":"smb1\tsmb2\tsmb3","smb.capabilities":"0x00000066","smb.dialect":"0x0302","smb.guid":"ff12583f-5ba1-53b8-8ff3-a48a394056f7","smb.nativeLM":"@(#)PROGRAM:smbd  PROJECT:smbx-499.60.1","smb.nativeOS":"Darwin","smb.sessionID":"0x9551b7cb00000001","smb.signing":"required","source":"mdns","syn.rtt":"624414","tcp.options":"MSS:05b4","tcp.ts":"2009544186","tcp.urg":"0","tcp.win":"65535","ts":"1597259740"},"192.168.0.5/5353/udp/":{"hw.device":"Desktop","hw.family":"Mac mini","hw.product":"Mac mini (Late 2018)","hw.vendor":"Apple","mdns.addrs":"fe80::1c9d:c567:8db1:d79b\t192.168.0.5","mdns.device.model":"Macmini8,1","mdns.device.osxvers":"19","mdns.ports":"eppc/tcp=3031\tnet-assistant/udp=3283\trfb/tcp=5900\tsftp-ssh/tcp=22\tsmb/tcp=445\tssh/tcp=22","mdns.replies":"5.0.168.192.in-addr.arpa.=PTR,Developers-Mac-mini.local.\tDeveloper\\226\\128\\153s\\ Mac\\ mini._device-info._tcp.local.=TXT,model=Macmini8,1 osxvers=19\tDevelopers-Mac-mini.local.=A,192.168.0.5\tDevelopers-Mac-mini.local.=AAAA,fe80::1c9d:c567:8db1:d79b\t_eppc._tcp.local.=PTR,Developer\\226\\128\\153s\\ Mac\\ mini._eppc._tcp.local.\t_net-assistant._udp.local.=PTR,Developer\\226\\128\\153s\\ Mac\\ mini._net-assistant._udp.local.\t_rfb._tcp.local.=PTR,Developer\\226\\128\\153s\\ Mac\\ mini._rfb._tcp.local.\t_sftp-ssh._tcp.local.=PTR,Developer\\226\\128\\153s\\ Mac\\ mini._sftp-ssh._tcp.local.\t_smb._tcp.local.=PTR,Developer\\226\\128\\153s\\ Mac\\ mini._smb._tcp.local.\t_ssh._tcp.local.=PTR,Developer\\226\\128\\153s\\ Mac\\ mini._ssh._tcp.local.","mdns.services":"ssh/tcp\tsftp-ssh/tcp\teppc/tcp\trfb/tcp\tsmb/tcp\tnet-assistant/udp","os.cpe23":"cpe:/o:apple:mac_os_x:10.15","os.family":"Mac OS X","os.product":"Mac OS X","os.vendor":"Apple","os.version":"10.15","protocol":"mdns","ts":"1597259740"},"192.168.0.5/5900/tcp/":{"ip.flags":"DF","ip.id":"0","ip.tos":"0","ip.ttl":"64","protocol":"vnc","source":"mdns","syn.rtt":"625419","tcp.options":"MSS:05b4","tcp.ts":"2009549134","tcp.urg":"0","tcp.win":"65535","ts":"1597259749","vnc.version":"RFB 003.889"}},"credentials":{},"rtts":{"icmp/echo":[541214]},"attributes":{"_macs.ipmap":"f0:18:98:ee:7c:7b=192.168.0.5","ip.ttl.hops":"0","ip.ttl.host":"192.168.0.5","ip.ttl.port":"22","ip.ttl.source":"64","ip.ttl.source.icmp":"64","ip.ttl.win":"65535","match.db":"mdns-device-info-txt","match.score":"90","ntlmssp.dnsComputer":"Developers-Mac-mini.local","ntlmssp.dnsDomain":"local","ntlmssp.version":"6.1.7600","os.cpe23":"cpe:/o:apple:mac_os_x:10.15","os.family":"Mac OS X","os.product":"Mac OS X","os.vendor":"Apple","os.version":"10.15","smb.guid":"ff12583f-5ba1-53b8-8ff3-a48a394056f7","smb.nativeLM":"@(#)PROGRAM:smbd  PROJECT:smbx-499.60.1","smb.nativeOS":"Darwin"},"service_count":9,"service_count_tcp":5,"service_count_udp":2,"service_count_arp":1,"service_count_icmp":1,"lowest_ttl":0,"lowest_rtt":541214,"last_explorer_id":"ca811190-329c-4da3-8cbe-3fd2ddff2663","last_task_id":"de5a4176-3614-4b71-8939-95b9108124aa","newest_mac":"f0:18:98:ee:7c:7b","newest_mac_vendor":"Apple, Inc.","newest_mac_age":1513987200000000000,"comments":null,"service_ports_tcp":["22","445","3031","3283","5900"],"service_ports_udp":["137","5353"],"service_protocols":["mdns","netbios","smb1","smb2","smb3","ssh","vnc"],"service_products":["openbsd openssh"],"org_name":"Test Lab","site_name":"MAC","explorer_name":"TENTACULAR"}

Asset Data uses a number of data types for top-level fields, including string arrays, objects, strings, and integers. Rumble tracks multiple IP addresses and MACs per asset and these are represented as arrays. For asset-level attributes and services, these are stored as objects with additional structure. Assets are uniquely identified by the id field (a V4 UUID) and nearly every other field can be changed between scans, as assets move around the network, change IPs, and open and close services.

Every asset belongs to an Organization and a Site within that Organization.

The asset data fields are defined below.

Field Description
id The unique ID of this asset defined as a v4 UUID
updated_at The asset last update time represented as a 64-bit Unix timestamp in seconds.
organization_id The Organization identifier defined as a v4 UUID.
site_id The Site identifier defined as a v4 UUID.
alive A boolean indicating whether this asset was found during the last scan of the site.
last_seen The time the asset last responded represented as a 64-bit Unix timestamp in seconds.
detected_by The protocol used to first detect that this asset was alive during the last scan.
type A classification that represents a guess of the asset’s purpose (Server, Desktop, Switch, etc).
os The operating system name as determined by the fingerprinting engine.
os_version The operating system version as determined by the fingerprinting engine.
hw The hardware definition as determined by the fingerprinting engine.
addresses An array of IP (v4/v6) addresses associated with this asset that were within the scan scope.
addresses_extra An array of IP (v4/v6) addresses associated with this asset that were outside the scan scope.
macs An array of MAC addresses associated with this asset.
mac_vendors An array of MAC address vendors associated with this asset.
names An array of unique hostnames associated with this asset (uppercase).
domains An array of unique domain names associated with this asset (uppercase).
tags A text representation of the user-specified tags associated with this asset.
services An object containing each associated service with the key representing the service description.
credentials An object containing a map of any associated credentials (SNMP v2/v3).
rtts An object containing a map of round-trip measurement times in milliseconds.
attributes An object containing a map key-value string attributes for this asset.
service_count A sum of TCP, UDP, ARP, and ICMP services.
service_count_tcp A sum of TCP services.
service_count_udp A sum of UDP services.
service_count_arp A sum of ARP services (0 or 1).
service_count_icmp A sum of ICMP services.
lowest_ttl The lowest observed source TTL for this asset.
lowest_rtt The lowest observed source RTT for this asset.
last_explorer_id The v4 UUID of the explorer responsible for the last scan of this asset.
last_task_id The v4 UUID of the task responsible associated with the last scan of this asset.
last_task_id The v4 UUID of the task responsible associated with the last scan of this asset.
newest_mac The “newest” MAC address by registration date.
newest_mac_vendor The “newest” MAC address vendor by registration date.
newest_mac_age The “newest” MAC address registration date as a Unix timestamp in nanoseconds.
comments User-specified comments associated with this asset.
service_ports_tcp An array of strings representing the unique TCP ports found on this asset
service_ports_udp An array of strings representing the unique UDP ports found on this asset
service_protocols An array of strings representing the unique protocols found on this asset
service_products An array of strings representing the unique products found on this asset
org_name The name of the Organization associated with this asset
site_name The name of the Site associated with this asset
explorer_name The name of the Explorer associated with this asset

The services field contains string keys that contain the unique service identifier with values stored as strings. Multiple values may be stored as tab-delimited strings in the service values. A typical service key looks like 192.168.0.5/22/tcp/. The components of the service key name consist of address, port, transport, and virtual host (which can be blank).

Change reports

The Rumble platform calculates a change report after processing each scan. This is a JSON document available for download from the Task Details page with the following structure.

{
  "new":     { "<asset-UUID>": { "Asset Data Fields":"" } },
  "online":  { "<asset-UUID>": { "Asset Data Fields":"" } },
  "offline": { "<asset-UUID>": { "Asset Data Fields":"" } },
  "changed": { "<asset-UUID>": { "Asset Data Fields":"" } },
  "summary": {
    "changed": 0,
    "new": 1,
    "offline": 0,
    "online": 0,
    "unchanged": 0
  },
  "truncated": false
}

The new, online, offline, and changed objects each contain keys consisting of the modified asset IDs with the values represented in the asset data format. The summary field indicates overall change statistics for this task. The truncated field is set to true if the change report is incomplete due to reaching the maximum change threshold (1000 asset changes today).