API Reference
A string used to filter threat actors. It can start with specific prefixes to indicate the type of filter:
name:: Filter by Name, case-insensitive.uuid:: Filter by UUID, case-insensitive.internal_name:: Filter by internal_name (exact match).desc:: Filter by description (searches both description and gen_description fields). If no prefix is provided, it defaults to filtering on the display_name or name fields. Examples:name:APTname:lazarus_groupinternal_name:m-threat-actor-happy-yellow-dog-a123lazarus_groupLazarus Group
The number of items to skip before starting to collect the result set.
0Field to sort by - either name, created_at, updated_at, enriched_at, trending_1d, trending_7d, or trending_30d
created_atPattern: ^(name|created_at|updated_at|enriched_at|trending_1d|trending_7d|trending_30d)$Sort order - either asc or desc
descPattern: ^(asc|desc)$The maximum number of items to return.
100Include entities that have been merged into other entities
falseWhen true, returns only threat actors that the tenant is following
falseFilter on the motivation field by exact match
Filter on the motivation field for items not equal to the given value
Filter on the motivation field for items that match any value in a comma-separated list
Filter on the motivation field for items that do not match any value in a comma-separated list
Filter on the motivation field for items that match a SQL LIKE pattern (use % as wildcard, case-sensitive)
Filter on the motivation field for items that match a SQL LIKE pattern (use % as wildcard, case-insensitive)
Filter on the sponsor field by exact match
Filter on the sponsor field for items not equal to the given value
Filter on the sponsor field for items that match any value in a comma-separated list
Filter on the sponsor field for items that do not match any value in a comma-separated list
Filter on the sponsor field for items that match a SQL LIKE pattern (use % as wildcard, case-sensitive)
Filter on the sponsor field for items that match a SQL LIKE pattern (use % as wildcard, case-insensitive)
Filter on the family_name field by exact match
Filter on the family_name field for items not equal to the given value
Filter on the family_name field for items that match any value in a comma-separated list
Filter on the family_name field for items that do not match any value in a comma-separated list
Filter on the family_name field for items that match a SQL LIKE pattern (use % as wildcard, case-sensitive)
Filter on the family_name field for items that match a SQL LIKE pattern (use % as wildcard, case-insensitive)
Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
The unique identifier (uuid or id) of the configuration set to retrieve
Successful Response
Not found
Validation Error
The vulnerability UUID to retrieve configuration sets for
Successful Response
Not found
Validation Error
The unique CVE ID or UUID of the vulnerability to retrieve
Successful Response
Not found
Validation Error
No content
The unique CVE ID or UUID of the vulnerability to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
published_atPattern: ^(type|name|created_at|published_at)$Sort order
descPattern: ^(asc|desc)$Filter parameter (e.g., 'type:ip.v4', 'type:domain', 'type:hash.sha256')
Successful Response
Not found
Validation Error
The unique CVE ID or UUID of the vulnerability to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
published_atPattern: ^(created_at|updated_at|published_at|source)$Sort order
descPattern: ^(asc|desc)$Filter parameter (e.g., 'user_generated_content:true' or 'user_generated_content:false')
Successful Response
Not found
Validation Error
The unique CVE ID or UUID of the vulnerability to export
Filter related objects to only include those created after this ISO8601/RFC3339 timestamp
Filter related objects to only include those created before this ISO8601/RFC3339 timestamp
Successful Response
Not found
Validation Error
No content
The unique CVE ID or UUID of the vulnerability to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by - created_at, updated_at, vendor, product_name, or product_type
created_atPattern: ^(created_at|updated_at|vendor|product_name|product_type)$Sort order
descPattern: ^(asc|desc)$Filter parameter (e.g., 'vulnerable:true' or 'vulnerable:false')
Output model type
detailedPattern: ^(basic|detailed)$Successful Response
Not found
Validation Error
The unique CVE ID or UUID of the vulnerability to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
created_atPattern: ^(created_at|updated_at|source|method|upstream_id)$Sort order
descPattern: ^(asc|desc)$Filter parameter (e.g., 'method:snort')
Output model type
basicPattern: ^(basic|detailed)$Successful Response
Not found
Validation Error
Time window for comparison. Format: '' where unit is 'd' (days) or 'h' (hours). Examples: '1d', '12h', '7d'. Maximum: 30d or 720h. Default: '1d'.
1dPattern: ^\d+[dh]$Maximum number of entities to consider as 'trending' per period. Only the top N entities by mention count are compared. Default: 10.
10Successful Response
Not found
Validation Error
A string used to filter vulnerabilities. It can start with specific prefixes to indicate the type of filter:
cve:: Filter by CVE ID.uuid:: Filter by UUID.internal_name:: Filter by internal_name (exact match).desc:: Filter by description (searches both description and gen_description fields).gen_display_name:: Filter by gen_display_name.cisa_kev:: Filter by cisa_kev.state:: Filter by state.- If the filter string matches the pattern
CVE-or a UUID pattern, it will be treated as a specific filter. - If no prefix is provided, it defaults to a description filter (searches both description fields).
Field to sort by - either cve_id, gen_cwe_id, state, created_at, updated_at, enriched_at, published_at, cvss_base_score, cvss_version, epss_score, epss_percentile, trending_1d, trending_7d, or trending_30d
created_atPattern: ^(cve_id|gen_cwe_id|state|created_at|updated_at|enriched_at|published_at|cvss_base_score|cvss_version|epss_score|epss_percentile|trending_1d|trending_7d|trending_30d)$Sort order - either asc or desc
descPattern: ^(asc|desc)$The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Include entities that have been merged into other entities
falseWhen true, returns only vulnerabilities that the tenant is following
falseFilter on the cvss_base_score field by exact match
Filter on the cvss_base_score field for items not equal to the given value
Filter on the cvss_base_score field for items greater than the given value
Filter on the cvss_base_score field for items greater than or equal to the given value
Filter on the cvss_base_score field for items less than the given value
Filter on the cvss_base_score field for items less than or equal to the given value
Filter on the cvss_base_score field for items that are NULL (true) or NOT NULL (false)
Filter on the cvss_base_score field for items that exist (true/false)
Filter on the epss_score field by exact match
Filter on the epss_score field for items not equal to the given value
Filter on the epss_score field for items greater than the given value
Filter on the epss_score field for items greater than or equal to the given value
Filter on the epss_score field for items less than the given value
Filter on the epss_score field for items less than or equal to the given value
Filter on the epss_score field for items that are NULL (true) or NOT NULL (false)
Filter on the epss_score field for items that exist (true/false)
Filter on the epss_percentile field by exact match
Filter on the epss_percentile field for items not equal to the given value
Filter on the epss_percentile field for items greater than the given value
Filter on the epss_percentile field for items greater than or equal to the given value
Filter on the epss_percentile field for items less than the given value
Filter on the epss_percentile field for items less than or equal to the given value
Filter on the epss_percentile field for items that are NULL (true) or NOT NULL (false)
Filter on the epss_percentile field for items that exist (true/false)
Filter on the gen_cwe_id field by exact match
Filter on the gen_cwe_id field for items not equal to the given value
Filter on the gen_cwe_id field for items that match any value in a comma-separated list
Filter on the gen_cwe_id field for items that do not match any value in a comma-separated list
Filter on the gen_cwe_id field for items that match a SQL LIKE pattern (use % as wildcard, case-sensitive)
Filter on the gen_cwe_id field for items that match a SQL LIKE pattern (use % as wildcard, case-insensitive)
Filter on the gen_cwe_id field for items that are NULL (true) or NOT NULL (false)
Filter on the gen_cwe_id field for items that exist (true/false)
Filter on the published_at field by exact match
Filter on the published_at field for items not equal to the given value
Filter on the published_at field for items less than the given value
Filter on the published_at field for items less than or equal to the given value
Filter on the published_at field for items greater than the given value
Filter on the published_at field for items greater than or equal to the given value
Filter on the published_at field for items that are NULL (true) or NOT NULL (false)
Filter on the published_at field for items that exist (true/false)
Filter by exploits count
Filter by exploits count (for items not equal to the given value)
Filter by exploits count (for items greater than the given value)
Filter by exploits count (for items greater than or equal to the given value)
Filter by exploits count (for items less than the given value)
Filter by exploits count (for items less than or equal to the given value)
Filter by exploitations count
Filter by exploitations count (for items not equal to the given value)
Filter by exploitations count (for items greater than the given value)
Filter by exploitations count (for items greater than or equal to the given value)
Filter by exploitations count (for items less than the given value)
Filter by exploitations count (for items less than or equal to the given value)
Filter by detection_signatures count
Filter by detection_signatures count (for items not equal to the given value)
Filter by detection_signatures count (for items greater than the given value)
Filter by detection_signatures count (for items greater than or equal to the given value)
Filter by detection_signatures count (for items less than the given value)
Filter by detection_signatures count (for items less than or equal to the given value)
Filter by mentions count
Filter by mentions count (for items not equal to the given value)
Filter by mentions count (for items greater than the given value)
Filter by mentions count (for items greater than or equal to the given value)
Filter by mentions count (for items less than the given value)
Filter by mentions count (for items less than or equal to the given value)
Filter by weaknesses count
Filter by weaknesses count (for items not equal to the given value)
Filter by weaknesses count (for items greater than the given value)
Filter by weaknesses count (for items greater than or equal to the given value)
Filter by weaknesses count (for items less than the given value)
Filter by weaknesses count (for items less than or equal to the given value)
Filter by advisories count
Filter by advisories count (for items not equal to the given value)
Filter by advisories count (for items greater than the given value)
Filter by advisories count (for items greater than or equal to the given value)
Filter by advisories count (for items less than the given value)
Filter by advisories count (for items less than or equal to the given value)
Filter by malware count
Filter by malware count (for items not equal to the given value)
Filter by malware count (for items greater than the given value)
Filter by malware count (for items greater than or equal to the given value)
Filter by malware count (for items less than the given value)
Filter by malware count (for items less than or equal to the given value)
Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
The unique UUID of the technology product advisory to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by - cve_id, cvss_base_score, epss_score, or published_at
epss_scorePattern: ^(cve_id|cvss_base_score|epss_score|published_at)$Sort order
descPattern: ^(asc|desc)$Output model type. Use 'basic' (default) for standard fields or 'detailed' for additional fields including relationships and extended metadata.
basicPattern: ^(basic|detailed)$Paginated list of vulnerabilities. Response schema depends on the type query parameter: 'basic' (default) or 'detailed'. Use type=detailed to get additional fields in the response.
Not found
Validation Error
No content
The unique UUID of the technology product advisory to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by - name, vendor_name, or created_at
namePattern: ^(name|vendor_name|created_at)$Sort order
ascPattern: ^(asc|desc)$Output model type. Use 'basic' (default) for standard fields or 'detailed' for additional fields including relationships and extended metadata.
basicPattern: ^(basic|detailed)$Paginated list of products. Response schema depends on the type query parameter: 'basic' (default) or 'detailed'. Use type=detailed to get additional fields in the response.
Not found
Validation Error
No content
The unique UUID of the technology product advisory to export
Filter related objects to only include those created after this ISO8601/RFC3339 timestamp
Filter related objects to only include those created before this ISO8601/RFC3339 timestamp
Successful Response
Not found
Validation Error
No content
Time window for comparison. Format: '' where unit is 'd' (days) or 'h' (hours). Examples: '1d', '12h', '7d'. Maximum: 30d or 720h. Default: '1d'.
1dPattern: ^\d+[dh]$Maximum number of entities to consider as 'trending' per period. Only the top N entities by mention count are compared. Default: 10.
10Successful Response
Not found
Validation Error
The unique UUID or name of the threat actor to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
created_atPattern: ^(name|mitre_attack_id|created_at|updated_at)$Sort order
descPattern: ^(asc|desc)$Successful Response
Not found
Validation Error
The unique UUID or name of the threat actor to export
Filter related objects to only include those created after this ISO8601/RFC3339 timestamp
Filter related objects to only include those created before this ISO8601/RFC3339 timestamp
Successful Response
Not found
Validation Error
No content
The unique UUID or name of the threat actor to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
published_atPattern: ^(created_at|updated_at|published_at|source)$Sort order
descPattern: ^(asc|desc)$Filter parameter (e.g., 'user_generated_content:true' or 'user_generated_content:false')
Successful Response
Not found
Validation Error
A string used to filter references. Allowed filter terms:
source:: filter by source. (exact match - lowercase)domain:: filter by domain. (case insensitive substring filter)url:: filter by url. (case insensitive substring filter)final_url:: filter by final_url. (case insensitive substring)title:: filter the title for a string. (case insensitive substring filter)topic:: filter the topic for a string. (case insensitive substring filter)label:: filter by content chunk label (exact match)embedding:: filter by content chunk embedding (semantic search)last_http_status:: filter by last_http_status (exact match)type:: filter by type. (exact match - converted to uppercase)- If no prefix is provided, the filter will be conducted on the url. Use published_at__gte and published_at__lt params for date filtering (half-open interval [start, end)).
Field to sort by - either created_at, updated_at, published_at, first_collected_at, or last_collected_at
published_atPattern: ^(published_at|first_collected_at|last_collected_at|created_at|updated_at)$Sort order - either asc or desc
descPattern: ^(asc|desc)$The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Filter by topic labels (e.g., malware, ransomware, vulnerability). Multiple values use OR matching. Combined with other label category params using AND.
[]Filter by format labels (e.g., blog_post, news_article, research_paper). Multiple values use OR matching. Combined with other label category params using AND.
[]Filter by source type labels (e.g., government_advisory, threat_intel_vendor). Multiple values use OR matching. Combined with other label category params using AND.
[]Filter by depth labels (e.g., technical_deep_dive). Multiple values use OR matching. Combined with other label category params using AND.
[]Filter on the source field by exact match
Filter on the source field for items that match any value in a comma-separated list
Filter on the user_generated_content field by exact match
Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Filter on the published_at field for items greater than or equal to the given value
Filter on the published_at field for items less than the given value
Successful Response
Not found
Validation Error
The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Field to sort by - either created_at, updated_at, published_at, or collected_at
published_atPattern: ^(created_at|updated_at|published_at|collected_at)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
Type of export to retrieve. Allowed: vuln_intel
vuln_intelExport strategy: full or incremental
incrementalSigned URL expiration time in seconds (300-86400)
86400Successful Response
Not found
Validation Error
Filter using prefix syntax:
type:: filter by observable type prefix or exact match, case sensitive (e.g., type:ip or type:ip.v4)name:: filter by observable name prefix or exact match, case sensitivesource:: filter by source (case insensitive)uuid:: filter by UUID (prefix or exact match)- If no prefix is provided, searches across type, name, and source
Field to sort by
uuidPattern: ^(uuid|created_at|published_at|observable_type|source)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Number of items to skip
0Maximum number of items to return
100Scope filter to optionally limit the results to global or tenant data. The scope can be one of the following: - global: only global data
- tenant: only tenant-specific data If no scope is provided, then both global and tenant data are returned.
^(global|tenant)$Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Filter on the published_at field for items greater than or equal to the given value
Filter on the published_at field for items less than the given value
Successful Response
Not found
Validation Error
Filter by entity type (e.g., organization, threat_actor, vulnerability, malware, technology_product)
Number of items to skip before starting to collect results
0Maximum number of items to return
100Field to sort by
published_atPattern: ^(created_at|updated_at|published_at|collected_at)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
A string used to filter exploits. It can start with specific prefixes to indicate the type of filter:
uuid:: Filter by UUID.url:: Filter by url.authors:: Filter by authors.maturity:: Filter by maturity.- If the filter string matches a UUID pattern, it will be treated as a specific filter.
- If no prefix is provided, it defaults to a url filter.
The number of items to skip before starting to collect the result set.
0Field to sort by - one of: url, authors, maturity, disclosed_at, created_at, or updated_at
created_atPattern: ^(url|authors|maturity|disclosed_at|created_at|updated_at|enriched_at)$Sort order - either asc or desc
descPattern: ^(asc|desc)$The maximum number of items to return.
100Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
The unique UUID of the story
Similarity threshold (higher values are more similar, range: -1 to 1)
0.6The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
10Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
A string used to filter stories. Allowed filter terms:
title:: filter by title (case insensitive substring)description:: filter by description (case insensitive substring)min_refs:: filter by minimum reference count (e.g., min_refs:5)max_refs:: filter by maximum reference count (e.g., max_refs:10)topic:: filter by topic labels (comma-separated, OR logic, e.g., topic:ransomware,malware)- If no prefix is provided, the filter will search in the title.
Filter by topic labels. Pass multiple values for OR logic (e.g., topics=ransomware&topics=malware). This is an alternative to using filter=topic:....
[]Field to sort by - either created_at, updated_at, title, or reference_count
created_atPattern: ^(created_at|updated_at|title|reference_count)$Sort order - either asc or desc
descPattern: ^(asc|desc)$The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100When true, returns only stories that mention entities the tenant is following
falsefalseFilter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
A string used to filter sources. Allowed filter terms:
type:: filter by reference type. Valid values: UNSTRUCTURED, STRUCTURED, SYNTHETIC, STRUCTURED_SOCIAL (case insensitive)slug:: filter by slug. (case insensitive substring filter)- If no prefix is provided, the filter will be conducted on the slug.
Successful Response
Not found
Validation Error
A string used to filter products. It can start with specific prefixes to indicate the type of filter:
name:: Filter by Name.internal_name:: Filter by internal_name (exact match).desc:: Filter by description (searches both description and gen_description fields).- If no prefix is provided, it defaults to a name filter.
""The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Field to sort by - either name, created_at, updated_at, enriched_at, trending_1d, trending_7d, or trending_30d
created_atPattern: ^(name|created_at|updated_at|enriched_at|trending_1d|trending_7d|trending_30d)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Include entities that have been merged into other entities
falseWhen true, returns only products that the tenant is following
falseFilter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
A string used to filter malware. It can start with specific prefixes to indicate the type of filter:
name:: Filter by Name.uuid:: Filter by UUID.internal_name:: Filter by internal_name (exact match).desc:: Filter by description (searches both description and gen_description fields).- If no prefix is provided, it defaults to a name filter.
The number of items to skip before starting to collect the result set.
0Field to sort by - either name, created_at, updated_at, enriched_at, trending_1d, trending_7d, or trending_30d
created_atPattern: ^(name|created_at|updated_at|enriched_at|trending_1d|trending_7d|trending_30d)$Sort order - either asc or desc
descPattern: ^(asc|desc)$The maximum number of items to return.
100Include entities that have been merged into other entities
falseWhen true, returns only malware that the tenant is following
falseFilter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
The unique UUID of the exploit
A string used to filter vulnerabilities. It can start with specific prefixes to indicate the type of filter:
cve:: Filter by CVE ID.desc:: Filter by description.- If the filter string matches the pattern
CVE-, it will be treated as a CVE filter. - If no prefix is provided, it defaults to searching both CVE ID and description.
""The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Field to sort by: cve_id, created_at, updated_at, cvss_base_score, or epss_score
cve_idPattern: ^(cve_id|created_at|updated_at|cvss_base_score|epss_score)$Sort order - either asc or desc
ascPattern: ^(asc|desc)$Successful Response
Not found
Validation Error
The unique UUID of the story to export
Include analysis objects for content chunks
trueSuccessful Response
Not found
Validation Error
No content
The unique UUID of the story to update
Request schema for updating a story.
New title for the story
New description for the story
Successful Response
Not found
Validation Error
The unique UUID of the story to retrieve
Include stories that have been merged into other stories
falseSuccessful Response
Not found
Validation Error
Successful Response
Not found
Validation Error
Name of the schedule
Cron expression for scheduling (e.g., '0 9 * * *' for daily at 9am)
The prompt for the schedule
Status of the schedule, one of: active, paused
activeUUID of the Slack integration to use for notifications
IANA timezone identifier (e.g., 'America/New_York', 'Europe/London')
UTCSuccessful Response
Not found
Validation Error
The unique UUID of the technology product to export
Filter related objects to only include those created after this ISO8601/RFC3339 timestamp
Filter related objects to only include those created before this ISO8601/RFC3339 timestamp
Successful Response
Not found
Validation Error
No content
The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Field to sort by - either name, created_at or updated_at
created_atPattern: ^(name|created_at|updated_at)$Sort order - either asc or desc
descPattern: ^(asc|desc)$The search criteria for products
The type of search to perform. Options are: 'standard', 'did_you_mean'. Defaults to 'standard'.
standardExample: standardCommon Platform Enumeration (CPE) 2.3 string. Overrides type, vendor, and product if provided.
nullExample: cpe:2.3:a:vendor:product:1.0:*:*:*:*:*:*:*The type of the product (e.g., application, operating system). Defaults to 'application'.
applicationExample: applicationThe vendor of the product.
nullExample: ExampleVendorThe name of the product.
nullExample: ExampleProductSuccessful Response
Not found
Validation Error
The unique UUID or name of the organization to export
Filter related objects to only include those created after this ISO8601/RFC3339 timestamp
Filter related objects to only include those created before this ISO8601/RFC3339 timestamp
Successful Response
Not found
Validation Error
No content
Opinion UUID
Successful Response
Not found
Validation Error
Successful Response
Not found
Validation Error
The unique UUID or name of the malware to export
Filter related objects to only include those created after this ISO8601/RFC3339 timestamp
Filter related objects to only include those created before this ISO8601/RFC3339 timestamp
Successful Response
Not found
Validation Error
No content
Schema for updating an existing integration.
Sensitive credentials (will be encrypted)
Non-sensitive configuration
Successful Response
Validation Error
Force deletion even if schedules are using this integration
falseSuccessful Response
Validation Error
No content
The unique UUID of the exploit to export
Filter related objects to only include those created after this ISO8601/RFC3339 timestamp
Filter related objects to only include those created before this ISO8601/RFC3339 timestamp
Successful Response
Not found
Validation Error
No content
The technology product configuration UUID to retrieve vulnerable sets for
Successful Response
Not found
Validation Error
Maximum number of executions to return
100Number of executions to skip
0Successful Response
Not found
Validation Error
Filter by observable type (e.g., ip.v4, domain)
Comma-separated list of verdicts to filter by (e.g., malicious,suspicious)
Comma-separated list of sources to filter by (exact match)
Filter by observable name (case-insensitive contains search). Use this to search for specific IPs, domains, hashes, etc.
Field to sort by
published_atPattern: ^(observable_name|observable_type|published_at)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Number of grouped observables to skip
0Maximum number of grouped observables to return
50Scope filter to optionally limit the results to global or tenant data. If no scope is provided, then both global and tenant data are returned.
^(global|tenant)$Filter on the published_at field for items greater than or equal to the given value
Filter on the published_at field for items less than the given value
Successful Response
Not found
Validation Error
No content
Type of export to retrieve. Allowed: vuln_intel
vuln_intelFilter by export strategy
Number of exports to return
10Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
The unique UUID of the story
Field to sort by - either published_at, created_at, updated_at, title, or source_slug
published_atPattern: ^(published_at|created_at|updated_at|title|source_slug)$Sort order - either asc or desc
descPattern: ^(asc|desc)$The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Successful Response
Not found
Validation Error
The unique UUID of the story
Filter parameter (e.g., 'event_type:story_created', 'event_type:reference_assigned')
Sort order - either asc or desc
descPattern: ^(asc|desc)$The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Successful Response
Not found
Validation Error
The unique UUID of the story
Minimum saliency score threshold (range: 0 to 1)
0.5Filter by entity type: vulnerability, threat_actor, malware, technology_product, or organization
^(vulnerability|threat_actor|malware|technology_product|organization)$Successful Response
Not found
Validation Error
Field to sort by
story_countPattern: ^(story_count|latest_story_timestamp)$Sort order
descPattern: ^(asc|desc)$Filter topics with story count greater than this value
Filter topics with story count greater than or equal to this value
Filter topics with story count less than this value
Filter topics with story count less than or equal to this value
Filter topics with latest story timestamp greater than this ISO8601 date
Filter topics with latest story timestamp greater than or equal to this ISO8601 date
Filter topics with latest story timestamp less than this ISO8601 date
Filter topics with latest story timestamp less than or equal to this ISO8601 date
Successful Response
Not found
Validation Error
Case-insensitive search on the prompt field
Filter by status, one of: active, paused
The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
Filter by name or type. Use 'type:value' for type filter, 'name:value' or plain text for name filter (case-insensitive)
Number of items to skip
0Maximum number of items to return
500Successful Response
Validation Error
Type of export to retrieve. Allowed: vuln_intel
vuln_intelFilter by export strategy
Number of exports to return
10Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
A string used to filter configuration sets. It can start with specific prefixes to indicate the type of filter:
set_id:: Filter by set_id.vulnerability_uuid:: Filter by vulnerability_uuid.configuration_uuid:: Filter by technology_product_configuration_uuid.
The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Field to sort by - either set_id, created_at or updated_at
created_atPattern: ^(set_id|created_at|updated_at)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Field to sort by - either created_at, updated_at, source, or name
created_atPattern: ^(created_at|updated_at|source|name)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Field to sort by - either created_at, updated_at, published_at, or collected_at
published_atPattern: ^(created_at|updated_at|published_at|collected_at)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
The unique CVE ID or UUID of the vulnerability to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
created_atPattern: ^(name|created_at|updated_at)$Sort order
descPattern: ^(asc|desc)$Successful Response
Not found
Validation Error
The unique UUID of the technology product to retrieve
Successful Response
Not found
Validation Error
No content
The unique UUID, MITRE ATT&CK ID, or name of the attack pattern
Number of items to skip
0Maximum number of items to return
100Field to sort by
created_atPattern: ^(name|created_at|updated_at)$Sort order
descPattern: ^(asc|desc)$Successful Response
Not found
Validation Error
The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Field to sort by - either name, created_at or updated_at
created_atPattern: ^(name|created_at|updated_at|enriched_at)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
The unique UUID or name of the malware to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
created_atPattern: ^(name|mitre_attack_id|created_at|updated_at)$Sort order
descPattern: ^(asc|desc)$Successful Response
Not found
Validation Error
The unique UUID, MITRE ATT&CK ID, or name of the attack pattern
Number of items to skip
0Maximum number of items to return
100Field to sort by
published_atPattern: ^(created_at|updated_at|published_at|source)$Sort order
descPattern: ^(asc|desc)$Filter parameter (e.g., 'user_generated_content:true' or 'user_generated_content:false')
Successful Response
Not found
Validation Error
The unique UUID, MITRE ATT&CK ID, or name of the attack pattern
Number of items to skip
0Maximum number of items to return
100Field to sort by
created_atPattern: ^(name|created_at|updated_at)$Sort order
descPattern: ^(asc|desc)$Successful Response
Not found
Validation Error
The unique UUID or name of the threat actor to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
published_atPattern: ^(type|name|created_at|published_at)$Sort order
descPattern: ^(asc|desc)$Filter parameter (e.g., 'type:ip.v4', 'type:domain', 'type:hash.sha256')
Successful Response
Not found
Validation Error
A string used to filter organizations. It can start with specific prefixes to indicate the type of filter:
name:: Filter by Name, case-insensitive.uuid:: Filter by UUID, case-insensitive.internal_name:: Filter by internal_name (exact match).desc:: Filter by description (searches both description and gen_description fields). If no prefix is provided, it defaults to filtering on the display_name or name fields. Examples:name:Microsoftname:appleinternal_name:microsoft_corporationMicrosoft Corporation
The number of items to skip before starting to collect the result set.
0Field to sort by - either name, created_at, updated_at, enriched_at, trending_1d, trending_7d, or trending_30d
created_atPattern: ^(name|created_at|updated_at|enriched_at|trending_1d|trending_7d|trending_30d)$Sort order - either asc or desc
descPattern: ^(asc|desc)$The maximum number of items to return.
100Include entities that have been merged into other entities
falseWhen true, returns only organizations that the tenant is following
falseFilter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
Filter the exploitations by vulnerability_uuid, cve_id, source, begins_at, or ends_at. It can start with specific prefixes to indicate the type of filter:
vulnerability_uuid:: Filter by vulnerability UUID.cve_id:: Filter by CVE ID.source:: Filter by source.begins_at{operator}: Filter by begins_at. Allowed operators are: <, <=, =, >=, > (e.g.begins_at>2025-11-01)ends_at{operator}: Filter by ends_at. Allowed operators are: <, <=, =, >=, > (e.g.ends_at<2025-11-01)- If no prefix is provided, it defaults to filtering on the vulnerability_uuid, cve_id, and source fields.
The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Field to sort by - either count, created_at, updated_at, enriched_at, begins_at or ends_at
created_atPattern: ^(count|created_at|updated_at|enriched_at|begins_at|ends_at)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
Time window for comparison. Format: '' where unit is 'd' (days) or 'h' (hours). Examples: '1d', '12h', '7d'. Maximum: 30d or 720h. Default: '1d'.
1dPattern: ^\d+[dh]$Maximum number of entities to consider as 'trending' per period. Only the top N entities by mention count are compared. Default: 10.
10Successful Response
Not found
Validation Error
Time window for comparison. Format: '' where unit is 'd' (days) or 'h' (hours). Examples: '1d', '12h', '7d'. Maximum: 30d or 720h. Default: '1d'.
1dPattern: ^\d+[dh]$Maximum number of entities to consider as 'trending' per period. Only the top N entities by mention count are compared. Default: 10.
10Successful Response
Not found
Validation Error
Time window for comparison. Format: '' where unit is 'd' (days) or 'h' (hours). Examples: '1d', '12h', '7d'. Maximum: 30d or 720h. Default: '1d'.
1dPattern: ^\d+[dh]$Maximum number of entities to consider as 'trending' per period. Only the top N entities by mention count are compared. Default: 10.
10Successful Response
Not found
Validation Error
Filter using prefix syntax:
topic:: filter by topic prefix (e.g., topic:ransom)uuid:: filter by UUID prefix
Field to sort by
created_atPattern: ^(uuid|created_at|updated_at|topic)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Number of items to skip
0Maximum number of items to return
50Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
Filter using prefix syntax:
entity_type:: filter by entity type (e.g., entity_type:vulnerability)uuid:: filter by UUID prefix
Field to sort by
created_atPattern: ^(uuid|created_at|updated_at|entity_type)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Number of items to skip
0Maximum number of items to return
50Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
Time window for comparison. Format: '' where unit is 'd' (days) or 'h' (hours). Examples: '1d', '12h', '7d'. Maximum: 30d or 720h. Default: '1d'.
1dPattern: ^\d+[dh]$Maximum number of entities to consider as 'trending' per period. Only the top N entities by mention count are compared. Default: 10.
10Successful Response
Not found
Validation Error
Field to sort by - either created_at or updated_at
created_atPattern: ^(created_at|updated_at)$Sort order - either asc or desc
descPattern: ^(asc|desc)$The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Successful Response
Not found
Validation Error
A string used to filter content chunks. The filter will be conducted within the content chunk embeddings.
The maximum number of items to return.
10Successful Response
Not found
Validation Error
A string used to filter content chunks. The filter will be conducted within the content chunk embeddings.
Field to sort by - either created_at, updated_at or analyzed_at
created_atPattern: ^(created_at|updated_at|analyzed_at)$Sort order - either asc or desc
descPattern: ^(asc|desc)$The number of items to skip before starting to collect the result set.
0The maximum number of items to return.
100Filter by topic labels (e.g., malware, ransomware, vulnerability). Multiple values use OR matching. Combined with other label category params using AND.
[]Filter by format labels (e.g., blog_post, news_article, research_paper). Multiple values use OR matching. Combined with other label category params using AND.
[]Filter by source type labels (e.g., government_advisory, threat_intel_vendor). Multiple values use OR matching. Combined with other label category params using AND.
[]Filter by depth labels (e.g., technical_deep_dive). Multiple values use OR matching. Combined with other label category params using AND.
[]Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
Filter using prefix syntax:
type:: filter by observable type prefix or exact match (e.g., type:ip or type:ip.v4)name:: filter by observable name (case insensitive)uuid:: filter by UUID (partial match)- If no prefix is provided, filters by name
Field to sort by
uuidPattern: ^(uuid|created_at|updated_at|type|name)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Number of items to skip
0Maximum number of items to return
100Scope filter to optionally limit the results to global or tenant data. If no scope is provided, then both global and tenant data are returned. The scope can be one of the following: - global: only global data
- tenant: only tenant-specific data
^(global|tenant)$Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
Observable UUID
Number of items to skip
0Maximum number of items to return
100Field to sort by
uuidPattern: ^(uuid|created_at|published_at|observable_type|source)$Sort order - either asc or desc
descPattern: ^(asc|desc)$Scope filter to optionally limit the results to global or tenant data. The scope can be one of the following: - global: only global data
- tenant: only tenant-specific data If no scope is provided, then the first matching Observable from global and tenant data, with tenant data preferred first.
^(global|tenant)$Successful Response
Not found
Validation Error
Signed URL expiration time in seconds (300-86400)
86400Successful Response
Not found
Validation Error
A string used to filter attack patterns. It can start with specific prefixes to indicate the type of filter:
mitre_id:: Filter by MITRE ATT&CK ID (e.g., 'mitre_id:T1566').tactic:: Filter by tactic (e.g., 'tactic:initial-access').name:: Filter by name (partial match, case-insensitive).subtechnique:: Filter by subtechnique status ('subtechnique:true' or 'subtechnique:false').uuid:: Filter by UUID. If no prefix is provided, it defaults to a name filter.
The number of items to skip before starting to collect the result set.
0Field to sort by - name, mitre_attack_id, created_at, updated_at, trending_1d, trending_7d, or trending_30d
created_atPattern: ^(name|mitre_attack_id|created_at|updated_at|trending_1d|trending_7d|trending_30d)$Sort order - either asc or desc
descPattern: ^(asc|desc)$The maximum number of items to return.
100Filter on the created_at field for items greater than or equal to the given value
Filter on the created_at field for items less than the given value
Filter on the updated_at field for items greater than or equal to the given value
Filter on the updated_at field for items less than the given value
Successful Response
Not found
Validation Error
Followed entity UUID
Type of entity being followed
UUID of the entity being followed
Successful Response
Not found
Validation Error
The unique UUID or name of the malware to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
published_atPattern: ^(created_at|updated_at|published_at|source)$Sort order
descPattern: ^(asc|desc)$Filter parameter (e.g., 'user_generated_content:true' or 'user_generated_content:false')
Successful Response
Not found
Validation Error
The unique UUID or name of the malware to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
published_atPattern: ^(type|name|created_at|published_at)$Sort order
descPattern: ^(asc|desc)$Filter parameter (e.g., 'type:ip.v4', 'type:domain', 'type:hash.sha256')
Successful Response
Not found
Validation Error
The unique UUID or name of the malware to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
created_atPattern: ^(cve_id|created_at|updated_at|published_at|cvss_base_score)$Sort order
descPattern: ^(asc|desc)$Successful Response
Not found
Validation Error
The unique UUID or name of the organization to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
published_atPattern: ^(created_at|updated_at|published_at|source)$Sort order
descPattern: ^(asc|desc)$Filter parameter (e.g., 'user_generated_content:true' or 'user_generated_content:false')
Successful Response
Not found
Validation Error
The unique UUID or name of the organization to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
created_atPattern: ^(name|created_at|updated_at)$Sort order
descPattern: ^(asc|desc)$Successful Response
Not found
Validation Error
The unique UUID of the technology product to retrieve
Number of items to skip
0Maximum number of items to return
100Field to sort by
published_atPattern: ^(created_at|updated_at|published_at|source)$Sort order
descPattern: ^(asc|desc)$Filter parameter (e.g., 'user_generated_content:true' or 'user_generated_content:false')
Successful Response
Not found
Validation Error
Last updated