cb0d02ee28f8

latestSwagger 2.02026-08-0484141342.3 KB

Threats

# Threat List

Threat List; Threat ID, Threat Display ID, Threat Name, Release Date, Severity, Tags, Affected Operating Systems, Is Predefined, Attack Categories, Attack Module Ids, Unified Kill Chain Phases, Mitres

get/v1/threat-library/threats

Query parameters

limitinteger

offsetinteger

severitiesstring[]

Filter with Severity (one or more severity): Low | Medium | High

attack_category_idsinteger[]

Filter with one or more Attack Category IDs.

Available attack categories, as id: name (attack module):

1: Malicious Code (Network Infiltration) 2: Attack Scenario (Windows Endpoint Scenario) 3: Vulnerability Exploitation (Network Infiltration) 4: Web Application (Web Application) 5: Malicious Code (E-mail Infiltration) 6: Vulnerability Exploitation (E-mail Infiltration) 7: Data Exfiltration (Data Exfiltration) 37: Attack Scenario (Linux Endpoint Scenario) 38: Attack Scenario (macOS Endpoint Scenario) 39: Lateral Movement Techniques (Windows Endpoint Scenario) 41: URL Filtering (URL Filtering) 42: Attack Scenario (Kubernetes Endpoint Scenario) 137: Azure ARM (Azure Cloud Emulation) 138: Azure Entra ID (Azure Cloud Emulation) 139: Azure m365 (Azure Cloud Emulation) 140: AWS (AWS Cloud Emulation) 141: GCP (GCP Cloud Emulation)

attack_module_idsinteger[]

Filter with one or more Attack Module IDs.

Available attack modules, as id: name:

1: Network Infiltration 2: Windows Endpoint Scenario 3: Web Application 4: E-mail Infiltration 5: Data Exfiltration 6: Linux Endpoint Scenario 7: macOS Endpoint Scenario 9: URL Filtering 10: Kubernetes Endpoint Scenario 103: Azure Cloud Emulation 104: AWS Cloud Emulation 105: GCP Cloud Emulation

release_date_gteinteger

Filter with Release Date Greater Than or Equals.

release_date_lteinteger

Filter with Release Date Less Than or Equals.

is_predefinedboolean

Filter with whether threat is predefined.

affected_productsstring[]

Filter with Affected Products.

affected_osstring[]

Filter with Affected Operating Systems. Windows | Linux | macOS

unified_kill_chainsstring[]

Filter with Unified Kill Chain Phases.

threat_actorsstring[]

Threat Actors Filter

mitre_attackstring[]

Mitre Tactics Filter

attacker_objectivesstring[]

Attacker Objectives Filter

Response

ThreatsReturnResponse

Example response

{
  "pages": {
    "limit": 20,
    "total_count": 100
  },
  "threats": [
    {
      "affected_os": [
        "Windows"
      ],
      "attack_categories": [
        {
          "id": 1,
          "name": "Attack Category 1"
        }
      ],
      "attack_modules": [
        1,
        2
      ],
      "created_at": 1654623047,
      "description": "Threat 1",
      "display_id": 1000,
      "id": 1,
      "mitre_attack": [
        {
          "tactic": "Credential Access",
          "techniques": [
            "OS Credential Dumping"
          ]
        },
        {
          "tactic": "Execution",
          "techniques": [
            "Inter-Process Communication"
          ]
        }
      ],
      "name": "Threat 1",
      "release_date": 1649681264,
      "severity": "High",
      "tags": [
        "Custom"
      ],
      "unified_kill_chains": [
        {
          "phases": [
            "Credential Access"
          ],
          "stage": "Network Propagation"
        },
        {
          "phases": [
            "Execution"
          ],
          "stage": "Network Propagation"
        }
      ],
      "updated_at": 1654623047
    }
  ]
}