Sign in

v1

latestOpenAPI 3.0.3Apache 2.02026-07-2272488.9 KB
Threats

Get Threat by Name

Retrieve detailed threat intelligence information for a specific threat by looking up the threat's name. To query links, retrieve the threat by ID instead.

get/api/threat.php

Query parameters

keystring

Your Pulsedive API key.

API key authentication is optional. However, requests without a key have stricter rate limits. We recommend including an API key for better performance and reliability.

threatstring required
Example:zeus

Name of the threat to retrieve.

pretty0 | 1

Indicates whether to format returned JSON results.

For pretty-printed output, set to 1. For compact output, set to 0.

Response

Successful request. Returns threat information in JSON format.

tidinteger

Unique identifier of the threat.

threatstring

Name of the threat being retrieved.

categorystring

Category assigned to the threat.

othernamesstring[]

Alternative names for the threat.

risk'unknown' | 'none' | 'low' | 'medium' | 'high' | 'critical' | 'retired'

Risk level associated with the threat.

descriptionstring nullable

Description of the threat.

notesstring nullable

Additional notes about the threat.

wikisummarystring nullable

Wikipedia summary of the threat.

wikireferencestring nullable

Link to Wikipedia reference.

retiredboolean nullable

Indicates whether the threat is inactive or obsolete.

A threat is automatically retired if, in the past three months, it has not been:

  • Reported using the Seen button in the Pulsedive UI
  • Observed in any source feeds
  • Submitted through the Analyze section of the Pulsedive UI

Pulsedive research can also retire threats manually.

When set to 1, this threat is retired. When set to 0, this threat is active.

stamp_addedstring sql-date-time nullable

Timestamp when the threat was first added to Pulsedive. 24-hour format, UTC time zone.

stamp_updatedstring sql-date-time nullable

Timestamp when the threat record was last updated in Pulsedive. 24-hour format, UTC time zone.

stamp_seenstring sql-date-time nullable

Timestamp when the threat was last seen in Pulsedive. 24-hour format, UTC time zone.

stamp_retiredstring sql-date-time nullable

Timestamp when the threat was retired in Pulsedive. 24-hour format, UTC time zone.

updated_last_domainstring sql-date-time nullable

Timestamp when the threat's last domain was updated in Pulsedive. 24-hour format, UTC time zone.

attributesobject

Threat attributes.

ttpsobject[]

Tactics, techniques, and procedures associated with the threat.

Example response

{
  "category": "malware",
  "stamp_added": "2017-09-27 18:11:38",
  "stamp_updated": "2017-09-27 18:11:38",
  "stamp_seen": "2017-09-27 18:11:38",
  "stamp_retired": "2017-09-27 18:11:38",
  "updated_last_domain": "2017-09-27 18:11:38",
  "related": [
    {
      "category": "malware",
      "stamp_updated": "2025-09-15 07:48:30"
    }
  ],
  "news": [
    {
      "stamp": "2017-09-27 18:11:38",
      "primary": 1
    }
  ],
  "comments": [
    {
      "stamp_added": "2017-09-27 18:11:38",
      "stamp_updated": "2017-09-27 18:11:38"
    }
  ],
  "summary": {
    "updated_last_domain": "2017-09-27 18:11:38",
    "feeds": [
      {
        "pricing": "free",
        "category": "malware",
        "indicators": 10
      }
    ],
    "risk": {
      "unknown": 31,
      "low": 17,
      "medium": 20,
      "high": 5,
      "critical": 1,
      "retired": 874,
      "total": 1037,
      "none": 89
    }
  }
}