---
title: "Malware Threat Map"
method: POST
path: "/map/malware"
tags: ["Malware Threat Map"]
---

# Malware Threat Map

`POST /map/malware`

Rank malware families by prevalence and opportunity scores for your primary organization.

## Request body

- MalwareThreatMapRequest — Malware threat map filters
  - `malware` string[] — An array of malware entity IDs. If used, the API response will be limited to only those malware whose entity IDs match those found in the array. To lookup a malware entity ID, use the Entity Match API.
  - `categories` string[] — An array of malware category entity IDs. If used, the API response will be filtered to only those malware whose category (e.g., Adware, Ransomware, Spyware) matches those found in the array. Categories must be listed by their Recorded Future Entity ID, which can be found by using the Malware Categories endpoint within the Threat API.
  - `watchlists` string[] — An array of client specific watch list IDs. If used, the API response will be limited to only those threat actors whose link to the threat map is via the watch lists included. To lookup a watch list ID, use the List API.

## Response `200`

OK

- MalwareThreatMapResponse — Malware threat map with prevalence/opportunity scores for malware families targeting the organization.
  - `data` object
    - `threat_map` MalwareThreatMapItem[] — Array of malware entries with risk assessments.
      - `id` string — Entity ID
      - `name` string — Entity name
      - `alias` string[] — Known aliases of the malware, including in other languages
      - `categories` string[]
      - `prevalence` integer
      - `opportunity` integer
      - `log_entries` MalwareLogEntry[]
        - `watchlist` BaseMalwareWatchlistOutput
          - `id` string — Watchlist ID
          - `name` string — Watchlist name
        - `entity` BaseMalwareEntityOutput
          - `id` string — Entity ID
          - `name` string — Entity name
        - `severity` string
        - `axis` 'opportunity' | 'intent'
        - `date` string, date-time
    - `date` string, date-time — Threat map generation timestamp

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)