Malware Threat Map — alert-api

v1

latestOpenAPI 3.1.12026-07-242899061.7 MB

Malware Threat Map

Rank malware families by prevalence and opportunity scores for your primary organization.

post/map/malware

Request body

malwarestring[]

An array of malware entity IDs. If used, the API response will be limited to only those malware whose entity IDs match those found in the array. To lookup a malware entity ID, use the Entity Match API.

categoriesstring[]

An array of malware category entity IDs. If used, the API response will be filtered to only those malware whose category (e.g., Adware, Ransomware, Spyware) matches those found in the array. Categories must be listed by their Recorded Future Entity ID, which can be found by using the Malware Categories endpoint within the Threat API.

watchlistsstring[]

An array of client specific watch list IDs. If used, the API response will be limited to only those threat actors whose link to the threat map is via the watch lists included. To lookup a watch list ID, use the List API.

Example request

{
  "malware": [
    "l3moPJ"
  ],
  "categories": [
    "GK7qU"
  ],
  "watchlists": [
    "report:Hsxme2"
  ]
}

Response

Example response

{
  "data": {
    "threat_map": [
      {
        "id": "MZycd3",
        "name": "VirRansom",
        "alias": [
          "Operation Global III ransomware"
        ],
        "categories": [
          "GK7qU"
        ],
        "prevalence": 5,
        "opportunity": 25,
        "log_entries": [
          {
            "watchlist": {
              "id": "lT36d1",
              "name": "Tech Stack Watch List"
            },
            "entity": {
              "id": "MZycd3",
              "name": "VirRansom"
            },
            "severity": "limited",
            "axis": "opportunity",
            "date": "2023-01-10T14:51:38.462Z"
          }
        ]
      }
    ],
    "date": "2023-01-10T14:51:38.462Z"
  }
}