BLblackkitetech
Cyber Threat Feed

Get the Cyber Threat Feed events of a company.

Changed on

List the Active Cyber Threat Feed events that mention a specific company, in the Black Kite JSON format. The company is identified by its Black Kite company id (BKID) in the path; events are matched directly on that BKID, so results are returned only for companies whose BKID is present in the feed data. The company does not need to be monitored. List responses omit the Advisories field.

get/api/v2/companies/{id}/threat-feed-events

Request

Path parameters

idinteger required
Example:123456

The Black Kite company id (BKID) to match events on.

Query parameters

start_datestring date-time
Example:2026-06-01T00:00:00.000Z

The earliest EventDate to match. The range between start_date and end_date can be at most 90 days.

end_datestring date-time
Example:2026-08-30T00:00:00.000Z

The latest EventDate to match. The range between start_date and end_date can be at most 90 days.

company_role'Affected' | 'Producer' | 'Publisher' | 'Mentioned'
Example:Affected

Restrict the results to events where the company carries this role.

event_type'Data Breach' | 'Ransomware' | 'Vulnerability' | 'Advisory' | 'Hacktivist' | 'Social' | 'Incident' | 'Credential Exposure' | 'Data Leak' | 'Threat Actor Activity' | 'Research Report'
Example:Ransomware

Restrict the results to a single event type.

page_numberinteger
Example:1

The number of the page requested.

page_size10 | 20 | 30 | 50 | 100 | 250
Example:10

The number of result items in a single response.

Response

Success

EventIdstring

The unique identifier of the event (string UUIDv7).

SchemaVersionstring

The version of the event schema.

LifecycleState'Active' | 'Merged' | 'Retracted' | 'Superseded'

The current lifecycle state of the event.

MergedIntostring nullable

When the event has been merged into another event, the id of the surviving event. Null otherwise.

EventType'Data Breach' | 'Ransomware' | 'Vulnerability' | 'Advisory' | 'Hacktivist' | 'Social' | 'Incident' | 'Credential Exposure' | 'Data Leak' | 'Threat Actor Activity' | 'Research Report'

The type of the event.

Severity'Informational' | 'Low' | 'Medium' | 'High' | 'Critical' nullable

The severity assigned to the event.

Titlestring nullable

A short title describing the event.

Summarystring nullable

A summary describing the event.

Linksstring[]

Reference links related to the event.

FeedMentionCountnumber

The number of distinct sources that mentioned the event.

FocusTagsstring[]

The focus tags associated with the event.

ThreatActorsstring[]

The threat actors associated with the event.

EventDatestring date-time

The real-world date and time the event occurred. This value never changes.

FirstSeenDatestring date-time

The date and time the event was first ingested.

UpdateDatestring date-time

The date and time the event was last updated. Use this value with UpdatedSince to synchronise incrementally.

Example response

[
  {
    "EventId": "01a06cad-bf24-7db7-93c4-cf480d0193aa",
    "SchemaVersion": "1.0",
    "LifecycleState": "Active",
    "EventType": "Data Breach",
    "Severity": "High",
    "Title": "Iweaver.ai database leaked on forum",
    "Companies": [
      {
        "CompanyId": 12345,
        "CompanyName": "Iweaver.ai",
        "Domain": "iweaver.ai",
        "Role": "Affected",
        "CountryCode": "US",
        "Industry": "Software Publishers",
        "NaicsCode": "5132"
      }
    ],
    "Summary": "A forum user shared a compromised database ...",
    "Links": [
      "https://spear.cx/Thread-Database-Iweaver-ai"
    ],
    "FeedMentionCount": 1,
    "AffectedProducts": [
      {
        "ProductName": "Iweaver.ai",
        "Cpes": [
          "cpe:2.3:a:vendor:product:1.0:*:*:*:*:*:*:*"
        ]
      }
    ],
    "Vulnerabilities": [
      {
        "Cve": "CVE-2026-63077"
      }
    ],
    "FocusTags": [
      "Ransomware"
    ],
    "ThreatActors": [
      "LockBit"
    ],
    "EventDate": "2026-09-03T20:45:03.000Z",
    "FirstSeenDate": "2026-09-04T13:48:39.000Z",
    "UpdateDate": "2026-09-04T13:48:39.000Z"
  }
]

Changes