BLblackkitetech
Cyber Threat Feed

Get a single Cyber Threat Feed event.

Changed on

Get a single Cyber Threat Feed event by its id, in the Black Kite JSON format. Merged, retracted and superseded events are returned (HTTP 200) so consumers can learn why an event was removed and which event superseded it. This endpoint includes the Advisories field.

get/api/v2/threat-feed-events/{eventId}

Request

Path parameters

eventIdstring required
Example:01a06cad-bf24-7db7-93c4-cf480d0193aa

The unique identifier of the event (string UUIDv7).

Response

Success

EventIdstring

The unique identifier of the event (string UUIDv7).

SchemaVersionstring

The version of the event schema.

LifecycleState'Active' | 'Merged' | 'Retracted' | 'Superseded'

The current lifecycle state of the event.

MergedIntostring nullable

When the event has been merged into another event, the id of the surviving event. Null otherwise.

EventType'Data Breach' | 'Ransomware' | 'Vulnerability' | 'Advisory' | 'Hacktivist' | 'Social' | 'Incident' | 'Credential Exposure' | 'Data Leak' | 'Threat Actor Activity' | 'Research Report'

The type of the event.

Severity'Informational' | 'Low' | 'Medium' | 'High' | 'Critical' nullable

The severity assigned to the event.

Titlestring nullable

A short title describing the event.

Summarystring nullable

A summary describing the event.

Linksstring[]

Reference links related to the event.

FeedMentionCountnumber

The number of distinct sources that mentioned the event.

FocusTagsstring[]

The focus tags associated with the event.

ThreatActorsstring[]

The threat actors associated with the event.

EventDatestring date-time

The real-world date and time the event occurred. This value never changes.

FirstSeenDatestring date-time

The date and time the event was first ingested.

UpdateDatestring date-time

The date and time the event was last updated. Use this value with UpdatedSince to synchronise incrementally.

Example response

{
  "EventId": "01a06cad-bf24-7db7-93c4-cf480d0193aa",
  "SchemaVersion": "1.0",
  "LifecycleState": "Active",
  "EventType": "Data Breach",
  "Severity": "High",
  "Title": "Iweaver.ai database leaked on forum",
  "Companies": [
    {
      "CompanyId": 12345,
      "CompanyName": "Iweaver.ai",
      "Domain": "iweaver.ai",
      "Role": "Affected",
      "CountryCode": "US",
      "Industry": "Software Publishers",
      "NaicsCode": "5132"
    }
  ],
  "Summary": "A forum user shared a compromised database ...",
  "Links": [
    "https://spear.cx/Thread-Database-Iweaver-ai"
  ],
  "FeedMentionCount": 1,
  "AffectedProducts": [
    {
      "ProductName": "Iweaver.ai",
      "Cpes": [
        "cpe:2.3:a:vendor:product:1.0:*:*:*:*:*:*:*"
      ]
    }
  ],
  "Vulnerabilities": [
    {
      "Cve": "CVE-2026-63077"
    }
  ],
  "FocusTags": [
    "Ransomware"
  ],
  "ThreatActors": [
    "LockBit"
  ],
  "EventDate": "2026-09-03T20:45:03.000Z",
  "FirstSeenDate": "2026-09-04T13:48:39.000Z",
  "UpdateDate": "2026-09-04T13:48:39.000Z"
}

Changes