BLblackkitetech
Cyber Threat Feed

Get the list of Cyber Threat Feed events.

Changed on

List the Cyber Threat Feed events matched by a previously created search key, in the Black Kite JSON format. The search criteria are re-run against the live feed on every request. List responses omit the Advisories field; use the single event endpoint to retrieve it.

get/api/v2/threat-feed-events

Request

Query parameters

search_keystring required
Example:0f8fad5b-d9cb-469f-a165-70867728950e

The search key returned by a call to the searchThreatFeedEvents operation.

page_numberinteger
Example:1

The number of the page requested.

page_size10 | 20 | 30 | 50 | 100 | 250
Example:10

The number of result items in a single response.

Response

Success

EventIdstring

The unique identifier of the event (string UUIDv7).

SchemaVersionstring

The version of the event schema.

LifecycleState'Active' | 'Merged' | 'Retracted' | 'Superseded'

The current lifecycle state of the event.

MergedIntostring nullable

When the event has been merged into another event, the id of the surviving event. Null otherwise.

EventType'Data Breach' | 'Ransomware' | 'Vulnerability' | 'Advisory' | 'Hacktivist' | 'Social' | 'Incident' | 'Credential Exposure' | 'Data Leak' | 'Threat Actor Activity' | 'Research Report'

The type of the event.

Severity'Informational' | 'Low' | 'Medium' | 'High' | 'Critical' nullable

The severity assigned to the event.

Titlestring nullable

A short title describing the event.

Summarystring nullable

A summary describing the event.

Linksstring[]

Reference links related to the event.

FeedMentionCountnumber

The number of distinct sources that mentioned the event.

FocusTagsstring[]

The focus tags associated with the event.

ThreatActorsstring[]

The threat actors associated with the event.

EventDatestring date-time

The real-world date and time the event occurred. This value never changes.

FirstSeenDatestring date-time

The date and time the event was first ingested.

UpdateDatestring date-time

The date and time the event was last updated. Use this value with UpdatedSince to synchronise incrementally.

Example response

[
  {
    "EventId": "01a06cad-bf24-7db7-93c4-cf480d0193aa",
    "SchemaVersion": "1.0",
    "LifecycleState": "Active",
    "EventType": "Data Breach",
    "Severity": "High",
    "Title": "Iweaver.ai database leaked on forum",
    "Companies": [
      {
        "CompanyId": 12345,
        "CompanyName": "Iweaver.ai",
        "Domain": "iweaver.ai",
        "Role": "Affected",
        "CountryCode": "US",
        "Industry": "Software Publishers",
        "NaicsCode": "5132"
      }
    ],
    "Summary": "A forum user shared a compromised database ...",
    "Links": [
      "https://spear.cx/Thread-Database-Iweaver-ai"
    ],
    "FeedMentionCount": 1,
    "AffectedProducts": [
      {
        "ProductName": "Iweaver.ai",
        "Cpes": [
          "cpe:2.3:a:vendor:product:1.0:*:*:*:*:*:*:*"
        ]
      }
    ],
    "Vulnerabilities": [
      {
        "Cve": "CVE-2026-63077"
      }
    ],
    "FocusTags": [
      "Ransomware"
    ],
    "ThreatActors": [
      "LockBit"
    ],
    "EventDate": "2026-09-03T20:45:03.000Z",
    "FirstSeenDate": "2026-09-04T13:48:39.000Z",
    "UpdateDate": "2026-09-04T13:48:39.000Z"
  }
]

Changes