BLblackkitetech
Cyber Threat Feed

Search through the Cyber Threat Feed events.

Changed on

Create a search operation over all public Cyber Threat Feed events. This endpoint does not return the resulting events, instead it returns a search key that can be used with the getThreatFeedEvents operation to list the events found. At least one search criterion is required; values inside an array are OR-ed and distinct arrays are AND-ed.  Attention: Every unique client id can create a maximum of 100000 search keys per day.  Attention: All array type search criteria may take a maximum of 100000 values each.

post/api/v2/threat-feed-searches

Request

Request body

GenericSearchTextstring

A generic search text searched over the event title, summary, company name, threat actor and product name.

EventTypesstring[] nullable

The list of event types to match.

Severitiesstring[] nullable

The list of severities to match.

LifecycleStatesstring[] nullable

The list of lifecycle states to match. Defaults to Active only when omitted.

CompanyDomainsstring[] nullable

The list of exact registrable company domains to match. Secondary company filter; prefer CompanyIds.

CompanyNamesstring[] nullable

The list of company names to match (partial match).

CompanyRolesstring[] nullable

The list of company roles used to narrow the company matches.

CountryCodesstring[] nullable

The list of ISO-3166-1 alpha-2 country codes to match.

NaicsCodesstring[] nullable

The list of 4 digit NAICS codes to match.

CompanyIdsnumber[] nullable

The list of Black Kite company ids (BKID) to match. This is the primary company filter.

ProductNamesstring[] nullable

The list of product names to match (partial match).

Cpesstring[] nullable

The list of CPEs to match. An event matches when any of its products carries any of the given CPEs.

Cvesstring[] nullable

The list of CVE ids to match (exact match).

ProductIdsnumber[] nullable

The list of Black Kite product ids to match. This identifier is reserved for future use and is not currently populated.

VulnerabilityIdsnumber[] nullable

The list of Black Kite vulnerability ids to match. This identifier is reserved for future use and is not currently populated.

FocusTagsstring[] nullable

The list of focus tags to match.

ThreatActorsstring[] nullable

The list of threat actors to match.

EventStartDatestring date-time

The earliest EventDate to match. The range between EventStartDate and EventEndDate can be at most 90 days.

EventEndDatestring date-time

The latest EventDate to match. The range between EventStartDate and EventEndDate can be at most 90 days.

UpdatedSincestring date-time

Only match events whose UpdateDate is later than this value. Use together with SortBy=UpdateDate for incremental synchronisation.

SortBy'EventDate' | 'UpdateDate' | 'FeedMentionCount' | 'Severity'

The field to sort the results by.

SortOrder'Ascending' | 'Descending'

The sort direction.

Example request

{
  "GenericSearchText": "ransomware",
  "EventTypes": [
    "Ransomware"
  ],
  "Severities": [
    "High"
  ],
  "LifecycleStates": [
    "Active"
  ],
  "CompanyDomains": [
    "example.com"
  ],
  "CompanyNames": [
    "Acme"
  ],
  "CompanyRoles": [
    "Affected"
  ],
  "CountryCodes": [
    "US"
  ],
  "NaicsCodes": [
    "5132"
  ],
  "CompanyIds": [
    12345
  ],
  "ProductNames": [
    "FortiClient"
  ],
  "Cpes": [
    "cpe:2.3:a:vendor:product:1.0:*:*:*:*:*:*:*"
  ],
  "Cves": [
    "CVE-2026-63077"
  ],
  "ProductIds": [
    6789
  ],
  "VulnerabilityIds": [
    4567
  ],
  "FocusTags": [
    "Ransomware"
  ],
  "ThreatActors": [
    "LockBit"
  ],
  "EventStartDate": "2026-06-01T00:00:00.000Z",
  "EventEndDate": "2026-08-30T00:00:00.000Z",
  "UpdatedSince": "2026-08-01T00:00:00.000Z",
  "SortBy": "EventDate",
  "SortOrder": "Descending"
}

Response

Success

Keystring required

A key in GUID format pointing to the newly created search action. Use this key with the getThreatFeedEvents operation as the search_key query parameter to fetch the results.

Example response

{
  "Key": "0f8fad5b-d9cb-469f-a165-70867728950e"
}

Changes