---
title: "Details of the given batch of threat IDs"
method: POST
path: "/v1/secops/infra_threats/batch"
tags: ["Security"]
---

# Details of the given batch of threat IDs

`POST /v1/secops/infra_threats/batch`

Details of the given batch of threat IDs. Supports a maximum of 1000 IDs per request.

## Request body

- ObjectIdBatchRequest
  - `ids` string[]

## Response `200`

Success

- ThreatResponse[] — List of Threat details
  - `service_account_id` string — ID of the service account to which the threat/vulnerability belongs to.
  - `cloud_provider` 'AWS' | 'Azure' | 'AzureStack' | 'Azure_CSP' | 'Azure_CSP-Direct' | 'Azure_EA' | 'Azure_MCA' | 'Cloudstack' | 'GCP' | 'MS_VMM' | 'OCI' | 'Openstack' | 'PrivateCloud' | 'Rackspace' | 'VMware' | 'VMware_VCD' | 'vCenter' — Cloud Provider of the service account
  - `tenant_id` string — Tenant ID where the service account belongs to
  - `resource_id` string — ID of the resource where the threat/vulnerability is observed
  - `resource_name` string — Name of the resource where the threat/vulnerability is observed
  - `resource_category` string — Category of the resource to which the threat/vulnerability belongs to.
  - `resource_type` string — Type of the resource to which the threat/vulnerability belongs to.
  - `resource` string — Resource to which the threat/vulnerability belongs to.
  - `region` string — Region the impacted resource is located in.
  - `location` string — Location the impacted resource is located in.
  - `resource_group` string — Resource Group of the resource to which the threat/vulnerability belongs to.
  - `severity` 'Critical' | 'High' | 'Info' | 'Low' | 'Medium' | 'None' | 'Unknown' — Severity of the threat/vulnerability
  - `status` 'active' | 'closed' | 'inactive' | 'resolved' | 'skipped' | 'suppressed' — Status of the threats/vulnerabilities
  - `source` string — Source of the threat/vulnerability
  - `issue_type` string — Issue Type of the threat/vulnerability
  - `provider_issue_id` string — Unique id for threat/vulnerability as provided by the cloud provider
  - `title` string — Title of the threat/vulnerability
  - `created_at` string, date-time — Date and time when the threat/vulnerability was created in corestack
  - `updated_at` string, date-time — Date and time when the threat/vulnerability was updated in corestack
  - `description` string — Description of the threat/vulnerability
  - `detected_at` string, date-time — Date and time when the threat/vulnerability was detected
  - `recommendation` string — Recommendation for the threat/vulnerability
  - `remediation` string — Recommended remediation for the threat/vulnerability
  - `source_data` object — Source data of the threat/vulnerability captured from the cloud.
  - `intent` string[] — List of threat intents, representing the potential goals or purposes behind the threat, such as "Persistence", "CredentialAccess", or "DefenseEvasion". These help categorize and understand the threat behavior.
  - `threat_id` string — Unique identifier of the threat.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal Server Error

---

[API](https://skmtc.dev/corestack/apis/corestack-external-api.md) · [All operations](https://skmtc.dev/corestack/apis/corestack-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/corestack/corestack-external-api/revisions/bf2cdf20826d/schema)