--- title: "List threat intelligence items" method: GET path: "/api/intel/items" tags: ["Intel"] --- # List threat intelligence items `GET /api/intel/items` ## Request - Base URL: `https://app.cotool.ai` - URL: `https://app.cotool.ai/api/intel/items` - Auth: HTTP bearer Retrieves a paginated list of threat intelligence items with support for filtering by severity, platform, status, source, and text search ## Query parameters - `page` number - `perPage` number - `severity` 'none' | 'low' | 'medium' | 'high' | 'critical' - `platform` string - `status` 'active' | 'corrected' | 'retracted' - `source` string - `search` string - `minRelevancyScore` number - `relevancyMode` 'relevant' | 'all' ## Response `200` Successful response - object - `items` object[], required - `id` string, required - `externalId` string - `source` object, required - `url` string, uri, required - `name` string - `publisher` string, required - `publishTime` string, required - `tlp` 'CLEAR' | 'GREEN' | 'AMBER' | 'AMBER+STRICT' | 'RED' - `license` string - `language` string, required - `event` object, required - `title` string, required - `eventFirstSeen` string - `eventLastSeen` string - `severity` 'none' | 'low' | 'medium' | 'high' | 'critical', required - `confidence` number, required - `status` 'active' | 'corrected' | 'retracted', required - `summary` string, required - `abstract` string - `tldr` string, required - `attackPath` string[], required - `classification` object, required: Classification including ATT&CK mapping, kill chain phases, actors, malware, and platforms. - `attack` object[], required - `technique` string - `subTechnique` string: Sub-technique ID when applicable (e.g., T1059.001). - `techniqueName` string: Resolved human-readable technique name. Omit when unknown. - `confidence` number - `evidenceRef` string: Optional reference to supporting evidence (e.g., passage index or quote id). - `killChain` string[], required: Relevant kill chain phases demonstrated in the content. Return [] when not evidenced. - `malware` object[], required - `name` string, required: Malware family/tool name. - `confidence` number - `aliases` string[]: Known aliases for the malware family/tool. - `actor` object[], required - `name` string, required: Threat actor/group name. - `confidence` number - `aliases` string[]: Known aliases for the actor/group. - `platforms` string[], required: Affected platforms/environments. Return [] when not stated. - `mappings` object[], required: Mappings to other frameworks (e.g., NIST, CIS). Return [] when not applicable. - `framework` string, required: Framework name (e.g., NIST, CIS). - `id` string, required: Framework control/technique identifier. - `confidence` number: Optional confidence in mapping in [0,1]. - `affectedProducts` object[], required - `vendor` string - `product` string - `versions` string[], required - `fixedVersions` string[], required: Minimum patched/secure versions of this product that remediate the issue, one per supported release line (e.g. ["16.3.6"] or ["15.5.10", "16.3.6"]). Only versions the source states as fixed; never guess. Use [] when the source names no fixed version. - `confidence` number: Optional confidence in product impact in [0,1]. - `iocs` object, required: Grouped IOCs (read-tolerant). - `ipv4` object[] - `type` string - `value` string, required: Indicator value string as observed. - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot). - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown. - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown. - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. - `status` 'active' | 'revoked' | 'superseded' | 'expired' - `confidence` number - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. - `ipv6` object[] - `type` string - `value` string, required: Indicator value string as observed. - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot). - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown. - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown. - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. - `status` 'active' | 'revoked' | 'superseded' | 'expired' - `confidence` number - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. - `domains` object[] - `type` string - `value` string, required: Indicator value string as observed. - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot). - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown. - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown. - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. - `status` 'active' | 'revoked' | 'superseded' | 'expired' - `confidence` number - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. - `urls` object[] - `type` string - `value` string, required: Indicator value string as observed. - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot). - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown. - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown. - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. - `status` 'active' | 'revoked' | 'superseded' | 'expired' - `confidence` number - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. - `hashes` object[] - `type` string - `value` string, required: Indicator value string as observed. - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot). - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown. - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown. - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. - `status` 'active' | 'revoked' | 'superseded' | 'expired' - `confidence` number - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. - `files` object[] - `type` string - `value` string, required: Indicator value string as observed. - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot). - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown. - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown. - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. - `status` 'active' | 'revoked' | 'superseded' | 'expired' - `confidence` number - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. - `registryKeys` object[] - `type` string - `value` string, required: Indicator value string as observed. - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot). - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown. - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown. - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. - `status` 'active' | 'revoked' | 'superseded' | 'expired' - `confidence` number - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. - `processes` object[] - `type` string - `value` string, required: Indicator value string as observed. - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot). - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown. - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown. - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. - `status` 'active' | 'revoked' | 'superseded' | 'expired' - `confidence` number - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. - `certs` object[] - `type` string - `value` string, required: Indicator value string as observed. - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot). - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown. - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown. - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. - `status` 'active' | 'revoked' | 'superseded' | 'expired' - `confidence` number - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. - `cloudIds` object[] - `type` string - `value` string, required: Indicator value string as observed. - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot). - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown. - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown. - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. - `status` 'active' | 'revoked' | 'superseded' | 'expired' - `confidence` number - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. - `mobileIds` object[] - `type` string - `value` string, required: Indicator value string as observed. - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot). - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown. - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown. - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. - `status` 'active' | 'revoked' | 'superseded' | 'expired' - `confidence` number - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. - `provenance` object, required: Provenance information tying claims to exact sources/passages. - `supportingPassages` object[], required: Evidence snippets grounding technical claims and mappings. Use [] when no precise evidence exists. - `text` string, required: Exact quoted text supporting a technical claim. Do not paraphrase. - `sourceUrl` string, uri: Optional URL if the passage is from a different source. - `charSpan` object: Character span for the quoted passage within the analyzed content. - `start` number, required: Start character offset (inclusive) of quoted span within content. - `end` number, required: End character offset (exclusive) of quoted span within the analyzed content. - `version` integer, required - `lastUpdated` string - `createdAt` string - `addedToFeedAt` string - `canonicalKey` string - `duplicateOf` string - `tenantOverrides` unknown - `total` number, required - `page` number, required - `perPage` number, required - `hasNext` boolean, required - `validations` object - `outputs` object ## Other responses - `400`: Bad request — input validation failed or the request was malformed - `401`: Unauthorized — missing or invalid API key / session - `403`: Forbidden — the authenticated user lacks the required permissions - `500`: Internal server error --- [API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)