---
title: "Get Threat by Name"
method: GET
path: "/api/threat.php"
tags: ["Threats"]
---

# Get Threat by Name

`GET /api/threat.php`

Retrieve detailed threat intelligence information for a specific threat by looking up the threat's name.
To query links, retrieve the threat by ID instead.

## Query parameters

- `key` string
- `threat` string, required
- `pretty` 0 | 1

## Response `200`

Successful request. Returns threat information in JSON format.

- ThreatResponse
  - `tid` integer — Unique identifier of the threat.
  - `threat` string — Name of the threat being retrieved.
  - `category` string — Category assigned to the threat.
  - `othernames` string[] — Alternative names for the threat.
  - `risk` 'unknown' | 'none' | 'low' | 'medium' | 'high' | 'critical' | 'retired' — Risk level associated with the threat.
  - `description` string, nullable — Description of the threat.
  - `notes` string, nullable — Additional notes about the threat.
  - `wikisummary` string, nullable — Wikipedia summary of the threat.
  - `wikireference` string, nullable — Link to Wikipedia reference.
  - `retired` boolean, nullable — Indicates whether the threat is inactive or obsolete. A threat is automatically retired if, in the past three months, it has not been: - Reported using the Seen button in the Pulsedive UI - Observed in any source feeds - Submitted through the Analyze section of the Pulsedive UI Pulsedive research can also retire threats manually. When set to `1`, this threat is retired. When set to `0`, this threat is active.
  - `stamp_added` string, sql-date-time, nullable — Timestamp when the threat was first added to Pulsedive. 24-hour format, UTC time zone.
  - `stamp_updated` string, sql-date-time, nullable — Timestamp when the threat record was last updated in Pulsedive. 24-hour format, UTC time zone.
  - `stamp_seen` string, sql-date-time, nullable — Timestamp when the threat was last seen in Pulsedive. 24-hour format, UTC time zone.
  - `stamp_retired` string, sql-date-time, nullable — Timestamp when the threat was retired in Pulsedive. 24-hour format, UTC time zone.
  - `updated_last_domain` string, sql-date-time, nullable — Timestamp when the threat's last domain was updated in Pulsedive. 24-hour format, UTC time zone.
  - `related` object[] — Related threats associated with this threat.
    - `tid` integer — Unique identifier of the related threat.
    - `name` string — Name of the related threat.
    - `category` string — Category assigned to the related threat.
    - `risk` 'unknown' | 'none' | 'low' | 'medium' | 'high' | 'critical' | 'retired' — Risk level associated with the related threat.
    - `stamp_updated` string, sql-date-time, nullable — Timestamp when the related threat record was last updated in Pulsedive. 24-hour format, UTC time zone.
  - `attributes` object — Threat attributes.
  - `ttps` object[] — Tactics, techniques, and procedures associated with the threat.
  - `news` object[] — News articles about the threat.
    - `title` string — Title of the article.
    - `channel` string — Name of the news channel or publication.
    - `icon` string — URL of the channel icon.
    - `link` string — URL of the article.
    - `stamp` string, sql-date-time, nullable — Timestamp when the article was published. 24-hour format, UTC time zone.
    - `primary` integer — Indicates whether this is a primary reference for the threat. When set to `1`, it is a primary reference that was intentionally linked to the threat (e.g., from a threat feed or a contributor). When set to `0`, it is a news article that mentioned the threat.
  - `comments` object[] — Comments submitted by Pulsedive users for this threat.
    - `cid` integer — Unique identifier of the comment.
    - `username` string — Username of the commenter.
    - `title` string — Title of the commenter.
    - `comment` string — Comment text.
    - `stamp_added` string, sql-date-time, nullable — Timestamp when the comment was added to Pulsedive. 24-hour format, UTC time zone.
    - `stamp_updated` string, sql-date-time, nullable — Timestamp when the comment was last updated in Pulsedive. 24-hour format, UTC time zone.
  - `summary` object — Summary information about the threat.
    - `updated_last_domain` string, sql-date-time, nullable — Timestamp when the threat's last domain was updated. 24-hour format, UTC time zone.
    - `attributes` object — Summary attributes for the threat.
      - `technology` object — Technologies identified.
      - `hosttype` object — Host types identified.
      - `protocol` object — Protocols identified.
      - `port` object — Ports identified.
    - `properties` object — Additional properties.
    - `feeds` object[] — Feeds associated with this threat.
      - `fid` integer — Unique identifier of the feed.
      - `organization` string — Organization associated with the feed.
      - `name` string — Name of the feed.
      - `pricing` string, nullable — Pricing tier of the feed.
      - `category` string — Category assigned to the feed.
      - `indicators` integer — Count of indicators in the feed.
    - `risk` object — Count of indicators at each risk level for the threat. Consists of key-value pairs, where each key matches an indicator risk level and its value contains the corresponding count.

## Other responses

- `400` — Bad request. The request was malformed or missing required parameters.
- `401` — Unauthorized. Your API key is missing or invalid.
- `404` — Not found. The requested indicator could not be located.
- `429` — Rate limit exceeded. Too many requests have been made in a short period of time.
- `500` — Server error. An unexpected problem occurred on our end. These errors are automatically reported to our team.

---

[API](https://skmtc.dev/pulsedive/apis/pulsedive-api-reference.md) · [All operations](https://skmtc.dev/pulsedive/apis/pulsedive-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/pulsedive/pulsedive-api-reference/revisions/d0d40458010b/schema)