Actors Threat Map

Threat Actor Threat Map for Organization

Rank threat actors by risk to a specific organization in a multi-org enterprise.

post/map/{orgId}/actors

Request

Base URL
https://api.recordedfuture.com/threat
URL
https://api.recordedfuture.com/threat/map/{orgId}/actors
Auth
- API key in header X-RFToken
- or OAuth 2
  Authorization code: https://id.recordedfuture.com/authorize
  Token URL: https://id.recordedfuture.com/token

Path parameters

orgIdstring required

The entity ID of the organization for which to fetch the threat map. The calling user must have access to this organization.

Request body

actorsstring[]

An array of threat actor entity IDs. If used, the API response will be limited to only those threat actors whose entity IDs match those found in the array. To lookup a threat actor entity ID, use the /actor/search endpoint.

categoriesstring[]

An array of threat actor category entity IDs. If used, the API response will be filtered to only those threat actors whose category (e.g., Hacktivist, Financially motivated, Nation-state sponsored) matches those found in the array. Categories must be listed by their Recorded Future Entity ID, which can be found by using the /actor/categories endpoint.

watchlistsstring[]

An array of client specific watch list IDs. If used, the API response will be limited to only those threat actors whose link to the threat map is via the watch lists included. To lookup a watch list ID, use the List API.

Example request

{
  "actors": [
    "l3moPJ"
  ],
  "categories": [
    "GK7qU"
  ],
  "watchlists": [
    "report:Hsxme2"
  ]
}

Response

Example response

{
  "data": {
    "threat_map": [
      {
        "id": "PD_NyL",
        "name": "Nation State Sponsored",
        "alias": [
          "Lorec53 APT Group"
        ],
        "categories": [
          "GK7qU"
        ],
        "intent": 5,
        "opportunity": 25,
        "log_entries": [
          {
            "watchlist": {
              "id": "PD_NyL",
              "name": "Nation State Sponsored"
            },
            "entity": {
              "id": "PD_NyL",
              "name": "Nation State Sponsored"
            },
            "severity": "limited",
            "axis": "opportunity",
            "date": "2023-01-10T14:51:38.462Z"
          }
        ]
      }
    ],
    "date": "2023-01-10T14:51:38.462Z"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.