List threat actors


Special privileges required

Threat actors endpoints are only available to users with the Threat Landscape module.

Returns a list of Threat Actors objects.

Allowed filters:

  • Text without modifiers: Threat actor's name or description.
  • description: Threat actor's description. You can search for word or expressions (full-text search).
  • name: Threat actor's name. Both name or aliases are allowed.
  • source_region: Threat actor's source region. You can use ISO 3166-1 alpha-2 country codes, the ISO or the full country name.
  • sponsor_region: Threat actor's sponsor region. Same use as source_region.
  • targeted_industry: Threat actor's targeted industry.
  • targeted_region: Threat actor's targeted region. Same use as source_region.

Allowed orders:

  • first_seen_date
  • last_modification_date
  • last_seen_date
  • related_entities_count

Some examples:
GET /api/v3/threat_actors?filter=targeted_region:US&order=last_seen_date-
GET /api/v3/threat_actors?filter=targeted_industry:government&order:related_entities_count-

Click Try It! to start a request and see the response here!