cURL
curl -X GET "https://app.cotool.ai/api/threats" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"import requests
url = "https://app.cotool.ai/api/threats"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cotool.ai/api/threats', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));HttpResponse<String> response = Unirest.get("https://app.cotool.ai/api/threats")
.header("Authorization", "Bearer <token>")
.asString();package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.cotool.ai/api/threats"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"threats": [
{
"threat": {
"id": "<string>",
"organizationId": "<string>",
"canonicalKey": "<string>",
"title": "<string>",
"aliases": [
"<string>"
],
"actorId": "<string>",
"intelItemIds": [
"<string>"
],
"relevancyScore": 123,
"exposureScore": 123,
"detectionEngineeringNote": "<string>",
"latestRunId": "<string>",
"assessmentRunningExecutionId": "<string>",
"assessmentFailedAt": "<string>",
"latestAlertId": "<string>",
"activeHuntAlertId": "<string>",
"dismissedAt": "<string>",
"dismissedByUserId": "<string>",
"dismissedReason": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>"
},
"runs": [
{
"id": "<string>",
"threatId": "<string>",
"runAt": "<string>",
"relevancyExecutionId": "<string>",
"relevancyScore": 123,
"relevancyExplanation": [
"<string>"
],
"exposureExecutionId": "<string>",
"exposureScore": 123,
"exposureStory": {
"summary": [
"<string>"
],
"exposureChecks": [
{
"checked": "<string>",
"source": "<string>",
"scope": "<string>",
"timeWindow": {
"start": "<string>",
"end": "<string>"
},
"evidence": "<string>",
"limitations": [
"<string>"
]
}
],
"assets": [
{
"identifier": "<string>",
"kind": "other",
"platform": null,
"source": "<string>",
"internetFacing": true,
"evidence": "<string>"
}
],
"iocFindings": [
{
"role": "compromise",
"platform": null,
"iocValue": "<string>",
"evidence": "<string>",
"affectedSystems": [
"<string>"
]
}
],
"detectionCoverage": {
"searches": [
{
"source": "<string>",
"criteria": "<string>",
"resultCount": 123,
"evidence": "<string>",
"limitations": [
"<string>"
]
}
],
"matches": [
{
"ref": {
"id": "<string>",
"name": "<string>",
"platform": "<string>",
"url": "<string>"
},
"rationale": "<string>",
"limitations": [
"<string>"
]
}
]
},
"gaps": [
{
"product": "<string>",
"logSource": "<string>",
"scopeId": "<string>",
"scopeKey": "<string>",
"blocking": true,
"description": "<string>",
"limitations": [
"<string>"
]
}
],
"nextSteps": [
"<string>"
],
"executionId": "<string>",
"runAt": "<string>",
"headline": "<string>",
"timeline": [
{
"timestamp": "<string>",
"description": "<string>"
}
]
},
"hasFoundIoc": true,
"hasBlockingGap": true,
"diff": {
"prevRunId": "<string>",
"beforeExposureScore": 123,
"afterExposureScore": 123,
"reasons": [
"<string>"
]
}
}
],
"deliverables": [
{
"id": "<string>",
"organizationId": "<string>",
"threatId": "<string>",
"executionId": "<string>",
"createdAt": "<string>",
"supersededById": "<string>",
"kind": "<string>",
"proposalId": "<string>",
"pullRequestUrl": "<string>",
"intent": "<string>",
"pinnedIocs": [
{
"type": "<string>",
"value": "<string>"
}
],
"targetProduct": "<string>",
"targetLogSource": "<string>"
}
],
"intelItems": [
{
"id": "<string>",
"title": "<string>",
"publisher": "<string>",
"url": "<string>",
"publishedAt": "<string>",
"tldr": "<string>",
"attackPath": [
"<string>"
],
"sourceName": "<string>",
"summary": "<string>",
"attackTechniques": [
{
"id": "<string>",
"name": "<string>"
}
],
"malware": [
"<string>"
],
"actors": [
"<string>"
],
"platforms": [
"<string>"
],
"affectedProducts": [
{
"name": "<string>",
"versions": [
"<string>"
]
}
],
"eventFirstSeen": "<string>",
"eventLastSeen": "<string>"
}
],
"alerts": [
{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"displayId": "<string>",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationName": "<string>",
"title": "<string>",
"description": "<string>",
"source": {},
"detection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"ruleId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>"
},
"originAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"externalRef": "<string>",
"externalUrl": "<string>",
"assignedAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"triageRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"dedupeKey": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"firstTriagedAt": "<string>",
"resolvedAt": "<string>",
"originAgentName": "<string>",
"assignedAgentName": "<string>",
"resolvedByUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"resolvedByAgentName": "<string>",
"resolvedReason": "<string>"
}
],
"activeHuntAlert": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"displayId": "<string>",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationName": "<string>",
"title": "<string>",
"description": "<string>",
"source": {},
"detection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"ruleId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>"
},
"originAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"externalRef": "<string>",
"externalUrl": "<string>",
"assignedAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"triageRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"dedupeKey": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"firstTriagedAt": "<string>",
"resolvedAt": "<string>",
"originAgentName": "<string>",
"assignedAgentName": "<string>",
"resolvedByUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"resolvedByAgentName": "<string>",
"resolvedReason": "<string>"
},
"latestAlert": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"displayId": "<string>",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationName": "<string>",
"title": "<string>",
"description": "<string>",
"source": {},
"detection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"ruleId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>"
},
"originAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"externalRef": "<string>",
"externalUrl": "<string>",
"assignedAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"triageRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"dedupeKey": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"firstTriagedAt": "<string>",
"resolvedAt": "<string>",
"originAgentName": "<string>",
"assignedAgentName": "<string>",
"resolvedByUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"resolvedByAgentName": "<string>",
"resolvedReason": "<string>"
},
"activityEvents": [
{
"id": "<string>",
"threatId": "<string>",
"runId": "<string>",
"metadata": {
"score": 123,
"hunting": true,
"executionId": "<string>",
"canonicalKey": "<string>",
"label": "<string>",
"userId": "<string>"
},
"createdAt": "<string>"
}
],
"capabilities": {
"canReadEvidence": true,
"canReassess": true,
"canTriage": true
}
}
]
}{
"error": "<string>",
"issues": [
{}
]
}{
"error": "<string>"
}{
"error": "<string>",
"missingPerms": [
"<string>"
]
}{
"error": "<string>"
}Hunt
List Threats
The durable Threat catalog. Filterable by derived status, canonical type, coverage state, exposure state, hunt result badge, actor, linked Alert state, and free-text query.
GET
/
api
/
threats
cURL
curl -X GET "https://app.cotool.ai/api/threats" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"import requests
url = "https://app.cotool.ai/api/threats"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cotool.ai/api/threats', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));HttpResponse<String> response = Unirest.get("https://app.cotool.ai/api/threats")
.header("Authorization", "Bearer <token>")
.asString();package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.cotool.ai/api/threats"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"threats": [
{
"threat": {
"id": "<string>",
"organizationId": "<string>",
"canonicalKey": "<string>",
"title": "<string>",
"aliases": [
"<string>"
],
"actorId": "<string>",
"intelItemIds": [
"<string>"
],
"relevancyScore": 123,
"exposureScore": 123,
"detectionEngineeringNote": "<string>",
"latestRunId": "<string>",
"assessmentRunningExecutionId": "<string>",
"assessmentFailedAt": "<string>",
"latestAlertId": "<string>",
"activeHuntAlertId": "<string>",
"dismissedAt": "<string>",
"dismissedByUserId": "<string>",
"dismissedReason": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>"
},
"runs": [
{
"id": "<string>",
"threatId": "<string>",
"runAt": "<string>",
"relevancyExecutionId": "<string>",
"relevancyScore": 123,
"relevancyExplanation": [
"<string>"
],
"exposureExecutionId": "<string>",
"exposureScore": 123,
"exposureStory": {
"summary": [
"<string>"
],
"exposureChecks": [
{
"checked": "<string>",
"source": "<string>",
"scope": "<string>",
"timeWindow": {
"start": "<string>",
"end": "<string>"
},
"evidence": "<string>",
"limitations": [
"<string>"
]
}
],
"assets": [
{
"identifier": "<string>",
"kind": "other",
"platform": null,
"source": "<string>",
"internetFacing": true,
"evidence": "<string>"
}
],
"iocFindings": [
{
"role": "compromise",
"platform": null,
"iocValue": "<string>",
"evidence": "<string>",
"affectedSystems": [
"<string>"
]
}
],
"detectionCoverage": {
"searches": [
{
"source": "<string>",
"criteria": "<string>",
"resultCount": 123,
"evidence": "<string>",
"limitations": [
"<string>"
]
}
],
"matches": [
{
"ref": {
"id": "<string>",
"name": "<string>",
"platform": "<string>",
"url": "<string>"
},
"rationale": "<string>",
"limitations": [
"<string>"
]
}
]
},
"gaps": [
{
"product": "<string>",
"logSource": "<string>",
"scopeId": "<string>",
"scopeKey": "<string>",
"blocking": true,
"description": "<string>",
"limitations": [
"<string>"
]
}
],
"nextSteps": [
"<string>"
],
"executionId": "<string>",
"runAt": "<string>",
"headline": "<string>",
"timeline": [
{
"timestamp": "<string>",
"description": "<string>"
}
]
},
"hasFoundIoc": true,
"hasBlockingGap": true,
"diff": {
"prevRunId": "<string>",
"beforeExposureScore": 123,
"afterExposureScore": 123,
"reasons": [
"<string>"
]
}
}
],
"deliverables": [
{
"id": "<string>",
"organizationId": "<string>",
"threatId": "<string>",
"executionId": "<string>",
"createdAt": "<string>",
"supersededById": "<string>",
"kind": "<string>",
"proposalId": "<string>",
"pullRequestUrl": "<string>",
"intent": "<string>",
"pinnedIocs": [
{
"type": "<string>",
"value": "<string>"
}
],
"targetProduct": "<string>",
"targetLogSource": "<string>"
}
],
"intelItems": [
{
"id": "<string>",
"title": "<string>",
"publisher": "<string>",
"url": "<string>",
"publishedAt": "<string>",
"tldr": "<string>",
"attackPath": [
"<string>"
],
"sourceName": "<string>",
"summary": "<string>",
"attackTechniques": [
{
"id": "<string>",
"name": "<string>"
}
],
"malware": [
"<string>"
],
"actors": [
"<string>"
],
"platforms": [
"<string>"
],
"affectedProducts": [
{
"name": "<string>",
"versions": [
"<string>"
]
}
],
"eventFirstSeen": "<string>",
"eventLastSeen": "<string>"
}
],
"alerts": [
{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"displayId": "<string>",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationName": "<string>",
"title": "<string>",
"description": "<string>",
"source": {},
"detection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"ruleId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>"
},
"originAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"externalRef": "<string>",
"externalUrl": "<string>",
"assignedAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"triageRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"dedupeKey": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"firstTriagedAt": "<string>",
"resolvedAt": "<string>",
"originAgentName": "<string>",
"assignedAgentName": "<string>",
"resolvedByUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"resolvedByAgentName": "<string>",
"resolvedReason": "<string>"
}
],
"activeHuntAlert": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"displayId": "<string>",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationName": "<string>",
"title": "<string>",
"description": "<string>",
"source": {},
"detection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"ruleId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>"
},
"originAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"externalRef": "<string>",
"externalUrl": "<string>",
"assignedAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"triageRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"dedupeKey": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"firstTriagedAt": "<string>",
"resolvedAt": "<string>",
"originAgentName": "<string>",
"assignedAgentName": "<string>",
"resolvedByUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"resolvedByAgentName": "<string>",
"resolvedReason": "<string>"
},
"latestAlert": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"displayId": "<string>",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationName": "<string>",
"title": "<string>",
"description": "<string>",
"source": {},
"detection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"ruleId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>"
},
"originAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"externalRef": "<string>",
"externalUrl": "<string>",
"assignedAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"triageRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"dedupeKey": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"firstTriagedAt": "<string>",
"resolvedAt": "<string>",
"originAgentName": "<string>",
"assignedAgentName": "<string>",
"resolvedByUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"resolvedByAgentName": "<string>",
"resolvedReason": "<string>"
},
"activityEvents": [
{
"id": "<string>",
"threatId": "<string>",
"runId": "<string>",
"metadata": {
"score": 123,
"hunting": true,
"executionId": "<string>",
"canonicalKey": "<string>",
"label": "<string>",
"userId": "<string>"
},
"createdAt": "<string>"
}
],
"capabilities": {
"canReadEvidence": true,
"canReassess": true,
"canTriage": true
}
}
]
}{
"error": "<string>",
"issues": [
{}
]
}{
"error": "<string>"
}{
"error": "<string>",
"missingPerms": [
"<string>"
]
}{
"error": "<string>"
}Authorizations
API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here
Query Parameters
Available options:
active, assessing, assessment_failed, blocked, monitoring, covered, clear, not_relevant, resolved, dismissed Available options:
vulnerability, campaign Available options:
none, partial, covered, unknown Available options:
compromise_signal_found, exposure_found, no_exposure_found, inconclusive Available options:
compromise_signal_found, exposure_found, covered_by_existing_detection, no_exposure_found, inconclusive Available options:
active, terminal, none Response
Successful response
Show child attributes
Show child attributes
Was this page helpful?
⌘I