> ## Documentation Index > Fetch the complete documentation index at: https://docs.cotool.ai/llms.txt > Use this file to discover all available pages before exploring further. # List threat intelligence items > Retrieves a paginated list of threat intelligence items with support for filtering by severity, platform, status, source, and text search ## OpenAPI ````yaml https://app.cotool.ai/api/docs/openapi.json get /api/intel/items openapi: 3.1.0 info: title: Cotool API version: 1.0.0 description: >- The Cotool REST API. Authenticate with an API key from `/settings/api-keys` sent as `Authorization: Bearer `. Authentication, error formats, pagination, and common integration recipes are documented in the [API overview](https://docs.cotool.ai/api-reference/introduction). Endpoints marked **Deprecated** keep working; each one's description names its replacement. servers: - url: https://app.cotool.ai description: Production server security: - ApiKeyAuth: [] tags: - name: Agents description: Create, update, run, and version agents. - name: Agent Runs description: Inspect agent runs, submit feedback, and read evaluation metrics. - name: Agent Triggers description: Webhook, schedule, and integration triggers that start agent runs. - name: Agents as Code description: Validate agents and skills defined as YAML in a Git repository. - name: Skills description: Reusable instructions and tool grants attached to agents. - name: Chat description: Chat sessions and their transcripts. - name: Alerts description: Alert triage, routing, and escalation notifications. - name: Output Destinations description: Webhook, Slack, Jira, and Linear destinations for agent output. - name: Detections description: Detection agents, detection hits, and the Cotool detection library. - name: Hunt description: Autonomous hunt threats, gaps, and settings. - name: Intel description: Threat-intelligence feed items, indicators, and sources. - name: Threat Model description: The organization threat model and its version history. - name: MITRE Coverage description: MITRE ATT&CK coverage across detections. - name: Tools description: Connected tool integrations and captured tool output. - name: CLIs description: Connected CLI integrations. - name: Artifacts description: Files and reports produced by agent runs. - name: Audit Logs description: Organization audit log export and event catalog. - name: Users description: Users, memberships, and the current session. - name: Roles description: Role-based permissions. - name: Organizations description: Organization-level metrics. paths: /api/intel/items: get: tags: - Intel summary: List threat intelligence items description: >- Retrieves a paginated list of threat intelligence items with support for filtering by severity, platform, status, source, and text search parameters: - in: query name: page schema: type: number minimum: 1 - in: query name: perPage schema: type: number minimum: 1 maximum: 100 - in: query name: severity schema: type: string enum: - none - low - medium - high - critical - in: query name: platform schema: type: string - in: query name: status schema: type: string enum: - active - corrected - retracted - in: query name: source schema: type: string - in: query name: search schema: type: string - in: query name: minRelevancyScore schema: type: number minimum: 0 maximum: 100 - in: query name: relevancyMode schema: type: string enum: - relevant - all responses: '200': description: Successful response content: application/json: schema: type: object properties: items: type: array items: type: object properties: id: type: string externalId: type: string source: type: object properties: url: type: string format: uri name: type: string publisher: type: string publishTime: type: string tlp: type: string enum: - CLEAR - GREEN - AMBER - AMBER+STRICT - RED license: type: string language: type: string required: - url - publisher - publishTime - language event: type: object properties: title: type: string eventFirstSeen: type: string eventLastSeen: type: string severity: type: string enum: - none - low - medium - high - critical confidence: type: number minimum: 0 maximum: 1 status: type: string enum: - active - corrected - retracted required: - title - severity - confidence - status summary: type: string abstract: type: string tldr: type: string maxLength: 240 attackPath: type: array items: type: string classification: type: object properties: attack: type: array items: type: object properties: technique: type: string subTechnique: type: string description: >- Sub-technique ID when applicable (e.g., T1059.001). techniqueName: type: string description: >- Resolved human-readable technique name. Omit when unknown. confidence: type: number minimum: 0 maximum: 1 evidenceRef: type: string description: >- Optional reference to supporting evidence (e.g., passage index or quote id). description: >- ATT&CK technique mapping with confidence. Include techniqueName when resolvable. killChain: type: array items: type: string enum: - reconnaissance - weaponization - delivery - exploitation - installation - c2 - actions description: >- Relevant kill chain phases demonstrated in the content. Return [] when not evidenced. malware: type: array items: type: object properties: name: type: string description: Malware family/tool name. confidence: type: number minimum: 0 maximum: 1 aliases: type: array items: type: string description: Known aliases for the malware family/tool. required: - name description: Malware identification claim. actor: type: array items: type: object properties: name: type: string description: Threat actor/group name. confidence: type: number minimum: 0 maximum: 1 aliases: type: array items: type: string description: Known aliases for the actor/group. required: - name description: Threat actor attribution claim. platforms: type: array items: type: string enum: - windows - linux - macos - ios - android - aws - gcp - azure - o365 - okta - kubernetes description: >- Affected platforms/environments. Return [] when not stated. mappings: type: array items: type: object properties: framework: type: string description: Framework name (e.g., NIST, CIS). id: type: string description: Framework control/technique identifier. confidence: type: number minimum: 0 maximum: 1 description: Optional confidence in mapping in [0,1]. required: - framework - id description: Mapping to other security frameworks. description: >- Mappings to other frameworks (e.g., NIST, CIS). Return [] when not applicable. required: - attack - killChain - malware - actor - platforms - mappings description: >- Classification including ATT&CK mapping, kill chain phases, actors, malware, and platforms. affectedProducts: type: array items: type: object properties: vendor: type: string product: type: string versions: type: array items: type: string default: [] confidence: type: number minimum: 0 maximum: 1 description: >- Optional confidence in product impact in [0,1]. required: - versions description: >- Affected vendor/product versions relevant for scoping detections. iocs: type: object properties: ipv4: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. ipv6: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. domains: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. urls: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. hashes: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. files: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. registryKeys: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. processes: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. certs: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. cloudIds: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. mobileIds: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. description: Grouped IOCs (read-tolerant). provenance: type: object properties: supportingPassages: type: array items: type: object properties: text: type: string description: >- Exact quoted text supporting a technical claim. Do not paraphrase. sourceUrl: type: string format: uri description: >- Optional URL if the passage is from a different source. charSpan: type: object properties: start: type: number description: >- Start character offset (inclusive) of quoted span within content. end: type: number description: >- End character offset (exclusive) of quoted span within the analyzed content. required: - start - end description: >- Character span for the quoted passage within the analyzed content. required: - text description: >- Supporting evidence passages used to justify extracted claims. description: >- Evidence snippets grounding technical claims and mappings. Use [] when no precise evidence exists. required: - supportingPassages description: >- Provenance information tying claims to exact sources/passages. version: type: integer exclusiveMinimum: 0 lastUpdated: type: string createdAt: type: string addedToFeedAt: type: string canonicalKey: type: string duplicateOf: type: string tenantOverrides: {} required: - id - source - event - summary - tldr - attackPath - classification - affectedProducts - iocs - provenance - version description: >- Backwards-compatible intel item for read/API responses (tolerates legacy stored shapes). total: type: number page: type: number perPage: type: number hasNext: type: boolean validations: type: object additionalProperties: type: - object - 'null' properties: relevancyScore: type: number minimum: 0 maximum: 100 description: >- Single numeric score from 0-100 for how APPLICABLE the threat is to this organization — whether the affected products/platforms/versions/ecosystems/surface are present here. NOT about whether compromise was found or telemetry is complete. 70-100: affected surface confirmed present (proceed to hunt even with no compromise evidence / limited telemetry); 50-69: plausibly present, unconfirmed; 0-49: genuinely absent / not applicable. Do not lower the score for missing compromise evidence or telemetry gaps. relevancyHeadline: type: string description: >- ONE self-contained, answer-first sentence stating whether and why this threat applies to this environment — always include it. Lead with the conclusion, then the concrete reason (e.g. "The Acrobat Chrome extension is not installed on any managed browser, so this threat does not apply."). Never lead with background inventory or scene-setting. Wrap tool-backed clauses in ... spans as in explanation. explanation: type: array items: type: string description: >- One concise tool-backed finding. Wrap each clause supported by a tool call in .... Example: Confirmed 12 macOS hosts running vulnerable Atlas v3.1. description: >- 3-6 compact bullets citing specific tool observations about applicability, visibility, and gaps. Wrap the specific clause(s) backed by a tool call in inline citation spans of the form ..., where qN matches a marker that preceded a tool result in this run. agentId: type: string format: uuid executionId: type: string format: uuid runAt: type: string format: date-time description: ISO timestamp when the validation completed. toolsUsed: type: array items: type: string description: >- Tool identifiers actually invoked during validation (e.g., "splunk.query", "sentinelone.search", "aws.ec2.describe"). required: - relevancyScore - explanation - agentId - executionId - runAt - toolsUsed description: >- Structured output for the built-in threat relevancy agent. outputs: type: object additionalProperties: type: - object - 'null' properties: exposureScore: type: number minimum: 0 maximum: 100 description: >- Single numeric score (0-100) estimating likelihood of exposure, based strictly on tool evidence. ~90-100: compromised; 60-89: suspicious activity; 1-59: no evidence; 0: unknown. headline: type: string description: >- ONE self-contained sentence: the verdict line rendered standalone on the Alert card/list, without the intel or the other bullets for context — always include it. It must answer "why am I being shown this alert?": state the concrete indicator/activity or exposure found, the affected system/account/environment, and the evidence-based interpretation that determines the score. If a match is attributable to security inspection, scanning, testing, or another evidenced benign cause, state both the match and that interpretation so the reader immediately understands why it is not concerning. Never use background/applicability context (platform presence, telemetry availability, intel restatement) as the headline, and never use bare back-references ("Both IPs", "the IOCs") that assume prior context. Wrap tool-backed clauses in ... spans as in exposureExplanation. exposureExplanation: type: array items: type: string description: >- 3-8 concise bullets summarizing the strongest findings that drive the score. Each bullet should reference specific tool evidence (hostnames, query ids, brief log snippet summaries). Wrap the specific clause(s) backed by a tool call in inline citation spans of the form ..., where qN matches a marker that preceded a tool result in this run. iocFindings: type: array items: type: object properties: iocType: type: string enum: - ip - domain - url - hash - file_path - process - registry_key - certificate - cloud_id - package - email - user_agent - mutex - other description: >- Canonical indicator type: one of ip, domain, url, hash, file_path, process, registry_key, certificate, cloud_id, package, email, user_agent, mutex, other. Use the canonical type of the indicator you were given (or the closest match for one you discovered); use "other" only when none fit. role: type: string enum: - compromise - relevance default: compromise description: >- Carry the role the indicator was given in the input: "compromise" for attacker-controlled/attacker-specific artifacts indicative on their own; "relevance" for legitimate/dual-use artifacts the threat uses, abuses, or targets (a match proves environment relevance, NEVER compromise on its own). Never promote "relevance" to "compromise" or demote "compromise" to "relevance". For an indicator you discovered yourself (not in the input), assign the role by the same test: would a credible match alone justify reporting a compromise signal? platform: type: string description: >- For package/image indicators, the registry/ecosystem it lives in ("npm", "pypi", "nuget", "dockerhub", "github") so its logo can be shown. Omit for domain/ip/hash indicators and anything with no brandable registry. Never the SIEM/EDR tool that detected it. iocValue: type: string description: Exact indicator value that was searched. found: type: boolean description: >- True if any credible matches were identified in tool results. evidence: type: string description: >- Short evidence note (≤280 chars): include minimal context such as a timestamp, log id, query reference, or snippet summary. Do not paste full logs. May contain inline citation spans of the form ... referencing the tool call that produced the finding. affectedSystems: type: array items: type: string description: >- Compact list of implicated assets (hostnames, asset ids, instance ids) if applicable. required: - iocType - role - iocValue - found description: >- Per-indicator results actually searched. Include only when indicators were checked; omit entirely if no indicator search was performed. assets: type: array items: type: object properties: identifier: type: string description: >- Asset identifier — hostname, asset id, instance id, ARN, repo, or account. kind: type: string enum: - repository - host - service - cloud_resource - identity - package - domain - saas_account - container_image - other description: >- What kind of asset this is. Pick the closest match; use "other" only when none fit. platform: type: string description: >- The brandable system the asset NATIVELY lives in / is managed from — e.g. "github"/"gitlab" for a repo, "aws"/"gcp"/"azure" for a cloud resource, "okta" for an identity — so we can show its logo. Set ONLY to where the asset resides, NOT the telemetry/SIEM tool you observed it through (a host seen in Splunk/CrowdStrike still has no platform unless it genuinely lives in a brandable product). Omit when there is no brandable home. source: type: string description: >- Where the asset was OBSERVED — the tool/integration that surfaced it, e.g. "CrowdStrike", "Datadog APM", "GitHub". This is the evidence source, not necessarily where the asset lives. internetFacing: type: boolean description: >- True when the asset is reachable from the internet, false when confirmed internal. Omit when unknown. evidence: type: string description: >- Short cited note on why this asset drives exposure. May contain inline citation spans of the form .... required: - identifier - kind description: >- Concrete assets whose cited evidence drives exposure (e.g. vulnerable internet-facing hosts). Populate for exposure-found results even when no IOC was found; omit when no concrete asset was established. timeline: type: array items: type: object properties: timestamp: type: string description: ISO timestamp of the notable event. description: type: string description: Short description of what happened and where. required: - timestamp - description description: >- Optional, up to 10 items, ordered by time. Include only if notable events were established from tool evidence. gaps: type: array items: type: object properties: product: type: string description: Product whose telemetry is missing/weak. logSource: type: string description: >- The missing/weak logs as a short plain-language description (1-3 words, e.g. "DNS query logs", "CI/CD audit logs") — human-readable words, never a snake_case/technical identifier. scopeType: type: string enum: - org - integration - account - environment - asset_group - tenant - domain description: Scope of the gap; defaults to org. blocking: type: boolean description: True when the gap blocked a reliable answer. description: type: string description: >- Why the missing/weak log source blocked or weakened the hunt. May contain spans. required: - product - logSource - description description: >- Observability gaps: missing or weak log sources that blocked or weakened this hunt. detectionCoverage: type: object properties: state: type: string enum: - none - partial - covered - unknown description: Whether existing detections cover this threat. matches: type: array items: type: object properties: detectionId: type: string description: Detection id if a Cotool detection. detectionName: type: string description: Name of the matched detection. source: type: string description: >- Detection engine / SIEM the rule lives in, lowercase key when known (e.g. "datadog", "splunk", "scanner", "crowdstrike", "sentinelone"). Drives the engine logo in the UI. coverage: type: string enum: - partial - covered - unknown description: How well this detection covers the threat. rationale: type: string description: >- Cited evidence the detection is deployed, scoped, healthy, and matches. May contain spans. required: - detectionName - coverage - rationale description: >- Detections evaluated as covering this threat. Only covered/partial with cited deploy/scope/health/logic evidence. required: - state description: >- Existing detection coverage assessment (separate axis from exposure). agentId: type: string format: uuid executionId: type: string format: uuid runAt: type: string format: date-time description: ISO timestamp when the threat hunt completed. toolsUsed: type: array items: type: string description: >- Tool identifiers actually invoked during the hunt (e.g., "splunk.query", "crowdstrike.search", "vpcflow.scan"). required: - exposureScore - exposureExplanation - agentId - executionId - runAt - toolsUsed required: - items - total - page - perPage - hasNext '400': description: Bad request — input validation failed or the request was malformed content: application/json: schema: $ref: '#/components/schemas/ValidationError' '401': description: Unauthorized — missing or invalid API key / session content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Forbidden — the authenticated user lacks the required permissions content: application/json: schema: $ref: '#/components/schemas/PermissionError' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' x-codeSamples: - lang: shell label: cURL source: |- curl -X GET "https://app.cotool.ai/api/intel/items" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" components: schemas: ValidationError: type: object properties: error: type: string description: Error message describing what went wrong issues: type: array description: >- Detailed validation issues, present when request or response schema validation fails items: type: object additionalProperties: true required: - error Error: type: object properties: error: type: string description: Error message describing what went wrong required: - error PermissionError: type: object properties: error: type: string description: Error message describing what went wrong missingPerms: type: array description: Permissions the authenticated user is missing for this operation items: type: string required: - error securitySchemes: ApiKeyAuth: type: http scheme: bearer bearerFormat: API Key description: >- API Key authentication for programmatic access. Include your API key in the Authorization header as: `Bearer your_api_key_here` ````