The threats and alerts APIs let you retrieve detected threats, the endpoints they affect, the individual detections that make up each threat, and the raw security alerts behind them. Use these endpoints to feed threat data into incident response workflows, SIEM correlation, or long-term archival.
Endpoints
Endpoint | Description |
|---|---|
Use this to retrieve a filtered, paginated list of threats. | |
Use this to retrieve full details for a single threat. | |
Use this to list every endpoint where a threat was detected. | |
Use this to retrieve the individual detection events within a threat. | |
Use this to retrieve raw security alerts. | |
Use this to retrieve raw security alerts with enriched host data. |
Common reference
All endpoints return a severity value on the s0–s5 scale. For details, see Security levels.