Report List
curl --request POST \
--url https://api.threatbook.io/v3/reports/list \
--header 'Content-Type: application/json' \
--data '
{
"query": "<string>",
"threat_type_list": [
"<string>"
],
"severity_list": [
"<string>"
],
"category_list": [
"<string>"
],
"threat_actor_list": [
"<string>"
],
"target_region_list": [
"<string>"
],
"target_region_code": [
"<string>"
],
"target_industry_list": [
"<string>"
],
"target_org_list": [
"<string>"
],
"target_product_list": [
"<string>"
],
"industry_of_target_org": [
"<string>"
],
"hq_region_of_target_org": [
"<string>"
],
"has_iocs": true,
"has_cves": true,
"has_rules": true,
"published_from": "<string>",
"published_to": "<string>",
"from_tb_lab": true,
"limit": 123,
"cursor": "<string>"
}
'import requests
url = "https://api.threatbook.io/v3/reports/list"
payload = {
"query": "<string>",
"threat_type_list": ["<string>"],
"severity_list": ["<string>"],
"category_list": ["<string>"],
"threat_actor_list": ["<string>"],
"target_region_list": ["<string>"],
"target_region_code": ["<string>"],
"target_industry_list": ["<string>"],
"target_org_list": ["<string>"],
"target_product_list": ["<string>"],
"industry_of_target_org": ["<string>"],
"hq_region_of_target_org": ["<string>"],
"has_iocs": True,
"has_cves": True,
"has_rules": True,
"published_from": "<string>",
"published_to": "<string>",
"from_tb_lab": True,
"limit": 123,
"cursor": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
query: '<string>',
threat_type_list: ['<string>'],
severity_list: ['<string>'],
category_list: ['<string>'],
threat_actor_list: ['<string>'],
target_region_list: ['<string>'],
target_region_code: ['<string>'],
target_industry_list: ['<string>'],
target_org_list: ['<string>'],
target_product_list: ['<string>'],
industry_of_target_org: ['<string>'],
hq_region_of_target_org: ['<string>'],
has_iocs: true,
has_cves: true,
has_rules: true,
published_from: '<string>',
published_to: '<string>',
from_tb_lab: true,
limit: 123,
cursor: '<string>'
})
};
fetch('https://api.threatbook.io/v3/reports/list', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.threatbook.io/v3/reports/list",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'query' => '<string>',
'threat_type_list' => [
'<string>'
],
'severity_list' => [
'<string>'
],
'category_list' => [
'<string>'
],
'threat_actor_list' => [
'<string>'
],
'target_region_list' => [
'<string>'
],
'target_region_code' => [
'<string>'
],
'target_industry_list' => [
'<string>'
],
'target_org_list' => [
'<string>'
],
'target_product_list' => [
'<string>'
],
'industry_of_target_org' => [
'<string>'
],
'hq_region_of_target_org' => [
'<string>'
],
'has_iocs' => true,
'has_cves' => true,
'has_rules' => true,
'published_from' => '<string>',
'published_to' => '<string>',
'from_tb_lab' => true,
'limit' => 123,
'cursor' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.threatbook.io/v3/reports/list"
payload := strings.NewReader("{\n \"query\": \"<string>\",\n \"threat_type_list\": [\n \"<string>\"\n ],\n \"severity_list\": [\n \"<string>\"\n ],\n \"category_list\": [\n \"<string>\"\n ],\n \"threat_actor_list\": [\n \"<string>\"\n ],\n \"target_region_list\": [\n \"<string>\"\n ],\n \"target_region_code\": [\n \"<string>\"\n ],\n \"target_industry_list\": [\n \"<string>\"\n ],\n \"target_org_list\": [\n \"<string>\"\n ],\n \"target_product_list\": [\n \"<string>\"\n ],\n \"industry_of_target_org\": [\n \"<string>\"\n ],\n \"hq_region_of_target_org\": [\n \"<string>\"\n ],\n \"has_iocs\": true,\n \"has_cves\": true,\n \"has_rules\": true,\n \"published_from\": \"<string>\",\n \"published_to\": \"<string>\",\n \"from_tb_lab\": true,\n \"limit\": 123,\n \"cursor\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.threatbook.io/v3/reports/list")
.header("Content-Type", "application/json")
.body("{\n \"query\": \"<string>\",\n \"threat_type_list\": [\n \"<string>\"\n ],\n \"severity_list\": [\n \"<string>\"\n ],\n \"category_list\": [\n \"<string>\"\n ],\n \"threat_actor_list\": [\n \"<string>\"\n ],\n \"target_region_list\": [\n \"<string>\"\n ],\n \"target_region_code\": [\n \"<string>\"\n ],\n \"target_industry_list\": [\n \"<string>\"\n ],\n \"target_org_list\": [\n \"<string>\"\n ],\n \"target_product_list\": [\n \"<string>\"\n ],\n \"industry_of_target_org\": [\n \"<string>\"\n ],\n \"hq_region_of_target_org\": [\n \"<string>\"\n ],\n \"has_iocs\": true,\n \"has_cves\": true,\n \"has_rules\": true,\n \"published_from\": \"<string>\",\n \"published_to\": \"<string>\",\n \"from_tb_lab\": true,\n \"limit\": 123,\n \"cursor\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.threatbook.io/v3/reports/list")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"query\": \"<string>\",\n \"threat_type_list\": [\n \"<string>\"\n ],\n \"severity_list\": [\n \"<string>\"\n ],\n \"category_list\": [\n \"<string>\"\n ],\n \"threat_actor_list\": [\n \"<string>\"\n ],\n \"target_region_list\": [\n \"<string>\"\n ],\n \"target_region_code\": [\n \"<string>\"\n ],\n \"target_industry_list\": [\n \"<string>\"\n ],\n \"target_org_list\": [\n \"<string>\"\n ],\n \"target_product_list\": [\n \"<string>\"\n ],\n \"industry_of_target_org\": [\n \"<string>\"\n ],\n \"hq_region_of_target_org\": [\n \"<string>\"\n ],\n \"has_iocs\": true,\n \"has_cves\": true,\n \"has_rules\": true,\n \"published_from\": \"<string>\",\n \"published_to\": \"<string>\",\n \"from_tb_lab\": true,\n \"limit\": 123,\n \"cursor\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"cursor": "d19ba003fbc998df0d299f2ff41607ad2ce6ecc2a573f5e0a152bedaa8ff2f591ef5329521d6e2ddbd5646a56918d3b33f652e36ab05bde0fd78000e27c7caccd3ecd8903b1914e4c2858f93ffe27a773ed388a338b65e40dcf0b7745e0df41a3ede6a33a561f100d522ce9a00af42103a728e2d0fbdbabced7ea70a4702640e83d03a2d48481e215d635c2292984be2bb6ecb35e5c5a1a7c08b4d8599a74d8efa0ee76153b83c8c985b7df1d6143c18b14a851faf7059a6ce448ecefd801911ff6433d234d4b21368d1297271eeab6bbcbb4b01608756b024779f600b33cd88c3bc08250a29c0125ff9d97f2f103a061b78d9282a080849262ce8718ae7b59f25f26a09213f1cee20110c82651b96341db0f09c0969896b6d9beb3bc7538812",
"total": 2753,
"limit": 20,
"items": [
{
"id": "303012",
"title": "Qilin Ransomware Targets Italian Automotive Leader Pieffe Auto Group",
"summary": "In 2025, the activities of the ransomware group Qilin significantly increased, launching a series of cyberattacks against enterprises and mid-sized organizations across multiple industries. Qilin employs a double extortion strategy, not only encrypting victims' data but also threatening to publicly disclose sensitive information to exert pressure, resulting in severe financial and reputational losses for businesses. The attack targets span various sectors, including automotive manufacturing, beverage production, medical devices, food industry, and legal services, demonstrating its broad attack range and increasingly sophisticated tactics. Victims include well-known companies such as Pieffe Auto Group in Italy, Asahi Group in Japan, Beta Dyne in the United States, and Volkswagen in France. Security experts recommend that affected organizations strengthen their cybersecurity defenses, including continuous monitoring, incident response plans, backup validation, and employee defense training, to mitigate the risk of future attacks. Qilin's attacks not only disrupt business operations but may also trigger a ripple effect on societal infrastructure, highlighting the urgency of cybersecurity protection.",
"source": "Open Source",
"published_time": "2025-11-25T00:00:00Z",
"event_time": "2025-09-17",
"severity": "Critical",
"organizations": [
"Volkswagen France",
"Echo Lake Foods, Inc."
],
"target_orgs": [
{
"org_name": "Volkswagen France",
"website": "volkswagen.fr",
"org_industry": [
"Automotive",
"Manufacturing"
],
"hq_region": [
"FR"
]
},
{
"org_name": "Echo Lake Foods, Inc.",
"website": "echolakefoods.com",
"org_industry": [
"Food & Beverage",
"Manufacturing"
],
"hq_region": [
"US"
]
}
],
"regions": [
"Netherlands",
"United States",
"Japan",
"UAE",
"Mexico",
"Italy",
"France"
],
"industries": [
"Healthcare",
"Manufacturing",
"Government"
],
"products": [],
"threat_type": [
"Ransomware"
],
"tags": [
"Qilin"
],
"cve_stats": 0,
"reference_link": [
"https://www.dexpose.io/free-darkweb-report/",
"https://www.dexpose.io/email-data-breach-scan/",
"https://cybernews.com/news/bmw-ransomware-attack-everest-claim-everest-luxury-target-jlr-trend/",
"https://cybernews.com/security/production-process-of-jaguar-land-rover-disrupted-by-cyberattack/",
"https://cybernews.com/security/jaguar-jlr-cyberattack-claimed-by-salesforce-hackers-scattered-spider-shiny-hunters/",
"https://cybernews.com/security/massive-salesforce-breach-campaign-started-on-github/",
"https://cybernews.com/news/marks-spencer-breach-tcs-third-party-vendor-social-engineering-attack/",
"https://cybernews.com/news/jaguar-land-rover-production-down-for-at-least-another-week-due-to-cyberattack/",
"https://cybernews.com/security/bridgestone-cyberattack-auto-manufacturer-disrupted-jaguar-link/",
"https://cybernews.com/ransomlooker/",
"https://cybernews.com/security/texas-electric-coops-ransomware-attack/",
"https://cybernews.com/news/asahi-beer-cyberattack-claimed-qilin-ransomware-stolen-data/",
"https://cybernews.com/news/cal-club-ransomware-attack-california-golf-club-san-franscico-qilin-claims/",
"https://cybernews.com/news/israel-shamir-medical-center-ransowmare-attack-qilin-8t-patient-data-stolen/",
"https://cybernews.com/news/nissan-ransomware-attack-creative-box-creative-box-radesign-studio-qilin-group/",
"https://cybernews.com/news/inotiv-ransomware-attack-qilin-pharma-research-testing-animal-cruelty-fines/",
"https://cybernews.com/security/singer-associates-ransomware-attack-qilin/",
"https://cybernews.com/news/sk-group-ransomware-attack-qilin-gang-claims-stolen-data/",
"https://cybernews.com/security/lee-enterprises-cyberattack-impact/",
"https://cybernews.com/news/houston-symphony-qilin-ransomware-attack/",
"https://cybernews.com/security/television-station-detroit-pbs-hacked/",
"https://cybernews.com/news/yanfeng-ransomware-attack-claimed-qilin/",
"https://cybernews.com/news/cancer-hospital-breach-is-claimed-by-qilin-gang-in-new-ransomware-low/",
"https://botcrawl.com/category/data-breaches/"
]
}
]
},
"response_code": 200,
"msg": "Success"
}This response has no body data.{
"msg": "Required:{resource/apikey}",
"response_code": 400
}{
"msg": "Invalid account status",
"response_code": 401
}{
"msg": "Invalid API method",
"response_code": 405
}{
"msg": "Request rate limitation",
"response_code": 429
}{
"msg": "System error",
"response_code": 500
}Reports
Report List
Retrieves a paginated list of threat intelligence reports from ThreatBook Lab and open-source intelligence sources.
POST
/
v3
/
reports
/
list
Report List
curl --request POST \
--url https://api.threatbook.io/v3/reports/list \
--header 'Content-Type: application/json' \
--data '
{
"query": "<string>",
"threat_type_list": [
"<string>"
],
"severity_list": [
"<string>"
],
"category_list": [
"<string>"
],
"threat_actor_list": [
"<string>"
],
"target_region_list": [
"<string>"
],
"target_region_code": [
"<string>"
],
"target_industry_list": [
"<string>"
],
"target_org_list": [
"<string>"
],
"target_product_list": [
"<string>"
],
"industry_of_target_org": [
"<string>"
],
"hq_region_of_target_org": [
"<string>"
],
"has_iocs": true,
"has_cves": true,
"has_rules": true,
"published_from": "<string>",
"published_to": "<string>",
"from_tb_lab": true,
"limit": 123,
"cursor": "<string>"
}
'import requests
url = "https://api.threatbook.io/v3/reports/list"
payload = {
"query": "<string>",
"threat_type_list": ["<string>"],
"severity_list": ["<string>"],
"category_list": ["<string>"],
"threat_actor_list": ["<string>"],
"target_region_list": ["<string>"],
"target_region_code": ["<string>"],
"target_industry_list": ["<string>"],
"target_org_list": ["<string>"],
"target_product_list": ["<string>"],
"industry_of_target_org": ["<string>"],
"hq_region_of_target_org": ["<string>"],
"has_iocs": True,
"has_cves": True,
"has_rules": True,
"published_from": "<string>",
"published_to": "<string>",
"from_tb_lab": True,
"limit": 123,
"cursor": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
query: '<string>',
threat_type_list: ['<string>'],
severity_list: ['<string>'],
category_list: ['<string>'],
threat_actor_list: ['<string>'],
target_region_list: ['<string>'],
target_region_code: ['<string>'],
target_industry_list: ['<string>'],
target_org_list: ['<string>'],
target_product_list: ['<string>'],
industry_of_target_org: ['<string>'],
hq_region_of_target_org: ['<string>'],
has_iocs: true,
has_cves: true,
has_rules: true,
published_from: '<string>',
published_to: '<string>',
from_tb_lab: true,
limit: 123,
cursor: '<string>'
})
};
fetch('https://api.threatbook.io/v3/reports/list', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.threatbook.io/v3/reports/list",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'query' => '<string>',
'threat_type_list' => [
'<string>'
],
'severity_list' => [
'<string>'
],
'category_list' => [
'<string>'
],
'threat_actor_list' => [
'<string>'
],
'target_region_list' => [
'<string>'
],
'target_region_code' => [
'<string>'
],
'target_industry_list' => [
'<string>'
],
'target_org_list' => [
'<string>'
],
'target_product_list' => [
'<string>'
],
'industry_of_target_org' => [
'<string>'
],
'hq_region_of_target_org' => [
'<string>'
],
'has_iocs' => true,
'has_cves' => true,
'has_rules' => true,
'published_from' => '<string>',
'published_to' => '<string>',
'from_tb_lab' => true,
'limit' => 123,
'cursor' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.threatbook.io/v3/reports/list"
payload := strings.NewReader("{\n \"query\": \"<string>\",\n \"threat_type_list\": [\n \"<string>\"\n ],\n \"severity_list\": [\n \"<string>\"\n ],\n \"category_list\": [\n \"<string>\"\n ],\n \"threat_actor_list\": [\n \"<string>\"\n ],\n \"target_region_list\": [\n \"<string>\"\n ],\n \"target_region_code\": [\n \"<string>\"\n ],\n \"target_industry_list\": [\n \"<string>\"\n ],\n \"target_org_list\": [\n \"<string>\"\n ],\n \"target_product_list\": [\n \"<string>\"\n ],\n \"industry_of_target_org\": [\n \"<string>\"\n ],\n \"hq_region_of_target_org\": [\n \"<string>\"\n ],\n \"has_iocs\": true,\n \"has_cves\": true,\n \"has_rules\": true,\n \"published_from\": \"<string>\",\n \"published_to\": \"<string>\",\n \"from_tb_lab\": true,\n \"limit\": 123,\n \"cursor\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.threatbook.io/v3/reports/list")
.header("Content-Type", "application/json")
.body("{\n \"query\": \"<string>\",\n \"threat_type_list\": [\n \"<string>\"\n ],\n \"severity_list\": [\n \"<string>\"\n ],\n \"category_list\": [\n \"<string>\"\n ],\n \"threat_actor_list\": [\n \"<string>\"\n ],\n \"target_region_list\": [\n \"<string>\"\n ],\n \"target_region_code\": [\n \"<string>\"\n ],\n \"target_industry_list\": [\n \"<string>\"\n ],\n \"target_org_list\": [\n \"<string>\"\n ],\n \"target_product_list\": [\n \"<string>\"\n ],\n \"industry_of_target_org\": [\n \"<string>\"\n ],\n \"hq_region_of_target_org\": [\n \"<string>\"\n ],\n \"has_iocs\": true,\n \"has_cves\": true,\n \"has_rules\": true,\n \"published_from\": \"<string>\",\n \"published_to\": \"<string>\",\n \"from_tb_lab\": true,\n \"limit\": 123,\n \"cursor\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.threatbook.io/v3/reports/list")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"query\": \"<string>\",\n \"threat_type_list\": [\n \"<string>\"\n ],\n \"severity_list\": [\n \"<string>\"\n ],\n \"category_list\": [\n \"<string>\"\n ],\n \"threat_actor_list\": [\n \"<string>\"\n ],\n \"target_region_list\": [\n \"<string>\"\n ],\n \"target_region_code\": [\n \"<string>\"\n ],\n \"target_industry_list\": [\n \"<string>\"\n ],\n \"target_org_list\": [\n \"<string>\"\n ],\n \"target_product_list\": [\n \"<string>\"\n ],\n \"industry_of_target_org\": [\n \"<string>\"\n ],\n \"hq_region_of_target_org\": [\n \"<string>\"\n ],\n \"has_iocs\": true,\n \"has_cves\": true,\n \"has_rules\": true,\n \"published_from\": \"<string>\",\n \"published_to\": \"<string>\",\n \"from_tb_lab\": true,\n \"limit\": 123,\n \"cursor\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"cursor": "d19ba003fbc998df0d299f2ff41607ad2ce6ecc2a573f5e0a152bedaa8ff2f591ef5329521d6e2ddbd5646a56918d3b33f652e36ab05bde0fd78000e27c7caccd3ecd8903b1914e4c2858f93ffe27a773ed388a338b65e40dcf0b7745e0df41a3ede6a33a561f100d522ce9a00af42103a728e2d0fbdbabced7ea70a4702640e83d03a2d48481e215d635c2292984be2bb6ecb35e5c5a1a7c08b4d8599a74d8efa0ee76153b83c8c985b7df1d6143c18b14a851faf7059a6ce448ecefd801911ff6433d234d4b21368d1297271eeab6bbcbb4b01608756b024779f600b33cd88c3bc08250a29c0125ff9d97f2f103a061b78d9282a080849262ce8718ae7b59f25f26a09213f1cee20110c82651b96341db0f09c0969896b6d9beb3bc7538812",
"total": 2753,
"limit": 20,
"items": [
{
"id": "303012",
"title": "Qilin Ransomware Targets Italian Automotive Leader Pieffe Auto Group",
"summary": "In 2025, the activities of the ransomware group Qilin significantly increased, launching a series of cyberattacks against enterprises and mid-sized organizations across multiple industries. Qilin employs a double extortion strategy, not only encrypting victims' data but also threatening to publicly disclose sensitive information to exert pressure, resulting in severe financial and reputational losses for businesses. The attack targets span various sectors, including automotive manufacturing, beverage production, medical devices, food industry, and legal services, demonstrating its broad attack range and increasingly sophisticated tactics. Victims include well-known companies such as Pieffe Auto Group in Italy, Asahi Group in Japan, Beta Dyne in the United States, and Volkswagen in France. Security experts recommend that affected organizations strengthen their cybersecurity defenses, including continuous monitoring, incident response plans, backup validation, and employee defense training, to mitigate the risk of future attacks. Qilin's attacks not only disrupt business operations but may also trigger a ripple effect on societal infrastructure, highlighting the urgency of cybersecurity protection.",
"source": "Open Source",
"published_time": "2025-11-25T00:00:00Z",
"event_time": "2025-09-17",
"severity": "Critical",
"organizations": [
"Volkswagen France",
"Echo Lake Foods, Inc."
],
"target_orgs": [
{
"org_name": "Volkswagen France",
"website": "volkswagen.fr",
"org_industry": [
"Automotive",
"Manufacturing"
],
"hq_region": [
"FR"
]
},
{
"org_name": "Echo Lake Foods, Inc.",
"website": "echolakefoods.com",
"org_industry": [
"Food & Beverage",
"Manufacturing"
],
"hq_region": [
"US"
]
}
],
"regions": [
"Netherlands",
"United States",
"Japan",
"UAE",
"Mexico",
"Italy",
"France"
],
"industries": [
"Healthcare",
"Manufacturing",
"Government"
],
"products": [],
"threat_type": [
"Ransomware"
],
"tags": [
"Qilin"
],
"cve_stats": 0,
"reference_link": [
"https://www.dexpose.io/free-darkweb-report/",
"https://www.dexpose.io/email-data-breach-scan/",
"https://cybernews.com/news/bmw-ransomware-attack-everest-claim-everest-luxury-target-jlr-trend/",
"https://cybernews.com/security/production-process-of-jaguar-land-rover-disrupted-by-cyberattack/",
"https://cybernews.com/security/jaguar-jlr-cyberattack-claimed-by-salesforce-hackers-scattered-spider-shiny-hunters/",
"https://cybernews.com/security/massive-salesforce-breach-campaign-started-on-github/",
"https://cybernews.com/news/marks-spencer-breach-tcs-third-party-vendor-social-engineering-attack/",
"https://cybernews.com/news/jaguar-land-rover-production-down-for-at-least-another-week-due-to-cyberattack/",
"https://cybernews.com/security/bridgestone-cyberattack-auto-manufacturer-disrupted-jaguar-link/",
"https://cybernews.com/ransomlooker/",
"https://cybernews.com/security/texas-electric-coops-ransomware-attack/",
"https://cybernews.com/news/asahi-beer-cyberattack-claimed-qilin-ransomware-stolen-data/",
"https://cybernews.com/news/cal-club-ransomware-attack-california-golf-club-san-franscico-qilin-claims/",
"https://cybernews.com/news/israel-shamir-medical-center-ransowmare-attack-qilin-8t-patient-data-stolen/",
"https://cybernews.com/news/nissan-ransomware-attack-creative-box-creative-box-radesign-studio-qilin-group/",
"https://cybernews.com/news/inotiv-ransomware-attack-qilin-pharma-research-testing-animal-cruelty-fines/",
"https://cybernews.com/security/singer-associates-ransomware-attack-qilin/",
"https://cybernews.com/news/sk-group-ransomware-attack-qilin-gang-claims-stolen-data/",
"https://cybernews.com/security/lee-enterprises-cyberattack-impact/",
"https://cybernews.com/news/houston-symphony-qilin-ransomware-attack/",
"https://cybernews.com/security/television-station-detroit-pbs-hacked/",
"https://cybernews.com/news/yanfeng-ransomware-attack-claimed-qilin/",
"https://cybernews.com/news/cancer-hospital-breach-is-claimed-by-qilin-gang-in-new-ransomware-low/",
"https://botcrawl.com/category/data-breaches/"
]
}
]
},
"response_code": 200,
"msg": "Success"
}This response has no body data.{
"msg": "Required:{resource/apikey}",
"response_code": 400
}{
"msg": "Invalid account status",
"response_code": 401
}{
"msg": "Invalid API method",
"response_code": 405
}{
"msg": "Request rate limitation",
"response_code": 429
}{
"msg": "System error",
"response_code": 500
}Query Parameters
Your API key. For details on how to obtain and manage your API key, please refer to the Authentication page.
Kindly note:
Please check if you have bound your access IP to the key and have the authority quotas to access this API before you interact with it.
Body
application/json
Keyword search parameter that matches across multiple indexed fields, including report title, summary, tags, IOCs, CVE identifiers and names, target products, target organizations, and other relevant attributes.
Specifies one or more threat event types to filter reports. Multiple values should be passed as a JSON array of strings (String[]).For the list of supported threat event types, please refer to the Threat Report Glossaries.
Note: This parameter is only applicable to reports belonging to the Incident Analysis category.
Specifies one or more severity levels to filter reports. Multiple values should be passed as a JSON array of strings (String[]). Supported levels include:
- critical
- high
- low
If not provided, reports of all severity levels will be returned.
Specifies one or more report content categories to filter results. Multiple values should be passed as a JSON array of strings (String[]). Supported categories include:
- Incident Analysis
- Malware Analysis
- Vulnerability Analysis
- Summary Report
- Security News
- Incident Response
Specifies one or more threat actors to filter reports. Multiple values should be passed as a JSON array of strings (String[]).
Example values include names of known threat groups such as Lazarus, APT41, etc.
Specifies one or more target countries to filter reports. Multiple values should be passed as a JSON array of strings (String[]).
Specifies one or more target countries to filter reports using ISO 3166-1 alpha-2 country codes (e.g., US, CN, GB). Multiple values should be passed as a JSON array of strings (String[]). For a full list of codes, refer to the ISO Online Browsing Platform.
Specifies one or more target industries to filter reports. Multiple values should be passed as a JSON array of strings (String[]). Industry names follow the STIX II industry taxonomy (e.g., financial-services, government, technology, etc.). For the list of supported industries, please refer to the Reports Glossaries.
Specifies one or more targeted organizations referenced in the reports. Multiple values should be passed as a JSON array of strings (String[]).
Specifies one or more targeted products referenced in the reports. Multiple values should be passed as a JSON array of strings (String[]). Examples include product names such as OpenSSH, Exchange Server.
Specifies one or more targeted organizations' industries to filter reports. Multiple values should be passed as a JSON array of strings (String[]). Industry names follow the STIX II industry taxonomy (e.g., financial-services, government, technology, etc.). For the list of supported industries, please refer to the Reports Glossaries.
Specifies one or more targeted organizations' headquarters regions using ISO 3166-1 alpha-2 country codes (e.g., US, CN, GB). Multiple values should be passed as a JSON array of strings (String[]). For a full list of codes, refer to the ISO Online Browsing Platform.
Indicates whether to return only reports that contain IOC information.
- true, only reports with IOC data will be returned.
- false or omitted, all reports will be included by default.
Indicates whether to return only reports that contain CVE information.
- true, only reports with CVE data will be returned.
- false or omitted, all reports will be included by default.
Indicates whether to return only reports that contain detection rules.
- true, only reports with detection rule data will be returned.
- false or omitted, all reports will be included by default.
Specifies the start of the report publication time range (inclusive).
Supports ISO8601 datetime format, e.g., 2024-09-01T00:00:00Z.
Specifies the end of the report publication time range (inclusive).
Supports ISO8601 datetime format, e.g., 2024-10-01T00:00:00Z.
Indicates whether to return only ThreatBook Lab exclusive reports.
- true, only ThreatBook Lab–originated reports will be returned.
- false or omitted, all reports (including open-source intelligence) will be included by default.
Specifies the number of records to return per page. The default value is 20, and the maximum allowed value is 100.
Specifies the pagination cursor used to retrieve the next page of results.
If omitted, the first page of results will be returned.
Response
Hide child attributes
Hide child attributes
Cursor value used to retrieve the next page of results.
If empty, it indicates that no additional data is available.
Total number of records that match the query filters.
Number of records returned in the current page.
Hide child attributes
Hide child attributes
Unique identifier of the report. Used to query report details.
Title of the threat intelligence report.
A summary describing the highlights of the report.
Indicates the origin of the report.
Values include ThreatBook Lab (exclusive content) or Open Source.
Publication time of the report in ISO8601 format.
Time of the associated incident or threat activity.
May be aggregated to day, month, or year depending on source data.
Severity level of the report (e.g., low, high, critical).
List of affected organizations referenced in the report.
Detailed list of targeted organizations containing rich entity attributes.
Hide child attributes
Hide child attributes
The name of the targeted organization.
The official website domain of the targeted organization.
List of industries the targeted organization belongs to based on STIX II taxonomy (e.g., financial-services, government, technology, etc.). For the list of supported industries, please refer to the Reports Glossaries.
List of headquarters regions or countries of the targeted organization using ISO 3166-1 alpha-2 country codes (e.g., US, CN, GB). For a full list of codes, refer to the ISO Online Browsing Platform.
List of affected regions or countries referenced in the report.
List of affected industries based on STIX II industry taxonomy. For the list of supported industries, please refer to the Reports Glossaries.
List of affected products referenced in the report.
One or more threat event types associated with the report.
Set of extracted intelligence tags associated with the report. Currently supported tag categories include:
- Threat Actors
- Malware Families
- Attack Tools
Total number of CVE identifiers referenced in the report.
One or more external source URLs related to the report.
Allowed value: "Success"