Malware Threat Map for Organization

post

https://api.recordedfuture.com/threat/map/{orgId}/malware

Rank malware families by prevalence and opportunity scores for a specific organization.

What this endpoint does

Returns the malware threat map for a specific organization within a multi-organization enterprise. Identical to Malware Threat Map but requires an explicit orgId path parameter. Obtain valid org IDs from Available Threat Maps — use the organization.id field (uhash format). The url field from Available Threat Maps is the literal request path. Filter by malware entity IDs, category IDs, or watchlist IDs; empty body returns the full map.

Response data

Returns malware families ranked by prevalence and opportunity scores with watchlist-triggered log entries — same structure as the primary-org variant. The field is prevalence, not intent as the spec documents.

Path Params

orgId

string

required

The entity ID of the organization for which to fetch the threat map. The calling user must have access to this organization.

Body Params

Malware threat map filters

malware

array of strings

An array of malware entity IDs. If used, the API response will be limited to only those malware whose entity IDs match those found in the array. To lookup a malware entity ID, use the Entity Match API.

malware

What this endpoint does

Response data

200OK