Rank threat actors by risk to your primary organization using intent and opportunity scores.
What this endpoint does
Returns the threat actor threat map for the API token's primary organization, scoring each relevant actor by intent (targeting interest, 0–100) and opportunity (attack surface potential, 0–100). Filter by actor entity IDs (from Threat Actor Search), category entity IDs (from Threat Actor Categories), or watchlist IDs. An empty body returns the full map. For other organizations in a multi-org enterprise, use Threat Actor Threat Map (Org) with an orgId from Available Threat Maps.
Response data
Returns a prioritized assessment of which threat actors pose the greatest risk to your organization. Each actor carries intent and opportunity scores (0–100) — intent measures how likely the actor is to target organizations like yours based on observed targeting patterns, while opportunity measures how exposed your attack surface is to their known techniques and tools. Actors scoring high on both dimensions are your top priority. Log entries are the evidence trail behind each score: they link actors to your organization's watchlists (tech stack, methods, target sectors) through specific entities like CVEs, MITRE techniques, and malware tools. The axis field on each log entry tells you whether the evidence contributes to capability, intent, or opportunity scoring. The response can be very large (375KB+) when many actors match your watchlists — use the actor ID or category filters to scope down for targeted analysis.