List IOC Threat Actors

Endpoint

GET https://api.falconfeeds.io/merlin/ioc/actor

Authentication

Authorization: Bearer <your-api-token>

Query Parameters

Parameter	Type	Required	Description
`sortBy`	`string`	Yes	Field to sort results by. See allowed values below.
`sortOrder`	`string`	Yes	Sort direction. See allowed values below.
`uuid`	`string`	No	Filter by a specific Threat Actor UUID.
`country`	`string`	No	Filter results by a specific country.
`name`	`string`	No	Match threat actors by the beginning of their name (prefix match).
`next`	`string`	No	Cursor for pagination. Pass the `next` value from the previous response.

Allowed Values - `sortBy`

lastSeen, malwareCount, iocCount

Allowed Values - `sortOrder`

asc, desc

Request

curl --location 'https://api.falconfeeds.io/merlin/ioc/actor?sortBy={string}&sortOrder={string}' \
  --header 'Authorization: Bearer <your-api-token>'

Response

{
  "message": "string",
  "data": [
    {
      "UUID": "string",
      "Name": "string",
      "Aliases": ["string"],
      "IOCCount": "number",
      "MalwareCount": "number",
      "FirstSeen": "number",
      "LastSeen": "number",
      "CreatedAt": "number",
      "UpdatedAt": "number",
      "Victims": [
        {
          "type": "string",
          "value": ["string"]
        }
      ],
      "Countries": ["string"]
    }
  ],
  "next": "string"
}

string

Status message from the API.

array

Array of IOC threat actor objects.

string

Unique identifier for the threat actor.

string

Name of the threat actor.

array

Known aliases for this threat actor.

number

Number of IOCs associated with this threat actor. Defaults to 0.

number

Number of malware families associated with this threat actor. Defaults to 0.

number

Unix timestamp (in milliseconds) of the earliest recorded activity. Defaults to 0 when unavailable.

number

Unix timestamp (in milliseconds) of the most recently recorded activity. Defaults to 0 when unavailable.

number

Unix timestamp (in milliseconds) when the record was created. Defaults to 0 when unavailable.

number

Unix timestamp (in milliseconds) when the record was last updated. Defaults to 0 when unavailable.

array

Victim entities targeted by this threat actor.

array

Countries associated with this threat actor’s operations.

string

Cursor to pass as next for the next page, or null if no more results.

​Endpoint

​Authentication

​Query Parameters

​Allowed Values - sortBy

​Allowed Values - sortOrder

​Request

​Response

Endpoint

Authentication

Query Parameters

Allowed Values - `sortBy`

Allowed Values - `sortOrder`

Request

Response