List Threat Actors - FalconFeeds

Endpoint

GET https://api.falconfeeds.io/merlin/threat/actor

Authentication

Authorization: Bearer <your-api-token>

Query Parameters

Parameter	Type	Required	Description
`next`	`string`	No	Cursor for the next page. Pass the `next` value from the previous response.
`uuid`	`string`	No	Retrieve a single threat actor by UUID.
`name`	`string`	No	Match threat actors by the beginning of their name (prefix match).

Request

curl --location 'https://api.falconfeeds.io/merlin/threat/actor' \
  --header 'Authorization: Bearer <your-api-token>'

Response

{
  "message": "string",
  "data": [
    {
      "uuid": "string",
      "name": "string",
      "description": "string",
      "category": ["string"],
      "alias": [
        {
          "uuid": "string",
          "name": "string"
        }
      ],
      "suspectedAlias": [
        {
          "uuid": "string",
          "name": "string"
        }
      ],
      "activeChannels": [
        {
          "network": "string",
          "link": "string"
        }
      ],
      "targets": [
        {
          "type": "string",
          "values": ["string"]
        }
      ],
      "lastActivityReportedAt": "number",
      "firstActivityReportedAt": "number",
      "meta": {
        "type": "string",
        "groupLeaders": [
          {
            "uuid": "string",
            "name": "string"
          }
        ],
        "groupMembers": [
          {
            "uuid": "string",
            "name": "string"
          }
        ]
      }
    }
  ],
  "next": "string"
}

string

Status message from the API.

array

Array of threat actor objects.

string

Unique identifier for the threat actor.

string

Name of the threat actor.

string

Description of the threat actor’s known activities.

array

Array of category classifications for the threat actor.

array

Confirmed aliases for this threat actor.

array

Suspected (unconfirmed) aliases for this threat actor.

array

Active communication channels (e.g., Telegram, dark web forums) used by the threat actor.

array

Known target types and values (e.g., industries, countries).

number

Unix timestamp (in milliseconds) of the most recently reported activity. Defaults to 0 when unavailable.

number

Unix timestamp (in milliseconds) of the earliest recorded activity. Defaults to 0 when unavailable.

object

Additional metadata including group structure (leaders and members).

string

Cursor to pass as next for the next page of results.

​Endpoint

​Authentication

​Query Parameters

​Request

​Response

Endpoint

Authentication

Query Parameters

Request

Response