> For the complete documentation index, see [llms.txt](https://wapack-labs-llc.gitbook.io/redxray-plus-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wapack-labs-llc.gitbook.io/redxray-plus-guide/redxray/api/4.-threats-counts-company-id.md). # 4. /THREATS/COUNTS/{COMPANY ID} ### 4.1 GET /threats/counts/{company id} Aggregate threat counts seen within the last 24 hours. Returns the aggregate number of new threat counts seen for a single company within the last 24 hours. The counts are reported using the following categories: breach data, malware hits, malicious email hits, phishing hits, osint. Each category corresponds to a single elasticsearch index or a group of indices in the Red Sky Alliance CTI collection. breach data corresponds to the wl\_breach\_data index. malware hits groups the wl\_botnet\_tracker, wl\_sinkhole\_trafc, and wl\_keylogger\_data indices. Malicious email hits groups the wl\_malicious\_emails, wl\_malicious\_emails\_context, and wl\_malicious\_email\_detections indices. phishing hits corresponds to the wl\_threat\_recon index, and osint corresponds to the wl\_pastebin index. #### REQUEST - PATH PARAMETERS | Name | Type | Description | | ------------ | ------ | --------------------------------------------------------------------------------------------------------------- | | \*company id | string | ID of company to return threat count data for. Company IDs can be obtained using the `/companies/ids` endpoint. | #### RESPONSE MODEL - application/json *STATUS CODE - 200:* : *Returns a JSON object containing threat categories and the number of new threat indicators seen in each category within the last 24 hours. If this company has not had any new threats for a category within the time frame, the value will read \`"No hits within the last {time frame}."* | Name | Type | Description | | ---------------------- | ------- | ----------- | | threat\_counts | array | | | breach\_data | integer | | | company\_name | integer | | | malicious\_email\_hits | integer | | | malware\_hits | integer | | | osint | integer | | | phishing\_hits | integer | | *STATUS CODE - 401: Missing or invalid API token.* *STATUS CODE - 403: Account disabled, or user role prevents access to this resource.* *STATUS CODE - 500: Unexpected error.* ### 4.2 GET /threats/counts/{company id}/{time frame} Aggregate threat counts seen within the given time frame. Returns the aggregate number of new threat counts seen for a single company within the given time frame. The counts are reported using the following categories: breach data, malware hits, malicious email hits, phishing hits, osint. Each category corresponds to a single elasticsearch index or a group of indices in the Red Sky Alliance CTI collection. breach data corresponds to the wl\_breach\_data index. malware hits groups the wl\_botnet\_tracker, wl\_sinkhole\_trafc, and wl\_keylogger\_data indices. Malicious email hits groups the wl\_malicious\_emails, wl\_malicious\_emails\_context, and wl\_malicious\_email\_detections indices. phishing hits corresponds to the wl\_threat\_recon index, and osint corresponds to the wl\_pastebin index. #### REQUEST - PATH PARAMETERS | Name | Type | Description | | ------------ | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | \*company id | string | ID of company to update. Company IDs can be obtained using the `/companies/ids` endpoint. | | \*time frame | string | Valid options are: `last_24h`, `last_7d`, `last_30d`, `last_90d`, `ALL`. The reporting time frame used to calculate the threat counts. For example, if `last_24h` is used, Redxray will return the number of new threats that were seen within the last 24 hours for the company sepcifed by `{company id}`. If only a `{company id}` is supplied, the default `{time frame}` is `last_24h`. | #### RESPONSE - RESPONSE MODEL - application/json *STATUS CODE - 200:* : *Returns a JSON object containing threat categories and the number of new threat indicators seen in each category within the time frame. If this company has not had any new threats for a category within the time frame, the value will read `"No hits within the last {time frame}."`* | Name | Type | Description | | ---------------------- | ------- | ----------- | | threat\_counts | array | | | breach\_data | integer | | | company\_name | integer | | | malicious\_email\_hits | integer | | | malware\_hits | integer | | | osint | integer | | | phishing\_hits | integer | | *STATUS CODE - 401: Missing or invalid API token.* *STATUS CODE - 403: Account disabled, or user role prevents access to this resource.* *STATUS CODE - 500: Unexpected error.* | Name | Type | Description | | ------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | success | string | REDXRAY is now working in the background to enrich your company data. The new company will appear in your company list when enrichment is complete. Usually this only takes a few minutes but can take longer with companies with a large number of indicators. | | Name | Type | Description | | ---------------------- | ------- | ----------- | | threat\_counts | array | | | breach\_data | integer | | | company\_name | integer | | | malicious\_email\_hits | integer | | | malware\_hits | integer | | | osint | integer | | | phishing\_hits | integer | | *STATUS CODE - 401: Missing or invalid API token.* *STATUS CODE - 403: Account disabled, or user role prevents access to this resource.* *STATUS CODE - 500: Unexpected error.*