Get Linked Indicators

Retrieve indicators linked to a specific threat.

To create risk breakdowns, use the summary parameter with the splitrisk parameter. This will split out indicator counts by risk level.

GET /api/threat.php

cURL

Get Links

curl "https://pulsedive.com/api/threat.php?tid=1&get=links"

200

{
  "updated_last_domain": "2025-09-03 11:44:52",
  "attributes": {
    "technology": {},
    "hosttype": {},
    "protocol": {},
    "port": {}
  },
  "properties": {},
  "feeds": [
    {
      "fid": 123,
      "organization": "<string>",
      "name": "<string>",
      "pricing": "free",
      "category": "malware",
      "indicators": {
        "total": 39,
        "low": 4,
        "none": 3,
        "high": 3,
        "medium": 16,
        "retired": 13
      }
    }
  ],
  "risk": {
    "unknown": 31,
    "low": 17,
    "medium": 20,
    "high": 5,
    "critical": 1,
    "retired": 874,
    "total": 1037,
    "none": 89
  }
}

Query Parameters

key · string

Your Pulsedive API key.

API key authentication is optional. However, requests without a key have stricter rate limits. We recommend including an API key for better performance and reliability.

tid · string · required

Unique identifier of the threat to retrieve.

Example:

"1"

get · enum<string> · required

Indicates which data subset to retrieve. Options include:

• links: Retrieves relationship data showing how the indicator connects to other objects.

Large result sets are automatically paginated. To learn how to handle paginated responses, visit Pagination.

Available options: links

summary · enum<integer>

Summarize the data in the response.

For summarized data, set to 1. For full results, set to 0.

Available options: 1, 0

Example:

1

splitrisk · enum<integer>

Split out indicator counts by risk level.

For risk breakdown, set to 1. For non-aggregated results, set to 0.

Available options: 1, 0

Example:

1

pretty · enum<integer> · default: 0

Indicates whether to format returned JSON results.

For pretty-printed output, set to 1. For compact output, set to 0.

Available options: 0, 1

Response

200

application/json

Successful request. Returns threat summary information in JSON format.

updated_last_domain · string<sql-date-time> | null

Timestamp when the threat's last domain was updated. 24-hour format, UTC time zone.

Pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$

Example:

"2025-09-03 11:44:52"

attributes · object

Indicator attributes with risk breakdowns.

Show child attributes

properties · object

Additional properties.

feeds · object[]

Feeds associated with this threat with risk breakdowns.

Show child attributes

risk · object

Count of indicators at each risk level for the threat.

Consists of key-value pairs, where each key matches an indicator risk level and its value contains the corresponding count.

Example:

{
  "unknown": 31,
  "low": 17,
  "medium": 20,
  "high": 5,
  "critical": 1,
  "retired": 874,
  "total": 1037,
  "none": 89
}