---
updatedAt: 2025-09-18T00:44:11.000Z
agentTools:
  projectIndex: https://docs.ic.armis.com/llms.txt
---

# Threat

# Threat

> 📘 Go straight to the [API reference](/reference/get_threat-search).

In the context of this API a "threat" refers to an actual threat to a device, such as (but not limited to): a DDoS attack,\
C\&C communication, suspicious host access, etc.

### Supported properties

| Property    | Meaning                                                                           | Example      |
| :---------- | :-------------------------------------------------------------------------------- | :----------- |
| `type`      | The type of the threat as defined by Armis                                        | `Tor Access` |
| `host`      | The host / IP address that participated in the threat                             | `61.3.74.12` |
| `direction` | The direction of the threat (e.g. Inbound for DDoS and Outbound for data-leakage) | `Inbound`    |

### Supported calculations

| Name              | Meaning                                                                                                  |
| :---------------- | :------------------------------------------------------------------------------------------------------- |
| `share`           | The ratio of the amount threats of the current grouping out of all threats matching the search criteria. |
| `distinctThreats` | The number of threats matching the search criteria and grouping.                                         |

## Related entities

The `threat` entity can be filtered not only by its own properties (described previously), but also by the properties of its\
related entities.

### Device

When filtering a CVE by its related devices, it means that we consider only CVEs that are affecting the\
matching devices.

> 📘 To learn more about the `device` entity, see the [documentation page](/docs/entities_device).

### CVE

When filtering a threat by its related CVEs, it means that we consider only threats that are utilizing the\
matching CVEs.

> 📘 To learn more about the `cve` entity, see the [documentation page](/docs/entities_cve).

## Explorer

You can play with the threat API directly in the [explorer page](https://ic.armis.com/manage/explorer?entity=threat) in the management console.

## Example use-cases

1. Which are the suspicious hosts that are communicating the most with mobile devices in the manufacturing industry? ([explore](https://ic.armis.com/manage/explorer?entity=threat\&qs=groupBy%3Dhost%26calculate%3Dshare%26type%5Beq%5D%3DSuspicious%20Host%26device.type%5Beq%5D%3DMobile%20Phones%26device.industry%5Beq%5D%3DManufacturing))

```curl Request
/api/v1/threat/_search?groupBy=host&calculate=share&type[eq]=Suspicious Host&device.type[eq]=Mobile Phones&device.industry[eq]=Manufacturing
```

```json Response
[
    {
        "host": "subsworker.bid",
        "share": 0.352
    },
    {
        "host": "msgr.com",
        "share": 0.1147
    },
    {
        "host": "208.100.26.245",
        "share": 0.0675
    },
    ...,
]
```

## Enums and lists

Some fields that are available for filtering and grouping the threat entity are populated with a closed list of possible values, as described next:

<details>
<summary><code>type</code>: The type of the threat as defined by Armis</summary>

<ul>
<li><code>C&C Communication</code></li>
<li><code>Malware Communication</code></li>
<li><code>Suspicious Host</code></li>
<li><code>Tor Access</code></li>
</ul>
</details>

<details>
<summary><code>direction</code>: The direction of the threat (e.g. Inbound for DDoS and Outbound for data-leakage)</summary>

<ul>
<li><code>Inbound</code></li>
<li><code>Outbound</code></li>
</ul>
</details>