Threat intelligence reports
Batches of threat intelligence this master reports anonymously to the vendor (auto-banned high-risk IPs, upload scan hits and false positives, newly seen file fingerprints), one batch every 5 minutes; nothing is reported while intelligence sharing is off. Admin only.
intel-reportsProtectionAuthentication: Admin only1 endpointsList intelligence reports
GET
/api/v2/intel-reportsAuthentication: Admin only
Query parameters
| Field | Type | Required | Description |
|---|---|---|---|
| page | integer | — | Page number, starting from 1 |
| page_size | integer | — | Items per page |
| type | IntelReportType | — | Filter by type (ip / upload_hit / false_positive / sha256_report / samples); omit for all. |
Threat intelligence reports object
| Field | Type | Required | Description |
|---|---|---|---|
| created_at | string | — | Batch time. |
| error | string | — | Failure reason; empty on success. Consecutive failures keep only the latest. |
| id | integer | — | Record ID |
| items | integer | — | Number of items in the batch. |
| result | string | — | Result - ok delivered; failed not delivered (items stay queued for the next round). |
| type | IntelReportType | — | Intelligence type - risky IP / upload hit / false positive marked by an admin / newly seen file fingerprint / suspicious request samples. |