## Threat intelligence reports (`intel-reports`)

Batches of threat intelligence this master reports anonymously to the vendor (auto-banned high-risk IPs, upload scan hits and false positives, newly seen file fingerprints), one batch every 5 minutes; nothing is reported while intelligence sharing is off. Admin only.

Authentication: Admin only · Docs: https://www-demo.kuxitong.com/en/docs/api/intel-reports

### GET `/api/v2/intel-reports`

List intelligence reports · Authentication: Admin only

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `page` | integer |  | Page number, starting from 1 Default: 1 |
| `page_size` | integer |  | Items per page Default: 20 |
| `type` | IntelReportType |  | Filter by type (ip / upload_hit / false_positive / sha256_report / samples); omit for all. Values: ["ip","upload_hit","false_positive","sha256_report","samples"] |

```sh
curl "https://panel.example.com/api/v2/intel-reports" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

Threat intelligence reports object:

| Field | Type | Required | Description |
|---|---|---|---|
| `created_at` | string |  | Batch time. |
| `error` | string |  | Failure reason; empty on success. Consecutive failures keep only the latest. |
| `id` | integer |  | Record ID |
| `items` | integer |  | Number of items in the batch. |
| `result` | string |  | Result - ok delivered; failed not delivered (items stay queued for the next round). Values: ["ok","failed"] |
| `type` | IntelReportType |  | Intelligence type - risky IP / upload hit / false positive marked by an admin / newly seen file fingerprint / suspicious request samples. Values: ["ip","upload_hit","false_positive","sha256_report","samples"] |