s1_threats
List and filter threats to drill down into incidents, returning threat name, classification, confidence, verdict, status, mitigation, file path/hash, affected machine and site, newest first.
Instructions
List threats/detections with filters — the drill-down tool for incidents. Returns each threat's name, classification, confidence level (malicious/suspicious), analyst verdict, incident status, mitigation status and actions, detection engine, file path/hash, affected machine and site, sorted newest first. Returns a compact summary per threat by default; set full_details=true for complete raw records. Use s1_threat_summary for aggregated counts across the estate.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ids | No | Comma-separated threat IDs to fetch specific threats | |
| limit | No | Max records per response (default 25, max 1000). | |
| cursor | No | Pagination cursor: pass the nextCursor from the previous response to get the next page. | |
| site_ids | No | Comma-separated site IDs to scope to | |
| full_details | No | Return complete raw threat records instead of the compact summary. Default false. | |
| computer_name | No | Filter to threats on machines whose name contains this text | |
| created_after | No | Only threats detected after this ISO 8601 datetime, e.g. "2026-07-01T00:00:00Z" | |
| content_hashes | No | Comma-separated SHA1 hashes to search for | |
| created_before | No | Only threats detected before this ISO 8601 datetime | |
| classifications | No | Comma-separated threat classifications, e.g. "Malware,Ransomware,PUA,Trojan" | |
| analyst_verdicts | No | Comma-separated: "undefined", "true_positive", "false_positive", "suspicious" | |
| confidence_levels | No | Comma-separated: "malicious", "suspicious", "n/a" | |
| incident_statuses | No | Comma-separated: "unresolved", "in_progress", "resolved". Use "unresolved,in_progress" for open incidents. | |
| mitigation_statuses | No | Comma-separated: "not_mitigated", "mitigated", "marked_as_benign" |