Skip to main content
Assessment endpoints turn resolved subject context and evidence into deterministic decision support.

​
Assessment Endpoints

  • /v2/threat-assessments
  • /v2/cve-assessments
  • /v2/actor-assessments
  • /v2/environment-assessments
  • /v2/ioc-assessments

​
Response Envelope

Assessment endpoints return: Batch assessment responses use the standard batch envelope described in Batch responses.

​
What to Preserve

  • assessment result or verdict
  • score and confidence fields
  • rationale fields
  • evidence references
  • caveats
  • trace_id
  • request correlation fields

​
IOC Assessments

/v2/ioc-assessments focuses on the submitted IOC and returns deterministic disposition, confidence, caveats, and recommended actions for that observable. It does not include event-correlated IOC expansion inline. When an agent needs related indicators, call /v2/relationships for the same IOC subject with relationship_types: ["ioc"]. This keeps assessment responses fast and separates verdict generation from pivot expansion.

​
Subject and Query Modes

For evidence, relationships, and assessments, provide exactly one of subject or query. Prefer subject after successful resolution. Use query for exact IOC strings, especially URLs or observables where canonicalization could lose important detail.

​
Reporting Guidance

Do not output a decisive remediation recommendation without evidence IDs or report references. Separate facts from inference.