Threat report

A threat report is a piece of threat intelligence the platform ingests from an external feed, then triages per Space to find behaviors worth a new detection.

Perpetual creates one threat report per source URL across the organization, with the article's title, summary, publication details, and enriched content. On ingest, Perpetual evaluates the report against the datasets and existing detections in every Space except the System space. A detectable behavior without coverage can open a content work item for a new detection, subject to each Space's weekly content-engineering quota. The report records the resulting work items, chats, completion state, and skipped Spaces, while ingestion fires the ThreatReportCreated webhook event.

Outputs

A threat report has no writable fields, so it has no Inputs table. The platform authors it from the threat intelligence feed, and the caller never creates or edits one. Every report is feed-ingested, so createdByUserId is always null. Every field below is returned by list and getById unless its row says otherwise, and the report's id is prefixed THR_.

Field	Type	Description
name	string	The report title, taken from the source article.
summary	string	A short AI-generated summary of the article.
content	string	The full report body. Holds the article text plus the feed's enrichments (extracted entities, MITRE ATT&CK mappings, indicators of compromise, and CVE details) as a JSON block.
publishedDate	timestamp	When the source article was published. Reports list newest-published first.
url	string	The source article URL. Unique per report within the organization.
author	string	The article author. Null when the feed does not supply one.
imageUrl	string	A featured image for the article. Null when the feed does not supply one.
triageComplete	boolean	Whether triage has produced at least one agent reply for the caller's readable Spaces. Computed on read, not stored.
triageQuotaSkippedSpaces	object	Map of Space ID to the reason triage was skipped for that Space. The only reason is QuotaExceeded. Empty when no Space was skipped.
contentWorkItems	array<object>	The content work items triage opened from this report. On list, each carries id, name, status, and assignedToUserId. On getById, the full work items.
chats	array<object>	The triage chats this report triggered, one per Space triaged. Returned by getById only.

Plus the common resource fields.

Related

• Detections, the content triage builds to cover a behavior a report describes.
• Chat, the record of a triage or content-engineering agent session a report triggers.
• Spaces, the scope triage runs against, one run per Space.
• Webhooks, whose ThreatReportCreated event fires an outbound request when a report is ingested.
• The Simba agent, which triages the report and drafts the detections.