Skip to main content
Retrieve data and statistics about the activity of a threat actor. Notes:
  • Enrichment allows access to actor data for 8 hours without consuming tokens.
  • Multiple accounts for an actor in the same source are returned in a single response.
  • Activity reports are returned without message content.
  • Maximum 1 request per second is allowed.
Response fields:
  • tokenCharged: If false, the request does not consume tokens.
  • tokensLeft: Shows the remaining token balance.

​
Parameters

ParameterDescription
SourceThe source the actor is active in. Can be retrieved from the active_sources field of the Get Actor Profile action.

Note: This parameter is not case-sensitive.
Threat Actor IDThe ID of the threat actor. Can be obtained by the List Threat Actors action.

​
Example Output

{
	"sourceData": [
		{
			"profileId": "String",
			"profileUrl": "String (URL)",
			"registrationDate": "Unix timestamps",
			"totalPosts": "Number",
			"firstPostDate": "Unix timestamps",
			"lastPostDate": "Unix timestamps",
			"handles": [
				{
					"value": "String",
					"postedDate": "Unix timestamps"
				}
			],
			"handlesTimeline": [
				{
					"value": "String",
					"dateRange": [
						{
							"start": "Unix timestamps",
							"end": "Unix timestamps"
						}
					]
				}
			],
			"profilePictures": [
				{
					"value": "String (URL)",
					"postedDate": "Unix timestamps"
				}
			],
			"signatures": [
				{
					"value": "string",
					"postedDate": "Unix timestamps"
				}
			],
			"groups": [
				{
					"value": "string",
					"totalMessages": "Number"
				}
			],
			"bio": [
				{
					"value": "string",
					"postedDate": "Unix timestamps"
				}
			],
			"telegramId": "String",
			"index": "string"
		}
	],
	"totalAuthorsFromSource": "Number",
	"tokenCharged": "Boolean",
	"tokensLeft": "Number"
}

​
Workflow Library Example

Get Actor Activity with Kela and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop