Get Actor Activity - BlinkOps Documentation

Retrieve data and statistics about the activity of a threat actor. Notes:

Enrichment allows access to actor data for 8 hours without consuming tokens.
Multiple accounts for an actor in the same source are returned in a single response.
Activity reports are returned without message content.
Maximum 1 request per second is allowed.

Response fields:

tokenCharged: If false, the request does not consume tokens.
tokensLeft: Shows the remaining token balance.

Parameters

Parameter	Description
Source	The source the actor is active in. Can be retrieved from the `active_sources` field of the `Get Actor Profile` action. Note: This parameter is not case-sensitive.
Threat Actor ID	The ID of the threat actor. Can be obtained by the `List Threat Actors` action.

Example Output

{
	"sourceData": [
		{
			"profileId": "String",
			"profileUrl": "String (URL)",
			"registrationDate": "Unix timestamps",
			"totalPosts": "Number",
			"firstPostDate": "Unix timestamps",
			"lastPostDate": "Unix timestamps",
			"handles": [
				{
					"value": "String",
					"postedDate": "Unix timestamps"
				}
			],
			"handlesTimeline": [
				{
					"value": "String",
					"dateRange": [
						{
							"start": "Unix timestamps",
							"end": "Unix timestamps"
						}
					]
				}
			],
			"profilePictures": [
				{
					"value": "String (URL)",
					"postedDate": "Unix timestamps"
				}
			],
			"signatures": [
				{
					"value": "string",
					"postedDate": "Unix timestamps"
				}
			],
			"groups": [
				{
					"value": "string",
					"totalMessages": "Number"
				}
			],
			"bio": [
				{
					"value": "string",
					"postedDate": "Unix timestamps"
				}
			],
			"telegramId": "String",
			"index": "string"
		}
	],
	"totalAuthorsFromSource": "Number",
	"tokenCharged": "Boolean",
	"tokensLeft": "Number"
}

Workflow Library Example

Get Actor Activity with Kela and Send Results Via Email

Preview this Workflow on desktop