Report

Use this endpoint to generate reports for sandbox submissions, rule matches, threat models, and other ThreatStream resources.

Request

/api/v1/alfred/report/

Method

HTTP Method: GET

Request

Generate a PDF report for a specified resource

GET /api/v1/alfred/report/?resource_name=<resource_name>&resource_id=<resource_id>&sync=false where resource_name is the type of resource for which the report is requested. resource_id is the ID of the specified resource. Possible resource_name values include: sandbox, rulematch, dashboard, eula, actor, attackpattern, campaign, incident, malware, signature, tipreport, ttp, and vulnerability.

Response

A response to a report request includes the following parameters, each providing a URL to view or export the requested report:

• printableUrl—Opens the report in a web browser for on-screen viewing.

• callbackUrl—Triggers the export of the report in PDF format.

Examples

• Below is the response to the request for generating a report for the sandbox submission with ID 1372328.

  Copy

  {
      "id": 406721,
      "dateRequested": "2025-08-06T21:24:50.557Z",
      "params": {
          "api_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
          "username": "example@anomali.com"
      },
      "sync": false,
      "printableUrl": "https://ui.threatstream.com/sandbox/report/1372328/printable",
      "callbackUrl": "https://optic.threatstream.com/api/v1/alfred/async/407262/",
      "updatedAt": "2025-08-06T21:24:50.562Z",
      "createdAt": "2025-08-06T21:24:50.557Z",
      "dateCompleted": null,
      "ClientAppId": 1,
      "async_report": 407262,
      "success": true
  }

  To view the report in a browser, click the URL specified in the printableUrl parameter of the response.

  To download the sandbox report in PDF format:

  1. Click the URL specified in the callbackUrl parameter. You will be redirected to the report code page.

  2. (Optionally) Select Pretty-print.

  3. Copy the URL specified in the signed_s3_url parameter and paste it in your browser.

     Copy

     {
       "created_ts": "2025-08-06T21:24:50.526135",
       "id": 407262,
       "modified_ts": "2025-08-06T21:25:13.378704",
       "printable": "https://ui.threatstream.com/sandbox/report/1372328/printable",
       "r_id": 1372328,
       "report_type": "sandbox",
       "resource_uri": "",
       "s3_url": "https://ts-optic.s3.amazonaws.com/userUploads/2025-08-06/20250806_212513_userId-50205_407262-sandbox.pdf",
       "signed_s3_url": "https://ts-optic.s3.amazonaws.com/userUploads/2025-08-06/20250806_212513_userId-50205_407262-sandbox.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAQFAWH2VRI3NC33OB%2F20250806%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250806T213619Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=a9f56ef87638e3c55ae8de6b67bfc661a7da9caeb03d71926be88aadaec361e0",
       "succeed": true
     }

     Note: The s3_url and signed_s3_url fields are included in the response only if "succeed": true .
     If "succeed": null, the report generation is still in progress.
     If "succeed": false, the report generation has failed.

  4. Click Enter on your keyboard.

     The download starts immediately.

• Below is the response to the request for generating a report for the Actor with ID 775054.

  Copy

  {
      "id": 406720,
      "dateRequested": "2025-08-06T20:37:31.851Z",
      "params": {
          "api_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
          "username": "example@anomali.com"
      },
      "sync": false,
      "printableUrl": "https://ui.threatstream.com/printable/actor/775054",
      "callbackUrl": "https://optic.threatstream.com/api/v1/alfred/async/407261/",
      "updatedAt": "2025-08-06T20:37:31.868Z",
      "createdAt": "2025-08-06T20:37:31.851Z",
      "dateCompleted": null,
      "ClientAppId": 1,
      "async_report": 407261,
      "success": true
  }

  To view the report in a browser, click the URL specified in the printableUrl parameter of the response.

  To download the report in PDF format:

  1. Click the URL specified in the callbackUrl parameter. You will be redirected to the report code page.

  2. (Optionally) Select Pretty-print.

  3. Copy the URL specified in the signed_s3_url parameter and paste it in your browser.

     Copy

     {
       "created_ts": "2025-08-06T20:37:31.820552",
       "id": 407261,
       "modified_ts": "2025-08-06T20:37:43.874156",
       "printable": "https://ui.threatstream.com/printable/actor/775054",
       "r_id": 775054,
       "report_type": "actor",
       "resource_uri": "",
       "s3_url": "https://ts-optic.s3.amazonaws.com/userUploads/2025-08-06/20250806_203743_userId-50205_407261-actor.pdf",
       "signed_s3_url": "https://ts-optic.s3.amazonaws.com/userUploads/2025-08-06/20250806_203743_userId-50205_407261-actor.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAQFAWH2VRI3NC33OB%2F20250806%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250806T205502Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=baa7d85c621812fd0e1b968a8886cd81ee5f0c27844e65bed68e023449e700a4",
       "succeed": true
     }

     Note: The s3_url and signed_s3_url fields are included in the response only if "succeed": true .
     If "succeed": null, the report generation is still in progress.
     If "succeed": false, the report generation has failed.

  4. Click Enter on your keyboard.

     The download starts immediately.