curl --request POST \
--url https://api.wirespeed.co/v1/detection/metrics \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"size": 123,
"page": 123,
"filter": "<string>",
"search": "<string>",
"orderBy": "<string>",
"days": 123,
"startDate": "<string>",
"endDate": "<string>",
"caseIdOrSid": "<string>",
"statuses": [],
"assetId": "<string>",
"hideExcluded": true,
"onlyChatOps": true,
"onlyWasEscalated": true,
"onlyWasContained": true,
"hideDemoClients": true,
"exclusionId": "<string>",
"createdAt": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"groupIds": [
"<string>"
]
}
'import requests
url = "https://api.wirespeed.co/v1/detection/metrics"
payload = {
"size": 123,
"page": 123,
"filter": "<string>",
"search": "<string>",
"orderBy": "<string>",
"days": 123,
"startDate": "<string>",
"endDate": "<string>",
"caseIdOrSid": "<string>",
"statuses": [],
"assetId": "<string>",
"hideExcluded": True,
"onlyChatOps": True,
"onlyWasEscalated": True,
"onlyWasContained": True,
"hideDemoClients": True,
"exclusionId": "<string>",
"createdAt": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"groupIds": ["<string>"]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
size: 123,
page: 123,
filter: '<string>',
search: '<string>',
orderBy: '<string>',
days: 123,
startDate: '<string>',
endDate: '<string>',
caseIdOrSid: '<string>',
statuses: [],
assetId: '<string>',
hideExcluded: true,
onlyChatOps: true,
onlyWasEscalated: true,
onlyWasContained: true,
hideDemoClients: true,
exclusionId: '<string>',
createdAt: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
groupIds: ['<string>']
})
};
fetch('https://api.wirespeed.co/v1/detection/metrics', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.wirespeed.co/v1/detection/metrics",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'size' => 123,
'page' => 123,
'filter' => '<string>',
'search' => '<string>',
'orderBy' => '<string>',
'days' => 123,
'startDate' => '<string>',
'endDate' => '<string>',
'caseIdOrSid' => '<string>',
'statuses' => [
],
'assetId' => '<string>',
'hideExcluded' => true,
'onlyChatOps' => true,
'onlyWasEscalated' => true,
'onlyWasContained' => true,
'hideDemoClients' => true,
'exclusionId' => '<string>',
'createdAt' => [
'gt' => '<string>',
'gte' => '<string>',
'lt' => '<string>',
'lte' => '<string>'
],
'groupIds' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.wirespeed.co/v1/detection/metrics"
payload := strings.NewReader("{\n \"size\": 123,\n \"page\": 123,\n \"filter\": \"<string>\",\n \"search\": \"<string>\",\n \"orderBy\": \"<string>\",\n \"days\": 123,\n \"startDate\": \"<string>\",\n \"endDate\": \"<string>\",\n \"caseIdOrSid\": \"<string>\",\n \"statuses\": [],\n \"assetId\": \"<string>\",\n \"hideExcluded\": true,\n \"onlyChatOps\": true,\n \"onlyWasEscalated\": true,\n \"onlyWasContained\": true,\n \"hideDemoClients\": true,\n \"exclusionId\": \"<string>\",\n \"createdAt\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"groupIds\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.wirespeed.co/v1/detection/metrics")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"size\": 123,\n \"page\": 123,\n \"filter\": \"<string>\",\n \"search\": \"<string>\",\n \"orderBy\": \"<string>\",\n \"days\": 123,\n \"startDate\": \"<string>\",\n \"endDate\": \"<string>\",\n \"caseIdOrSid\": \"<string>\",\n \"statuses\": [],\n \"assetId\": \"<string>\",\n \"hideExcluded\": true,\n \"onlyChatOps\": true,\n \"onlyWasEscalated\": true,\n \"onlyWasContained\": true,\n \"hideDemoClients\": true,\n \"exclusionId\": \"<string>\",\n \"createdAt\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"groupIds\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.wirespeed.co/v1/detection/metrics")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"size\": 123,\n \"page\": 123,\n \"filter\": \"<string>\",\n \"search\": \"<string>\",\n \"orderBy\": \"<string>\",\n \"days\": 123,\n \"startDate\": \"<string>\",\n \"endDate\": \"<string>\",\n \"caseIdOrSid\": \"<string>\",\n \"statuses\": [],\n \"assetId\": \"<string>\",\n \"hideExcluded\": true,\n \"onlyChatOps\": true,\n \"onlyWasEscalated\": true,\n \"onlyWasContained\": true,\n \"hideDemoClients\": true,\n \"exclusionId\": \"<string>\",\n \"createdAt\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"groupIds\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"mttdSeconds": 123,
"mttvMilliseconds": 123
}{
"message": "<string>",
"statusCode": 123
}Average MTTD and MTTV across detections matching search filters
curl --request POST \
--url https://api.wirespeed.co/v1/detection/metrics \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"size": 123,
"page": 123,
"filter": "<string>",
"search": "<string>",
"orderBy": "<string>",
"days": 123,
"startDate": "<string>",
"endDate": "<string>",
"caseIdOrSid": "<string>",
"statuses": [],
"assetId": "<string>",
"hideExcluded": true,
"onlyChatOps": true,
"onlyWasEscalated": true,
"onlyWasContained": true,
"hideDemoClients": true,
"exclusionId": "<string>",
"createdAt": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"groupIds": [
"<string>"
]
}
'import requests
url = "https://api.wirespeed.co/v1/detection/metrics"
payload = {
"size": 123,
"page": 123,
"filter": "<string>",
"search": "<string>",
"orderBy": "<string>",
"days": 123,
"startDate": "<string>",
"endDate": "<string>",
"caseIdOrSid": "<string>",
"statuses": [],
"assetId": "<string>",
"hideExcluded": True,
"onlyChatOps": True,
"onlyWasEscalated": True,
"onlyWasContained": True,
"hideDemoClients": True,
"exclusionId": "<string>",
"createdAt": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"groupIds": ["<string>"]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
size: 123,
page: 123,
filter: '<string>',
search: '<string>',
orderBy: '<string>',
days: 123,
startDate: '<string>',
endDate: '<string>',
caseIdOrSid: '<string>',
statuses: [],
assetId: '<string>',
hideExcluded: true,
onlyChatOps: true,
onlyWasEscalated: true,
onlyWasContained: true,
hideDemoClients: true,
exclusionId: '<string>',
createdAt: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
groupIds: ['<string>']
})
};
fetch('https://api.wirespeed.co/v1/detection/metrics', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.wirespeed.co/v1/detection/metrics",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'size' => 123,
'page' => 123,
'filter' => '<string>',
'search' => '<string>',
'orderBy' => '<string>',
'days' => 123,
'startDate' => '<string>',
'endDate' => '<string>',
'caseIdOrSid' => '<string>',
'statuses' => [
],
'assetId' => '<string>',
'hideExcluded' => true,
'onlyChatOps' => true,
'onlyWasEscalated' => true,
'onlyWasContained' => true,
'hideDemoClients' => true,
'exclusionId' => '<string>',
'createdAt' => [
'gt' => '<string>',
'gte' => '<string>',
'lt' => '<string>',
'lte' => '<string>'
],
'groupIds' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.wirespeed.co/v1/detection/metrics"
payload := strings.NewReader("{\n \"size\": 123,\n \"page\": 123,\n \"filter\": \"<string>\",\n \"search\": \"<string>\",\n \"orderBy\": \"<string>\",\n \"days\": 123,\n \"startDate\": \"<string>\",\n \"endDate\": \"<string>\",\n \"caseIdOrSid\": \"<string>\",\n \"statuses\": [],\n \"assetId\": \"<string>\",\n \"hideExcluded\": true,\n \"onlyChatOps\": true,\n \"onlyWasEscalated\": true,\n \"onlyWasContained\": true,\n \"hideDemoClients\": true,\n \"exclusionId\": \"<string>\",\n \"createdAt\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"groupIds\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.wirespeed.co/v1/detection/metrics")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"size\": 123,\n \"page\": 123,\n \"filter\": \"<string>\",\n \"search\": \"<string>\",\n \"orderBy\": \"<string>\",\n \"days\": 123,\n \"startDate\": \"<string>\",\n \"endDate\": \"<string>\",\n \"caseIdOrSid\": \"<string>\",\n \"statuses\": [],\n \"assetId\": \"<string>\",\n \"hideExcluded\": true,\n \"onlyChatOps\": true,\n \"onlyWasEscalated\": true,\n \"onlyWasContained\": true,\n \"hideDemoClients\": true,\n \"exclusionId\": \"<string>\",\n \"createdAt\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"groupIds\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.wirespeed.co/v1/detection/metrics")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"size\": 123,\n \"page\": 123,\n \"filter\": \"<string>\",\n \"search\": \"<string>\",\n \"orderBy\": \"<string>\",\n \"days\": 123,\n \"startDate\": \"<string>\",\n \"endDate\": \"<string>\",\n \"caseIdOrSid\": \"<string>\",\n \"statuses\": [],\n \"assetId\": \"<string>\",\n \"hideExcluded\": true,\n \"onlyChatOps\": true,\n \"onlyWasEscalated\": true,\n \"onlyWasContained\": true,\n \"hideDemoClients\": true,\n \"exclusionId\": \"<string>\",\n \"createdAt\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"groupIds\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"mttdSeconds": 123,
"mttvMilliseconds": 123
}{
"message": "<string>",
"statusCode": 123
}Authorizations
Team API key sent as a Bearer token. Create a key in Wirespeed under Settings → Team. See https://docs.wirespeed.co/api-reference/authentication.
Body
asc, desc Number of days for time-based filtering (1-365). Used by stats/widget endpoints to set the time window.
Start date (inclusive, ISO8601 string)
End date (inclusive, ISO8601 string)
Filter by case ID or case SID
Filter detections by status
NEW, PROCESSING, ESCALATED, HUNTING, MONITORING, CHATOPS, CLOSED Filter detections by verdict
MALICIOUS, SUSPICIOUS, BENIGN Filter detections involving a specific asset
Filter detections by asset type involved
USER, PROCESS, USER_AGENT, FILE, ENDPOINT, LOCATION, IP, DOMAIN Hide detections that have been excluded
Only show detections that were escalated
Only show detections that were escalated
Only show detections that resulted in containment
Hide detections from demo client teams
Filter detections by category class
ENDPOINT, IDENTITY, CLOUD, EMAIL, NETWORK, DATA, POSTURE, OTHER Filter detections by specific category
OTHER__DIAGNOSTIC, OTHER__INFORMATIONAL_EVENT, OTHER__WARNING, OTHER__UNKNOWN, OTHER__DECEPTION, OTHER__DECEPTION__SIMULATION, OTHER__CUSTOM_DETECTION, CLOUD__INVOCATION, CLOUD__DISCOVERY, CLOUD__DATA_TRANSFER, CLOUD__PERSISTENCE, CLOUD__PUBLIC_BUCKET, ENDPOINT__DISCOVERY, ENDPOINT__EXECUTION, ENDPOINT__LIVE_OFF_THE_LAND, ENDPOINT__NUISANCE, ENDPOINT__MALWARE_DISCOVERY, ENDPOINT__MALWARE_EXECUTION, ENDPOINT__LATE_STAGE, ENDPOINT__PERSISTENCE, ENDPOINT__REMOTE_MANAGEMENT, ENDPOINT__LATERAL_MOVEMENT, ENDPOINT__IMPACT, ENDPOINT__EVASION, ENDPOINT__EXPLOITATION, ENDPOINT__SIMULATION, ENDPOINT__PLANNED_CHANGE, IDENTITY__LOGIN, IDENTITY__REJECTED_MFA, IDENTITY__DISCOVERY, IDENTITY__BRUTE_FORCE, IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE, IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE, IDENTITY__PERSISTENCE, IDENTITY__ACCOUNT_COMPROMISE, IDENTITY__OAUTH_GRANT, IDENTITY__SIMULATION, NETWORK__INBOUND_CONNECTION, NETWORK__OUTBOUND_CONNECTION, NETWORK__PHISHING, NETWORK__NOISY, NETWORK__DISCOVERY, EMAIL__PHISHING, EMAIL__PHISHING_REPORTED, EMAIL__EVASION, EMAIL__MALWARE, EMAIL__MALICIOUS_LINK, EMAIL__GRAYMAIL, EMAIL__SPAM, EMAIL__BUSINESS_EMAIL_COMPROMISE, EMAIL__MAILBOX_RULE, DATA__DATA_TRANSFER, DATA__DATA_SHARE, POSTURE__POSTURE, POSTURE__HEALTH Filter detections by exclusion rule ID
Filter detections by severity
INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL Filter detections by integration platform
acronis, admin-by-request, agger-labs, anthropic, aws, axonius, bitwarden, box, checkpoint-firewall, checkpoint-harmony, cisco-catalyst, cisco-duo, cisco-meraki, cisco-secure-access, cisco-umbrella, connectwise-psa, crowdstrike-falcon, cyberark, darktrace, dfir-iris, email, exium, fleet-dm, fortianalyzer, fortinet, freshservice, generic-json, generic-syslog, github, google-alert-center, google-chronicle, google-directory, google-security-center, halcyon, halo-itsm, have-i-been-pwned, horizon3, hyas-protect, ipinfo, jamf-pro, jamf-protect, jira-cloud, jira-data-center, jumpcloud, kandji, manage-engine-ad-audit-plus, microsoft, microsoft-entra, microsoft-teams, microsoft-teams-v2, mimecast, netskope, ninjaone, odoo-helpdesk, okta, one-password, onelogin, openai, orca-security, pager-duty, palo-alto-networks-cortex, perception-point, picus, ping-one, reversing-labs, safebreach, sandfly, sentinel-one, service-now, slack, sms, smtp, sonic-wall, sophos, splunk, stairwell, tenable-nessus, thinkst-canary, tracebit, unifi, vectra, watchguard-firebox, windows-event-logs, wirespeed, wiz, wordfence, zabbix, zscaler-zpa Filter by creation date
Show child attributes
Show child attributes
Filter detections by group IDs (OR) — matches detections whose users or endpoints belong to any of the specified groups

