Skip to main content
All four subcommands default to the trailing 3 months when you give no date range. Pass --from and --to for an explicit window, or --this-week for the current ISO week.

metrics summary

Summary metrics for an organization over a date range.

metrics found

Count of newly found threats — the customer-facing “new threats” number. Same options as metrics summary.

metrics breakdown

Threat counts grouped by an axis.

metrics organization

The documented GET /organization/metrics endpoint, including its multi-organization rollup. Works with organization-scoped API keys (single org only), user API keys (multi-org allowed, inheriting the user’s permissions), and session auth.
--include accepts reports, newThreats, threatsWatchlisted, takedownsFiled, takedownsCompleted, domainThreats, twitterThreats, telegramThreats, otherThreats, blockedByType, blockedByDay. Fields you leave out come back as null, so narrowing --include is the cheapest way to speed up a wide query. A multi-organization response carries totals, per-day and per-organization-per-day averages, and a per-organization breakdown.
metrics org is accepted as an alias for metrics organization.