All four subcommands default to the trailing 3 months when you give no date range. Pass
--from and --to for an explicit window, or --this-week for the current ISO week.
metrics summary
Summary metrics for an organization over a date range.
metrics found
Count of newly found threats — the customer-facing “new threats” number. Same options as
metrics summary.
metrics breakdown
Threat counts grouped by an axis.
metrics organization
The documented GET /organization/metrics endpoint, including its multi-organization
rollup. Works with organization-scoped API keys (single org only), user API keys (multi-org
allowed, inheriting the user’s permissions), and session auth.
--include accepts reports, newThreats, threatsWatchlisted, takedownsFiled,
takedownsCompleted, domainThreats, twitterThreats, telegramThreats, otherThreats,
blockedByType, blockedByDay. Fields you leave out come back as null, so narrowing
--include is the cheapest way to speed up a wide query.
A multi-organization response carries totals, per-day and per-organization-per-day
averages, and a per-organization breakdown.
metrics org is accepted as an alias for metrics organization.