All four subcommands default to the trailing 3 months when you give no date range. Pass
--from and --to for an explicit window, or --this-week for the current ISO week.
metrics summary
Summary metrics for an organization over a date range.
metrics found
Count of newly found threats — the customer-facing “new threats” number. Same options as
metrics summary.
metrics breakdown
Threat counts grouped by an axis.
metrics organization
The documented GET /organization/metrics endpoint, including its multi-organization
rollup. Works with organization-scoped API keys (single org only), user API keys (multi-org
allowed, inheriting the user’s permissions), and session auth.
--include accepts reports, newThreats, threatsWatchlisted, takedownsFiled,
takedownsInProgress, takedownsCompleted, takedownsCancelled, domainThreats,
twitterThreats, telegramThreats, otherThreats, blockedByType, blockedByDay.
Fields you leave out come back as null, so narrowing --include is the cheapest way to
speed up a wide query.
takedownsInProgress and takedownsCancelled count takedowns currently in that status
whose updatedAt falls in the window (same windowing as takedownsFiled), so they
reconcile with the Takedowns list filtered by status over the same date range. If the API
you’re talking to doesn’t return a metric your CLI version knows about, the CLI skips
that row in the output.
A multi-organization response carries totals, per-day and per-organization-per-day
averages, and a per-organization breakdown.
metrics org is accepted as an alias for metrics organization.
