> ## Documentation Index
> Fetch the complete documentation index at: https://chainpatrol.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# metrics command — query organization metrics

> Query ChainPatrol organization metrics from the CLI: summary counts, newly found threats, breakdowns by day, type, or brand, time to takedown, time to detection, and multi-organization rollups.

```bash theme={null}
chainpatrol metrics <summary|found|breakdown|takedown-time|takedown-time-trend|time-to-detection|organization>
```

Every subcommand except `takedown-time-trend` defaults to the trailing 3 months when you
give no date range. Pass `--from` and `--to` for an explicit window, or `--this-week` for
the current ISO week. A date-only `--to` covers the whole day.

## metrics summary

Summary metrics for an organization over a date range.

```bash theme={null}
chainpatrol metrics summary --org <slug> [--from ISO --to ISO|--this-week]
```

| Option | Description |
| - | - |
| `--org <slug>` | Organization slug. |
| `--from <iso>` / `--to <iso>` | Date range (ISO 8601). |
| `--this-week` | Use the current ISO week. |
| `--brand <ids>` | Comma-separated brand IDs. |

```bash theme={null}
chainpatrol metrics summary --org acme --this-week
chainpatrol metrics summary --org acme --from 2026-01-01 --to 2026-01-08
```

## metrics found

Count of newly found threats — the customer-facing "new threats" number. Same options as
`metrics summary`.

```bash theme={null}
chainpatrol metrics found --org acme --this-week
chainpatrol --json metrics found --org acme --from 2026-01-01 --to 2026-02-01
```

## metrics breakdown

Threat counts grouped by an axis.

```bash theme={null}
chainpatrol metrics breakdown --org <slug> --by <day|type|brand> [--from ISO --to ISO|--this-week]
```

| Option | Description |
| - | - |
| `--org <slug>` | Organization slug. |
| `--by <axis>` | `day`, `type`, or `brand`. Required. |
| `--from <iso>` / `--to <iso>` | Date range. |
| `--this-week` | Use the current ISO week. |
| `--brand <ids>` | Comma-separated brand IDs. |

```bash theme={null}
chainpatrol metrics breakdown --org acme --by day --this-week
chainpatrol metrics breakdown --org acme --by type --from 2026-01-01 --to 2026-01-08
chainpatrol metrics breakdown --org acme --by brand --output csv
```

## metrics takedown-time

Median time from takedown start to completion: one overall median across every takedown in
scope, plus one per asset type.

```bash theme={null}
chainpatrol metrics takedown-time --org <slug> [--from ISO --to ISO|--this-week] [--asset-type <types>] [--asset-group <groups>]
```

| Option | Description |
| - | - |
| `--org <slug>` | Organization slug. |
| `--from <iso>` / `--to <iso>` | Date range (ISO 8601). |
| `--this-week` | Use the current ISO week. |
| `--brand <ids>` | Comma-separated brand IDs. |
| `--asset-type <types>` | Comma-separated asset types to include, for example `URL,TWITTER`. |
| `--asset-group <groups>` | Comma-separated asset-type groups to include: `DOMAINS`, `SOCIALS`, `APP_STORES`, `ADS`, `EXTENSIONS`, `CRYPTO`, `EMAIL`, `PACKAGES`, `OTHER`. Combined with `--asset-type`. |

Crypto addresses (`ADDRESS`) are left out unless you ask for them with
`--asset-type ADDRESS` or `--asset-group CRYPTO`. An address is reported on many sites at
once, so its takedown time would skew the median for domains and socials.

```bash theme={null}
chainpatrol metrics takedown-time --org acme --from 2026-01-01 --to 2026-02-01
chainpatrol metrics takedown-time --org acme --asset-group DOMAINS
chainpatrol metrics takedown-time --org acme --asset-group SOCIALS --asset-type EMAIL
```

## metrics takedown-time-trend

Median time from takedown start to completion for each month over a trailing window, with
the change from the month before.

```bash theme={null}
chainpatrol metrics takedown-time-trend --org <slug> [--months <n>] [--asset-type <types>]
```

| Option | Description |
| - | - |
| `--org <slug>` | Organization slug. |
| `--months <n>` | Size of the window in whole months, including the current month. 2 to 36, default 12. |
| `--asset-type <types>` | Comma-separated asset types, up to 5. You get one series per type; leave it out for a single series across all types. |
| `--brand <ids>` | Comma-separated brand IDs. |

As with `takedown-time`, crypto addresses are left out unless you pass `--asset-type ADDRESS`.

```bash theme={null}
chainpatrol metrics takedown-time-trend --org acme
chainpatrol metrics takedown-time-trend --org acme --months 6 --asset-type URL,TWITTER
```

## metrics time-to-detection

How long threats were already live before ChainPatrol's first automated detection, per asset
type. It covers assets your organization blocked in the date range that are still blocked.
The clock runs from when the asset was first seen live to its earliest automated detection;
a report from a person doesn't stop it. Each number is a minimum and comes with how many
blocked assets it measures.

```bash theme={null}
chainpatrol metrics time-to-detection --org <slug> [--from ISO --to ISO|--this-week]
```

| Option | Description |
| - | - |
| `--org <slug>` | Organization slug. |
| `--from <iso>` / `--to <iso>` | Date range (ISO 8601). |
| `--this-week` | Use the current ISO week. |
| `--brand <ids>` | Comma-separated brand IDs. |

```bash theme={null}
chainpatrol metrics time-to-detection --org acme --from 2026-01-01 --to 2026-02-01
```

## metrics organization

The documented `GET /organization/metrics` endpoint, including its multi-organization
rollup. Works with organization-scoped API keys (single org only), user API keys (multi-org
allowed, inheriting the user's permissions), and session auth.

```bash theme={null}
chainpatrol metrics organization [--org <slug>|--slugs <list>|--all-my-orgs] [--from ISO --to ISO|--this-week] [--include <list>]
```

| Option | Description |
| - | - |
| `--org <slug>` | A single organization. Mutually exclusive with `--slugs` and `--all-my-orgs`. |
| `--slugs <list>` | Comma list of organization slugs, capped at 500. The response is the rollup across them. |
| `--all-my-orgs` | Every organization you can see. Organization-scoped API keys are rejected. Capped at 500. |
| `--subscription-status <list>` | With `--all-my-orgs`: any of `ACTIVE`, `POC`, `PROSPECT`, `INTEGRATION`, `PROTECTION`, `INACTIVE`. Defaults to every status except `INACTIVE`; pass `INACTIVE` to include churned organizations. |
| `--service-active <list>` | With `--all-my-orgs`: only organizations with the listed services active — `reporting`, `reviewing`, `protection`, `takedowns`, `detection`, `darkWebMonitoring`. |
| `--brand-slug <slug>` | Filter by brand slug. Single organization only. |
| `--from <iso>` / `--to <iso>` | Date range. |
| `--this-week` | Use the current ISO week. |
| `--include <list>` | Fields to compute. Omit for all. |

`--include` accepts `reports`, `newThreats`, `threatsWatchlisted`, `takedownsFiled`,
`takedownsCompleted`, `domainThreats`, `twitterThreats`, `telegramThreats`, `otherThreats`,
`blockedByType`, `blockedByDay`. Fields you leave out come back as `null`, so narrowing
`--include` is the cheapest way to speed up a wide query.

A multi-organization response carries totals, per-day and per-organization-per-day
averages, and a per-organization breakdown.

```bash theme={null}
# defaults to the last 3 months
chainpatrol metrics organization --org acme

# just the takedown numbers
chainpatrol metrics organization --org acme --include takedownsFiled,takedownsCompleted

# a rollup across three named orgs
chainpatrol metrics organization --slugs acme,beta,gamma \
  --include takedownsCompleted --from 2026-05-12 --to 2026-05-19

# a cross-customer total in one call
chainpatrol metrics organization --all-my-orgs \
  --service-active takedowns --subscription-status ACTIVE \
  --include takedownsCompleted --from 2026-05-12 --to 2026-05-19

# with an API key
CHAINPATROL_API_KEY=... chainpatrol metrics organization --json --include reports
```

> [!NOTE]
>
> `metrics org` is accepted as an alias for `metrics organization`.

## Related

* [`GET /organization/metrics`](https://chainpatrol.com/docs/external-api/organization-metrics)
* [`POST /metrics/takedown-time`](https://chainpatrol.com/docs/external-api/metrics-takedown-time)
* [`POST /metrics/takedown-time/trend`](https://chainpatrol.com/docs/external-api/metrics-takedown-time-trend)
* [`POST /metrics/time-to-detection`](https://chainpatrol.com/docs/external-api/metrics-time-to-detection)
* [Metrics concept](https://chainpatrol.com/docs/concepts/metrics.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.