Active threat analytics and risk spotter APIs