> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Metrics

> Roll up your monitoring — per-source and per-day counts, a 12-month trend, and the org-wide default cadence.

# Metrics

These endpoints summarize what your monitoring is catching — by source, by day, and over the year — so you can chart exposure and spot spikes.

\*\*Two different things get counted.\*\* The overview and monthly trend count \*\*result items\*\* — the individual leaked records found. Alert-hit statistics count \*\*matches\*\* — how many times a rule fired. A single match can carry many result items, so the two won't line up; pick the one that answers your question.

Three of the four take a `period`, one of `last_week`, `last_month`, `last_6_months`, `last_year`, or `all_time`. All are org-scoped.

#### Overview — by source and day

[`alert_system_statistic_get_alert_overview`](https://client-api.leak.center/scalar-docs/#tag/alert-system/GET/service/alert_system_statistic_get_alert_overview/) gives one row per service per day:

```bash theme={"dark"}
curl "https://client-api.leak.center/api/service/alert_system_statistic_get_alert_overview/?period=last_month" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

`period` is required; narrow to specific sources with `service_ids` (comma-separated); paginated. Each row is `{ service_name, date, count, excluded_count }` — `count` is result items found that day for that source, `excluded_count` how many of them an exclusion suppressed.

#### Monthly distribution — the year at a glance

[`alert_system_statistic_get_monthly_match_count`](https://client-api.leak.center/scalar-docs/#tag/alert-system/GET/service/alert_system_statistic_get_monthly_match_count/) returns a plain list of the **last 12 months** — no `period`, no pagination:

```bash theme={"dark"}
curl "https://client-api.leak.center/api/service/alert_system_statistic_get_monthly_match_count/" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

Each entry is `{ month, count, excluded_count }`, with `month` as `YYYY-MM`. Months with nothing return `count: 0`, so you always get 12 points to plot.

#### Alert-hit statistics — how often rules fire

[`alert_system_alert_get_alert_match_statistics`](https://client-api.leak.center/scalar-docs/#tag/alert-system/GET/service/alert_system_alert_get_alert_match_statistics/) counts **matches** per source per day:

```bash theme={"dark"}
curl "https://client-api.leak.center/api/service/alert_system_alert_get_alert_match_statistics/?period=all_time" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

`period` is required; filter sources with `services` (comma-separated — note the param is `services` here, not `service_ids`); add `show_excluded=true` to include all-excluded matches; paginated. Each row is `{ alert_hit_count, creation_date, service_id, service_name }`.

#### Your organization's default cadence

New rules created without a `frequency` inherit your org default. Read it with [`alert_system_setting_get_organization_alert_frequency`](https://client-api.leak.center/scalar-docs/#tag/alert-system/GET/service/alert_system_setting_get_organization_alert_frequency/) and change it with [`alert_system_setting_update_organization_alert_frequency`](https://client-api.leak.center/scalar-docs/#tag/alert-system/PUT/service/alert_system_setting_update_organization_alert_frequency/):

```bash theme={"dark"}
curl -X PUT "https://client-api.leak.center/api/service/alert_system_setting_update_organization_alert_frequency/" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" -H "Content-Type: application/json" \
  -d '{ "default_alert_frequency": "weekly" }'
```

`default_alert_frequency` takes the same six values as a rule's [frequency](https://github.com/kaduu-cti/darknetsearch-docs/blob/main/api/guides/monitoring-rules/README.md) (`daily`, `twice_weekly`, `weekly`, `biweekly`, `twice_monthly`, `monthly`) and defaults to `daily`. It's a floor for convenience, not an override: a rule still can't run faster than its source allows, so the effective cadence is the slower of this default and the source's own.