Threat Intelligenceas Code
Two APIs for two jobs. The Intelligence API provides context-rich intelligence. The IOC API provides lean, active indicators. Both are available over MCP, REST and TAXII.
API access starts with Team. Both the Intelligence API and IOC API are available via MCP, REST and TAXII. Free and Professional are web-only.
$199/month · 10 seats
Intelligence API and IOC API, both via MCP, REST and TAXII · OpenCTI connector · 30-day history · self-serve.
30-day API history included.
Two APIs. Two jobs.
The Intelligence API gives analysts context. The IOC API gives machines indicators. Both are STIX 2.1 native and available via MCP, REST and TAXII.
Threat Landscape Intelligence API
Context-rich threat intelligence for analysis, enrichment and decision-making. Query across the complete STIX 2.1 object graph: threat actors, malware families, campaigns, victims, target sectors, CVEs, TTPs, relationships, and more. Available via MCP, REST and TAXII for analysts and the platforms they use.
- Threat actors, groups & campaigns
- Malware families & tooling
- Victims & target sectors
- CVEs & vulnerability intelligence
- MITRE ATT&CK TTPs
- Reports & intelligence products
- Relationships & object graph
- Full source provenance
- Advanced array filtering & time ranges
- Historical data within your plan window
{
"type": "bundle",
"objects": [
{
"type": "threat-actor",
"name": "FIN99",
"aliases": ["SilverFox"],
"primary_motivation": "financial-gain",
"sectors": ["financial-services", "retail"],
"external_references": [{ ... }]
},
{
"type": "campaign",
"name": "Operation CloudHook"
},
{ "type": "relationship", ... }
]
}Threat Landscape IOC API
Lean, fast, and purpose-built for automated indicator ingestion. It delivers only STIX indicator objects, IPv4 addresses, domains, URLs, and file hashes, optimized for direct pipeline consumption. Pipe fresh, high-fidelity IOCs straight into your SIEM, EDR, firewall, or blocklist without wading through the rich contextual objects you don't need.
- IPv4 & IPv6 addresses
- Domains & subdomains
- URLs & URI patterns
- File hashes (MD5, SHA-1, SHA-256)
- Lean payload — indicators only
- Optimized for automated ingestion
{
"type": "indicator",
"spec_version": "2.1",
"pattern": "[domain-name:value = 'evil.example.com']",
"valid_from": "2026-04-01T00:00:00Z",
"valid_until": "2026-07-01T00:00:00Z",
"indicator_types": ["malicious-activity"]
}Separate per-type endpoints return only the currently active indicators as plain values, one per line and without STIX wrapping. Available for IPv4, IPv6, domains, URLs, MD5, SHA-1, and SHA-256 hashes.
GET /ioc/ipv4/active 185.220.101.45 193.32.162.73 45.142.212.100
Plug In With Zero Friction
TAXII 2.1 support is built into both APIs. If your platform already speaks the protocol, point it at the server and start consuming intelligence in minutes, without custom connectors, middleware, or hand-rolled parsing. New to the concept? Read what a threat intelligence feed is and how it differs from a platform.
Standards-compliant
OASIS TAXII 2.1 and STIX 2.1, so it works with any compliant client out of the box.
Collection Separation
Each feed has a dedicated collection, so you subscribe to exactly the feeds you need.
Incremental Polling
Use TAXII's added_after parameter to efficiently poll for only new objects since your last sync.
REST and TAXII
Both APIs support REST and TAXII 2.1, so pick whichever transport fits your stack.
Developer Capabilities
Enterprise-grade features for production deployments.
Advanced Filtering
Use PostgREST syntax to query denormalized array columns. Filter by threat actor, malware family, target sector, MITRE ATT&CK pattern, geography, or time window, across both APIs.
Custom Intelligence Feeds
Build highly tailored feeds using logical operators. Combine timestamps, geographic targeting, and source filters to pipe only relevant intelligence into your security stack.
Full Provenance
Every response includes complete source attribution via external_references. Trace any piece of intelligence back to the original research for validation and audit.
Comprehensive Documentation
API reference covering both APIs: authentication, endpoints, filtering syntax, TAXII collections, and worked examples.
Read the Docs →Historical Data Within Your Plan
Query historical intelligence within your plan’s history window using latest_ts and earliest_ts. Track the evolution of threat actors, malware families, and CVE exploitation over time.
Platform Integrations
Works with the platforms your team already uses, and any stack that speaks REST or TAXII 2.1. The OpenCTI connector is included.
REST and TAXII 2.1 are language-agnostic by design. Python, Node.js, Go, Java, PowerShell, or anything else that can make an HTTP request will integrate.
Your first STIX bundle in under five minutes.
API access starts with Team at $199/month. Buy online, activate your account, and get your key. Or request a demo. Free and Professional are web-only.