Incident Response
Variants seen in the corpus:
Incident Responseincident-response
Providers using this tag (63)
Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.
Strong 2 Solid coverage with minor gaps
Developing 16 Usable, with meaningful gaps to close
Thin 20 Limited public surface area
Emerging 18 Early or largely undocumented
Minimal 7 Almost no public developer surface
APIs with this tag (13)
Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →
Developing 7 Usable, with meaningful gaps to close
IRONSCALES MCP ServerRemote Model Context Protocol server operated by IRONSCALES at mcp.ironscales.com, served over streamable H...Grafana OnCall APIProgrammatic access to OnCall alert groups, integrations, escalation chains, schedules, on-call shifts, rou...Corelayer APIThe Corelayer v1 REST API (api/v1) provides programmatic access to issues, groups, integrations, events, an...IncidentFox REST APIProgrammatic access to trigger AI-driven incident investigations, poll investigation status and results, an...Splunk SOAR REST APIThe Splunk SOAR REST API creates, updates, queries and selectively removes the objects the platform automat...Trellix EDR APIEndpoint Detection and Response API for advanced threat hunting, investigation, and automated response capa...Trellix Endpoint Security (HX) APIREST API for the Trellix Endpoint Security (HX) platform, formerly FireEye HX. Provides programmatic access...
Thin 5 Limited public surface area
Red Canary REST API v3Tenant-scoped REST API over the Red Canary portal. Documented resources include detections, threats, events...SIGNL4 REST APIRESTful API for programmatic alert lifecycle management including creating events, acknowledging or closing...DrDroid Platform (MCP + Agent)The DrDroid platform surface — the hosted Model Context Protocol (MCP) server and DroidAgent investigation ...Torq REST APIThe Torq REST API allows programmatic management of workspace resources including workflows, users, secrets...Kestrel PlatformKestrel AI provides an AI-native cloud incident response platform that uses autonomous agents to detect, in...
Emerging 1 Early or largely undocumented
Score breakdown
Frequency
51.2
log-scaled weighted occurrences
Breadth
1.7
spread across providers
Quality lift
36.2
mean composite of providers using it
Cohesion
0.0
strength of nearest seed neighbor
Related tags
Security Operations 19 co-occurrences
Threat Detection 28 co-occurrences
SOC 13 co-occurrences
Managed Detection and Response 10 co-occurrences
SOAR 8 co-occurrences
Threat Intelligence 15 co-occurrences
SIEM 10 co-occurrences
On-Call 7 co-occurrences
Where this tag comes from
Provider tag60
Api tag13
Cohort brief
Auto-generatedThe 63 providers in the APIs.io catalog tagged Incident Response, scored on the Kin Score. Every figure below is computed from the catalog — nothing here is written.
Providers
63
all scored
Mean Kin Score
29.8
+9.1 vs catalog 20.7
Mean Agent Readiness
13.8
+4.1 vs catalog 9.7
Spread
4.3–60.7
median 30.6 · σ 14.8
How the 63 split by band
Exemplar 0Strong 3Developing 16Thin 17Emerging 20Minimal 7
Facet averages, against the whole catalog
| Facet | This cohort | Catalog | Difference | Scored |
|---|---|---|---|---|
| Access Clarity | 36.6 | 22.3 | +14.3 | 63 |
| Developer Ergonomics | 31.2 | 17.9 | +13.3 | 63 |
| Discoverability | 69.7 | 60.4 | +9.3 | 63 |
| Operational Transparency | 20.4 | 11.3 | +9.1 | 63 |
| Contract Governance | 11 | 6.4 | +4.6 | 63 |
| Contract Quality | 21.5 | 17.5 | +4 | 63 |
A facet is averaged over the members that carry it, not over the whole cohort — the “Scored” column is that count. Averaging an absent facet as zero would score our own coverage gaps as the providers’ posture.
What this cohort publishes
| Artifact | This cohort | Catalog | Difference |
|---|---|---|---|
| MCP server (any) | 30% | 16% | +14 |
| MCP server (first-party) | 24% | 7% | +17 |
| Agent Skills | 0% | 0% | 0 |
| OAuth scopes | 17% | 9% | +8 |
| Security | 97% | 88% | +9 |
| Arazzo workflows | 0% | 2% | -2 |
| Governance rules | 14% | 13% | +1 |
mcp_pct counts any mcp/ artifact including ones API Evangelist derived from the provider OpenAPI; mcp_first_party_pct counts only servers the provider publishes. Prefer the latter.
Top by Kin Score
- 1 Cisco XDR 60.7
- 2 Splunk Observability Cloud 60.6
- 3 IRONSCALES 56
- 4 Grafana 52.3
- 5 LevelBlue 52.2
- 6 Corelayer 49.7
- 7 IncidentFox (Brownie) 47.3
- 8 Cyware 46.9
- 9 Tracebit 46.8
- 10 RunWhen 45.6
Top by Agent Readiness
- 1 IRONSCALES 51.6
- 2 RunWhen 42.6
- 3 Cisco XDR 38.9
- 4 Splunk Observability Cloud 36.7
- 5 Cyware 34.6
- 6 Stairwell 32.2
- 7 LevelBlue 30.8
- 8 Corelayer 29.3
- 9 Doctor Droid 28.1
- 10 Coalition 26.7
All 63 members of this roster resolve to a scored provider in
the catalog.Generated from the catalog build of
25 August 2026, across 26891
providers, using the same computation served by the
APIs.io cohort API. Briefs are published for rosters of
5 or more scored providers; below that a distribution is not meaningful.
Work with this as data
Every tag here is available over the APIs.io API and to AI agents over MCP.