niche · 0.1 market domain

Incident Response

Score 20.0 / 100 62 providers +4 via APIs 16 APIs Search apis.io →

Providers using this tag (62)

Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.

Strong 3 Solid coverage with minor gaps
Cisco XDRSecurityXDRThreat Detection12 APIs61.4Splunk Observability CloudObservabilityAPMMonitoringTelemetry48 APIs61.0IRONSCALESEmail SecurityCybersecurityPhishingAnti-Phishing10 APIs55.5
Developing 14 Usable, with meaningful gaps to close
CoalitionCyber InsuranceInsuranceInsurtechRisk Management1 API50.2CorelayerCompanyArtificial IntelligenceSRE1 API49.4LevelBlueCompanyEnterpriseCybersecuritySecurity1 API48.0CywareThreat Intelligencecyber-threat-intelligenceCybersecuritySecurity Operations2 APIs47.1IncidentFox (Brownie)CompanySREAIOps1 API47.0TracebitCompanyCloud SaasSecurityDeception1 API45.2RunWhenCompanyAIOpsSREDevOps1 API45.1TinesSecurity AutomationNo-CodeWorkflow-AutomationSecurity Operations1 API42.3Splunk SOARSecuritySOARAutomationOrchestration1 API42.0At-BayInsuranceCyber InsuranceInsurSecInsurtech1 API41.7Google Cloud ChronicleLog ManagementSecurity AnalyticsSecurity Operations1 API41.0RunRevealCompanySecuritySIEMSecurity Log Management1 API39.9SpyderbatCompanySecurityCloud SecurityRuntime Security2 APIs39.7SophosCybersecurityEndpoint ProtectionSecuritySIEM1 API39.6
Thin 19 Limited public surface area
SwimlaneSOARSecurity OrchestrationAutomation1 API38.9All QuietIncident ManagementOn-CallAlerting1 API38.2Red CanaryCompanySecurityCybersecurityManaged Detection and Response1 API38.2CynetCompanyCybersecuritySecurityXDR2 APIs37.8DemistoCompanySecuritySOAR1 API37.4Doctor DroidCompanyArtificial IntelligenceAIOpsSRE1 API35.5NeubirdCompanyArtificial IntelligenceAI SRE1 API35.3SecureworksCybersecurityXDRThreat DetectionSecurity Operations1 API35.2ReliaQuestCybersecuritySecurity OperationsThreat Detection2 APIs35.0StairwellCompanySecurityThreat IntelligenceMalware Analysis1 API34.6TorqSecurity AutomationSOARHyper-AutomationSecurity Orchestration1 API33.3CorelightCompanyCybersecurityNetwork Detection and ResponseNDR1 API31.5ExabeamCompanyCybersecuritySecuritySIEM13 APIs30.2SentinelOneSecurityXDREDREndpoint Protection1 API29.5HuntersCompanyCybersecuritySIEMSOC1 API29.2IntezerCompanyCybersecuritySecurityMalware Analysis1 API29.2SquadcastOn-Call ManagementDevOpsSRE1 API28.6KestrelAI AgentsCloud SecurityKubernetes2 APIs27.3Splunk On-Call (VictorOps)Incident ManagementOn-CallAlertingDevOps2 APIs26.8
Emerging 18 Early or largely undocumented
Resolve AICompanyInfrastructureArtificial IntelligenceSite Reliability Engineering23.8eSentireCompanySecurityCybersecurityManaged Detection and Response1 API22.8MitigaCompanySecurityCloud SecuritySaaS Security1 API22.6HygroundCompanyAi MlSite Reliability EngineeringDevOps20.67AICompanyCybersecuritySecurityArtificial Intelligence19.7CYGNVSCompanyCybersecurityCyber Crisis Management19.5DaylightCompanySecurityCybersecurityManaged Detection and Response1 API19.4Radiant SecurityCompanySecurityCybersecuritySecurity Operations18.6MandiantCompanySecurityThreat IntelligenceCybersecurity2 APIs17.3StoikCompanyCyber InsuranceCybersecurityInsurtech16.1SazabiCompanyObservabilityMonitoringArtificial Intelligence15.9ClearvectorCompanySecurityCloud SecurityDetection and Response14.5Qevlar AICompanyEngineering ServicesSecurityCybersecurity14.5CounterTackCompanySecurityCybersecurityEndpoint Security1 API13.8ExaforceCompanySecurityCybersecuritySecurity Operations13.5DevAICompanyDeveloper ToolsIT OperationsArtificial Intelligence13.3Legion SecurityCompanyCloud SaasSecuritySecurity Operations13.1Command ZeroCompanySecurityCybersecuritySOC13.0
Minimal 7 Almost no public developer surface
Mate SecurityCompanyCybersecuritySecuritySecurity Operations10.5Surefire CyberCompanyCybersecurityDigital Forensics10.5CotoolCompanyArtificial IntelligenceCybersecuritySecurity Operations10.4Eye SecurityCompanyCybersecurityManaged Detection and ResponseManaged XDR6.7effxCompanyDeveloper ToolsMicroservicesService Catalog5.5PhishMeCompanyCybersecurityPhishingEmail Security5.5SecOpsDevSecOpsSecurityThreat Management4.3
Unrated 1 Not yet scored
ShorelineAIOpsAutomationSite Reliability Engineering1 API

APIs with this tag (16)

Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →

Exemplar 1 Complete, well-documented, and agent-ready
Harness Incident Response APIThe Incident Response API from Harness — 1 operation(s) for incident response.86.2
Strong 1 Solid coverage with minor gaps
IRONSCALES MCP ServerRemote Model Context Protocol server operated by IRONSCALES at mcp.ironscales.com, served over streamable H...55.5
Developing 6 Usable, with meaningful gaps to close
Grafana OnCall APIProgrammatic access to OnCall alert groups, integrations, escalation chains, schedules, on-call shifts, rou...52.3Corelayer APIThe Corelayer v1 REST API (api/v1) provides programmatic access to issues, groups, integrations, events, an...49.4IncidentFox REST APIProgrammatic access to trigger AI-driven incident investigations, poll investigation status and results, an...47.0Trellix EDR APIEndpoint Detection and Response API for advanced threat hunting, investigation, and automated response capa...43.6Trellix Endpoint Security (HX) APIREST API for the Trellix Endpoint Security (HX) platform, formerly FireEye HX. Provides programmatic access...43.6Splunk SOAR REST APIThe Splunk SOAR REST API creates, updates, queries and selectively removes the objects the platform automat...42.0
Thin 6 Limited public surface area
Red Canary REST API v3Tenant-scoped REST API over the Red Canary portal. Documented resources include detections, threats, events...38.2SIGNL4 REST APIRESTful API for programmatic alert lifecycle management including creating events, acknowledging or closing...37.9DrDroid Platform (MCP + Agent)The DrDroid platform surface — the hosted Model Context Protocol (MCP) server and DroidAgent investigation ...35.5GreyMatter APIThe GreyMatter API exposes select GreyMatter capabilities through a single GraphQL endpoint. All requests a...35.0Torq REST APIThe Torq REST API allows programmatic management of workspace resources including workflows, users, secrets...33.3Kestrel PlatformKestrel AI provides an AI-native cloud incident response platform that uses autonomous agents to detect, in...27.3
Emerging 1 Early or largely undocumented
Mitiga Platform APIThe product API behind the Mitiga cloud detection and response platform. The host is live and fronted by a ...22.6
Unrated 1 Not yet scored
ShorelineThe Shoreline cluster API — the backend that alarms, actions, bots, runbooks, notebooks, resources, files, ...

Companies reaching this through an API (4)

These companies publish an API, specification or operation carrying “Incident Response” but do not classify their business under it. Listed unranked and kept out of the count above, because one tagged operation is not a statement about what a company does.

Grafana Harness SIGNL4 Trellix

Score breakdown

Frequency
51.4
log-scaled weighted occurrences
Breadth
1.7
spread across providers
Quality lift
33.3
mean composite of providers using it
Cohesion
0.0
strength of nearest seed neighbor

Related tags

Security Operations 19 co-occurrences Threat Detection 29 co-occurrences SOC 13 co-occurrences SOAR 8 co-occurrences Threat Intelligence 17 co-occurrences Managed Detection and Response 8 co-occurrences SIEM 11 co-occurrences On-Call 7 co-occurrences

Where this tag comes from

Provider tag62
Api tag16
Openapi tag1
Openapi op tag1

Cohort brief

Auto-generated

The 59 providers in the APIs.io catalog tagged Incident Response, scored on the Kin Score. Every figure below is computed from the catalog — nothing here is written.

Providers
59
all scored
Mean Kin Score
30.2
+6.2 vs catalog 24
Mean Agent Readiness
14.3
+1.9 vs catalog 12.4
Spread
5.5–61.4
median 30.2 · σ 13.9
How the 59 split by band
Exemplar 0Strong 3Developing 14Thin 19Emerging 18Minimal 5
Facet averages, against the whole catalog
FacetThis cohortCatalogDifferenceScored
Access Clarity 37 26.5 +10.5 59
Developer Ergonomics 33.5 23.4 +10.1 59
Operational Transparency 21 14 +7 59
Discoverability 66.8 61 +5.8 59
Contract Governance 9.9 6.5 +3.4 59
Contract Quality 22 20.1 +1.9 59

A facet is averaged over the members that carry it, not over the whole cohort — the “Scored” column is that count. Averaging an absent facet as zero would score our own coverage gaps as the providers’ posture.

What this cohort publishes
ArtifactThis cohortCatalogDifference
MCP server (any) 27% 10% +17
MCP server (first-party) 27% 13% +14
Agent Skills 0% 0% 0
OAuth scopes 17% 11% +6
Security 100% 96% +4
Arazzo workflows 0% 2% -2
Governance rules 13% 13% 0

mcp_pct counts any mcp/ artifact including ones API Evangelist derived from the provider OpenAPI; mcp_first_party_pct counts only servers the provider publishes. Prefer the latter.

Top by Kin Score
  1. 1 Cisco XDR 61.4
  2. 2 Splunk Observability Cloud 61
  3. 3 IRONSCALES 55.5
  4. 4 Coalition 50.2
  5. 5 Corelayer 49.4
  6. 6 LevelBlue 48
  7. 7 Cyware 47.1
  8. 8 IncidentFox (Brownie) 47
  9. 9 Tracebit 45.2
  10. 10 RunWhen 45.1
Top by Agent Readiness
  1. 1 IRONSCALES 51.6
  2. 2 RunWhen 42.6
  3. 3 Cisco XDR 38.5
  4. 4 Splunk Observability Cloud 34.6
  5. 5 Cyware 34.6
  6. 6 Spyderbat 32.4
  7. 7 Stairwell 32.2
  8. 8 Corelayer 29.3
  9. 9 LevelBlue 28.6
  10. 10 Coalition 28.1
All 62 members of this roster resolve to a scored provider in the catalog.Generated from the catalog build of 20 September 2026, across 27620 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.

Work with this as data

Every tag here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for tags

7 MCP tools reach this
  • find_tagsBrowse and filter every tag in the catalog.
  • get_cohortThis tag as a scored cohort — every provider carrying it, with scores.
  • cohort_statsPRO — the distribution across this tag: mean, median, band split, adoption rates.
  • cohort_rankingsPRO — the leaderboard, on composite AND agent-readiness axes.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This tag 
curl "https://apis.io/api/v1/tags/incident-response"
All tags 
curl "https://apis.io/api/v1/tags?limit=25"
As a scored cohort 
curl "https://apis.io/api/v1/cohorts/tag/incident-response"
The distribution (Pro) 
curl "https://apis.io/api/v1/cohorts/tag/incident-response/stats" \
  -H "X-API-Key: $APIS_IO_KEY"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.