Incident Response
Providers using this tag (69)
Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.
Exemplar 1 Complete, well-documented, and agent-ready
Strong 4 Solid coverage with minor gaps
Developing 17 Usable, with meaningful gaps to close
Thin 17 Limited public surface area
Emerging 22 Early or largely undocumented
Minimal 8 Almost no public developer surface
APIs with this tag (16)
Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →
Exemplar 1 Complete, well-documented, and agent-ready
Strong 2 Solid coverage with minor gaps
Developing 7 Usable, with meaningful gaps to close
Splunk SOAR REST APIThe Splunk SOAR REST API creates, updates, queries and selectively removes the objects the platform automat...Trellix EDR APIEndpoint Detection and Response API for advanced threat hunting, investigation, and automated response capa...Trellix Endpoint Security (HX) APIREST API for the Trellix Endpoint Security (HX) platform, formerly FireEye HX. Provides programmatic access...Corelayer APIThe Corelayer v1 REST API (api/v1) provides programmatic access to issues, groups, integrations, events, an...IncidentFox REST APIProgrammatic access to trigger AI-driven incident investigations, poll investigation status and results, an...DrDroid Platform (MCP + Agent)The DrDroid platform surface — the hosted Model Context Protocol (MCP) server and DroidAgent investigation ...Red Canary REST API v3Tenant-scoped REST API over the Red Canary portal. Documented resources include detections, threats, events...
Thin 3 Limited public surface area
GreyMatter APIThe GreyMatter API exposes select GreyMatter capabilities through a single GraphQL endpoint. All requests a...SIGNL4 REST APIRESTful API for programmatic alert lifecycle management including creating events, acknowledging or closing...Mitiga Platform APIThe product API behind the Mitiga cloud detection and response platform. The host is live and fronted by a ...
Emerging 2 Early or largely undocumented
Minimal 1 Almost no public developer surface
Companies reaching this through an API (4)
These companies publish an API, specification or operation carrying “Incident Response” but do not classify their business under it. Listed unranked and kept out of the count above, because one tagged operation is not a statement about what a company does.
Score breakdown
Frequency
52.7
log-scaled weighted occurrences
Breadth
1.7
spread across providers
Quality lift
30.9
mean composite of providers using it
Cohesion
0.0
strength of nearest seed neighbor
Related tags
Threat Detection 31 co-occurrences
Security Operations 20 co-occurrences
SOC 13 co-occurrences
Incident Management 15 co-occurrences
Managed Detection and Response 9 co-occurrences
SOAR 8 co-occurrences
Threat Intelligence 17 co-occurrences
SIEM 11 co-occurrences
Where this tag comes from
Provider tag73
Api tag16
Openapi tag1
Openapi op tag1
Work with this as data
Every tag here is available over the APIs.io API and to AI agents over MCP.