Threat Detection
Business capabilities this tag reaches
Cybersecurity Management 1
Providers using this tag (107)
Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.
Strong 8 Solid coverage with minor gaps
Developing 20 Usable, with meaningful gaps to close
Thin 21 Limited public surface area
Emerging 32 Early or largely undocumented
MitigaLacework FortiCNAPPDaylightIBM QRadar Security Intelligence PlatformResurfaceSentinelOne7AICardinalOpsVorlonAmbient.aiCarbon BlackHalcyonRadiant SecurityVega SecurityClarotyMimicCroglAegisAICounterTackSkopenowClearvectorQevlar AIPeripheryAbstract SecurityExaforceLegion SecurityCommand ZeroProphet SecurityCrosslayer LabsEclypsiumSIEMonsterAndesite
Minimal 20 Almost no public developer surface
APIs with this tag (69)
Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →
Exemplar 1 Complete, well-documented, and agent-ready
Strong 50 Solid coverage with minor gaps
Cisco XDR Actor APIActor operationsCisco XDR Asset APIAsset operationsCisco XDR Asset Mapping APIAsset Mapping operationsCisco XDR Asset Properties APIAsset Properties operationsCisco XDR Attack Pattern APIAttack Pattern operationsCisco XDR Bulk APIThe Bulk API from Cisco XDR — 1 operation(s) for bulk.Cisco XDR Bundle APIThe Bundle API from Cisco XDR — 2 operation(s) for bundle.Cisco XDR Campaign APICampaign operationsCisco XDR Casebook APICasebook operationsCisco XDR COA APICOA operationsCisco XDR Deliberate APIThis set of routes allow to quickly get answers from your integrations You might use them at the start of a...Cisco XDR Event APIEvents operationsCisco XDR Feed APIFeed operationsCisco XDR Feedback APIFeedback RoutesCisco XDR Health APIThis set of routes allow to check the health of your integrations setup Verify if your modules are setup co...Cisco XDR Incident APIIncident operationsCisco XDR Indicator APIIndicator operationsCisco XDR Inspect APIInspect related routesCisco XDR Investigation APIThe Investigation API from Cisco XDR — 8 operation(s) for investigation.Cisco XDR INVITE APIThe INVITE API from Cisco XDR — 2 operation(s) for invite.Cisco XDR Iroh APIThe Iroh API from Cisco XDR — 3 operation(s) for iroh.Cisco XDR Judgement APIJudgement operationsCisco XDR LOGIN APIThe LOGIN API from Cisco XDR — 4 operation(s) for login.Cisco XDR Malware APIMalware operationsCisco XDR MCP ServerModel Context Protocol server published by CiscoDevNet exposing 27 Cisco XDR tools across Inspect, Investig...Cisco XDR Metrics APIThe Metrics API from Cisco XDR — 1 operation(s) for metrics.Cisco XDR Module Instance APIModuleInstance RoutesCisco XDR Module Type APIModuleType RoutesCisco XDR Module Type Patch APIModuleTypePatch RoutesCisco XDR Note APIThe Note API from Cisco XDR — 8 operation(s) for note.Cisco XDR Observe APIThis set of routes allow to get in depth investigation data about a threat You might use them at the start ...Cisco XDR One Click APIOne-click RoutesCisco XDR Private Intel APIAccess private-intelCisco XDR Properties APIThe Properties API from Cisco XDR — 1 operation(s) for properties.Cisco XDR Query APIThis set of routes allow to query for records related to observable events.Results are returned in OCSF for...Cisco XDR Refer APIThis set of routes allow to get relevant Reference links and quickly pivot pursuing your investigation on a...Cisco XDR Relationship APIRelationship operationsCisco XDR Reputation APIThe Reputation API from Cisco XDR — 1 operation(s) for reputation.Cisco XDR Response APIIROH ResponseCisco XDR Session Cookie APICookie-based session validationCisco XDR Sighting APISighting operationsCisco XDR Status APIThe Status API from Cisco XDR — 1 operation(s) for status.Cisco XDR Target Record APITarget Record operationsCisco XDR Tool APITool operationsCisco XDR Verdict APIThe Verdict API from Cisco XDR — 1 operation(s) for verdict.Cisco XDR Version APIThe Version API from Cisco XDR — 1 operation(s) for version.Cisco XDR Vulnerability APIThe Vulnerability API from Cisco XDR — 9 operation(s) for vulnerability.Cisco XDR Webhook APIWebhook RoutesCisco XDR Webhook Result APIThe WebhookResult API from Cisco XDR — 2 operation(s) for webhookresult.Treblle API SecurityTreblle API Security provides real-time threat detection with 15+ automated security checks on every API re...
Developing 12 Usable, with meaningful gaps to close
VMware vDefend APIAPI for VMware vDefend lateral security platform providing network security segmentation, threat detection,...AT&T Threat Detection APIThe Threat Detection API from AT&T — 1 operation(s) for threat detection.Trellix Detection as a Service APIAPI-driven malware detection service that leverages the Trellix Multi-Vector Virtual Execution (MVX) engine...Trellix Email Security Cloud APIRESTful API for Trellix Email Security Cloud (formerly FireEye ETP) providing custom integration capabiliti...Trellix Endpoint Security (HX) APIREST API for the Trellix Endpoint Security (HX) platform, formerly FireEye HX. Provides programmatic access...Trellix Helix APIAPI for the Trellix Helix security operations platform that integrates security controls from Trellix and o...Trellix Intelligent Sandbox APIREST API for Trellix Intelligent Sandbox (formerly Advanced Threat Defense) that enables automated submissi...Trellix IOC (Indicators of Compromise) APIREST API interface for managing indicators of compromise within the Trellix security platform. Enables uplo...Hexagate (Chainalysis)Web3 security product (acquired by Chainalysis) that monitors smart contracts and on-chain activity in real...Red Canary REST API v3Tenant-scoped REST API over the Red Canary portal. Documented resources include detections, threats, events...Imperva API SecurityAPI for managing Imperva's API security product, providing visibility into API traffic, detection of API vu...Stream.Security Threat Detection APIThe Threat Detection API from Stream.Security — 4 operation(s) for threat detection.
Thin 3 Limited public surface area
Traceable API Security PlatformTraceable provides an intelligent API security platform offering API discovery, threat detection and protec...Hypernative APIThe Hypernative REST API exposes the platform's monitoring, detection, screening and automated-response sur...Layer (Runtime)Commercial runtime security product that monitors and controls AI applications in production with deep visi...
Emerging 3 Early or largely undocumented
QRadar REST APICore REST API for managing QRadar SIEM functionality including offenses, assets, rules, and searches.Resurface PlatformResurface captures complete API request and response data in real time, providing full-payload API call log...Noname Runtime ProtectionNoname Runtime Protection uses AI and machine learning to detect and block API attacks in real time, includ...
Companies reaching this through an API (8)
These companies publish an API, specification or operation carrying “Threat Detection” but do not classify their business under it. Listed unranked and kept out of the count above, because one tagged operation is not a statement about what a company does.
Score breakdown
Frequency
61.0
log-scaled weighted occurrences
Breadth
2.8
spread across providers
Quality lift
33.1
mean composite of providers using it
Cohesion
9.0
strength of nearest seed neighbor
Where this tag sits
Related tags
SIEM 32 co-occurrences
Security Operations 29 co-occurrences
Incident Response 30 co-occurrences
SOC 16 co-occurrences
Cybersecurity 67 co-occurrences
Cloud Security 21 co-occurrences
Endpoint Security 15 co-occurrences
Security 81 co-occurrences
Where this tag comes from
Provider tag107
Api tag69
Openapi tag2
Openapi op tag6
Cohort brief
Auto-generatedThe 100 providers in the APIs.io catalog tagged Threat Detection, scored on the Kin Score. Every figure below is computed from the catalog — nothing here is written.
Providers
100
all scored
Mean Kin Score
27.2
+4.3 vs catalog 22.9
Mean Agent Readiness
12.4
+0.5 vs catalog 11.9
Spread
0–65.6
median 24 · σ 16.3
How the 100 split by band
Exemplar 0Strong 8Developing 20Thin 21Emerging 32Minimal 19
Facet averages, against the whole catalog
| Facet | This cohort | Catalog | Difference | Scored |
|---|---|---|---|---|
| Access Clarity | 31.5 | 26.5 | +5 | 100 |
| Developer Ergonomics | 27.4 | 23.2 | +4.2 | 100 |
| Discoverability | 61.9 | 58.1 | +3.8 | 100 |
| Contract Quality | 20.8 | 17.6 | +3.2 | 100 |
| Contract Governance | 8.5 | 6.3 | +2.2 | 100 |
| Operational Transparency | 15.5 | 13.7 | +1.8 | 100 |
A facet is averaged over the members that carry it, not over the whole cohort — the “Scored” column is that count. Averaging an absent facet as zero would score our own coverage gaps as the providers’ posture.
What this cohort publishes
| Artifact | This cohort | Catalog | Difference |
|---|---|---|---|
| MCP server (any) | 17% | 14% | +3 |
| MCP server (first-party) | 16% | 12% | +4 |
| Agent Skills | 0% | 0% | 0 |
| OAuth scopes | 12% | 11% | +1 |
| Security | 94% | 98% | -4 |
| Arazzo workflows | 4% | 2% | +2 |
| Governance rules | 14% | 14% | 0 |
mcp_pct counts any mcp/ artifact including ones API Evangelist derived from the provider OpenAPI; mcp_first_party_pct counts only servers the provider publishes. Prefer the latter.
Top by Kin Score
- 1 Cisco XDR 65.6
- 2 OpenText Cybersecurity 60.3
- 3 AppOmni 59
- 4 Malwarebytes 59
- 5 Amazon GuardDuty 57.7
- 6 AirMDR 55.1
- 7 Amazon Security Lake 55.1
- 8 Panther 54.6
- 9 Upwind 52
- 10 LevelBlue 50
Top by Agent Readiness
- 1 AirMDR 45.8
- 2 Upwind 41.5
- 3 Cisco XDR 38.5
- 4 Amazon GuardDuty 37.1
- 5 OpenText Cybersecurity 36.7
- 6 AppOmni 36.7
- 7 Stream.Security 34.4
- 8 Adlumin 33.6
- 9 Panther 30.8
- 10 Varonis 30.6
All 107 members of this roster resolve to a scored provider in
the catalog.Generated from the catalog build of
5 October 2026, across 29093
providers, using the same computation served by the
APIs.io cohort API. Briefs are published for rosters of
5 or more scored providers; below that a distribution is not meaningful.
Work with this as data
Every tag here is available over the APIs.io API and to AI agents over MCP.