Threat Detection
Business capabilities this tag reaches
Cybersecurity Management 1
Providers using this tag (111)
Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.
Exemplar 2 Complete, well-documented, and agent-ready
Strong 6 Solid coverage with minor gaps
Developing 18 Usable, with meaningful gaps to close
Thin 25 Limited public surface area
Emerging 32 Early or largely undocumented
Lacework FortiCNAPPIBM QRadar Security Intelligence PlatformPetraSIEMonsterAndesiteMitigaDaylightSentinelOneCrogl7AIResurfaceCardinalOpsVorlonAmbient.aiCarbon BlackHalcyonRadiant SecurityVega SecurityMimicCounterTackAegisAISkopenowClearvectorQevlar AIPeripheryAbstract SecurityExaforceLegion SecurityCommand ZeroProphet SecurityCrosslayer LabsEclypsium
Minimal 22 Almost no public developer surface
APIs with this tag (69)
Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →
Exemplar 49 Complete, well-documented, and agent-ready
Cisco XDR Actor APIActor operationsCisco XDR Asset APIAsset operationsCisco XDR Asset Mapping APIAsset Mapping operationsCisco XDR Asset Properties APIAsset Properties operationsCisco XDR Attack Pattern APIAttack Pattern operationsCisco XDR Bulk APIThe Bulk API from Cisco XDR — 1 operation(s) for bulk.Cisco XDR Bundle APIThe Bundle API from Cisco XDR — 2 operation(s) for bundle.Cisco XDR Campaign APICampaign operationsCisco XDR Casebook APICasebook operationsCisco XDR COA APICOA operationsCisco XDR Deliberate APIThis set of routes allow to quickly get answers from your integrations You might use them at the start of a...Cisco XDR Event APIEvents operationsCisco XDR Feed APIFeed operationsCisco XDR Feedback APIFeedback RoutesCisco XDR Health APIThis set of routes allow to check the health of your integrations setup Verify if your modules are setup co...Cisco XDR Incident APIIncident operationsCisco XDR Indicator APIIndicator operationsCisco XDR Inspect APIInspect related routesCisco XDR Investigation APIThe Investigation API from Cisco XDR — 8 operation(s) for investigation.Cisco XDR INVITE APIThe INVITE API from Cisco XDR — 2 operation(s) for invite.Cisco XDR Iroh APIThe Iroh API from Cisco XDR — 3 operation(s) for iroh.Cisco XDR Judgement APIJudgement operationsCisco XDR LOGIN APIThe LOGIN API from Cisco XDR — 4 operation(s) for login.Cisco XDR Malware APIMalware operationsCisco XDR MCP ServerModel Context Protocol server published by CiscoDevNet exposing 27 Cisco XDR tools across Inspect, Investig...Cisco XDR Metrics APIThe Metrics API from Cisco XDR — 1 operation(s) for metrics.Cisco XDR Module Instance APIModuleInstance RoutesCisco XDR Module Type APIModuleType RoutesCisco XDR Module Type Patch APIModuleTypePatch RoutesCisco XDR Note APIThe Note API from Cisco XDR — 8 operation(s) for note.Cisco XDR Observe APIThis set of routes allow to get in depth investigation data about a threat You might use them at the start ...Cisco XDR One Click APIOne-click RoutesCisco XDR Private Intel APIAccess private-intelCisco XDR Properties APIThe Properties API from Cisco XDR — 1 operation(s) for properties.Cisco XDR Query APIThis set of routes allow to query for records related to observable events.Results are returned in OCSF for...Cisco XDR Refer APIThis set of routes allow to get relevant Reference links and quickly pivot pursuing your investigation on a...Cisco XDR Relationship APIRelationship operationsCisco XDR Reputation APIThe Reputation API from Cisco XDR — 1 operation(s) for reputation.Cisco XDR Response APIIROH ResponseCisco XDR Session Cookie APICookie-based session validationCisco XDR Sighting APISighting operationsCisco XDR Status APIThe Status API from Cisco XDR — 1 operation(s) for status.Cisco XDR Target Record APITarget Record operationsCisco XDR Tool APITool operationsCisco XDR Verdict APIThe Verdict API from Cisco XDR — 1 operation(s) for verdict.Cisco XDR Version APIThe Version API from Cisco XDR — 1 operation(s) for version.Cisco XDR Vulnerability APIThe Vulnerability API from Cisco XDR — 9 operation(s) for vulnerability.Cisco XDR Webhook APIWebhook RoutesCisco XDR Webhook Result APIThe WebhookResult API from Cisco XDR — 2 operation(s) for webhookresult.
Strong 2 Solid coverage with minor gaps
Developing 11 Usable, with meaningful gaps to close
VMware vDefend APIAPI for VMware vDefend lateral security platform providing network security segmentation, threat detection,...AT&T Threat Detection APIThe Threat Detection API from AT&T — 1 operation(s) for threat detection.Trellix Detection as a Service APIAPI-driven malware detection service that leverages the Trellix Multi-Vector Virtual Execution (MVX) engine...Trellix Email Security Cloud APIRESTful API for Trellix Email Security Cloud (formerly FireEye ETP) providing custom integration capabiliti...Trellix Endpoint Security (HX) APIREST API for the Trellix Endpoint Security (HX) platform, formerly FireEye HX. Provides programmatic access...Trellix Helix APIAPI for the Trellix Helix security operations platform that integrates security controls from Trellix and o...Trellix Intelligent Sandbox APIREST API for Trellix Intelligent Sandbox (formerly Advanced Threat Defense) that enables automated submissi...Trellix IOC (Indicators of Compromise) APIREST API interface for managing indicators of compromise within the Trellix security platform. Enables uplo...Red Canary REST API v3Tenant-scoped REST API over the Red Canary portal. Documented resources include detections, threats, events...Hexagate (Chainalysis)Web3 security product (acquired by Chainalysis) that monitors smart contracts and on-chain activity in real...Stream.Security Threat Detection APIThe Threat Detection API from Stream.Security — 4 operation(s) for threat detection.
Thin 3 Limited public surface area
Traceable API Security PlatformTraceable provides an intelligent API security platform offering API discovery, threat detection and protec...Imperva API SecurityAPI for managing Imperva's API security product, providing visibility into API traffic, detection of API vu...Hypernative APIThe Hypernative REST API exposes the platform's monitoring, detection, screening and automated-response sur...
Emerging 3 Early or largely undocumented
Layer (Runtime)Commercial runtime security product that monitors and controls AI applications in production with deep visi...QRadar REST APICore REST API for managing QRadar SIEM functionality including offenses, assets, rules, and searches.Resurface PlatformResurface captures complete API request and response data in real time, providing full-payload API call log...
Minimal 1 Almost no public developer surface
Companies reaching this through an API (8)
These companies publish an API, specification or operation carrying “Threat Detection” but do not classify their business under it. Listed unranked and kept out of the count above, because one tagged operation is not a statement about what a company does.
Score breakdown
Frequency
60.2
log-scaled weighted occurrences
Breadth
2.5
spread across providers
Quality lift
28.3
mean composite of providers using it
Cohesion
8.2
strength of nearest seed neighbor
Where this tag sits
Related tags
SIEM 32 co-occurrences
Security Operations 29 co-occurrences
Incident Response 31 co-occurrences
Cybersecurity 69 co-occurrences
SOC 16 co-occurrences
Endpoint Security 17 co-occurrences
Cloud Security 21 co-occurrences
Security 82 co-occurrences
Where this tag comes from
Provider tag111
Api tag69
Openapi tag2
Openapi op tag6
Markets provisional
Kin Score markets whose measured providers carry this tag. Share is the fraction of the market's measured providers that carry it — it describes the market, not this tag.
| Market | Share of the market's providers |
|---|---|
| Security (EDR, SIEM, SOAR) | 24% |
Cohort brief
Auto-generatedThe 104 providers in the APIs.io catalog tagged Threat Detection, scored on the Kin Score. Every figure below is computed from the catalog — nothing here is written.
Providers
104
of 111 in the catalog
Mean Kin Score
27.2
+5.0 vs catalog 22.2
Mean Agent Readiness
12.8
+0.8 vs catalog 12
Spread
0–69.1
median 24.1 · σ 16.5
How the 104 split by band
Exemplar 2Strong 6Developing 18Thin 25Emerging 32Minimal 21
Facet averages, against the whole catalog
| Facet | This cohort | Catalog | Difference | Scored |
|---|---|---|---|---|
| Access Clarity | 30.4 | 23.9 | +6.5 | 104 |
| Developer Ergonomics | 27.6 | 23.2 | +4.4 | 104 |
| Discoverability | 62.2 | 57.9 | +4.3 | 104 |
| Contract Quality | 21 | 17.2 | +3.8 | 104 |
| Operational Transparency | 16 | 13 | +3 | 104 |
| Contract Governance | 8.6 | 6.5 | +2.1 | 104 |
A facet is averaged over the members that carry it, not over the whole cohort — the “Scored” column is that count. Averaging an absent facet as zero would score our own coverage gaps as the providers’ posture.
What this cohort publishes
| Artifact | This cohort | Catalog | Difference |
|---|---|---|---|
| MCP server (any) | 17% | 13% | +4 |
| MCP server (first-party) | 17% | 12% | +5 |
| Agent Skills | 0% | 0% | 0 |
| OAuth scopes | 12% | 11% | +1 |
| Security | 95% | 98% | -3 |
| Arazzo workflows | 4% | 2% | +2 |
| Governance rules | 16% | 16% | 0 |
mcp_pct counts any mcp/ artifact including ones API Evangelist derived from the provider OpenAPI; mcp_first_party_pct counts only servers the provider publishes. Prefer the latter.
Top by Kin Score
- 1 Malwarebytes 69.1
- 2 Cisco XDR 68.3
- 3 Amazon GuardDuty 62.3
- 4 OpenText Cybersecurity 60.4
- 5 AppOmni 56.3
- 6 AirMDR 55.1
- 7 Amazon Security Lake 55
- 8 Panther 54.6
- 9 Upwind 52.1
- 10 LevelBlue 50.1
Top by Agent Readiness
- 1 Claroty 45.5
- 2 AirMDR 45.4
- 3 Upwind 40.3
- 4 Cisco XDR 39.1
- 5 OpenText Cybersecurity 38.5
- 6 Amazon GuardDuty 36.5
- 7 Stream.Security 36.2
- 8 AppOmni 35.7
- 9 Adlumin 35
- 10 Panther 34.5
All 111 members of this roster resolve to a provider in the
catalog; 104 carry a score (94%).
The figures above describe the scored members only.
Coverage caveat. 93 of 104 scored members had under half their catalog-attributable points satisfied at all (catalog_earned / catalog_max < 0.5). They are INCLUDED in the mean above. A large share here means the cohort mean is partly a measurement of how far our enrichment reached, not only of how these providers publish.Generated from the catalog build of 24 October 2026, across 31984 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.
Coverage caveat. 93 of 104 scored members had under half their catalog-attributable points satisfied at all (catalog_earned / catalog_max < 0.5). They are INCLUDED in the mean above. A large share here means the cohort mean is partly a measurement of how far our enrichment reached, not only of how these providers publish.Generated from the catalog build of 24 October 2026, across 31984 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.
Work with this as data
Every tag here is available over the APIs.io API and to AI agents over MCP.