emerging · 0.1 market domain

Threat Detection

Score 23.2 / 100 107 providers +10 via APIs 74 APIs Search apis.io →

Providers using this tag (107)

Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.

Strong 4 Solid coverage with minor gaps
Cisco XDRSecurityXDRIncident Response12 APIs62.9AppOmniSaaS SecuritySSPMCompliance9 APIs58.3Amazon GuardDutyAnomaly DetectionComplianceMachine-LearningMonitoring1 API57.0MalwarebytesCompanySecurityCybersecurityEndpoint Security2 APIs54.6
Developing 23 Usable, with meaningful gaps to close
OpenText CybersecurityCybersecurityApplication SecurityVulnerability ManagementSAST1 API54.2PantherCompanySecuritySIEMDetection and Response1 API53.9UpwindSecurityCloud SecurityCNAPPVulnerability Management2 APIs53.0Amazon Security LakeData LakeSecuritySIEM3 APIs52.8LevelBlueCompanyEnterpriseCybersecuritySecurity1 API47.3TaniumComplianceEndpoint ManagementPatch ManagementSecurity3 APIs47.3Google Cloud Security Command CenterCloud SecurityComplianceRisk ManagementSecurity1 API46.1TracebitCompanyCloud SaasSecurityDeception1 API45.2Microsoft SentinelMicrosoftSecuritySIEMSOAR5 APIs44.5Push SecurityCompanyEnterpriseSecurityIdentity1 API44.3TrellixCloud SecurityCybersecurityEndpoint Security2 APIs43.6FortaCompanySecurityBlockchainWeb31 API42.8AdluminSecurityCybersecurityManaged Detection and ResponseExtended Detection and Response2 APIs42.2CybereasonCybersecurityXDREDRNGAV1 API41.4SaaS AlertsMSPSaaS SecuritySecurity Monitoring1 API41.4Vectra AICompanyCybersecurityNetwork Detection and Response2 APIs41.3Google Cloud ChronicleIncident ResponseLog ManagementSecurity AnalyticsSecurity Operations1 API41.0SpyderbatCompanySecurityCloud SecurityRuntime Security2 APIs40.3VaronisCloud SecurityComplianceData AnalyticsData Governance1 API40.2RunRevealCompanySecuritySIEMSecurity Log Management1 API39.9Sublime SecurityCompanySecurityEmail SecurityPhishing2 APIs39.9SophosCybersecurityEndpoint ProtectionSecuritySIEM1 API39.6Stream.SecurityCompanySecurityCloud SecurityCloud Detection and Response2 APIs39.3
Thin 23 Limited public surface area
FalcoCloud-NativeeBPFRuntime SecuritySecurity1 API38.9ScannerCompanySecuritySIEMLog Analytics1 API38.7Red CanaryCompanySecurityCybersecurityManaged Detection and Response1 API38.2BlockaidCompanyFintechWeb3 SecurityBlockchain1 API37.8CynetCompanyCybersecuritySecurityXDR2 APIs37.8Ocean SecurityCompanySecurityEmail SecurityCybersecurity1 API37.3SecureworksCybersecurityXDRSecurity Operations1 API35.2StairwellCompanySecurityThreat IntelligenceMalware Analysis1 API34.6DevoCompanyCybersecuritySIEMSecurity6 APIs34.5TraceableAPI DiscoveryAPI ProtectionAPI SecurityAPI Testing1 API34.4Arctic Wolf NetworksCompanyCybersecuritySecurity OperationsManaged Detection and Response2 APIs33.4PromptArmorArtificial IntelligenceLLMSecurityPrompt Injection1 API32.9CorelightCompanyCybersecurityNetwork Detection and ResponseNDR1 API31.5HypernativeCompanySecurityBlockchainWeb31 API30.8AnvilogicCompanySecurityCybersecuritySecurity Operations2 APIs30.6ExabeamCompanyCybersecuritySecuritySIEM13 APIs30.2NebulockCompanySecurityThreat Hunting1 API29.5SentinelOneSecurityXDREDREndpoint Protection1 API29.5AWS Security HubSecurityCloud Security Posture ManagementComplianceFindings1 API29.2HuntersCompanyCybersecuritySIEMSOC1 API29.2OnapsisCompanyCybersecurityApplication SecurityVulnerability Management1 API27.9Lacework FortiCNAPPCloud SecurityCNAPPCompliance1 API26.7UptycsSecurityCybersecurityCNAPPXDR1 API26.7
Emerging 33 Early or largely undocumented
Corelight (fka Broala)CompanyCybersecurityNetwork Detection and ResponseNDR23.8ResurfaceAPI AnalyticsAPI ComplianceAPI LoggingAPI Observability5 APIs23.3MitigaCompanySecurityCloud SecuritySaaS Security1 API22.6IBM QRadar Security Intelligence PlatformAnalyticsLog ManagementSecuritySIEM2 APIs20.7Carbon BlackCompanySecurityEndpoint SecurityEDR1 API19.87AICompanyCybersecuritySecurityArtificial Intelligence19.7Ambient.aiCompanyPhysical SecurityComputer-VisionArtificial Intelligence19.4DaylightCompanySecurityCybersecurityManaged Detection and Response1 API19.4CardinalOpsCompanyCybersecuritySecurity OperationsDetection Engineering19.1VorlonCompanySecuritySaaS SecurityAI Agents18.8Radiant SecurityCompanySecurityCybersecuritySecurity Operations18.6HalcyonCompanyAI InfrastructureCybersecurityRansomware1 API18.4ClarotyCompanyCybersecurityOT SecurityCyber-Physical Systems17.9CroglCompanySecurityCybersecuritySecurity Operations17.7Vega SecurityCompanyCybersecuritySecurity OperationsSIEM17.4AegisAICompanyArtificial IntelligenceEmail SecurityCybersecurity16.2SkopenowCompanyOpen Source IntelligenceOSINTInvestigations15.6MimicCompanyEnterpriseCybersecurityRansomware Defense15.5ClearvectorCompanySecurityCloud SecurityDetection and Response14.5Qevlar AICompanyEngineering ServicesSecurityCybersecurity14.5Abstract SecuritySecurityCybersecuritySIEMSecurity Data Pipeline14.3CounterTackCompanySecurityCybersecurityEndpoint Security1 API13.8PeripheryCompanySecurityCybersecurityCritical Infrastructure13.6ExaforceCompanySecurityCybersecuritySecurity Operations13.5Prophet SecurityCompanyArtificial IntelligenceSecurityCybersecurity13.4Legion SecurityCompanyCloud SaasSecuritySecurity Operations13.1Command ZeroCompanySecurityCybersecuritySOC13.0AndesiteCompanyDefense GovernmentCybersecuritySecurity Operations12.4Crosslayer LabsCompanySecurityNetwork SecurityWeb Infrastructure12.3SIEMonsterCompanySecuritySIEMCybersecurity12.1EclypsiumCompanySecurityCybersecurityFirmware Security11.4Tenex AICompanyCybersecuritySecurity OperationsManaged Detection and Response11.4SemperisCompanyCybersecurityIdentity SecurityActive Directory11.0
Minimal 23 Almost no public developer surface
Obsidian SecuritySaaS Security1 API10.7Mate SecurityCompanyCybersecuritySecuritySecurity Operations10.5CotoolCompanyArtificial IntelligenceCybersecuritySecurity Operations10.4mokSa AICompanyArtificial IntelligenceSurveillanceVideo Analytics10.3NozomiCompanySecurityOT SecurityIoT Security9.8Bastille NetworksCompanyCybersecurityWireless SecurityRF Detection9.3Artemis SecurityCompanySecurityCybersecurity8.6MokNCompanyEnterpriseCybersecurity8.1ArcSightCompanySecuritySIEMCybersecurity7.9AcalvioCompanyArtificial IntelligenceCybersecurityDeception Technology7.6AirEyeCompanySecurityCybersecurityWireless5.5AwakeCompanyCybersecurityNetwork Detection and ResponseNetwork Security5.0Awake Security (Arista Networks)CompanySecurityNetwork Detection and ResponseNDR5.0ConflueraCompanyCybersecuritySecurity5.0DistributedspectrumCompanyRadio FrequencySignals Intelligence5.0EnsiloCompanySecurityCybersecurityEndpoint Security5.0Jask LabsCompanySecurityCybersecuritySecurity Operations5.0LancopeCompanyAcquiredNetwork SecuritySecurity Analytics5.0LightCyberCompanySecurityCybersecurityBehavioral Analytics5.0Miru LabsCompanyCybersecuritySecurityInsider Threat5.0VersiveCompanySecurityCybersecurityArtificial Intelligence5.0ProtectWiseCompanySecurityNetwork Detection and Response4.8GemCompanySecurityCloud SecurityCloud Detection and Response1.5
Unrated 1 Not yet scored
SeculertCompanyCybersecuritySecurity

APIs with this tag (74)

Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →

Strong 56 Solid coverage with minor gaps
Logz.io Cloud SIEM APILogz.io Cloud SIEM control plane — manage detection rules (correlation and threshold), retrieve raised secu...64.9Cisco XDR Actor APIActor operations62.9Cisco XDR Asset APIAsset operations62.9Cisco XDR Asset Mapping APIAsset Mapping operations62.9Cisco XDR Asset Properties APIAsset Properties operations62.9Cisco XDR Attack Pattern APIAttack Pattern operations62.9Cisco XDR Bulk APIThe Bulk API from Cisco XDR — 1 operation(s) for bulk.62.9Cisco XDR Bundle APIThe Bundle API from Cisco XDR — 2 operation(s) for bundle.62.9Cisco XDR Campaign APICampaign operations62.9Cisco XDR Casebook APICasebook operations62.9Cisco XDR COA APICOA operations62.9Cisco XDR Deliberate APIThis set of routes allow to quickly get answers from your integrations You might use them at the start of a...62.9Cisco XDR Event APIEvents operations62.9Cisco XDR Feed APIFeed operations62.9Cisco XDR Feedback APIFeedback Routes62.9Cisco XDR Graph QL APIThe GraphQL API from Cisco XDR — 1 operation(s) for graphql.62.9Cisco XDR Health APIThis set of routes allow to check the health of your integrations setup Verify if your modules are setup co...62.9Cisco XDR Incident APIIncident operations62.9Cisco XDR Indicator APIIndicator operations62.9Cisco XDR Inspect APIInspect related routes62.9Cisco XDR Investigation APIThe Investigation API from Cisco XDR — 8 operation(s) for investigation.62.9Cisco XDR INVITE APIThe INVITE API from Cisco XDR — 2 operation(s) for invite.62.9Cisco XDR Iroh APIThe Iroh API from Cisco XDR — 3 operation(s) for iroh.62.9Cisco XDR Judgement APIJudgement operations62.9Cisco XDR LOGIN APIThe LOGIN API from Cisco XDR — 4 operation(s) for login.62.9Cisco XDR Malware APIMalware operations62.9Cisco XDR MCP ServerModel Context Protocol server published by CiscoDevNet exposing 27 Cisco XDR tools across Inspect, Investig...62.9Cisco XDR Metrics APIThe Metrics API from Cisco XDR — 1 operation(s) for metrics.62.9Cisco XDR Module Instance APIModuleInstance Routes62.9Cisco XDR Module Type APIModuleType Routes62.9Cisco XDR Module Type Patch APIModuleTypePatch Routes62.9Cisco XDR Note APIThe Note API from Cisco XDR — 8 operation(s) for note.62.9Cisco XDR Observe APIThis set of routes allow to get in depth investigation data about a threat You might use them at the start ...62.9Cisco XDR One Click APIOne-click Routes62.9Cisco XDR Private Intel APIAccess private-intel62.9Cisco XDR Properties APIThe Properties API from Cisco XDR — 1 operation(s) for properties.62.9Cisco XDR Query APIThis set of routes allow to query for records related to observable events.Results are returned in OCSF for...62.9Cisco XDR Refer APIThis set of routes allow to get relevant Reference links and quickly pivot pursuing your investigation on a...62.9Cisco XDR Relationship APIRelationship operations62.9Cisco XDR Reputation APIThe Reputation API from Cisco XDR — 1 operation(s) for reputation.62.9Cisco XDR Response APIIROH Response62.9Cisco XDR Session Cookie APICookie-based session validation62.9Cisco XDR Sighting APISighting operations62.9Cisco XDR Status APIThe Status API from Cisco XDR — 1 operation(s) for status.62.9Cisco XDR Target Record APITarget Record operations62.9Cisco XDR Tool APITool operations62.9Cisco XDR Verdict APIThe Verdict API from Cisco XDR — 1 operation(s) for verdict.62.9Cisco XDR Version APIThe Version API from Cisco XDR — 1 operation(s) for version.62.9Cisco XDR Vulnerability APIThe Vulnerability API from Cisco XDR — 9 operation(s) for vulnerability.62.9Cisco XDR Webhook APIWebhook Routes62.9Cisco XDR Webhook Result APIThe WebhookResult API from Cisco XDR — 2 operation(s) for webhookresult.62.9AppOmni Posture Findings APIPosture Findings consolidates policy issues and Insights into a single view. This API lists, filters and re...58.3Red Hat Malware Detection APIAPI for detecting potential malware signatures on RHEL systems registered with the Hybrid Cloud Console, pr...57.5AT&T Threat Detection APIThe Threat Detection API from AT&T — 1 operation(s) for threat detection.56.4Treblle API SecurityTreblle API Security provides real-time threat detection with 15+ automated security checks on every API re...55.8VMware vDefend APIAPI for VMware vDefend lateral security platform providing network security segmentation, threat detection,...54.3
Developing 10 Usable, with meaningful gaps to close
CloudGuard Intelligence APICloud intelligence and CDR - account onboarding for the Intelligence (Magellan) service, usage quota notifi...53.7Trellix Detection as a Service APIAPI-driven malware detection service that leverages the Trellix Multi-Vector Virtual Execution (MVX) engine...43.6Trellix Email Security Cloud APIRESTful API for Trellix Email Security Cloud (formerly FireEye ETP) providing custom integration capabiliti...43.6Trellix Endpoint Security (HX) APIREST API for the Trellix Endpoint Security (HX) platform, formerly FireEye HX. Provides programmatic access...43.6Trellix Helix APIAPI for the Trellix Helix security operations platform that integrates security controls from Trellix and o...43.6Trellix Intelligent Sandbox APIREST API for Trellix Intelligent Sandbox (formerly Advanced Threat Defense) that enables automated submissi...43.6Trellix IOC (Indicators of Compromise) APIREST API interface for managing indicators of compromise within the Trellix security platform. Enables uplo...43.6Imperva API SecurityAPI for managing Imperva's API security product, providing visibility into API traffic, detection of API vu...42.4Adlumin XDR/MDR APITenant-scoped REST API over the Adlumin security operations platform. Eleven v1 endpoints return security d...42.2Stream Security APIREST API over the Stream Security CloudTwin. 34 operations across twelve resource groups - inventory, attac...39.3
Thin 5 Limited public surface area
Hexagate (Chainalysis)Web3 security product (acquired by Chainalysis) that monitors smart contracts and on-chain activity in real...39.2Red Canary REST API v3Tenant-scoped REST API over the Red Canary portal. Documented resources include detections, threats, events...38.2Traceable API Security PlatformTraceable provides an intelligent API security platform offering API discovery, threat detection and protec...34.4Layer (Runtime)Commercial runtime security product that monitors and controls AI applications in production with deep visi...33.1Hypernative APIThe Hypernative REST API exposes the platform's monitoring, detection, screening and automated-response sur...30.8
Emerging 3 Early or largely undocumented
Resurface PlatformResurface captures complete API request and response data in real time, providing full-payload API call log...23.3QRadar REST APICore REST API for managing QRadar SIEM functionality including offenses, assets, rules, and searches.20.7Noname Runtime ProtectionNoname Runtime Protection uses AI and machine learning to detect and block API attacks in real time, includ...12.8

Companies reaching this through an API (10)

These companies publish an API, specification or operation carrying “Threat Detection” but do not classify their business under it. Listed unranked and kept out of the count above, because one tagged operation is not a statement about what a company does.

AT&T Chainalysis CloudGuard Imperva Logz.io Noname Security Protect AI Red Hat Treblle VMware

Score breakdown

Frequency
61.2
log-scaled weighted occurrences
Breadth
2.9
spread across providers
Quality lift
28.9
mean composite of providers using it
Cohesion
8.9
strength of nearest seed neighbor

Related tags

SIEM 33 co-occurrences Security Operations 28 co-occurrences Incident Response 29 co-occurrences Cybersecurity 68 co-occurrences SOC 16 co-occurrences Cloud Security 22 co-occurrences Endpoint Security 16 co-occurrences Security 83 co-occurrences

Where this tag comes from

Provider tag107
Api tag74
Openapi tag1
Openapi op tag2

Cohort brief

Auto-generated

The 99 providers in the APIs.io catalog tagged Threat Detection, scored on the Kin Score. Every figure below is computed from the catalog — nothing here is written.

Providers
99
all scored
Mean Kin Score
27
+3.1 vs catalog 23.9
Mean Agent Readiness
12.2
+0.2 vs catalog 12
Spread
1.5–62.9
median 26.7 · σ 15.2
How the 99 split by band
Exemplar 0Strong 4Developing 23Thin 23Emerging 33Minimal 16
Facet averages, against the whole catalog
FacetThis cohortCatalogDifferenceScored
Access Clarity 31.7 26.5 +5.2 99
Developer Ergonomics 27.6 23.4 +4.2 99
Discoverability 64.4 61.2 +3.2 99
Contract Quality 22.6 19.8 +2.8 99
Contract Governance 8.6 6.4 +2.2 99
Operational Transparency 15.6 14 +1.6 99

A facet is averaged over the members that carry it, not over the whole cohort — the “Scored” column is that count. Averaging an absent facet as zero would score our own coverage gaps as the providers’ posture.

What this cohort publishes
ArtifactThis cohortCatalogDifference
MCP server (any) 17% 10% +7
MCP server (first-party) 16% 13% +3
Agent Skills 0% 0% 0
OAuth scopes 14% 11% +3
Security 100% 97% +3
Arazzo workflows 4% 2% +2
Governance rules 14% 14% 0

mcp_pct counts any mcp/ artifact including ones API Evangelist derived from the provider OpenAPI; mcp_first_party_pct counts only servers the provider publishes. Prefer the latter.

Top by Kin Score
  1. 1 Cisco XDR 62.9
  2. 2 AppOmni 58.3
  3. 3 Amazon GuardDuty 57
  4. 4 Malwarebytes 54.6
  5. 5 OpenText Cybersecurity 54.2
  6. 6 Panther 53.9
  7. 7 Upwind 53
  8. 8 Amazon Security Lake 52.8
  9. 9 LevelBlue 47.3
  10. 10 Tanium 47.3
Top by Agent Readiness
  1. 1 Upwind 43.7
  2. 2 Cisco XDR 38.5
  3. 3 Adlumin 38.2
  4. 4 Amazon GuardDuty 37.1
  5. 5 AppOmni 36.7
  6. 6 Stream.Security 34.4
  7. 7 Malwarebytes 32.5
  8. 8 Spyderbat 32.4
  9. 9 OpenText Cybersecurity 32.2
  10. 10 Stairwell 32.2
All 107 members of this roster resolve to a scored provider in the catalog.Generated from the catalog build of 15 September 2026, across 27661 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.

Work with this as data

Every tag here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for tags

7 MCP tools reach this
  • find_tagsBrowse and filter every tag in the catalog.
  • get_cohortThis tag as a scored cohort — every provider carrying it, with scores.
  • cohort_statsPRO — the distribution across this tag: mean, median, band split, adoption rates.
  • cohort_rankingsPRO — the leaderboard, on composite AND agent-readiness axes.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This tag 
curl "https://apis.io/api/v1/tags/threat-detection"
All tags 
curl "https://apis.io/api/v1/tags?limit=25"
As a scored cohort 
curl "https://apis.io/api/v1/cohorts/tag/threat-detection"
The distribution (Pro) 
curl "https://apis.io/api/v1/cohorts/tag/threat-detection/stats" \
  -H "X-API-Key: $APIS_IO_KEY"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.