Threat Intelligence
Business capabilities this tag reaches
Cybersecurity Management 2
Variants seen in the corpus:
cyber-threat-intelligenceThreat Intelligence
Providers using this tag (129)
Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.
Exemplar 6 Complete, well-documented, and agent-ready
Strong 23 Solid coverage with minor gaps
Developing 32 Usable, with meaningful gaps to close
CywareMalloryBase OperationsFiligranCybleAnomaliMandiantCrowdsecStairwellLevelBlueHackNoticeDragosDomainToolsSplunk SOARHave I Been PwnedHoneyLabsInfobloxKodexAbuseIPDBCVE SecurityKenna SecurityArctic Wolfcrimsoncrawler-comIPstackRed CanaryNetographyProofpointNucleus SecurityTrellixSilent PushReliaQuestOcean Security
Thin 26 Limited public surface area
Emerging 27 Early or largely undocumented
Minimal 14 Almost no public developer surface
Unrated 1 Not yet scored
APIs with this tag (77)
Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →
Exemplar 29 Complete, well-documented, and agent-ready
Recorded Future Alert APIThe Alert API allows for interacting with Recorded Future Alerts and Alert rules. Please read the [document...Recorded Future Analyst Note APIA Recorded Future API for creating, fetching, editing and deleting Analyst Notes. Please read the [Recorded...Recorded Future ASI Project APIThe Attack Surface Intelligence (ASI) Project API is designed to allow you full-featured access to all of t...Recorded Future Autonomous Threat Operations APIAPIs for interacting with Recorded Future Autonomous Threat OperationsRecorded Future CaseCase — part of the Recorded Future API documented at docs.recordedfuture.com. A very descriptive descriptio...Recorded Future Collective Insights APISubmit events captured by your security tools to your organization's Recorded Future enterprise. Collective...Recorded Future Common Platform Enumeration APIs V0Common Platform Enumeration APIs V0 — part of the Recorded Future API documented at docs.recordedfuture.com.Recorded Future Customer APIs V0Customer APIs V0 — part of the Recorded Future API documented at docs.recordedfuture.com.Recorded Future Customer APIs V2Customer APIs V2 — part of the Recorded Future API documented at docs.recordedfuture.com.Recorded Future Detection Rule APIThe Detection Rule API allows clients to programmatically search for and download YARA, Sigma, and Snort ru...Recorded Future Detection Rule Relation APIAPI to fetch entities and types associated with detection rulesRecorded Future Entity Match APIExternal API for integrations and clients to lookup entity IDs by name and/or type, and also to find entiti...Recorded Future Fusion APIA Recorded Future API for managing Fusion flows, files and custom blocks Please read the [detailed support ...Recorded Future Identity APIAPI to lookup identity leaks data. [Identity API](https://support.recordedfuture.com/hc/en-us/articles/4402...Recorded Future Intelligence Cloud APIThe Recorded Future Intelligence Cloud REST API (api.recordedfuture.com) provides programmatic access to th...Recorded Future Links APIAn API to retrieve verified links between entities. Links may come from technical analysis of cyber threats...Recorded Future List APIExternal List API for reading and writing user lists Please read the [detailed support article](https://sup...Recorded Future Malware IntelligenceA Recorded Future API for Malware Intelligence. The Malware Intelligence API provides programmatic access t...Recorded Future Mastercard Riskrecon APIRiskRecon provides organizations with frequent, comprehensive, actionable visibility into the security qual...Recorded Future Payment Fraud Intelligence APIPayment Fraud Intelligence API — part of the Recorded Future API documented at docs.recordedfuture.com.Recorded Future Playbook AlertsA Recorded Future API for Playbook Alerts. The playbook alert API provides programmatic access to Recorded ...Recorded Future recorded-future-sandbox-api-secopstiRecorded Future Sandbox API (formerly Hatching Tria.ge). Provides malware analysis capabilities including f...Recorded Future Risk APIA Recorded Future API for fetching risk and risk risk history information.Recorded Future Soar APIThe SOAR API is designed for high throughput risk checks using Recorded Future's threat intelligence in bul...Recorded Future Threat APIExternal API to retrieve threat data such as threat maps, threat actors and their categories. Please read t...AutoFocus API (Deprecated)A threat intelligence API that provided contextual information about malware, campaigns, and threat actors ...Feedly Threat Graph MCP ServerHosted, remote Model Context Protocol server exposing the Feedly Real-Time Threat Graph to AI agents. Feedl...Microsoft Defender Threat Intelligence APIAccess threat intelligence data, indicators of compromise (IOCs), and threat analytics.Microsoft Sentinel Threat Intelligence APIThe Threat Intelligence API from Microsoft Sentinel — 7 operation(s) for threat intelligence.
Strong 8 Solid coverage with minor gaps
NordStellar MCP ServerRemote MCP server that lets any MCP-compatible assistant query the NordStellar platform in natural language...WhisperGraph and Control Plane (Cypher API)The documented front door for both halves of the platform: POST https://graph.whisper.online/api/query runs...WhisperGraph MCP ServerHosted remote MCP server at https://mcp.whisper.security (Streamable HTTP, protocol revisions up to 2025-11...Splunk Intelligence Management APIThe Splunk Intelligence Management (formerly ThreatStream) API provides REST v2.0 endpoints for managing th...CybelAngel Threat Intelligence APIFetch threat intelligence data from the CybelAngel platform.Juniper Networks Threat Intelligence APIThreat feed and intelligence dataWebz.io APIToken-authenticated REST endpoints under https://api.webz.io covering seven products: News, Blogs and Forum...Webz.io Cyber APIDeep and dark web content for threat intelligence. Search endpoint `/cyberFilter`, segmentation `/cyberSeg`...
Developing 17 Usable, with meaningful gaps to close
Cyware MCP ServerOpen-source Model Context Protocol server, written in Go and published under MIT by Cyware Labs, that expos...LevelBlue Open Threat Exchange (OTX) DirectConnect APIThe OTX DirectConnect API provides programmatic access to the LevelBlue Open Threat Exchange, an open commu...HackNotice MCP ServerRemote Model Context Protocol server operated by HackNotice, speaking JSON-RPC 2.0 over Streamable HTTP at ...OpenCTI GraphQL APIThe OpenCTI platform exposes a full GraphQL API on the /graphql endpoint for programmatic access to cyber t...Infoblox Dossier APIThreat research API that provides contextual information from multiple sources simultaneously for a given i...Infoblox Threat Defense APIAPI for threat intelligence, security analytics, and DNS firewall capabilities. Provides programmatic acces...Infoblox TIDE APIThreat Intelligence Data Exchange (TIDE) API for submitting and retrieving threat indicators. Provides acce...Vectra AI Platform APIThe Vectra AI Platform REST API (api.vectra.io) provides programmatic access to detections, hosts, accounts...Emerging Threats (ET) Intelligence Query API v1The ET Intelligence Query API is Proofpoint's threat-intelligence lookup service, reached at api.emergingth...Proofpoint Targeted Attack Protection (TAP) API v2The TAP v2 API exposes the Threat Insight Dashboard to machines: SIEM event download (blocked/permitted cli...Nucleus Security Vulnerability Intelligence APIPublic, unauthenticated read API behind the Nucleus Security vulnerability intelligence dataset - CVE recor...Trellix Insights APIAPI for accessing threat intelligence, security analytics, and insights from the Trellix threat research pl...Trellix IOC (Indicators of Compromise) APIREST API interface for managing indicators of compromise within the Trellix security platform. Enables uplo...Trellix Threat Intelligence Exchange (TIE) APIAPI for Trellix Threat Intelligence Exchange which acts as a reputation broker enabling real-time sharing o...Silent Push APIUnified REST gateway for Silent Push threat intelligence. Sections cover Enrich (single and bulk domain, IP...Silent Push MCP ServerSaaS-hosted Model Context Protocol server announced in Release 6.0 (2026-06-12, beta). Exposes 33 read-only...Digital Shadows SearchLight Portal APIREST API of the Digital Shadows SearchLight digital-risk-protection portal, operated by ReliaQuest since it...
Thin 16 Limited public surface area
AT&T Mobility Threat and Anomaly Detection APIUses machine learning to identify threats and unusual activity on mobile devices on the AT&T network. Provi...SniffCat REST APIDocumented, versioned REST API (/api/v1/*) for checking IPs, retrieving blacklist feeds and report history,...Intezer Platform APIIntezer Platform API 2.0 — submit files, URLs, hashes and endpoint scans for autonomous malware analysis an...McAfee Threat Intelligence Exchange (TIE) APIReal-time threat intelligence sharing and reputation services API.CISA Automated Indicator Sharing (AIS) TAXII ServerCISA's Automated Indicator Sharing (AIS) program uses a TAXII 2.1 server to deliver STIX-formatted cyber th...CISA Cybersecurity AdvisoriesCISA publishes Cybersecurity Advisories (CSAs), Industrial Control Systems Advisories (ICSAs), and Common S...Check Point Threat Hunting APIREST API for the Check Point Threat Hunting (TH) platform exposing threat intelligence, indicators, and hun...Uptycs Platform APIPer-customer JSON REST API over each Uptycs stack covering alerts and alert rules, events and event rules, ...Netscout Arbor Sightline SP REST APIREST API for DDoS detection, mitigation, and threat intelligence on the Arbor Sightline platform. Provides ...Netscout Omnis Cyber Intelligence APIOpen API surface for the Omnis Cyber Intelligence NDR platform, enabling network investigation and adding n...QAX Threat Intelligence APIREST threat-intelligence API from the QAX Threat Intelligence Center. Provides IP reputation, domain and UR...QAX Threat Intelligence MCP ServiceHosted Model Context Protocol server published by the QAX Threat Intelligence Center, announced on the QAX ...Dataminr Pulse APIOAuth2-secured REST API for consuming Dataminr real-time alerts and managing watchlists/lists. Token flow a...Strider MCPStrider's hosted Model Context Protocol server, published at app.striderintel.com/app-api/mcp. It advertise...Strider Shield APIShield is Strider's curated nation-state threat-intelligence dataset — high-risk email addresses, malicious...IPregistry IP Geolocation and Threat Intelligence APIA REST API that resolves IPv4/IPv6 addresses and Autonomous System Numbers to rich intelligence including g...
Emerging 6 Early or largely undocumented
Flashpoint APIFlashpoint's REST API exposes threat intelligence, compromised credentials, vulnerability, and fraud data p...Lastline Analyst APIWeb API for submitting files (PE, PDF, Office documents, Flash, Java applets, Android applications, archive...CNMF Malware Sharing via VirusTotalThe U.S. Cyber Command Cyber National Mission Force (CNMF) shares unclassified malware samples on VirusTota...SearchLight Portal APIThe Digital Shadows SearchLight Portal API — the REST surface behind the SearchLight / GreyMatter DRP porta...Nisos Ascend External APICredential-gated HTTPS API behind the Nisos Ascend human risk management platform. Its existence and base U...FireHOL IP ListsPublic IP blocklist feeds (ipset/netset files) for attacks, abuse, malware, botnets, open proxies and anony...
Minimal 1 Almost no public developer surface
Companies reaching this through an API (7)
These companies publish an API, specification or operation carrying “Threat Intelligence” but do not classify their business under it. Listed unranked and kept out of the count above, because one tagged operation is not a statement about what a company does.
Score breakdown
Frequency
58.5
log-scaled weighted occurrences
Breadth
1.7
spread across providers
Quality lift
36.7
mean composite of providers using it
Cohesion
0.0
strength of nearest seed neighbor
Where this tag sits
Related tags
Cybersecurity 89 co-occurrences
Vulnerability Management 23 co-occurrences
Incident Response 18 co-occurrences
Attack Surface Management 14 co-occurrences
Security Operations 15 co-occurrences
Endpoint Security 14 co-occurrences
SIEM 13 co-occurrences
CVE 10 co-occurrences
Where this tag comes from
Provider tag129
Api tag77
Openapi tag3
Openapi op tag15
Markets provisional
Kin Score markets whose measured providers carry this tag. Share is the fraction of the market's measured providers that carry it — it describes the market, not this tag.
| Market | Share of the market's providers |
|---|---|
| Security (EDR, SIEM, SOAR) | 32% |
| Domains and DNS (registrars, registries, DNS) | 20% |
Cohort brief
Auto-generatedThe 121 providers in the APIs.io catalog tagged Threat Intelligence, scored on the Kin Score. Every figure below is computed from the catalog — nothing here is written.
Providers
121
of 129 in the catalog
Mean Kin Score
37.9
+13.8 vs catalog 24.1
Mean Agent Readiness
22.3
+8.2 vs catalog 14.1
Spread
2.2–71.6
median 39 · σ 18.8
How the 121 split by band
Exemplar 6Strong 23Developing 31Thin 25Emerging 25Minimal 11
Facet averages, against the whole catalog
| Facet | This cohort | Catalog | Difference | Scored |
|---|---|---|---|---|
| Developer Ergonomics | 42.1 | 24.5 | +17.6 | 121 |
| Operational Transparency | 26.6 | 13.2 | +13.4 | 121 |
| Contract Quality | 31.1 | 18.6 | +12.5 | 121 |
| Access Clarity | 41.3 | 30 | +11.3 | 121 |
| Discoverability | 69.2 | 59.1 | +10.1 | 121 |
| Contract Governance | 16.5 | 9.7 | +6.8 | 121 |
A facet is averaged over the members that carry it, not over the whole cohort — the “Scored” column is that count. Averaging an absent facet as zero would score our own coverage gaps as the providers’ posture.
What this cohort publishes
| Artifact | This cohort | Catalog | Difference |
|---|---|---|---|
| MCP server (any) | 29% | 18% | +11 |
| MCP server (first-party) | 27% | 16% | +11 |
| Agent Skills | 0% | 0% | 0 |
| OAuth scopes | 16% | 13% | +3 |
| Security | 98% | 99% | -1 |
| Arazzo workflows | 5% | 1% | +4 |
| Governance rules | 55% | 36% | +19 |
mcp_pct counts any mcp/ artifact including ones API Evangelist derived from the provider OpenAPI; mcp_first_party_pct counts only servers the provider publishes. Prefer the latter.
Top by Kin Score
- 1 Recorded Future 71.6
- 2 Cisco XDR 68.9
- 3 Palo Alto Networks 68.8
- 4 Feedly 68
- 5 Microsoft Defender 67.9
- 6 CrowdStrike 67.2
- 7 Censys 65.5
- 8 DomScan 65.3
- 9 Nord Security 65.3
- 10 isMalicious 65
Top by Agent Readiness
- 1 DomScan 72.6
- 2 Feedly 65.3
- 3 Recorded Future 58.8
- 4 Whisper Security 57.6
- 5 DomainTools 55.5
- 6 HoneyLabs 51.9
- 7 IRONSCALES 50.5
- 8 Nucleus Security 48.9
- 9 Securonix 46.8
- 10 IPGeolocation.io 45.3
All 129 members of this roster resolve to a provider in the
catalog; 121 carry a score (94%).
The figures above describe the scored members only.
Coverage caveat. 84 of 121 scored members had under half their catalog-attributable points satisfied at all (catalog_earned / catalog_max < 0.5). They are INCLUDED in the mean above. A large share here means the cohort mean is partly a measurement of how far our enrichment reached, not only of how these providers publish.Generated from the catalog build of 14 November 2026, across 41591 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.
Coverage caveat. 84 of 121 scored members had under half their catalog-attributable points satisfied at all (catalog_earned / catalog_max < 0.5). They are INCLUDED in the mean above. A large share here means the cohort mean is partly a measurement of how far our enrichment reached, not only of how these providers publish.Generated from the catalog build of 14 November 2026, across 41591 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.
Work with this as data
Every tag here is available over the APIs.io API and to AI agents over MCP.