emerging · -1.1

Threat Intelligence

Score 23.4 / 100 109 providers +8 via APIs 48 APIs Search apis.io →
Variants seen in the corpus: Threat IntelligenceThreatIntelligence

Providers using this tag (109)

Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.

Exemplar 3 Complete, well-documented, and agent-ready
Palo Alto NetworksCloud SecurityCybersecurityFirewallNetwork Security468 APIs71.1IPinfoIP IntelligenceIP GeolocationASNPrivacy Detection1 API67.5ShodanSecuritySearchInternetDevices5 APIs67.2
Strong 8 Solid coverage with minor gaps
Cisco XDRSecurityXDRThreat DetectionIncident Response12 APIs62.9FeedlyCybersecuritycyber-threat-intelligenceContent Aggregation36 APIs59.4Cisco UmbrellaSecurityDNSSecure Web GatewayCloud Security52 APIs59.3GreyNoise IntelligenceSecurityCybersecurityIP Reputation1 API59.3DomScanDomainsDNSWHOISrdap1 API56.7CybelAngelCompanyCybersecurityexternal-attack-surface-management7 APIs54.7Nord SecurityCybersecurityDark Web MonitoringAttack Surface Management7 APIs54.7AbuseIPDBAnti MalwareBlacklistCybersecurityIP Reputation1 API54.4
Developing 31 Usable, with meaningful gaps to close
IPGeolocation.ioGeocodingIP GeolocationIP IntelligenceIP Security7 APIs53.9Cisco PSIRT openVuln APISecurityVulnerability ManagementDisclosure1 API53.3IRONSCALESEmail SecurityCybersecurityPhishingAnti-Phishing10 APIs52.7Abnormal AICompanySecurityEmail SecurityCybersecurity1 API51.7HackNoticeCompanySecurityCybersecurity1 API51.3Have I Been PwnedSecurityData BreachesPwned PasswordsIdentity3 APIs51.3ArmorCompanyCybersecurityManaged Detection and ResponseCloud Security16 APIs51.1VirusTotalAnti MalwareSecurityFile Analysis7 APIs50.9UpGuardCompanyCybersecurityThird-Party Risk ManagementAttack Surface Management1 API50.4CoalitionCyber InsuranceInsuranceInsurtechRisk Management1 API50.2Webz.ioNews DataWeb DataWeb ScrapingDark Web2 APIs50.0KodexCompanyLaw EnforcementComplianceLegal2 APIs49.4InfobloxCloudDDIDHCPDNS1 API49.1DomainToolsCompanyDomain IntelligenceDNS4 APIs48.5VulnCheckCompanySecurityVulnerability IntelligenceExploit Intelligence1 API48.4Picus SecurityCybersecuritySecurity ValidationBreach and Attack SimulationAdversarial Exposure Validation15 APIs47.9KnosticCompanySecurityArtificial IntelligenceAI Agents1 API47.7EmailRepSecurityEmailEmail Reputation1 API47.5LevelBlueCompanyEnterpriseCybersecuritySecurity1 API47.3Cywarecyber-threat-intelligenceCybersecuritySecurity Operations2 APIs47.1FiligranCompanyCybersecurityOpenCTI2 APIs45.7DragosCompanyCybersecurityOT SecurityICS1 API45.6TrellixCloud SecurityCybersecurityEndpoint SecurityThreat Detection2 APIs43.6DoppelCompanySecurityCybersecurityDigital Risk Protection1 API43.1CybleCybersecurityAttack Surface ManagementInternet Scanning2 APIs42.8IPstackGeocodingIP GeolocationLocation2 APIs42.8Splunk SOARSecuritySOARAutomationOrchestration1 API42.0Arctic WolfCompanySecurityCybersecurityManaged Detection and Response1 API41.9Base OperationsCompanySecurityRisk Management1 API41.7Cybersecurity and Infrastructure Security AgencyAdvisoriesAISBinding Operational DirectiveCSAF1 API40.8McAfee (Trellix)AntivirusCybersecurityEndpoint ProtectionSecurity4 APIs39.4
Thin 26 Limited public surface area
SpyCloudCybersecurityIdentityFraud Prevention18 APIs38.7Red CanaryCompanySecurityCybersecurityManaged Detection and Response1 API38.2NetographyNetwork SecurityNetwork Detection and ResponseCloud SecurityNetwork Observability1 API37.6DemistoCompanySecuritySOARIncident Response1 API37.5IPQualityScoreFraud PreventionIP ReputationProxy DetectionEmail Validation1 API37.5Ocean SecurityCompanySecurityEmail SecurityCybersecurity1 API37.3Silent PushCompanySecurityCybersecurity2 APIs37.2CompleteDNSDNSDNS HistoryDomain IntelligenceDomains2 APIs37.1IPregistryIP GeolocationIP AddressASN1 API36.6Nucleus SecurityCompanySecurityCybersecurityVulnerability Management2 APIs35.5SecureworksCybersecurityXDRThreat DetectionSecurity Operations1 API35.2Koi SecurityCompanySecurityEndpoint SecuritySupply Chain Security1 API35.0SniffCatIP Reputationabuse-databaseCybersecurity1 API34.6StairwellCompanySecurityMalware Analysis1 API34.6watchTowrCompanySecurityCybersecurityAttack Surface Management1 API34.6CertiKCompanyCybersecurityWeb3Blockchain1 API34.0SecuronixSecuritySIEMUEBASOAR4 APIs34.0ipbaseIP GeolocationIP AddressGeolocationSecurity1 API32.3ProofpointSecurityCybersecurityEmail Security7 APIs30.6NetscoutCybersecurityDDoS ProtectionNetwork MonitoringNetwork Performance8 APIs29.8Empirical SecurityCompanySecurityCybersecurityVulnerability Management1 API29.4IntezerCompanyCybersecuritySecurityMalware Analysis1 API29.2BitSightCompanySecurityCyber RiskSecurity Ratings1 API29.1LookoutCompanyCybersecurityMobile SecurityEndpoint Security1 API27.7Quadrant APIAlertsSecurity1 API27.2DataminrCompanyAnalyticsRisk1 API27.1
Emerging 25 Early or largely undocumented
DeepwatchCompanyCybersecurityManaged Detection and ResponseSecurity Operations1 API26.0US Cyber CommandCybersecurityFederal-GovernmentMilitary2 APIs24.5WebrootCompanyCybersecurityEndpoint Protection1 API24.4AlienVaultCompanySecurityCybersecurity1 API24.3StriderCompanyStrategic IntelligenceRisk Management2 APIs23.9LastlineCompanyCybersecurityMalware AnalysisSandboxing1 API23.5eSentireCompanySecurityCybersecurityManaged Detection and Response1 API22.8Recorded FutureCybersecurityIntelligence CloudBrand Intelligence1 API22.7Kenna SecurityCompanyCybersecurityVulnerability ManagementRisk-Based Prioritization1 API19.9Agari DataCompanyEmail SecurityPhishing ProtectionDMARC1 API19.6Digital ShadowsCompanyCybersecurityDigital Risk Protection1 API19.5NisosHuman Risk ManagementInsider ThreatExecutive Protection1 API19.5OnticCompanySecurityPhysical SecurityProtective Intelligence19.3Authentic8CompanySecurityCybersecuritySecure Browser19.1Qi AnxinCompanySecurityCybersecurity2 APIs18.7Upstream SecurityCompanySecurityCybersecurityAutomotive18.1MandiantCompanySecurityCybersecurity2 APIs17.3360 PrivacyCompanyPrivacyData RemovalExecutive Protection16.9AnomaliCompanyEnterpriseCybersecurity1 API16.2Bluecoat (Symantec)CompanySecurityWeb SecuritySecure Web Gateway14.5Abstract SecuritySecurityCybersecuritySIEMSecurity Data Pipeline14.3Efflux SystemsCompanySecurityCybersecurityAttack Surface Management1 API13.3FlashpointCompanyCybersecuritySecurity1 API13.3OpenDNSCompanyCybersecurityDNSSecurity12.8OuttakeCompanySecurityDigital Risk Protection12.3
Minimal 14 Almost no public developer surface
AletheaCompanyArtificial IntelligenceNarrative Risk10.6Surefire CyberCompanyCybersecurityIncident ResponseDigital Forensics10.5SlashNextCompanySecurityCybersecurityPhishing1 API10.0ThreatTrack SecurityCompanyCybersecurityMalware Analysis9.5Nodal IndustriesCompanySecurityNetwork SecurityCybersecurity7.6BluevoyantCompanyCybersecurityManaged Detection and Response6.9DevSecOpsApplication SecurityAutomationBest PracticesCI/CD5.7RiskIQCompanySecurityAttack Surface Management5.7PhishMeCompanyCybersecurityPhishingEmail Security5.5Signify GroupSportsOnline AbuseContent Moderation5.5HuaunCompanyEnterpriseCybersecurityAttack Surface Management5.0iSIGHT SecurityCompanyCybersecuritySecurity5.0Terbium LabsCompanyCybersecurityDark WebDigital Risk Protection5.0Veriti.aiCompanyCybersecurityExposure ManagementVulnerability Management5.0
Unrated 2 Not yet scored
Morta SecurityCompanySecurityCybersecuritySkybox SecurityCompanySecurityCybersecurityNetwork Security

APIs with this tag (46)

Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →

Exemplar 1 Complete, well-documented, and agent-ready
AutoFocus API (Deprecated)A threat intelligence API that provided contextual information about malware, campaigns, and threat actors ...71.1
Strong 4 Solid coverage with minor gaps
Feedly Threat Graph MCP ServerHosted, remote Model Context Protocol server exposing the Feedly Real-Time Threat Graph to AI agents. Feedl...59.4DomScan APIREST domain-intelligence API (40+ endpoints under /v1) for availability, DNS, WHOIS/RDAP, SSL/TLS, email au...56.7CybelAngel Threat Intelligence APIFetch threat intelligence data from the CybelAngel platform.54.7NordStellar MCP ServerRemote MCP server that lets any MCP-compatible assistant query the NordStellar platform in natural language...54.7
Developing 19 Usable, with meaningful gaps to close
HackNotice MCP ServerRemote Model Context Protocol server operated by HackNotice, speaking JSON-RPC 2.0 over Streamable HTTP at ...51.3Webz.io APIToken-authenticated REST endpoints under https://api.webz.io covering seven products: News, Blogs and Forum...50.0Infoblox Dossier APIThreat research API that provides contextual information from multiple sources simultaneously for a given i...49.1Infoblox Threat Defense APIAPI for threat intelligence, security analytics, and DNS firewall capabilities. Provides programmatic acces...49.1Infoblox TIDE APIThreat Intelligence Data Exchange (TIDE) API for submitting and retrieving threat indicators. Provides acce...49.1Microsoft Defender Threat Intelligence APIAccess threat intelligence data, indicators of compromise (IOCs), and threat analytics.48.5LevelBlue Open Threat Exchange (OTX) DirectConnect APIThe OTX DirectConnect API provides programmatic access to the LevelBlue Open Threat Exchange, an open commu...47.3Cyware MCP ServerOpen-source Model Context Protocol server, written in Go and published under MIT by Cyware Labs, that expos...47.1OpenCTI GraphQL APIThe OpenCTI platform exposes a full GraphQL API on the /graphql endpoint for programmatic access to cyber t...45.7Splunk Intelligence Management APIThe Splunk Intelligence Management (formerly ThreatStream) API provides REST v2.0 endpoints for managing th...45.3Microsoft Sentinel ThreatIntelligence APIThe ThreatIntelligence API from Microsoft Sentinel — 1 operation(s) for threatintelligence.44.5Trellix Insights APIAPI for accessing threat intelligence, security analytics, and insights from the Trellix threat research pl...43.6Trellix IOC (Indicators of Compromise) APIREST API interface for managing indicators of compromise within the Trellix security platform. Enables uplo...43.6Trellix Threat Intelligence Exchange (TIE) APIAPI for Trellix Threat Intelligence Exchange which acts as a reputation broker enabling real-time sharing o...43.6Juniper Networks Threat Intelligence APIThreat feed and intelligence data43.0Vectra AI Platform APIThe Vectra AI Platform REST API (api.vectra.io) provides programmatic access to detections, hosts, accounts...41.3CISA Automated Indicator Sharing (AIS) TAXII ServerCISA's Automated Indicator Sharing (AIS) program uses a TAXII 2.1 server to deliver STIX-formatted cyber th...40.8CISA Cybersecurity AdvisoriesCISA publishes Cybersecurity Advisories (CSAs), Industrial Control Systems Advisories (ICSAs), and Common S...40.8McAfee Threat Intelligence Exchange (TIE) APIReal-time threat intelligence sharing and reputation services API.39.4
Thin 11 Limited public surface area
Silent Push APIUnified REST gateway for Silent Push threat intelligence. Sections cover Enrich (single and bulk domain, IP...37.2Silent Push MCP ServerSaaS-hosted Model Context Protocol server announced in Release 6.0 (2026-06-12, beta). Exposes 33 read-only...37.2IPregistry IP Geolocation and Threat Intelligence APIA REST API that resolves IPv4/IPv6 addresses and Autonomous System Numbers to rich intelligence including g...36.6Check Point Threat Hunting APIREST API for the Check Point Threat Hunting (TH) platform exposing threat intelligence, indicators, and hun...36.4Lookip APIREST/HTTP IP intelligence API with LITE and MAX lookup tiers, batch lookups, and keyless public ASN endpoin...35.6SniffCat REST APIDocumented, versioned REST API (/api/v1/*) for checking IPs, retrieving blacklist feeds and report history,...34.6Netscout Arbor Sightline SP REST APIREST API for DDoS detection, mitigation, and threat intelligence on the Arbor Sightline platform. Provides ...29.8Netscout Omnis Cyber Intelligence APIOpen API surface for the Omnis Cyber Intelligence NDR platform, enabling network investigation and adding n...29.8Intezer Platform APIIntezer Platform API 2.0 — submit files, URLs, hashes and endpoint scans for autonomous malware analysis an...29.2Dataminr Pulse APIOAuth2-secured REST API for consuming Dataminr real-time alerts and managing watchlists/lists. Token flow a...27.1Uptycs Platform APIPer-customer JSON REST API over each Uptycs stack covering alerts and alert rules, events and event rules, ...26.7
Emerging 10 Early or largely undocumented
CNMF Malware Sharing via VirusTotalThe U.S. Cyber Command Cyber National Mission Force (CNMF) shares unclassified malware samples on VirusTota...24.5Strider MCPStrider's hosted Model Context Protocol server, published at app.striderintel.com/app-api/mcp. It advertise...23.9Strider Shield APIShield is Strider's curated nation-state threat-intelligence dataset — high-risk email addresses, malicious...23.9Lastline Analyst APIWeb API for submitting files (PE, PDF, Office documents, Flash, Java applets, Android applications, archive...23.5Recorded Future Intelligence Cloud APIThe Recorded Future Intelligence Cloud REST API (api.recordedfuture.com) provides programmatic access to th...22.7Nisos Ascend External APICredential-gated HTTPS API behind the Nisos Ascend human risk management platform. Its existence and base U...19.5SearchLight Portal APIThe Digital Shadows SearchLight Portal API — the REST surface behind the SearchLight / GreyMatter DRP porta...19.5QAX Threat Intelligence APIREST threat-intelligence API from the QAX Threat Intelligence Center. Provides IP reputation, domain and UR...18.7QAX Threat Intelligence MCP ServiceHosted Model Context Protocol server published by the QAX Threat Intelligence Center, announced on the QAX ...18.7Flashpoint APIFlashpoint's REST API exposes threat intelligence, compromised credentials, vulnerability, and fraud data p...13.3
Minimal 1 Almost no public developer surface
SlashNext On-demand Threat Intelligence (OTI) APIRESTful phishing threat intelligence API. Look up URL/host reputation, run real-time SEER-engine URL scans ...10.0

Companies reaching this through an API (8)

These companies publish an API, specification or operation carrying “Threat Intelligence” but do not classify their business under it. Listed unranked and kept out of the count above, because one tagged operation is not a statement about what a company does.

Check Point Juniper Networks Lookip Microsoft Defender Microsoft Sentinel Splunk Uptycs Vectra AI

Score breakdown

Frequency
60.0
log-scaled weighted occurrences
Breadth
3.0
spread across providers
Quality lift
38.0
mean composite of providers using it
Cohesion
0.0
strength of nearest seed neighbor

Related tags

Cybersecurity 81 co-occurrences Vulnerability Management 21 co-occurrences Incident Response 16 co-occurrences Attack Surface Management 12 co-occurrences SOAR 10 co-occurrences Security Operations 12 co-occurrences Email Security 11 co-occurrences SIEM 12 co-occurrences

Where this tag comes from

Provider tag109
Api tag48
Openapi tag3
Openapi op tag7

Cohort brief

Auto-generated

The 104 providers in the APIs.io catalog tagged Threat Intelligence, scored on the Kin Score. Every figure below is computed from the catalog — nothing here is written.

Providers
104
all scored
Mean Kin Score
34.4
+10.5 vs catalog 23.9
Mean Agent Readiness
19.5
+7.5 vs catalog 12
Spread
5–71.1
median 35.4 · σ 16.5
How the 104 split by band
Exemplar 3Strong 8Developing 31Thin 26Emerging 25Minimal 11
Facet averages, against the whole catalog
FacetThis cohortCatalogDifferenceScored
Developer Ergonomics 38.8 23.4 +15.4 104
Operational Transparency 26 14 +12 104
Access Clarity 36.9 26.5 +10.4 104
Contract Quality 29.6 19.8 +9.8 104
Discoverability 69.9 61.2 +8.7 104
Contract Governance 11.3 6.4 +4.9 104

A facet is averaged over the members that carry it, not over the whole cohort — the “Scored” column is that count. Averaging an absent facet as zero would score our own coverage gaps as the providers’ posture.

What this cohort publishes
ArtifactThis cohortCatalogDifference
MCP server (any) 24% 10% +14
MCP server (first-party) 27% 13% +14
Agent Skills 0% 0% 0
OAuth scopes 13% 11% +2
Security 99% 97% +2
Arazzo workflows 6% 2% +4
Governance rules 16% 14% +2

mcp_pct counts any mcp/ artifact including ones API Evangelist derived from the provider OpenAPI; mcp_first_party_pct counts only servers the provider publishes. Prefer the latter.

Top by Kin Score
  1. 1 Palo Alto Networks 71.1
  2. 2 IPinfo 67.5
  3. 3 Shodan 67.2
  4. 4 Cisco XDR 62.9
  5. 5 Feedly 59.4
  6. 6 Cisco Umbrella 59.3
  7. 7 GreyNoise Intelligence 59.3
  8. 8 DomScan 56.7
  9. 9 CybelAngel 54.7
  10. 10 Nord Security 54.7
Top by Agent Readiness
  1. 1 Feedly 63.3
  2. 2 IRONSCALES 51.6
  3. 3 Nord Security 43.5
  4. 4 Securonix 42.5
  5. 5 CybelAngel 42.3
  6. 6 Nucleus Security 41.7
  7. 7 Abnormal AI 41.5
  8. 8 Armor 40.4
  9. 9 Palo Alto Networks 39.4
  10. 10 DomainTools 39
All 109 members of this roster resolve to a scored provider in the catalog.Generated from the catalog build of 15 September 2026, across 27661 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.

Work with this as data

Every tag here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for tags

7 MCP tools reach this
  • find_tagsBrowse and filter every tag in the catalog.
  • get_cohortThis tag as a scored cohort — every provider carrying it, with scores.
  • cohort_statsPRO — the distribution across this tag: mean, median, band split, adoption rates.
  • cohort_rankingsPRO — the leaderboard, on composite AND agent-readiness axes.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This tag 
curl "https://apis.io/api/v1/tags/threat-intelligence"
All tags 
curl "https://apis.io/api/v1/tags?limit=25"
As a scored cohort 
curl "https://apis.io/api/v1/cohorts/tag/threat-intelligence"
The distribution (Pro) 
curl "https://apis.io/api/v1/cohorts/tag/threat-intelligence/stats" \
  -H "X-API-Key: $APIS_IO_KEY"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.