Threat Intelligence
Business capabilities this tag reaches
Cybersecurity Management 2
Variants seen in the corpus:
cyber-threat-intelligenceThreat Intelligence
Providers using this tag (119)
Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.
Exemplar 2 Complete, well-documented, and agent-ready
Strong 15 Solid coverage with minor gaps
Developing 32 Usable, with meaningful gaps to close
CywareFiligranAnomaliCybleIPGeolocation.ioBase OperationsCrowdsecVirusTotalWebz.ioAbnormal AIGreyNoise IntelligenceUpGuardHackNoticeLevelBluePicus SecurityMicrosoft DefenderDomainToolsHave I Been PwnedInfobloxDoppelDragosIPstackKodexSplunk SOARAbuseIPDBArctic WolfKenna SecurityTrellixRed CanaryProofpointSpyCloudSilent Push
Thin 29 Limited public surface area
StairwellBitSightCloudsekNetscoutIPregistryFlashpointIPQualityScoreThreatConnectNetographyReliaQuestMcAfee (Trellix)Ocean SecurityDemistoCertiKSniffCatSecuronixNucleus SecurityIntezerKoi SecuritywatchTowrCompleteDNSCoalitionSecureworksCybersecurity and Infrastructure Security AgencyEmpirical SecurityLookoutDeepwatchDataminreSentire
Emerging 23 Early or largely undocumented
Minimal 17 Almost no public developer surface
Unrated 1 Not yet scored
APIs with this tag (74)
Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →
Exemplar 1 Complete, well-documented, and agent-ready
Strong 32 Solid coverage with minor gaps
Recorded Future Alert APIThe Alert API allows for interacting with Recorded Future Alerts and Alert rules. Please read the [document...Recorded Future Analyst Note APIA Recorded Future API for creating, fetching, editing and deleting Analyst Notes. Please read the [Recorded...Recorded Future ASI Project APIThe Attack Surface Intelligence (ASI) Project API is designed to allow you full-featured access to all of t...Recorded Future Autonomous Threat Operations APIAPIs for interacting with Recorded Future Autonomous Threat OperationsRecorded Future CaseCase — part of the Recorded Future API documented at docs.recordedfuture.com. A very descriptive descriptio...Recorded Future Collective Insights APISubmit events captured by your security tools to your organization's Recorded Future enterprise. Collective...Recorded Future Common Platform Enumeration APIs V0Common Platform Enumeration APIs V0 — part of the Recorded Future API documented at docs.recordedfuture.com.Recorded Future Customer APIs V0Customer APIs V0 — part of the Recorded Future API documented at docs.recordedfuture.com.Recorded Future Customer APIs V2Customer APIs V2 — part of the Recorded Future API documented at docs.recordedfuture.com.Recorded Future Detection Rule APIThe Detection Rule API allows clients to programmatically search for and download YARA, Sigma, and Snort ru...Recorded Future Detection Rule Relation APIAPI to fetch entities and types associated with detection rulesRecorded Future Entity Match APIExternal API for integrations and clients to lookup entity IDs by name and/or type, and also to find entiti...Recorded Future Fusion APIA Recorded Future API for managing Fusion flows, files and custom blocks Please read the [detailed support ...Recorded Future Identity APIAPI to lookup identity leaks data. [Identity API](https://support.recordedfuture.com/hc/en-us/articles/4402...Recorded Future Intelligence Cloud APIThe Recorded Future Intelligence Cloud REST API (api.recordedfuture.com) provides programmatic access to th...Recorded Future Links APIAn API to retrieve verified links between entities. Links may come from technical analysis of cyber threats...Recorded Future List APIExternal List API for reading and writing user lists Please read the [detailed support article](https://sup...Recorded Future Malware IntelligenceA Recorded Future API for Malware Intelligence. The Malware Intelligence API provides programmatic access t...Recorded Future Mastercard Riskrecon APIRiskRecon provides organizations with frequent, comprehensive, actionable visibility into the security qual...Recorded Future Payment Fraud Intelligence APIPayment Fraud Intelligence API — part of the Recorded Future API documented at docs.recordedfuture.com.Recorded Future Playbook AlertsA Recorded Future API for Playbook Alerts. The playbook alert API provides programmatic access to Recorded ...Recorded Future recorded-future-sandbox-api-secopstiRecorded Future Sandbox API (formerly Hatching Tria.ge). Provides malware analysis capabilities including f...Recorded Future Risk APIA Recorded Future API for fetching risk and risk risk history information.Recorded Future Soar APIThe SOAR API is designed for high throughput risk checks using Recorded Future's threat intelligence in bul...Recorded Future Threat APIExternal API to retrieve threat data such as threat maps, threat actors and their categories. Please read t...Feedly Threat Graph MCP ServerHosted, remote Model Context Protocol server exposing the Feedly Real-Time Threat Graph to AI agents. Feedl...CybelAngel Threat Intelligence APIFetch threat intelligence data from the CybelAngel platform.WhisperGraph and Control Plane (Cypher API)The documented front door for both halves of the platform: POST https://graph.whisper.online/api/query runs...WhisperGraph MCP ServerHosted remote MCP server at https://mcp.whisper.security (Streamable HTTP, protocol revisions up to 2025-11...Splunk Intelligence Management APIThe Splunk Intelligence Management (formerly ThreatStream) API provides REST v2.0 endpoints for managing th...Juniper Networks Threat Intelligence APIThreat feed and intelligence dataNordStellar MCP ServerRemote MCP server that lets any MCP-compatible assistant query the NordStellar platform in natural language...
Developing 19 Usable, with meaningful gaps to close
Webz.io APIToken-authenticated REST endpoints under https://api.webz.io covering seven products: News, Blogs and Forum...Webz.io Cyber APIDeep and dark web content for threat intelligence. Search endpoint `/cyberFilter`, segmentation `/cyberSeg`...HackNotice MCP ServerRemote Model Context Protocol server operated by HackNotice, speaking JSON-RPC 2.0 over Streamable HTTP at ...LevelBlue Open Threat Exchange (OTX) DirectConnect APIThe OTX DirectConnect API provides programmatic access to the LevelBlue Open Threat Exchange, an open commu...Cyware MCP ServerOpen-source Model Context Protocol server, written in Go and published under MIT by Cyware Labs, that expos...Microsoft Defender Threat Intelligence APIAccess threat intelligence data, indicators of compromise (IOCs), and threat analytics.Infoblox Dossier APIThreat research API that provides contextual information from multiple sources simultaneously for a given i...Infoblox Threat Defense APIAPI for threat intelligence, security analytics, and DNS firewall capabilities. Provides programmatic acces...Infoblox TIDE APIThreat Intelligence Data Exchange (TIDE) API for submitting and retrieving threat indicators. Provides acce...OpenCTI GraphQL APIThe OpenCTI platform exposes a full GraphQL API on the /graphql endpoint for programmatic access to cyber t...Vectra AI Platform APIThe Vectra AI Platform REST API (api.vectra.io) provides programmatic access to detections, hosts, accounts...Microsoft Sentinel Threat Intelligence APIThe Threat Intelligence API from Microsoft Sentinel — 1 operation(s) for threat intelligence.Trellix Insights APIAPI for accessing threat intelligence, security analytics, and insights from the Trellix threat research pl...Trellix IOC (Indicators of Compromise) APIREST API interface for managing indicators of compromise within the Trellix security platform. Enables uplo...Trellix Threat Intelligence Exchange (TIE) APIAPI for Trellix Threat Intelligence Exchange which acts as a reputation broker enabling real-time sharing o...Emerging Threats (ET) Intelligence Query API v1The ET Intelligence Query API is Proofpoint's threat-intelligence lookup service, reached at api.emergingth...Proofpoint Targeted Attack Protection (TAP) API v2The TAP v2 API exposes the Threat Insight Dashboard to machines: SIEM event download (blocked/permitted cli...Silent Push APIUnified REST gateway for Silent Push threat intelligence. Sections cover Enrich (single and bulk domain, IP...Silent Push MCP ServerSaaS-hosted Model Context Protocol server announced in Release 6.0 (2026-06-12, beta). Exposes 33 read-only...
Thin 13 Limited public surface area
Digital Shadows SearchLight Portal APIREST API of the Digital Shadows SearchLight digital-risk-protection portal, operated by ReliaQuest since it...McAfee Threat Intelligence Exchange (TIE) APIReal-time threat intelligence sharing and reputation services API.SniffCat REST APIDocumented, versioned REST API (/api/v1/*) for checking IPs, retrieving blacklist feeds and report history,...Intezer Platform APIIntezer Platform API 2.0 — submit files, URLs, hashes and endpoint scans for autonomous malware analysis an...Check Point Threat Hunting APIREST API for the Check Point Threat Hunting (TH) platform exposing threat intelligence, indicators, and hun...CISA Automated Indicator Sharing (AIS) TAXII ServerCISA's Automated Indicator Sharing (AIS) program uses a TAXII 2.1 server to deliver STIX-formatted cyber th...CISA Cybersecurity AdvisoriesCISA publishes Cybersecurity Advisories (CSAs), Industrial Control Systems Advisories (ICSAs), and Common S...Netscout Arbor Sightline SP REST APIREST API for DDoS detection, mitigation, and threat intelligence on the Arbor Sightline platform. Provides ...Netscout Omnis Cyber Intelligence APIOpen API surface for the Omnis Cyber Intelligence NDR platform, enabling network investigation and adding n...Uptycs Platform APIPer-customer JSON REST API over each Uptycs stack covering alerts and alert rules, events and event rules, ...Dataminr Pulse APIOAuth2-secured REST API for consuming Dataminr real-time alerts and managing watchlists/lists. Token flow a...IPregistry IP Geolocation and Threat Intelligence APIA REST API that resolves IPv4/IPv6 addresses and Autonomous System Numbers to rich intelligence including g...Flashpoint APIFlashpoint's REST API exposes threat intelligence, compromised credentials, vulnerability, and fraud data p...
Emerging 8 Early or largely undocumented
Strider MCPStrider's hosted Model Context Protocol server, published at app.striderintel.com/app-api/mcp. It advertise...Strider Shield APIShield is Strider's curated nation-state threat-intelligence dataset — high-risk email addresses, malicious...Lastline Analyst APIWeb API for submitting files (PE, PDF, Office documents, Flash, Java applets, Android applications, archive...CNMF Malware Sharing via VirusTotalThe U.S. Cyber Command Cyber National Mission Force (CNMF) shares unclassified malware samples on VirusTota...SearchLight Portal APIThe Digital Shadows SearchLight Portal API — the REST surface behind the SearchLight / GreyMatter DRP porta...QAX Threat Intelligence APIREST threat-intelligence API from the QAX Threat Intelligence Center. Provides IP reputation, domain and UR...QAX Threat Intelligence MCP ServiceHosted Model Context Protocol server published by the QAX Threat Intelligence Center, announced on the QAX ...Nisos Ascend External APICredential-gated HTTPS API behind the Nisos Ascend human risk management platform. Its existence and base U...
Minimal 1 Almost no public developer surface
Companies reaching this through an API (6)
These companies publish an API, specification or operation carrying “Threat Intelligence” but do not classify their business under it. Listed unranked and kept out of the count above, because one tagged operation is not a statement about what a company does.
Score breakdown
Frequency
61.3
log-scaled weighted occurrences
Breadth
2.7
spread across providers
Quality lift
35.2
mean composite of providers using it
Cohesion
0.0
strength of nearest seed neighbor
Where this tag sits
Related tags
Cybersecurity 84 co-occurrences
Security Operations 15 co-occurrences
Incident Response 17 co-occurrences
Vulnerability Management 21 co-occurrences
Attack Surface Management 13 co-occurrences
SOAR 10 co-occurrences
Email Security 11 co-occurrences
Endpoint Security 13 co-occurrences
Where this tag comes from
Provider tag122
Api tag74
Openapi tag3
Openapi op tag7
Markets provisional
Kin Score markets whose measured providers carry this tag. Share is the fraction of the market's measured providers that carry it — it describes the market, not this tag.
| Market | Share of the market's providers |
|---|---|
| Security (EDR, SIEM, SOAR) | 32% |
| Domains and DNS (registrars, registries, DNS) | 20% |
Cohort brief
Auto-generatedThe 114 providers in the APIs.io catalog tagged Threat Intelligence, scored on the Kin Score. Every figure below is computed from the catalog — nothing here is written.
Providers
114
of 119 in the catalog
Mean Kin Score
34.7
+12.5 vs catalog 22.2
Mean Agent Readiness
20.9
+8.9 vs catalog 12
Spread
2.2–68.3
median 35.6 · σ 17
How the 114 split by band
Exemplar 2Strong 15Developing 32Thin 29Emerging 23Minimal 13
Facet averages, against the whole catalog
| Facet | This cohort | Catalog | Difference | Scored |
|---|---|---|---|---|
| Developer Ergonomics | 39.6 | 23.2 | +16.4 | 114 |
| Operational Transparency | 25.4 | 13 | +12.4 | 114 |
| Contract Quality | 28.5 | 17.2 | +11.3 | 114 |
| Access Clarity | 33.9 | 23.9 | +10 | 114 |
| Discoverability | 67.6 | 57.9 | +9.7 | 114 |
| Contract Governance | 11.1 | 6.5 | +4.6 | 114 |
A facet is averaged over the members that carry it, not over the whole cohort — the “Scored” column is that count. Averaging an absent facet as zero would score our own coverage gaps as the providers’ posture.
What this cohort publishes
| Artifact | This cohort | Catalog | Difference |
|---|---|---|---|
| MCP server (any) | 28% | 13% | +15 |
| MCP server (first-party) | 26% | 12% | +14 |
| Agent Skills | 0% | 0% | 0 |
| OAuth scopes | 16% | 11% | +5 |
| Security | 97% | 98% | -1 |
| Arazzo workflows | 4% | 2% | +2 |
| Governance rules | 22% | 16% | +6 |
mcp_pct counts any mcp/ artifact including ones API Evangelist derived from the provider OpenAPI; mcp_first_party_pct counts only servers the provider publishes. Prefer the latter.
Top by Kin Score
- 1 Cisco XDR 68.3
- 2 Palo Alto Networks 68.2
- 3 CrowdStrike 65.6
- 4 Recorded Future 64.3
- 5 Cisco Umbrella 62.7
- 6 DomScan 61.8
- 7 Feedly 59.6
- 8 CybelAngel 59.5
- 9 Whisper Security 59.3
- 10 Cisco PSIRT openVuln API 57.9
Top by Agent Readiness
- 1 DomScan 70.2
- 2 Feedly 65.3
- 3 Whisper Security 57.6
- 4 Recorded Future 56.1
- 5 DomainTools 55.5
- 6 IRONSCALES 50.5
- 7 Nord Security 42.9
- 8 CybelAngel 42.7
- 9 Securonix 42.7
- 10 Anomali 41.4
All 119 members of this roster resolve to a provider in the
catalog; 114 carry a score (96%).
The figures above describe the scored members only.
Coverage caveat. 94 of 114 scored members had under half their catalog-attributable points satisfied at all (catalog_earned / catalog_max < 0.5). They are INCLUDED in the mean above. A large share here means the cohort mean is partly a measurement of how far our enrichment reached, not only of how these providers publish.Generated from the catalog build of 24 October 2026, across 31984 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.
Coverage caveat. 94 of 114 scored members had under half their catalog-attributable points satisfied at all (catalog_earned / catalog_max < 0.5). They are INCLUDED in the mean above. A large share here means the cohort mean is partly a measurement of how far our enrichment reached, not only of how these providers publish.Generated from the catalog build of 24 October 2026, across 31984 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.
Work with this as data
Every tag here is available over the APIs.io API and to AI agents over MCP.