emerging · 1.6

Threat Intelligence

Score 23.5 / 100 103 providers 43 APIs Search apis.io →
Variants seen in the corpus: Threat IntelligenceThreatIntelligencethreat-intelligence

Providers using this tag (103)

Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.

Strong 12 Solid coverage with minor gaps
Palo Alto NetworksCloud SecurityCybersecurityFirewallNetwork Security741 APIs63.7ShodanSecuritySearchInternetDevices15 APIs63.6IPinfoIP IntelligenceIP GeolocationASNPrivacy Detection17 APIs61.9Cisco UmbrellaSecurityDNSSecure Web GatewayCloud Security26 APIs61.1Cisco XDRSecurityXDRThreat DetectionIncident Response50 APIs60.7GreyNoise IntelligenceSecurityCybersecurityIP Reputation10 APIs58.4FeedlyCybersecuritycyber-threat-intelligenceContent Aggregation2 APIs57.5Cisco PSIRT openVuln APISecurityVulnerability ManagementDisclosure3 APIs56.4CybelAngelCompanyCybersecurityexternal-attack-surface-management7 APIs56.4AbuseIPDBAnti MalwareBlacklistCybersecurityIP Reputation4 APIs56.0IRONSCALESEmail SecurityCybersecurityPhishingAnti-Phishing10 APIs56.0Abnormal AICompanySecurityEmail SecurityCybersecurity17 APIs55.0
Developing 29 Usable, with meaningful gaps to close
UpGuardCompanyCybersecurityThird-Party Risk ManagementAttack Surface Management18 APIs53.3Have I Been PwnedSecurityData BreachesPwned PasswordsIdentity16 APIs52.4LevelBlueCompanyEnterpriseCybersecuritySecurity4 APIs52.2IPGeolocation.ioGeocodingIP GeolocationIP IntelligenceIP Security7 APIs51.2Nord SecurityCybersecurityDark Web MonitoringAttack Surface Management10 APIs50.7DomainToolsCompanyDomain IntelligenceDNS12 APIs50.5Picus SecurityCybersecuritySecurity ValidationBreach and Attack SimulationAdversarial Exposure Validation14 APIs50.1KodexCompanyLaw EnforcementComplianceLegal2 APIs50.0KnosticCompanySecurityArtificial IntelligenceAI Agents4 APIs49.7VirusTotalAnti MalwareSecurityFile Analysis35 APIs49.7InfobloxCloudDDIDHCPDNS21 APIs49.6EmailRepSecurityEmailEmail Reputation2 APIs48.4DoppelCompanySecurityCybersecurityDigital Risk Protection7 APIs48.0ArmorCompanyCybersecurityManaged Detection and ResponseCloud Security70 APIs47.4DragosCompanyCybersecurityOT SecurityICS4 APIs47.3Cywarecyber-threat-intelligenceCybersecuritySecurity Operations35 APIs46.9SplunkAnalyticsData AnalysisLoggingMachine Data14 APIs46.5Arctic WolfCompanySecurityCybersecurityManaged Detection and Response3 APIs45.7CybleCybersecurityAttack Surface ManagementInternet Scanning1 API45.0FiligranCompanyCybersecurityOpenCTI2 APIs45.0Base OperationsCompanySecurityRisk Management12 APIs44.4CoalitionCyber InsuranceInsuranceInsurtechRisk Management2 APIs43.5TrellixCloud SecurityCybersecurityEndpoint SecurityThreat Detection27 APIs43.5Microsoft SentinelMicrosoftSecuritySIEMSOAR5 APIs42.2SpyCloudCybersecurityIdentityFraud Prevention7 APIs41.9Splunk SOARSecuritySOARAutomationOrchestration1 API41.3Ocean SecurityCompanySecurityEmail SecurityCybersecurity4 APIs40.1Cybersecurity and Infrastructure Security AgencyAdvisoriesAISBinding Operational DirectiveCSAF4 APIs39.4Red CanaryCompanySecurityCybersecurityManaged Detection and Response1 API39.3
Thin 23 Limited public surface area
NetographyNetwork SecurityNetwork Detection and ResponseCloud SecurityNetwork Observability28 APIs38.3DemistoCompanySecuritySOARIncident Response24 APIs38.0CompleteDNSDNSDNS HistoryDomain IntelligenceDomains2 APIs37.9Microsoft Defender9 APIs37.8watchTowrCompanySecurityCybersecurityAttack Surface Management20 APIs37.4IPQualityScoreFraud PreventionIP ReputationProxy DetectionEmail Validation6 APIs37.3Juniper NetworksArtificial IntelligenceAutomationCloudEnterprise48 APIs37.1IPregistryIP GeolocationIP AddressASN1 API36.6Koi SecurityCompanySecurityEndpoint SecuritySupply Chain Security1 API36.6SecureworksCybersecurityXDRThreat DetectionSecurity Operations3 APIs36.5Check PointCloud SecurityCybersecurityEndpoint SecurityFirewall21 APIs36.3McAfee (Trellix)AntivirusCybersecurityEndpoint ProtectionSecurity26 APIs35.2StairwellCompanySecurityMalware Analysis1 API34.9SniffCatIP Reputationabuse-databaseCybersecurity1 API33.6CertiKCompanyCybersecurityWeb3Blockchain2 APIs33.1Empirical SecurityCompanySecurityCybersecurityVulnerability Management3 APIs32.6ipbaseIP GeolocationIP AddressGeolocationSecurity1 API32.3BitSightCompanySecurityCyber RiskSecurity Ratings1 API30.2IntezerCompanyCybersecuritySecurityMalware Analysis1 API29.2AlienVaultCompanySecurityCybersecurity4 APIs27.1DataminrCompanyAnalyticsRisk1 API27.1DeepwatchCompanyCybersecurityManaged Detection and ResponseSecurity Operations1 API27.1LookoutCompanyCybersecurityMobile SecurityEndpoint Security1 API26.9
Emerging 25 Early or largely undocumented
NetscoutCybersecurityDDoS ProtectionNetwork MonitoringNetwork Performance8 APIs26.0StriderCompanyStrategic IntelligenceRisk Management2 APIs25.0UptycsSecurityCybersecurityCNAPPXDR1 API24.8WebrootCompanyCybersecurityEndpoint Protection1 API24.4Quadrant APIAlertsSecurity1 API24.0Recorded FutureCybersecurityIntelligence CloudBrand Intelligence1 API22.7US Cyber CommandCybersecurityFederal-GovernmentMilitary2 APIs22.2Vectra AICybersecurityNDRXDRAI Detection1 API21.2eSentireCompanySecurityCybersecurityManaged Detection and Response1 API20.4LastlineCompanyCybersecurityMalware AnalysisSandboxing1 API20.4Kenna SecurityCompanyCybersecurityVulnerability ManagementRisk-Based Prioritization1 API19.9Agari DataCompanyEmail SecurityPhishing ProtectionDMARC1 API19.6Digital ShadowsCompanyCybersecurityDigital Risk Protection1 API19.5OnticCompanySecurityPhysical SecurityProtective Intelligence19.3Authentic8CompanySecurityCybersecuritySecure Browser19.1MandiantCompanySecurityCybersecurity2 APIs17.3Upstream SecurityCompanySecurityCybersecurityAutomotive17.3AnomaliCompanyEnterpriseCybersecurity1 API16.2VegaCompanySecuritySecurity OperationsSIEM15.3Bluecoat (Symantec)CompanySecurityWeb SecuritySecure Web Gateway14.5DomScanDomainsDNSWHOISrdap1 API13.0OpenDNSCompanyCybersecurityDNSSecurity12.8Efflux SystemsCompanySecurityCybersecurityAttack Surface Management1 API12.6FlashpointCompanyCybersecuritySecurity1 API12.6OuttakeCompanySecurityDigital Risk Protection12.3
Minimal 14 Almost no public developer surface
AletheaCompanyArtificial IntelligenceNarrative Risk10.6SlashNextCompanySecurityCybersecurityPhishing1 API10.0ThreatTrack SecurityCompanyCybersecurityMalware Analysis9.5Nodal IndustriesCompanySecurityNetwork SecurityCybersecurity7.6BluevoyantCompanyCybersecurityManaged Detection and Response6.9DevSecOpsApplication SecurityAutomationBest PracticesCI/CD5.7PhishMeCompanyCybersecurityPhishingEmail Security5.5Signify GroupSportsOnline AbuseContent Moderation5.5HuaunCompanyEnterpriseCybersecurityAttack Surface Management5.0iSIGHT SecurityCompanyCybersecuritySecurity5.0Morta SecurityCompanySecurityCybersecurity5.0RiskIQCompanySecurityAttack Surface Management5.0Terbium LabsCompanyCybersecurityDark WebDigital Risk Protection5.0Veriti.aiCompanyCybersecurityExposure ManagementVulnerability Management5.0

APIs with this tag (43)

Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →

Strong 5 Solid coverage with minor gaps
AutoFocus API (Deprecated)A threat intelligence API that provided contextual information about malware, campaigns, and threat actors ...63.7Feedly APIREST API over api.feedly.com/v3 for the Feedly Threat Intelligence platform. Collect articles from AI Feeds...57.5Feedly Threat Graph MCP ServerHosted, remote Model Context Protocol server exposing the Feedly Real-Time Threat Graph to AI agents. Feedl...57.5CybelAngel Alerts API"Alerts in Feed" — real-time machine-readable access to the alerts CybelAngel's collection and ML pipeline ...56.4CybelAngel Threat Intelligence APIReturns claimed attacks observed by CybelAngel's threat-intelligence collection — ransomware and extortion ...56.4
Developing 17 Usable, with meaningful gaps to close
LevelBlue Open Threat Exchange (OTX) DirectConnect APIThe OTX DirectConnect API provides programmatic access to the LevelBlue Open Threat Exchange, an open commu...52.2NordStellar Company Risk Scoring APIEvaluates the cybersecurity risk of an external company identified primarily by domain name, returning scor...50.7NordStellar Enterprise Data APIAlso marketed as the NordStellar Dark Web API. Breach-intelligence data API over malware/infostealer logs, ...50.7NordStellar MCP ServerRemote MCP server that lets any MCP-compatible assistant query the NordStellar platform in natural language...50.7Infoblox Dossier APIThreat research API that provides contextual information from multiple sources simultaneously for a given i...49.6Infoblox Threat Defense APIAPI for threat intelligence, security analytics, and DNS firewall capabilities. Provides programmatic acces...49.6Infoblox TIDE APIThreat Intelligence Data Exchange (TIDE) API for submitting and retrieving threat indicators. Provides acce...49.6Cyware MCP ServerOpen-source Model Context Protocol server, written in Go and published under MIT by Cyware Labs, that expos...46.9Splunk Intelligence Management APIThe Splunk Intelligence Management (formerly ThreatStream) API provides REST v2.0 endpoints for managing th...46.5ODIN APIREST API for ODIN, Cyble's internet-scanning search engine. Twenty-seven operations across five datasets — ...45.0OpenCTI GraphQL APIThe OpenCTI platform exposes a full GraphQL API on the /graphql endpoint for programmatic access to cyber t...45.0Trellix Insights APIAPI for accessing threat intelligence, security analytics, and insights from the Trellix threat research pl...43.5Trellix IOC (Indicators of Compromise) APIREST API interface for managing indicators of compromise within the Trellix security platform. Enables uplo...43.5Trellix Threat Intelligence Exchange (TIE) APIAPI for Trellix Threat Intelligence Exchange which acts as a reputation broker enabling real-time sharing o...43.5Microsoft Sentinel ThreatIntelligence APIThe ThreatIntelligence API from Microsoft Sentinel — 1 operation(s) for threatintelligence.42.2CISA Automated Indicator Sharing (AIS) TAXII ServerCISA's Automated Indicator Sharing (AIS) program uses a TAXII 2.1 server to deliver STIX-formatted cyber th...39.4CISA Cybersecurity AdvisoriesCISA publishes Cybersecurity Advisories (CSAs), Industrial Control Systems Advisories (ICSAs), and Common S...39.4
Thin 8 Limited public surface area
Microsoft Defender Threat Intelligence APIAccess threat intelligence data, indicators of compromise (IOCs), and threat analytics.37.8Juniper Networks Threat Intelligence APIThreat feed and intelligence data37.1IPregistry IP Geolocation and Threat Intelligence APIA REST API that resolves IPv4/IPv6 addresses and Autonomous System Numbers to rich intelligence including g...36.6Check Point Threat Hunting APIREST API for the Check Point Threat Hunting (TH) platform exposing threat intelligence, indicators, and hun...36.3McAfee Threat Intelligence Exchange (TIE) APIReal-time threat intelligence sharing and reputation services API.35.2SniffCat REST APIDocumented, versioned REST API (/api/v1/*) for checking IPs, retrieving blacklist feeds and report history,...33.6Intezer Platform APIIntezer Platform API 2.0 — submit files, URLs, hashes and endpoint scans for autonomous malware analysis an...29.2Dataminr Pulse APIOAuth2-secured REST API for consuming Dataminr real-time alerts and managing watchlists/lists. Token flow a...27.1
Emerging 12 Early or largely undocumented
Netscout Arbor Sightline SP REST APIREST API for DDoS detection, mitigation, and threat intelligence on the Arbor Sightline platform. Provides ...26.0Netscout Omnis Cyber Intelligence APIOpen API surface for the Omnis Cyber Intelligence NDR platform, enabling network investigation and adding n...26.0Strider MCPStrider's hosted Model Context Protocol server, published at app.striderintel.com/app-api/mcp. It advertise...25.0Strider Shield APIShield is Strider's curated nation-state threat-intelligence dataset — high-risk email addresses, malicious...25.0Uptycs Platform APIPer-customer JSON REST API over each Uptycs stack covering alerts and alert rules, events and event rules, ...24.8Recorded Future Intelligence Cloud APIThe Recorded Future Intelligence Cloud REST API (api.recordedfuture.com) provides programmatic access to th...22.7CNMF Malware Sharing via VirusTotalThe U.S. Cyber Command Cyber National Mission Force (CNMF) shares unclassified malware samples on VirusTota...22.2Vectra AI Platform APIThe Vectra AI Platform REST API (api.vectra.io) provides programmatic access to detections, hosts, accounts...21.2Lastline Analyst APIWeb API for submitting files (PE, PDF, Office documents, Flash, Java applets, Android applications, archive...20.4SearchLight Portal APIThe Digital Shadows SearchLight Portal API — the REST surface behind the SearchLight / GreyMatter DRP porta...19.5DomScan APIREST domain-intelligence API (40+ endpoints under /v1) for availability, DNS, WHOIS/RDAP, SSL/TLS, email au...13.0Flashpoint APIFlashpoint's REST API exposes threat intelligence, compromised credentials, vulnerability, and fraud data p...12.6
Minimal 1 Almost no public developer surface
SlashNext On-demand Threat Intelligence (OTI) APIRESTful phishing threat intelligence API. Look up URL/host reputation, run real-time SEER-engine URL scans ...10.0

Score breakdown

Frequency
58.9
log-scaled weighted occurrences
Breadth
2.8
spread across providers
Quality lift
40.3
mean composite of providers using it
Cohesion
0.0
strength of nearest seed neighbor

Related tags

Cybersecurity 69 co-occurrences Incident Response 15 co-occurrences Attack Surface Management 11 co-occurrences SOAR 10 co-occurrences Vulnerability Management 17 co-occurrences Security Operations 11 co-occurrences Email Security 10 co-occurrences XDR 8 co-occurrences

Where this tag comes from

Provider tag96
Api tag43
Openapi tag3
Openapi op tag7

Cohort brief

Auto-generated

The 103 providers in the APIs.io catalog tagged Threat Intelligence, scored on the Kin Score. Every figure below is computed from the catalog — nothing here is written.

Providers
103
all scored
Mean Kin Score
33.1
+12.4 vs catalog 20.7
Mean Agent Readiness
17.6
+7.9 vs catalog 9.7
Spread
5–63.7
median 36.3 · σ 17
How the 103 split by band
Exemplar 0Strong 12Developing 29Thin 23Emerging 25Minimal 14
Facet averages, against the whole catalog
FacetThis cohortCatalogDifferenceScored
Developer Ergonomics 34 17.9 +16.1 103
Contract Quality 30.4 17.5 +12.9 103
Access Clarity 34 22.3 +11.7 103
Operational Transparency 22.8 11.3 +11.5 103
Discoverability 70.9 60.4 +10.5 103
Contract Governance 14.3 6.4 +7.9 103

A facet is averaged over the members that carry it, not over the whole cohort — the “Scored” column is that count. Averaging an absent facet as zero would score our own coverage gaps as the providers’ posture.

What this cohort publishes
ArtifactThis cohortCatalogDifference
MCP server (any) 38% 16% +22
MCP server (first-party) 16% 7% +9
Agent Skills 0% 0% 0
OAuth scopes 11% 9% +2
Security 95% 88% +7
Arazzo workflows 7% 2% +5
Governance rules 20% 13% +7

mcp_pct counts any mcp/ artifact including ones API Evangelist derived from the provider OpenAPI; mcp_first_party_pct counts only servers the provider publishes. Prefer the latter.

Top by Kin Score
  1. 1 Palo Alto Networks 63.7
  2. 2 Shodan 63.6
  3. 3 IPinfo 61.9
  4. 4 Cisco Umbrella 61.1
  5. 5 Cisco XDR 60.7
  6. 6 GreyNoise Intelligence 58.4
  7. 7 Feedly 57.5
  8. 8 Cisco PSIRT openVuln API 56.4
  9. 9 CybelAngel 56.4
  10. 10 AbuseIPDB 56
Top by Agent Readiness
  1. 1 Feedly 57.9
  2. 2 IRONSCALES 51.6
  3. 3 Nord Security 45.7
  4. 4 CybelAngel 44.4
  5. 5 Armor 43
  6. 6 Abnormal AI 41.5
  7. 7 Palo Alto Networks 39.4
  8. 8 DomainTools 39
  9. 9 Cisco XDR 38.9
  10. 10 watchTowr 38.7
All 103 members of this roster resolve to a scored provider in the catalog.Generated from the catalog build of 25 August 2026, across 26891 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.

Work with this as data

Every tag here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for tags

7 MCP tools reach this
  • find_tagsBrowse and filter every tag in the catalog.
  • get_cohortThis tag as a scored cohort — every provider carrying it, with scores.
  • cohort_statsPRO — the distribution across this tag: mean, median, band split, adoption rates.
  • cohort_rankingsPRO — the leaderboard, on composite AND agent-readiness axes.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools

Call it yourself

curl for this page
This tag 
curl "https://apis.io/api/v1/tags/threat-intelligence"
All tags 
curl "https://apis.io/api/v1/tags?limit=25"
As a scored cohort 
curl "https://apis.io/api/v1/cohorts/tag/threat-intelligence"
The distribution (Pro) 
curl "https://apis.io/api/v1/cohorts/tag/threat-intelligence/stats" \
  -H "X-API-Key: $APIS_IO_KEY"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.