established · 0.7 market domain

Threat Intelligence

Score 24.2 / 100 115 providers +6 via APIs 50 APIs Search apis.io →
Business capabilities this tag reaches
Cybersecurity Management 2

Providers using this tag (115)

Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.

Exemplar 2 Complete, well-documented, and agent-ready
Palo Alto NetworksCloud SecurityCybersecurityFirewallNetwork Security468 APIs76.9CrowdStrikeCybersecurityEndpoint SecurityEDR2 APIs67.1
Strong 14 Solid coverage with minor gaps
Cisco XDRSecurityXDRThreat DetectionIncident Response12 APIs65.6ShodanSecuritySearchInternetDevices5 APIs64.4IPinfoIP IntelligenceIP GeolocationASNPrivacy Detection1 API64.1Cisco UmbrellaSecurityDNSSecure Web GatewayCloud Security52 APIs62.1DomScanDomainsDNSWHOISRDAP2 APIs61.5FeedlyCybersecuritycyber-threat-intelligenceContent Aggregation36 APIs59.6ArmorCompanyCybersecurityManaged Detection and ResponseCloud Security16 APIs59.4Whisper SecurityAgent IdentityAgentsIPv6DNS1 API59.3CybelAngelCompanyCybersecurityexternal-attack-surface-management7 APIs58.9GreyNoise IntelligenceSecurityCybersecurityIP Reputation1 API58.4Cisco PSIRT openVuln APISecurityVulnerability ManagementDisclosure1 API57.8IRONSCALESEmail SecurityCybersecurityPhishingAnti-Phishing10 APIs56.9Nord SecurityCybersecurityDark Web MonitoringAttack Surface Management7 APIs56.4VulnCheckCompanySecurityVulnerability IntelligenceExploit Intelligence1 API55.5
Developing 30 Usable, with meaningful gaps to close
Webz.ioNews DataWeb DataWeb ScrapingDark Web13 APIs54.0Abnormal AICompanySecurityEmail SecurityCybersecurity1 API53.1EmailRepSecurityEmailEmail Reputation1 API52.9UpGuardCompanyCybersecurityThird-Party Risk ManagementAttack Surface Management1 API51.7AbuseIPDBAnti MalwareBlacklistCybersecurityIP Reputation1 API51.5Have I Been PwnedSecurityData BreachesPwned PasswordsIdentity3 APIs51.5Microsoft DefenderCloud SecurityData ProtectionEmail Security1 API51.4HackNoticeCompanySecurityCybersecurity1 API51.2IPGeolocation.ioGeocodingIP GeolocationIP IntelligenceIP Security7 APIs51.1LevelBlueCompanyEnterpriseCybersecuritySecurity1 API50.0Picus SecurityCybersecuritySecurity ValidationBreach and Attack SimulationAdversarial Exposure Validation15 APIs49.3Cywarecyber-threat-intelligenceCybersecuritySecurity Operations2 APIs49.2InfobloxCloudDDIDHCPDNS1 API48.8DomainToolsCompanyDomain IntelligenceDNS4 APIs48.3VirusTotalAnti MalwareSecurityFile Analysis7 APIs47.8KnosticCompanySecurityArtificial IntelligenceAI Agents1 API47.7FiligranCompanyCybersecurityOpenCTI2 APIs46.7DragosCompanyCybersecurityOT SecurityICS1 API46.2CoalitionCyber InsuranceInsuranceInsurtechRisk Management1 API45.9IPstackGeocodingIP GeolocationLocation2 APIs45.4KodexCompanyLaw EnforcementComplianceLegal2 APIs45.0Splunk SOARSecuritySOARAutomationOrchestration1 API44.7DoppelCompanySecurityCybersecurityDigital Risk Protection1 API44.5CybleCybersecurityAttack Surface ManagementInternet Scanning2 APIs43.6TrellixCloud SecurityCybersecurityEndpoint SecurityThreat Detection2 APIs43.3Arctic WolfCompanySecurityCybersecurityManaged Detection and Response1 API42.6Base OperationsCompanySecurityRisk Management1 API42.3Red CanaryCompanySecurityCybersecurityManaged Detection and Response1 API40.8ProofpointSecurityCybersecurityEmail Security7 APIs40.0SpyCloudCybersecurityIdentityFraud Prevention18 APIs40.0
Thin 26 Limited public surface area
Silent PushCompanySecurityCybersecurity2 APIs39.2McAfee (Trellix)AntivirusCybersecurityEndpoint ProtectionSecurity4 APIs38.2ReliaQuestCybersecuritySecurity OperationsThreat DetectionIncident Response2 APIs37.7Cybersecurity and Infrastructure Security AgencyAdvisoriesAISBinding Operational DirectiveCSAF1 API37.0NetographyNetwork SecurityNetwork Detection and ResponseCloud SecurityNetwork Observability1 API37.0Ocean SecurityCompanySecurityEmail SecurityCybersecurity1 API36.8DemistoCompanySecuritySOARIncident Response1 API36.2CertiKCompanyCybersecurityWeb3Blockchain1 API36.1SniffCatIP Reputationabuse-databaseCybersecurity1 API36.0StairwellCompanySecurityMalware Analysis1 API36.0CompleteDNSDNSDNS HistoryDomain IntelligenceDomains2 APIs35.7SecuronixSecuritySIEMUEBASOAR4 APIs35.2Nucleus SecurityCompanySecurityCybersecurityVulnerability Management2 APIs35.0IPregistryIP GeolocationIP AddressASN1 API34.8Koi SecurityCompanySecurityEndpoint SecuritySupply Chain Security1 API34.8watchTowrCompanySecurityCybersecurityAttack Surface Management1 API34.7IPQualityScoreFraud PreventionIP ReputationProxy DetectionEmail Verification1 API34.3SecureworksCybersecurityXDRThreat DetectionSecurity Operations1 API33.8Empirical SecurityCompanySecurityCybersecurityVulnerability Management1 API32.0BitSightCompanySecurityCyber RiskSecurity Ratings1 API31.2NetscoutCybersecurityDDoS ProtectionNetwork MonitoringNetwork Performance8 APIs30.9IntezerCompanyCybersecuritySecurityMalware Analysis1 API30.6LookoutCompanyCybersecurityMobile SecurityEndpoint Security1 API30.3DeepwatchCompanyCybersecurityManaged Detection and ResponseSecurity Operations1 API30.2ipbaseIP GeolocationIP AddressGeolocationSecurity1 API29.1DataminrCompanyAnalyticsRisk Management1 API28.6
Emerging 26 Early or largely undocumented
eSentireCompanySecurityCybersecurityManaged Detection and Response1 API26.0WebrootCompanyCybersecurityEndpoint Protection1 API25.5StriderCompanyStrategic IntelligenceRisk Management2 APIs25.0Quadrant APIAlertsSecurity1 API23.9US Cyber CommandCybersecurityFederal GovernmentMilitary2 APIs23.7LastlineCompanyCybersecurityMalware AnalysisSandboxing1 API23.4AlienVaultCompanySecurityCybersecurity1 API23.0Recorded FutureCybersecurityIntelligence CloudBrand Intelligence1 API22.1AlertMediaMass NotificationTravel Risk ManagementEmployee Safety Monitoring22.0OnticCompanySecurityPhysical SecurityProtective Intelligence21.2Agari DataCompanyEmail SecurityPhishing ProtectionDMARC1 API20.2Authentic8CompanySecurityCybersecuritySecure Browser20.1Digital ShadowsCompanyCybersecurityDigital Risk Protection1 API20.0Upstream SecurityCompanySecurityCybersecurityAutomotive19.9Qi AnxinCompanySecurityCybersecurity2 APIs19.7Kenna SecurityCompanyCybersecurityVulnerability ManagementRisk-Based Prioritization1 API19.0360 PrivacyCompanyPrivacyData RemovalExecutive Protection18.8NisosHuman Risk ManagementInsider ThreatExecutive Protection1 API17.4AnomaliCompanyEnterpriseCybersecurity1 API16.6MandiantCompanySecurityCybersecurity2 APIs16.5Bluecoat (Symantec)CompanySecurityWeb SecuritySecure Web Gateway14.0Abstract SecuritySecurityCybersecuritySIEMSecurity Data Pipeline13.9OpenDNSCompanyCybersecurityDNSSecurity12.3Efflux SystemsCompanySecurityCybersecurityAttack Surface Management1 API12.2FlashpointCompanyCybersecuritySecurity1 API11.7OuttakeCompanySecurityDigital Risk Protection11.7
Minimal 16 Almost no public developer surface
Surefire CyberCompanyCybersecurityIncident ResponseDigital Forensics10.5AletheaCompanyArtificial IntelligenceNarrative Risk10.0ThreatTrack SecurityCompanyCybersecurityMalware Analysis9.5SlashNextCompanySecurityCybersecurityPhishing1 API9.1Nodal IndustriesCompanySecurityNetwork SecurityCybersecurity6.5BluevoyantCompanyCybersecurityManaged Detection and Response6.0DevSecOpsApplication SecurityAutomationBest PracticesCI/CD4.1Signify GroupSportsOnline AbuseContent Moderation3.9PhishMeCompanyCybersecurityPhishingEmail Security3.8HuaunCompanyEnterpriseCybersecurityAttack Surface Management3.4Veriti.aiCompanyCybersecurityExposure ManagementVulnerability Management3.4RiskIQCompanySecurityAttack Surface Management3.2iSIGHT SecurityCompanyCybersecuritySecurity2.5AisperaCompanyCybersecurityArtificial Intelligence2.1Morta SecurityCompanySecurityCybersecurity0.0Skybox SecurityCompanySecurityCybersecurityNetwork Security0.0
Unrated 1 Not yet scored
Terbium LabsCompanyCybersecurityDark WebDigital Risk Protection

APIs with this tag (50)

Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →

Exemplar 1 Complete, well-documented, and agent-ready
AutoFocus API (Deprecated)A threat intelligence API that provided contextual information about malware, campaigns, and threat actors ...76.9
Strong 7 Solid coverage with minor gaps
Splunk Intelligence Management APIThe Splunk Intelligence Management (formerly ThreatStream) API provides REST v2.0 endpoints for managing th...60.5Juniper Networks Threat Intelligence APIThreat feed and intelligence data59.7Feedly Threat Graph MCP ServerHosted, remote Model Context Protocol server exposing the Feedly Real-Time Threat Graph to AI agents. Feedl...59.6WhisperGraph and Control Plane (Cypher API)The documented front door for both halves of the platform: POST https://graph.whisper.online/api/query runs...59.3WhisperGraph MCP ServerHosted remote MCP server at https://mcp.whisper.security (Streamable HTTP, protocol revisions up to 2025-11...59.3CybelAngel Threat Intelligence APIFetch threat intelligence data from the CybelAngel platform.58.9NordStellar MCP ServerRemote MCP server that lets any MCP-compatible assistant query the NordStellar platform in natural language...56.4
Developing 17 Usable, with meaningful gaps to close
Webz.io APIToken-authenticated REST endpoints under https://api.webz.io covering seven products: News, Blogs and Forum...54.0Webz.io Cyber APIDeep and dark web content for threat intelligence. Search endpoint `/cyberFilter`, segmentation `/cyberSeg`...54.0Microsoft Defender Threat Intelligence APIAccess threat intelligence data, indicators of compromise (IOCs), and threat analytics.51.4HackNotice MCP ServerRemote Model Context Protocol server operated by HackNotice, speaking JSON-RPC 2.0 over Streamable HTTP at ...51.2LevelBlue Open Threat Exchange (OTX) DirectConnect APIThe OTX DirectConnect API provides programmatic access to the LevelBlue Open Threat Exchange, an open commu...50.0Cyware MCP ServerOpen-source Model Context Protocol server, written in Go and published under MIT by Cyware Labs, that expos...49.2Infoblox Dossier APIThreat research API that provides contextual information from multiple sources simultaneously for a given i...48.8Infoblox Threat Defense APIAPI for threat intelligence, security analytics, and DNS firewall capabilities. Provides programmatic acces...48.8Infoblox TIDE APIThreat Intelligence Data Exchange (TIDE) API for submitting and retrieving threat indicators. Provides acce...48.8OpenCTI GraphQL APIThe OpenCTI platform exposes a full GraphQL API on the /graphql endpoint for programmatic access to cyber t...46.7Microsoft Sentinel Threat Intelligence APIThe Threat Intelligence API from Microsoft Sentinel — 1 operation(s) for threat intelligence.43.6Trellix Insights APIAPI for accessing threat intelligence, security analytics, and insights from the Trellix threat research pl...43.3Trellix IOC (Indicators of Compromise) APIREST API interface for managing indicators of compromise within the Trellix security platform. Enables uplo...43.3Trellix Threat Intelligence Exchange (TIE) APIAPI for Trellix Threat Intelligence Exchange which acts as a reputation broker enabling real-time sharing o...43.3Vectra AI Platform APIThe Vectra AI Platform REST API (api.vectra.io) provides programmatic access to detections, hosts, accounts...43.2Emerging Threats (ET) Intelligence Query API v1The ET Intelligence Query API is Proofpoint's threat-intelligence lookup service, reached at api.emergingth...40.0Proofpoint Targeted Attack Protection (TAP) API v2The TAP v2 API exposes the Threat Insight Dashboard to machines: SIEM event download (blocked/permitted cli...40.0
Thin 14 Limited public surface area
Silent Push APIUnified REST gateway for Silent Push threat intelligence. Sections cover Enrich (single and bulk domain, IP...39.2Silent Push MCP ServerSaaS-hosted Model Context Protocol server announced in Release 6.0 (2026-06-12, beta). Exposes 33 read-only...39.2McAfee Threat Intelligence Exchange (TIE) APIReal-time threat intelligence sharing and reputation services API.38.2Digital Shadows SearchLight Portal APIREST API of the Digital Shadows SearchLight digital-risk-protection portal, operated by ReliaQuest since it...37.7CISA Automated Indicator Sharing (AIS) TAXII ServerCISA's Automated Indicator Sharing (AIS) program uses a TAXII 2.1 server to deliver STIX-formatted cyber th...37.0CISA Cybersecurity AdvisoriesCISA publishes Cybersecurity Advisories (CSAs), Industrial Control Systems Advisories (ICSAs), and Common S...37.0SniffCat REST APIDocumented, versioned REST API (/api/v1/*) for checking IPs, retrieving blacklist feeds and report history,...36.0Check Point Threat Hunting APIREST API for the Check Point Threat Hunting (TH) platform exposing threat intelligence, indicators, and hun...35.9IPregistry IP Geolocation and Threat Intelligence APIA REST API that resolves IPv4/IPv6 addresses and Autonomous System Numbers to rich intelligence including g...34.8Netscout Arbor Sightline SP REST APIREST API for DDoS detection, mitigation, and threat intelligence on the Arbor Sightline platform. Provides ...30.9Netscout Omnis Cyber Intelligence APIOpen API surface for the Omnis Cyber Intelligence NDR platform, enabling network investigation and adding n...30.9Intezer Platform APIIntezer Platform API 2.0 — submit files, URLs, hashes and endpoint scans for autonomous malware analysis an...30.6Uptycs Platform APIPer-customer JSON REST API over each Uptycs stack covering alerts and alert rules, events and event rules, ...29.4Dataminr Pulse APIOAuth2-secured REST API for consuming Dataminr real-time alerts and managing watchlists/lists. Token flow a...28.6
Emerging 10 Early or largely undocumented
Strider MCPStrider's hosted Model Context Protocol server, published at app.striderintel.com/app-api/mcp. It advertise...25.0Strider Shield APIShield is Strider's curated nation-state threat-intelligence dataset — high-risk email addresses, malicious...25.0CNMF Malware Sharing via VirusTotalThe U.S. Cyber Command Cyber National Mission Force (CNMF) shares unclassified malware samples on VirusTota...23.7Lastline Analyst APIWeb API for submitting files (PE, PDF, Office documents, Flash, Java applets, Android applications, archive...23.4Recorded Future Intelligence Cloud APIThe Recorded Future Intelligence Cloud REST API (api.recordedfuture.com) provides programmatic access to th...22.1SearchLight Portal APIThe Digital Shadows SearchLight Portal API — the REST surface behind the SearchLight / GreyMatter DRP porta...20.0QAX Threat Intelligence APIREST threat-intelligence API from the QAX Threat Intelligence Center. Provides IP reputation, domain and UR...19.7QAX Threat Intelligence MCP ServiceHosted Model Context Protocol server published by the QAX Threat Intelligence Center, announced on the QAX ...19.7Nisos Ascend External APICredential-gated HTTPS API behind the Nisos Ascend human risk management platform. Its existence and base U...17.4Flashpoint APIFlashpoint's REST API exposes threat intelligence, compromised credentials, vulnerability, and fraud data p...11.7
Minimal 1 Almost no public developer surface
SlashNext On-demand Threat Intelligence (OTI) APIRESTful phishing threat intelligence API. Look up URL/host reputation, run real-time SEER-engine URL scans ...9.1

Companies reaching this through an API (6)

These companies publish an API, specification or operation carrying “Threat Intelligence” but do not classify their business under it. Listed unranked and kept out of the count above, because one tagged operation is not a statement about what a company does.

Check Point Juniper Networks Microsoft Sentinel Splunk Uptycs Vectra AI

Score breakdown

Frequency
60.5
log-scaled weighted occurrences
Breadth
3.0
spread across providers
Quality lift
41.8
mean composite of providers using it
Cohesion
0.0
strength of nearest seed neighbor

Where this tag sits

Security broader Cybersecurity broader

Related tags

Cybersecurity 84 co-occurrences Incident Response 18 co-occurrences Vulnerability Management 22 co-occurrences Attack Surface Management 13 co-occurrences Security Operations 14 co-occurrences SOAR 10 co-occurrences SIEM 13 co-occurrences Email Security 11 co-occurrences

Where this tag comes from

Provider tag115
Api tag50
Openapi tag3
Openapi op tag7

Cohort brief

Auto-generated

The 110 providers in the APIs.io catalog tagged Threat Intelligence, scored on the Kin Score. Every figure below is computed from the catalog — nothing here is written.

Providers
110
all scored
Mean Kin Score
35.2
+12.3 vs catalog 22.9
Mean Agent Readiness
19.7
+7.8 vs catalog 11.9
Spread
2.1–76.9
median 36 · σ 17.6
How the 110 split by band
Exemplar 2Strong 14Developing 30Thin 26Emerging 26Minimal 12
Facet averages, against the whole catalog
FacetThis cohortCatalogDifferenceScored
Developer Ergonomics 39.4 23.2 +16.2 110
Operational Transparency 26.3 13.7 +12.6 110
Access Clarity 37.5 26.5 +11 110
Contract Quality 27.5 17.6 +9.9 110
Discoverability 67.4 58.1 +9.3 110
Contract Governance 11.2 6.3 +4.9 110

A facet is averaged over the members that carry it, not over the whole cohort — the “Scored” column is that count. Averaging an absent facet as zero would score our own coverage gaps as the providers’ posture.

What this cohort publishes
ArtifactThis cohortCatalogDifference
MCP server (any) 29% 14% +15
MCP server (first-party) 27% 12% +15
Agent Skills 0% 0% 0
OAuth scopes 15% 11% +4
Security 98% 98% 0
Arazzo workflows 5% 2% +3
Governance rules 16% 14% +2

mcp_pct counts any mcp/ artifact including ones API Evangelist derived from the provider OpenAPI; mcp_first_party_pct counts only servers the provider publishes. Prefer the latter.

Top by Kin Score
  1. 1 Palo Alto Networks 76.9
  2. 2 CrowdStrike 67.1
  3. 3 Cisco XDR 65.6
  4. 4 Shodan 64.4
  5. 5 IPinfo 64.1
  6. 6 Cisco Umbrella 62.1
  7. 7 DomScan 61.5
  8. 8 Feedly 59.6
  9. 9 Armor 59.4
  10. 10 Whisper Security 59.3
Top by Agent Readiness
  1. 1 DomScan 69.2
  2. 2 Feedly 66.9
  3. 3 Whisper Security 56.7
  4. 4 DomainTools 53
  5. 5 IRONSCALES 49.5
  6. 6 Nord Security 43.5
  7. 7 CybelAngel 42.3
  8. 8 Abnormal AI 41.5
  9. 9 Securonix 41.2
  10. 10 Armor 40.4
All 115 members of this roster resolve to a scored provider in the catalog.Generated from the catalog build of 5 October 2026, across 29093 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.

Work with this as data

Every tag here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for tags

7 MCP tools reach this
  • find_tagsBrowse and filter every tag in the catalog.
  • get_cohortThis tag as a scored cohort — every provider carrying it, with scores.
  • cohort_statsPRO — the distribution across this tag: mean, median, band split, adoption rates.
  • cohort_rankingsPRO — the leaderboard, on composite AND agent-readiness axes.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This tag 
curl "https://apis.io/api/v1/tags/threat-intelligence"
All tags 
curl "https://apis.io/api/v1/tags?limit=25"
As a scored cohort 
curl "https://apis.io/api/v1/cohorts/tag/threat-intelligence"
The distribution (Pro) 
curl "https://apis.io/api/v1/cohorts/tag/threat-intelligence/stats" \
  -H "X-API-Key: $APIS_IO_KEY"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.