Use Case
Threat Detection & Security Operations
Detecting attacks and closing security exposure.
39 providers
571 APIs
32 declared variants
Collecting security telemetry, correlating it against detection rules and threat intelligence, and running the vulnerability, posture, and hardening work a security operations team owns.
39 API providers on the APIs.io network offer threat detection & security operations. The highest-rated are Dynatrace, IPinfo, Censys, Palo Alto Networks, Shodan.
Providers
Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.
Exemplar 3 Complete, well-documented, and agent-ready
DynatraceDynatrace is a software intelligence platform that provides application performance monitoring, artificial ...IPinfoIPinfo is an IP address data and intelligence platform that provides geolocation (country, region, city, co...CensysCensys is an internet intelligence and attack surface management platform that continuously scans the publi...
Strong 9 Solid coverage with minor gaps
Palo Alto NetworksPalo Alto Networks is a global cybersecurity leader providing advanced security platforms and services acro...ShodanShodan is the world's first search engine for Internet-connected devices. It continuously crawls the public...Amazon NeptuneAmazon Neptune is a fast, reliable, fully managed graph database service that makes it easy to build and ru...GreyNoise IntelligenceGreyNoise Intelligence collects and analyzes Internet-wide scan and attack traffic from a global network of...DatadogDatadog is a monitoring and analytics platform that helps organizations gain insight into their infrastruct...Amazon GuardDutyAmazon GuardDuty is an intelligent threat detection service that continuously monitors your AWS accounts, w...AbuseIPDBAbuseIPDB is a community-driven project to help system administrators, webmasters, and security analysts ch...Amazon CloudTrailAWS CloudTrail enables governance, compliance, operational auditing, and risk auditing of your AWS account ...Microsoft Active DirectoryMicrosoft Active Directory and Microsoft Entra ID provide identity and access management for organizations ...
Developing 13 Usable, with meaningful gaps to close
Amazon Kinesis Data FirehoseAmazon Kinesis Data Firehose is the easiest way to reliably load streaming data into data lakes, data store...Amazon IoT Device DefenderAWS IoT Device Defender is a security service that lets you continuously audit your IoT configurations to d...Amazon Security HubAWS Security Hub is a cloud security posture management service that provides a comprehensive view of your ...AT&TAT&T Inc. is a multinational telecommunications holding company providing wireless and wireline communicati...Amazon Security LakeAmazon Security Lake is a service that automatically centralizes an organization's security data from cloud...Google WorkspaceA collection of productivity and collaboration tools from Google including Gmail, Drive, Calendar, Meet, an...Amazon DetectiveAmazon Detective is a security investigation service that makes it easy to analyze, investigate, and quickl...Anomaly DetectionA curated collection of APIs, tools, and platforms for detecting anomalies in data streams, time series, an...CAST AICAST AI is an Application Performance Automation (APA) platform for Kubernetes that automates cost optimiza...AxiomAxiom is a serverless log management and analytics platform that provides real-time insights into structure...Aqua SecurityAqua Security provides cloud-native security for the full application lifecycle, protecting containers, ser...VaronisVaronis is a pioneer in data security and analytics, specializing in software for data security, governance...Apache DruidApache Druid is a high-performance, real-time analytics database governed by the Apache Software Foundation...
Thin 5 Limited public surface area
Akamai API SecurityAkamai API Security (formerly Noname Security) provides comprehensive API discovery, posture management, an...Axiom ControllerAxiom is a cloud-native observability platform providing APIs for ingesting, querying, and managing telemet...Amazon CloudShellAWS CloudShell is a browser-based terminal that enables users to manage and explore AWS resources directly ...APIClarityAPIClarity is an open source API security and observability tool that analyzes API traffic to reconstruct O...Adaptive ShieldAdaptive Shield (now CrowdStrike Falcon Shield) is a SaaS Security Posture Management (SSPM) platform that ...
Emerging 8 Early or largely undocumented
US Cyber CommandUS Cyber Command (USCYBERCOM) is a Unified Combatant Command of the United States Armed Forces responsible ...ChainguardChainguard builds, secures, and maintains a catalog of hardened, minimal container images and software supp...Abnormal SecurityAbnormal Security (operating under the abnormal.ai brand) is an AI-native email and SaaS security platform ...Recorded FutureRecorded Future is a threat intelligence platform whose Intelligence Cloud combines open-web, dark-web, tec...ExpelExpel is a managed detection and response (MDR) provider that delivers 24x7 security operations across endp...DarktraceDarktrace builds the ActiveAI Security Platform, an AI-native cybersecurity platform powered by Self-Learni...Vectra AIVectra AI is an AI-driven network detection and response (NDR) vendor whose Vectra AI Platform applies Atta...API DynamicsAPIDynamics is an AI-driven API security and observability platform that empowers enterprises to gain real-...
Minimal 1 Almost no public developer surface
What Providers Actually Declared
This use case is a canonical term. These are the free-text strings
providers wrote in their own apis.yml that map onto it.
API Security Posture AssessmentAPI Security Posture ManagementCloud Security MonitoringCloud Security PostureCloud Security Posture ManagementCloud Workload ProtectionCloud and Identity Threat DetectionCybersecurity Posture ImprovementCybersecurity and Threat DetectionCybersecurity and Threat IntelligenceIT and Security OperationsInsider Threat DetectionMalware DetectionNetwork and Security MonitoringNovel Threat DetectionReal-Time Threat DetectionSIEM IntegrationSaaS Security Posture ManagementSecurity AnalyticsSecurity MonitoringSecurity OperationsSecurity Posture AssessmentSecurity Posture HardeningSecurity Posture ManagementThreat DetectionThreat Detection and SecurityThreat HuntingThreat Hunting and OSINTThreat Intelligence EnrichmentThreat huntingVulnerability ManagementVulnerability Scanning Reduction
Scroll for all 32
Work with this as data
Every use case here is available over the APIs.io API and to AI agents over MCP. Use Cases is not yet its own endpoint on the v1 API. Reach it through catalog search and the tag graph, or the MCP server.