Curated real-time threat data feeds delivered via API in STIX/TAXII format. Integrate intelligence directly into your SIEM, SOAR, and security tools for automated defense.
STIX 2.1 Feed Active
Real-time streaming
Six specialized feed categories delivering actionable threat intelligence in standardized formats, ready for immediate integration into your security stack.
IP addresses, domains, URLs, and file hashes with confidence scores and full context. Continuously enriched and deduplicated for maximum signal-to-noise ratio.
Malware family indicators, behavioral signatures, and YARA rules. Track malware campaigns across families with variant-specific detection and attribution data.
CVE-based feeds with exploit status, threat actor exploitation data, and patch priority scoring. Focus on vulnerabilities actively exploited in the wild.
C2 server lists, botnet infrastructure mappings, and DGA domain feeds. Track active botnet operations with infrastructure correlation and attribution intelligence.
Phishing URLs, kit hashes, and impersonation domain feeds. Machine-validated phishing indicators with screenshot evidence and brand association metadata.
Region-specific threat intelligence feeds with geopolitical context. Tailored for regional SOC operations with localized threat actor tracking and compliance mapping.
10M+
Daily IOCs
STIX 2.1
Format
<100ms
API Latency
99.97%
Uptime SLA
Our intelligence pipeline transforms raw data into actionable feeds — enriched, formatted, and delivered directly into your security infrastructure.
Multi-source intelligence ingestion from 500+ collection points and partner networks worldwide.
Automated enrichment with context, confidence scoring, and correlation with active threat campaigns.
Standardized output in STIX 2.1, TAXII, CSV, JSON, and custom formats for seamless integration.
Real-time streaming via API, TAXII server, or scheduled batch delivery to your security infrastructure.
Every indicator is delivered in STIX 2.1 format with full context, confidence scoring, and threat actor attribution. Here's a sample response.
REST
API Endpoint
TAXII
2.1 Server
Webhook
Push Delivery
Native integrations with leading SIEM, SOAR, and security platforms. Get threat intelligence flowing into your existing tools in minutes.
Splunk
SIEM Integration
QRadar
IBM Security
Sentinel
Microsoft
Cortex XSOAR
Palo Alto
ServiceNow
ITSM & SecOps
Elastic
Security & SIEM
Anomali
Threat Platform
MISP
Open Source CTI
Choose the threat feed tier that matches your organization's security needs and budget.
| Feature | Community | Professional | Enterprise |
|---|---|---|---|
| IOC Volume | 100K/day | 2M/day | 10M+/day |
| Update Frequency | Daily | Hourly | Real-time |
| Enrichment Level | Basic | Advanced | Full Context |
| STIX / TAXII | |||
| API Access | Limited | Full | Full + Priority |
| SLA | Best effort | 99.9% | 99.97% |
| Price | Free | $499/mo | Custom |
Get started with our free Community Feed in minutes, or upgrade to Professional for real-time intelligence with full STIX/TAXII support.
We support STIX 2.1 (primary), TAXII 2.1, JSON, CSV, and custom XML formats. Feeds can be consumed via our REST API, TAXII server, webhook push, or scheduled SFTP/CSV downloads. Our SDKs support Python, Go, and JavaScript for easy integration.
Every indicator passes through multi-stage validation: automated sandbox verification, cross-source correlation, confidence scoring (0-100), and age-based decay. Our deduplication engine uses fuzzy matching and canonical normalization to eliminate redundant IOCs while preserving unique context.
Absolutely. You can create custom feed filters based on industry vertical, geographic region, threat actor group, malware family, confidence threshold, severity level, and more. Our relevance engine also learns from your infrastructure profile to automatically prioritize indicators targeting your technology stack.
The Community Feed provides 100K daily IOCs with basic enrichment, updated daily — perfect for small teams. The Professional Feed delivers 2M+ daily IOCs with advanced enrichment, hourly updates, full STIX/TAXII support, and 99.9% SLA. Enterprise adds real-time streaming, priority API access, custom formats, and 99.97% SLA.