POST /alert-rules
Create an alert rule (personal or managed-customer scoped) · 1 credit per call
Create a personal alert rule that fires when its conditions match a new threat cluster. Tier-capped conditions (5 most tiers, 50 Business). Delivery via your webhook(s) and/or email. Omit `mssp_customer_id` for a personal rule, or set it to scope the rule to one of your managed customers (Business plan).
Request body · AlertRuleCreate
| Field | Type | Meaning |
|---|
| name * | string | Rule name (required). |
| description | string or null | Optional description. |
| logic_operator | string | 'AND' (all conditions) or 'OR' (any). |
| conditions * | array of AlertCondition | 1+ conditions. Tier-capped (5 for most, 50 for Business). |
| notify_webhook | boolean | Deliver matches to your webhook(s). |
| notify_email | boolean | Deliver matches by email. |
| notify_email_address | string or null | Custom email (must be your domain). Defaults to your account email. |
| webhook_id | integer or null | Specific webhook id to route to (must be yours). Omit to use all. |
| mssp_customer_id | integer or null | Scope this rule to one of your managed customers (Business). Omit for a personal rule. If set, any webhook_id must be scoped to the same customer or be unscoped |
curl -H "X-API-Key: $TC_KEY" -X POST \
"https://threatcluster.io/api/public/v1/alert-rules"
POST /cve-alerts
Create a CVE alert rule (personal or managed-customer scoped) · 1 credit per call
Create a personal CVE alert rule. Fires when a CVE matches the filters (vendor/product/CWE/severity/CVSS/EPSS/KEV/exploit/ransomware/keywords), combined by match_logic. Shares the alert-rule tier quota.
Request body · CveAlertRuleCreate
| Field | Type | Meaning |
|---|
| name * | string | Rule name (required). |
| description | string or null | |
| match_logic | string or null | 'AND' or 'OR' across the filters set. |
| vendors | array or null | Affected vendor names to match. |
| products | array or null | Affected product names. |
| cwe_ids | array or null | CWE ids, e.g. 'CWE-79'. |
| severity | array or null | CVSS severities: CRITICAL/HIGH/MEDIUM/LOW. |
| cvss_min | number or null | Minimum CVSS v3 base score. |
| cvss_max | number or null | Maximum CVSS v3 base score. |
| epss_min | number or null | Minimum EPSS probability (0-1). |
| epss_percentile_min | number or null | Minimum EPSS percentile (0-1). |
| require_kev | boolean or null | Only CVEs on CISA KEV. |
| require_exploit | boolean or null | Only CVEs with a public exploit/PoC. |
| ransomware_use | array or null | CISA ransomware-use flag values (e.g. ['Known']). |
| keywords | array or null | Free-text keyword filters on the CVE. |
| notify_webhook | boolean | |
| notify_email | boolean | |
| webhook_id | integer or null | Specific webhook id (must be yours). |
| mssp_customer_id | integer or null | Scope this CVE rule to one of your managed customers (Business). Omit for a personal rule. |
curl -H "X-API-Key: $TC_KEY" -X POST \
"https://threatcluster.io/api/public/v1/cve-alerts"