Threat intelligence API / Reference / Alerts

Alerts endpoints

Alert rules and their matches. Researcher and up. Researcher and up.

POST /alert-rules · POST /cve-alerts

POST /alert-rules

Create an alert rule (personal or managed-customer scoped) · 1 credit per call

Create a personal alert rule that fires when its conditions match a new threat cluster. Tier-capped conditions (5 most tiers, 50 Business). Delivery via your webhook(s) and/or email. Omit `mssp_customer_id` for a personal rule, or set it to scope the rule to one of your managed customers (Business plan).

Request body · AlertRuleCreate

FieldTypeMeaning
name *stringRule name (required).
descriptionstring or nullOptional description.
logic_operatorstring'AND' (all conditions) or 'OR' (any).
conditions *array of AlertCondition1+ conditions. Tier-capped (5 for most, 50 for Business).
notify_webhookbooleanDeliver matches to your webhook(s).
notify_emailbooleanDeliver matches by email.
notify_email_addressstring or nullCustom email (must be your domain). Defaults to your account email.
webhook_idinteger or nullSpecific webhook id to route to (must be yours). Omit to use all.
mssp_customer_idinteger or nullScope this rule to one of your managed customers (Business). Omit for a personal rule. If set, any webhook_id must be scoped to the same customer or be unscoped
curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/alert-rules"

POST /cve-alerts

Create a CVE alert rule (personal or managed-customer scoped) · 1 credit per call

Create a personal CVE alert rule. Fires when a CVE matches the filters (vendor/product/CWE/severity/CVSS/EPSS/KEV/exploit/ransomware/keywords), combined by match_logic. Shares the alert-rule tier quota.

Request body · CveAlertRuleCreate

FieldTypeMeaning
name *stringRule name (required).
descriptionstring or null
match_logicstring or null'AND' or 'OR' across the filters set.
vendorsarray or nullAffected vendor names to match.
productsarray or nullAffected product names.
cwe_idsarray or nullCWE ids, e.g. 'CWE-79'.
severityarray or nullCVSS severities: CRITICAL/HIGH/MEDIUM/LOW.
cvss_minnumber or nullMinimum CVSS v3 base score.
cvss_maxnumber or nullMaximum CVSS v3 base score.
epss_minnumber or nullMinimum EPSS probability (0-1).
epss_percentile_minnumber or nullMinimum EPSS percentile (0-1).
require_kevboolean or nullOnly CVEs on CISA KEV.
require_exploitboolean or nullOnly CVEs with a public exploit/PoC.
ransomware_usearray or nullCISA ransomware-use flag values (e.g. ['Known']).
keywordsarray or nullFree-text keyword filters on the CVE.
notify_webhookboolean
notify_emailboolean
webhook_idinteger or nullSpecific webhook id (must be yours).
mssp_customer_idinteger or nullScope this CVE rule to one of your managed customers (Business). Omit for a personal rule.
curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/cve-alerts"