Indicators that go where you need them.

Every article that enters the pipeline is extracted for IOCs, validated for confidence, and made available wherever your analysts and tooling need them. STIX, MISP, REST, RSS, CLI.

Every article, extracted twice

The unambiguous indicators come out first. IPs, domains, URLs, hashes, CVE IDs, crypto wallets. Anything with a predictable shape gets captured with a script, not a model.

AI then handles the contextual layer. Threat actors, malware families, MITRE techniques, tools, industries, and targets. Benign domains, invalid hashes, and known false positives are filtered out up front, so the validation queue stays clean.

Confidence on every indicator

Every IOC is assigned a confidence level. High, medium, low, or false positive. Each carries a written justification so analysts know why the model graded it that way.

Confidence feeds every downstream filter, so analysts only see what's been verified. Pending IOCs surface separately for the analyst on triage duty, with an X-IOC-Pending-Count header on every API response so SIEM ingestion can see the validation lag in flight.

Per-cluster or in bulk

One cluster's IOCs as TXT for a firewall blocklist, CSV for a spreadsheet, JSON for a script, or STIX 2.1 with TLP marking for a TIP. Or query in bulk by type, confidence, and time window.

Defang on or off per request. ATT&CK Navigator layer for the techniques in the cluster. The full format matrix with auth, tier, and confidence defaults sits at /formats.

Native MISP feed

ThreatCluster ships a native MISP-compatible feed with manifest, hashes index, and event JSON. UUIDs are stable across regenerations, so MISP correlation works cleanly and event re-pulls don't generate duplicate records.

Authenticated tier carries 50 events with historical replay via ?since= and ?days=. Public tier carries 10 recent events. MISP Galaxy clusters auto-attach for recognised threat actors and ransomware groups.

Into your SIEM, however you ingest

REST API for direct pulls. RSS for feed-based ingestion. Webhook push into Splunk, Microsoft Sentinel, Elastic, or OpenSearch. Filter by confidence, type, and freshness on the wire so you don't have to filter post-ingest.

Over the API

The blocklist on this page needs no key at all. With a key you get the same validated indicators filtered by type, confidence and window, per cluster, and as STIX.

GET /iocs/feed

polling feed: text, CSV or JSON, filtered by type, confidence, hours

GET /iocs/export

bulk export for a SIEM lookup table

GET /threats/{id}/iocs

the indicators behind one incident, with reason and confidence

GET /threats/{id}/stix

the incident as a STIX 2.1 bundle

/api/iocs/public/feed.txt

the keyless blocklist, TLP:CLEAR

# free key: 100 requests/day, last 7 days, scope iocs:read
curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/iocs/feed?hours=24&confidence=confirmed&format=txt"

Quickstart and plans · OpenAPI reference · Or read it in the live feed

More of the platform

Dark Web Monitoring

In-house collection across leak sites and forums

The Exploits Database

CVEs ranked by what defenders care about

CLI and Headless

REST API, tc command, agent tool

Format matrix

Every IOC endpoint, format, and tier in one table

Pipe the IOCs where they need to go.

Eleven consumption surfaces, one entity graph behind them. STIX for your TIP, MISP for your sharing community, REST for your scripts, RSS for your dashboard.