Threat intelligence API / integrations

Elastic

ThreatCluster serves its IOC feed as STIX 2.1, which is the format Elastic's Custom Threat Intelligence integration is built to consume. Indicators land in ECS threat.indicator.* fields, and the Security app's indicator match rules alert when they appear in your logs.

Prerequisites

1. A ThreatCluster API key. Every plan, including free, has one: sign in, open Settings → API and select Generate API Key. Requests go to https://threatcluster.io/api/public/v1 with the key in an X-API-Key header.
2. A Fleet-managed Elastic Agent. The Custom Threat Intelligence integration reference lists Kibana 8.19.16 or 9.3.5 as the minimum versions.
3. Elastic Security enabled if you want the indicator match rules.

Setup

1. Generate your key under Settings → API.
2. In Kibana, open Integrations, search for Custom Threat Intelligence and add it to an agent policy. The integration ingests threat intelligence in STIX 2.1 format from REST APIs (GET and POST), TAXII 2.x servers, or log files; it also accepts a custom CEL program for APIs that need special handling.
3. Configure the REST API input to poll the ThreatCluster feed:

   URL:      https://threatcluster.io/api/public/v1/iocs/feed?format=stix&hours=24
   Method:   GET
   Header:   X-API-Key: YOUR_KEY
   Interval: 1h

   The response is a STIX 2.1 bundle whose objects array holds one indicator per IOC. If your version of the integration's default input expects bare STIX objects rather than a bundle, use its CEL option to unwrap the objects array; the integration reference covers both.
4. Confirm ingestion. Events are written to the logs-ti_custom.indicator data stream, and the currently active indicators are kept behind the logs-ti_custom_latest.indicator alias. The pipeline maps STIX fields onto ECS, including threat.indicator.type, threat.indicator.confidence, threat.indicator.description, threat.indicator.url.original and the threat.indicator.file.hash.* fields.
5. Turn on detection. In the Security app's Rules page, enable the prebuilt indicator match rules (for example Threat Intel IP Address Indicator Match, Threat Intel Hash Indicator Match, Threat Intel URL Indicator Match) or create a custom indicator match rule with logs-ti_custom_latest.indicator as the indicator index. Elastic matches against threat intelligence ingested during the last 30 days.

Worked example

The same feed in JSON, useful for testing your key before configuring the agent. This is a real captured response, trimmed:

GET https://threatcluster.io/api/public/v1/iocs/feed?format=json
X-API-Key: YOUR_KEY

{
  "iocs": [
    {
      "type": "domain",
      "value": "acrobatreaderonline.com",
      "confidence": "high",
      "reason": "[article sweep] Used as a malicious site impersonating Adobe Acrobat Reader."
    },
    {
      "type": "domain",
      "value": "bookcheckarrival-gueststayhotel.com",
      "confidence": "high",
      "reason": "Indicates attacker-controlled phishing domain targeting hotel reservations."
    }
  ],
  "count": 629,
  "confidence_filter": "confirmed",
  "hours": 720
}

With format=stix each of these becomes a STIX indicator: the domain turns into a [domain-name:value = '...'] pattern, hashes into [file:hashes.'SHA-256' = '...'] and so on, with the reason carried in description and confidence mapped to the STIX 0 to 100 scale. Other useful parameters: types (all, ip, domain, hash, email) and confidence (default confirmed, which excludes false positives and unreviewed IOCs).

Costs and limits

Full endpoint reference: /api/public/v1/docs. Output formats: /formats. Paid tiers with longer lookback and higher limits: /pricing.