Threat intelligence API / integrations

MISP

ThreatCluster publishes a MISP feed: one event per incident cluster, with the indicators as attributes and the actors, malware and CVEs as tags, so a MISP instance can fetch it like any other feed and correlate it against what you already hold. The feed is on the Researcher plan and up; the free IOC feed below works for a CSV import on any plan.

Prerequisites

1. A ThreatCluster API key on the Researcher or Business plan. Sign in, open Settings → API & Feeds and select Generate API key. The same key is the feed token.
2. A MISP instance where you can add feeds (the site admin or org admin role, under Sync Actions).

Setup: the MISP feed

1. In MISP go to Sync Actions → List Feeds → Add Feed.
2. Fill in:

   Name:           ThreatCluster
   Provider:       ThreatCluster
   Input source:   Network
   URL:            https://threatcluster.io/api/misp/?token=YOUR_KEY
   Source format:  MISP Feed
   Enabled:        yes

3. Save, then on the feed list select Fetch and store all feed data once to pull the manifest and the 50 most recent events. After that MISP's scheduled fetch keeps it current.
4. The manifest carries a rolling seven-day window by default. For a first load or a replay, use the manifest URL with a range:

   https://threatcluster.io/api/misp/manifest.json?token=YOUR_KEY&days=30
   https://threatcluster.io/api/misp/manifest.json?token=YOUR_KEY&since=2026-08-01

Setup: CSV feed on any plan

1. The public IOC feed needs no key and MISP can ingest it as a Simple CSV parsed feed. Add a feed with:

   Name:           ThreatCluster public IOCs
   Input source:   Network
   URL:            https://threatcluster.io/iocs/feed.csv
   Source format:  Simple CSV Parsed Feed
   Value field:    2
   Delimiter:      ,

   The columns are type,value,confidence,reason; MISP infers the attribute type from the value.
2. For a keyed pull with a longer window on paid plans, point the same feed at https://threatcluster.io/api/public/v1/iocs/feed?format=csv and add the key as a header under the feed's Headers field: X-API-Key: YOUR_KEY.

What arrives

Each event is one incident: the cluster title as the event info, the date the story broke, a TLP tag, and attributes for every validated indicator with the article it came from as a comment. Actors, malware families and CVEs are tags in the threatcluster: namespace so you can filter on them in MISP searches. The event UUID is stable, so re-fetching updates the event rather than duplicating it.

GET https://threatcluster.io/api/misp/manifest.json?token=YOUR_KEY

{
  "3f6c…": { "info": "Critical Oracle WebLogic Flaw Under Active Exploitation",
             "date": "2026-08-27", "timestamp": 1787868000,
             "Tag": [ {"name": "tlp:clear"}, {"name": "threatcluster:cve=\"CVE-2026-21962\""} ] },
  …
}

Costs and limits

Format details: /formats. The keyed IOC endpoints: IOC API. Plans: /pricing.