Threat intelligence API / integrations

OpenCTI

ThreatCluster exports every incident as a STIX 2.1 bundle: a Report, the Indicators, and the Threat Actor, Malware, Vulnerability and Identity objects it names, with relationships between them. OpenCTI imports STIX bundles natively, so a scheduled script that pulls the bundles for new incidents keeps an OpenCTI instance in step with the reporting.

Prerequisites

1. A ThreatCluster API key. Every plan has one: sign in, open Settings → API & Feeds and select Generate API key. Requests go to https://threatcluster.io/api/public/v1 with the key in an X-API-Key header.
2. An OpenCTI instance with an API token that has the Connector or Administrator role, and the pycti Python client (pip install pycti).

Setup: scheduled import

1. List the incidents you want. The newest of the last day, trending first:

   curl -H "X-API-Key: YOUR_KEY" \
     "https://threatcluster.io/api/public/v1/threats?time_filter=24h&limit=25"

2. Fetch each one as STIX. The bundle is TLP-marked and the Report's external_references point back at the cluster page and the source articles:

   curl -H "X-API-Key: YOUR_KEY" \
     "https://threatcluster.io/api/public/v1/threats/CLUSTER_ID/stix" -o bundle.json

3. Push it into OpenCTI with pycti. The object ids are deterministic, so re-importing a cluster updates it rather than duplicating:

   from pycti import OpenCTIApiClient
   import json, os, requests
   
   octi = OpenCTIApiClient(os.environ["OPENCTI_URL"], os.environ["OPENCTI_TOKEN"])
   tc = requests.Session(); tc.headers["X-API-Key"] = os.environ["TC_KEY"]
   base = "https://threatcluster.io/api/public/v1"
   
   for t in tc.get(f"{base}/threats", params={"time_filter": "24h", "limit": 25}).json()["threats"]:
       bundle = tc.get(f"{base}/threats/{t['cluster_id']}/stix").json()
       octi.stix2.import_bundle_from_json(json.dumps(bundle), update=True)
       print("imported", t["ai_title"])

4. Run it from cron or as a custom OpenCTI external-import connector. Hourly is enough; clusters that gained new reporting since the last run come back in the listing and re-import cleanly.

Setup: one-off import

For a single incident, download the bundle with the curl above and use Data → Import in OpenCTI, which accepts a STIX 2.1 JSON file and runs it through the import connector. Useful for a case you are working, before automating the rest.

What arrives

One report per incident with the summary as its description; indicator objects with STIX patterns for each validated domain, IP, URL and hash; threat-actor, malware, vulnerability and identity objects for the named entities; and relationship objects such as uses, targets and indicates inferred from the reporting. Everything carries a marking-definition for its TLP.

Costs and limits

Endpoint reference: threats endpoints. Format matrix: /formats. Plans: /pricing.