Threat intelligence API / integrations

Microsoft Sentinel

Poll the ThreatCluster IOC feed on a schedule and push the indicators into your Microsoft Sentinel workspace as STIX objects. Once ingested, they appear on Sentinel's Threat intelligence page and can be matched against your logs by analytics rules.

Prerequisites

On the ThreatCluster side you need an API key. Every plan, including free, has one: sign in, open Settings → API and select Generate API Key. Requests go to https://threatcluster.io/api/public/v1 with the key in an X-API-Key header.

On the Azure side, Microsoft's supported path for custom feeds is the threat intelligence upload API, which ingests STIX objects without a data connector. It is in preview as of the current Microsoft Learn docs (API version 2024-02-01-preview). You need:

1. Permission to register a Microsoft Entra application.
2. The application granted the Microsoft Sentinel Contributor role at the workspace level.
3. Your Log Analytics workspace ID.

Setup

1. Generate your ThreatCluster API key under Settings → API.
2. Register a Microsoft Entra application. Record the application (client) ID from the app's Overview tab and create a client secret.
3. Assign the role: in the Azure portal go to Log Analytics workspaces, select your workspace, then Access control (IAM) > Add > Add role assignment. Pick the Microsoft Sentinel Contributor role and assign it to your application (search for it by name; Entra apps are not shown by default).
4. Create a Logic App with a Recurrence trigger set to every 1 hour.
5. Add an HTTP action that pulls the feed as STIX 2.1 indicators:

   GET https://threatcluster.io/api/public/v1/iocs/feed?format=stix&hours=24
   X-API-Key: YOUR_KEY

   The response is a STIX 2.1 bundle whose objects array contains one indicator object per IOC, with pattern, pattern_type, valid_from, confidence and a description carrying the reason the IOC was flagged.
6. Send the objects to the upload API. In a Sentinel Logic App use only the action named Threat Intelligence - Upload STIX Objects (Preview); Microsoft's docs warn that the other 2 threat intelligence actions fail with this endpoint. Calling the API directly instead looks like this:

   POST https://api.ti.sentinel.azure.com/workspaces/{workspaceId}/threat-intelligence-stix-objects:upload?api-version=2024-02-01-preview
   Authorization: Bearer <Entra access token>
   Content-Type: application/json
   
   {
     "sourcesystem": "ThreatCluster",
     "stixobjects": [ ...the objects array from the feed response... ]
   }

   The API accepts at most 100 objects per request and 100 requests per minute, so chunk the array if a pull is large.
7. Verify: within a few minutes the indicators appear on the Threat intelligence page in the Microsoft Sentinel menu, and land in the ThreatIntelIndicators table for KQL and analytics rules. Note that Microsoft is retiring Sentinel in the Azure portal after 31 March 2027 in favour of the Defender portal; the API is the same either way.

Worked example

The same feed in JSON, useful for testing your key before wiring up the Logic App. This is a real captured response, trimmed:

GET https://threatcluster.io/api/public/v1/iocs/feed?format=json
X-API-Key: YOUR_KEY

{
  "iocs": [
    {
      "type": "domain",
      "value": "acrobatreaderonline.com",
      "confidence": "high",
      "reason": "[article sweep] Used as a malicious site impersonating Adobe Acrobat Reader."
    },
    {
      "type": "domain",
      "value": "bookcheckarrival-gueststayhotel.com",
      "confidence": "high",
      "reason": "Indicates attacker-controlled phishing domain targeting hotel reservations."
    }
  ],
  "count": 629,
  "confidence_filter": "confirmed",
  "hours": 720
}

Useful parameters on /iocs/feed: types (all, ip, domain, hash, email), format (txt, csv, json, stix), confidence (default confirmed, which excludes false positives and unreviewed IOCs) and hours. A single incident can also be exported as a richer STIX 2.1 bundle, including threat actors and malware, via GET /threats/{id}/stix.

Costs and limits

Full endpoint reference: /api/public/v1/docs. Output formats: /formats. Paid tiers with longer lookback and higher limits: /pricing.