Threat intelligence API / integrations

Splunk

Two ways to get ThreatCluster indicators into Splunk: a scripted input that polls the IOC feed and indexes the JSON as events, or a CSV lookup you refresh on a schedule and match against your logs with inputlookup.

Prerequisites

1. A ThreatCluster API key. Every plan, including free, has one: sign in, open Settings → API and select Generate API Key. Requests go to https://threatcluster.io/api/public/v1 with the key in an X-API-Key header.
2. For the scripted input: filesystem access to a Splunk Enterprise instance or a deployable app. Scripted inputs are configured in inputs.conf and the script must live in $SPLUNK_HOME/etc/apps/<app>/bin/. Enabling one requires a Splunk restart.
3. For the lookup route: a role with the upload_lookup_files capability if you upload through Splunk Web.

Setup: scripted input

1. Generate your key under Settings → API.
2. Create $SPLUNK_HOME/etc/apps/<app>/bin/threatcluster_feed.sh:

   #!/bin/sh
   curl -s -H "X-API-Key: YOUR_KEY" \
     "https://threatcluster.io/api/public/v1/iocs/feed?format=json&hours=24"

   Make it executable with chmod +x.
3. Add a stanza to $SPLUNK_HOME/etc/apps/<app>/local/inputs.conf. interval is in seconds, so 3600 polls once an hour:

   [script://$SPLUNK_HOME/etc/apps/<app>/bin/threatcluster_feed.sh]
   disabled = false
   interval = 3600
   index = threat_intel
   sourcetype = threatcluster:iocs

4. Restart Splunk. Scripted inputs can also be managed from Settings in Splunk Web; the exact page varies by version, so check the "Setting up a scripted input" docs for yours. The configuration file route above is stable.
5. Search the indexed events. Each event is one JSON response; spath extracts the IOC array:

   index=threat_intel sourcetype=threatcluster:iocs
   | spath path=iocs{} output=ioc
   | mvexpand ioc
   | spath input=ioc

Setup: CSV lookup blocklist

1. Pull the feed as CSV (columns are type,value,confidence,reason):

   curl -s -H "X-API-Key: YOUR_KEY" \
     "https://threatcluster.io/api/public/v1/iocs/feed?format=csv" \
     -o threatcluster_iocs.csv

2. Load it into Splunk. One-off: Settings > Lookups > Lookup table files > Add new, choose the file and a destination filename ending in .csv, then create a lookup definition from it. Recurring: run the curl from cron and write the file into your app's lookups directory, which keeps the table fresh without the UI.
3. Match your logs against it with a subsearch. For example, proxy traffic to known bad domains:

   index=proxy
     [ | inputlookup threatcluster_iocs.csv
       | search type=domain
       | rename value AS dest_host
       | fields dest_host ]

Worked example

A real captured response from the CSV endpoint, trimmed:

GET https://threatcluster.io/api/public/v1/iocs/feed?format=csv
X-API-Key: YOUR_KEY

type,value,confidence,reason
domain,acrobatreaderonline.com,high,[article sweep] Used as a malicious site impersonating Adobe Acrobat Reader.
domain,bookcheckarrival-gueststayhotel.com,high,Indicates attacker-controlled phishing domain targeting hotel reservations.
domain,browser-app.com,high,[article sweep] Domain used in a malicious browser extension campaign
domain,case-apple.com,high,[article sweep] Used in phishing scams impersonating Apple
domain,ccleanerwind.top,high,Identified as attacker-controlled domain for malware distribution

Useful parameters on /iocs/feed: types (all, ip, domain, hash, email), format (txt, csv, json, stix), confidence (default confirmed, which excludes false positives and unreviewed IOCs) and hours. format=txt returns bare values, one per line, if you want a plain blocklist. /iocs/export takes the same filters and serves the result as a download.

Costs and limits

Full endpoint reference: /api/public/v1/docs. Output formats: /formats. Paid tiers with longer lookback and higher limits: /pricing.