Threat intelligence API / integrations

TAXII

ThreatCluster runs a read-only TAXII 2.1 server, so any client that speaks TAXII can pull our validated indicators as STIX 2.1. You enter a URL, a collection id and your API key. There is nothing to install.

Prerequisites

An API key on the Starter, Growth or Business plan. Sign in, open Settings → API & Feeds and select Generate API key.

Connection details

Discovery URL:  https://threatcluster.io/api/public/v1/taxii2/
API root URL:   https://threatcluster.io/api/public/v1/taxii2/v1/
Username:       anything, for example taxii
Password:       your ThreatCluster API key

The key can also go in an X-API-Key header if your client supports custom headers.

Collections

High confidence. For detection, so start here.

4f8e2a61-3c7b-4d19-9a52-6b0e1f7c8d23

All validated. For enrichment. It includes medium and low confidence, so do not block on it.

a17c5d90-82ef-4b36-b1d4-29e6f3a07c58

Setup: Microsoft Sentinel

1. In Sentinel, open Content hub and install the Threat Intelligence solution, then open Data connectors and select the TAXII connector.
2. Fill in the friendly name, the API root URL, the collection id, the username and the password from above.
3. Set the polling frequency. Once an hour is enough, because the collection refreshes every 15 minutes at most and most hours add few indicators.

Setup: Elastic

1. In Kibana, open Integrations, add Custom Threat Intelligence to an agent policy and choose the TAXII input.
2. Turn on Enable TAXII 2.1 and enter the basic auth username and password.
3. Set the URL to the API root URL followed by the collection id and the objects path:

   {api root}collections/{collection id}/objects/

Setup: OpenCTI

1. Under OpenCTI's data ingestion settings, open TAXII feeds and add a feed.
2. Use the API root URL as the server URL, choose a collection id, and set the authentication type to basic with the username and password above.

Try it with curl

ROOT=https://threatcluster.io/api/public/v1/taxii2/v1
ID=4f8e2a61-3c7b-4d19-9a52-6b0e1f7c8d23

curl -u "taxii:$TC_KEY" \
  -H "Accept: application/taxii+json;version=2.1" \
  "$ROOT/collections/$ID/objects/?limit=2"

What arrives

Each indicator is a STIX 2.1 indicator object for an IP address, domain, file hash or email address, with its confidence, the reason we kept it, and a TLP:CLEAR marking. Crypto wallets are not included because STIX 2.1 has no standard object for them, but they are in the IOC API.

• Stable ids: an indicator keeps the same id for life, so a client updates it instead of duplicating it.
• Re-sightings: modified and the date added move to the latest report that mentions it, so it comes through again as a new version.
• Window: the collections hold indicators seen in reports in the last 90 days. Each one carries a valid_until 90 days after its latest sighting.
• Filters: added_after, limit (up to 1,000), next, match[id], match[type], match[version] and match[spec_version].

TAXII only carries indicators. For incident clusters, leak-site victims and CVEs, use the API.

Costs and limits

Format details: /formats. The keyed IOC endpoints: IOC API. Plans: /pricing.