Threat intelligence API / integrations

Windows Terminal

Call the ThreatCluster threat-intelligence API from PowerShell inside Windows Terminal. Invoke-RestMethod parses the JSON into objects you can filter with Select-Object, and Task Scheduler stands in for cron.

Prerequisites

  1. A free API key. Sign in and mint one under Settings → API. Free keys carry 100 credits a day, 30 requests a minute and a 7-day data window.
  2. Every request sends the key in the X-API-Key header.
  3. Base URL: https://threatcluster.io/api/public/v1
  4. Windows Terminal with a PowerShell profile. The steps work in Windows PowerShell 5.1 and PowerShell 7.

Setup

  1. Set the key for the current session:

    $env:TC_KEY = "tc_live_your_key_here"

  2. Persist it so future sessions have it too:

    [Environment]::SetEnvironmentVariable("TC_KEY", "tc_live_your_key_here", "User")

    This writes a user-scope variable that new terminal tabs and scheduled tasks will see. It only applies to new sessions; the current one keeps the value from step 1.

  3. Make a first request:

    $base = "https://threatcluster.io/api/public/v1"
$headers = @{ "X-API-Key" = $env:TC_KEY }

Invoke-RestMethod -Uri "$base/threats?time_filter=24h&limit=3" -Headers $headers |
  Select-Object -ExpandProperty threats |
  Select-Object ai_title, threat_score, urgency_level

  4. Invoke-RestMethod discards the response headers. To read the cost and budget headers, use Invoke-WebRequest:

    $r = Invoke-WebRequest -Uri "$base/threats?time_filter=24h" -Headers $headers
$r.Headers["X-Request-Cost"]
$r.Headers["X-RateLimit-Remaining"]

The curl gotcha. In Windows PowerShell 5.1, curl is an alias for Invoke-WebRequest, so curl-style flags such as -H fail with a parameter error. Call the real binary as curl.exe (bundled with current Windows 10 and 11), or stay with Invoke-RestMethod. PowerShell 7 removed the alias, so curl there runs curl.exe.

curl.exe -s -H "X-API-Key: $env:TC_KEY" "https://threatcluster.io/api/public/v1/search?q=Qilin"

An hourly pull with Task Scheduler

Save a pull script as C:\Scripts\tc-ioc-pull.ps1. It fetches the plain-text IOC feed and writes a blocklist file:

$headers = @{ "X-API-Key" = $env:TC_KEY }
$feed = Invoke-RestMethod -Uri "https://threatcluster.io/api/public/v1/iocs/feed?format=txt&hours=24" -Headers $headers
Set-Content -Path "C:\Scripts\threatcluster-blocklist.txt" -Value $feed

Register it to run every hour:

$action  = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -File C:\Scripts\tc-ioc-pull.ps1"
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
Register-ScheduledTask -TaskName "ThreatCluster IOC pull" -Action $action -Trigger $trigger

The task runs under your account, so it sees the user-scope TC_KEY from setup step 2. Each feed pull costs 3 credits, so 24 pulls a day spends 72 of the 100-credit free budget.

Worked example

Ransomware leak-site victims from the last 7 days:

Invoke-RestMethod -Uri "$base/darkweb/ransomware/victims?days=7" -Headers $headers |
  ConvertTo-Json -Depth 4

The response body, trimmed to 1 victim (the live call returned 100):

{
  "victims": [
    {
      "id": "a4834f3163071aad",
      "group": "rhysida",
      "name": "Szechenyi Programiroda Nonprofit Kf",
      "discovered": "2026-09-01 17:27:14.520298+00:00",
      "country": "HU",
      "sector": "Other",
      "description": "Szechenyi Programiroda Nonprofit Kf",
      "first_party": false,
      "delisted": false,
      "fp_has_note": false,
      "fp_cats": 0
    }
  ],
  "count": 100
}

Filter it as objects instead: append | Select-Object -ExpandProperty victims | Select-Object group, name, country.

Costs and limits

Free keys spend a daily budget of 100 credits. Most GETs cost 1 credit; the IOC feed and export, STIX bundles, dark-web keyword hits and trends cost 3; /search costs 5; a dark-web victim enrichment record costs 10. The rate limit is 30 requests a minute and data goes back 7 days. A request that finds nothing refunds its credits and returns X-Request-Cost: 0.

Endpoint reference: /api/public/v1/docs. Bigger windows and budgets: /pricing.