Threat intelligence for the clients you manage

One account, one bill, and a separate threat feed, alert rules, webhooks and branded digest for every client you look after. Customer scoping is a Business feature, in the UI and over the API, so an MSSP, a vCISO practice or a consultancy runs its whole book from one place.

Business is $199 a month for platform access, then $59 a month per managed customer; each customer adds 10,000 credits a day to your pool. Switched on over a short call.

Talk to us about Business Read the docs

One tenant per client

Each client is a customer record: name, domain, contact, sector, country and a logo. Records are managed under Settings or created over the API, and a client never needs to sign up or log in for you to run intelligence on their behalf.

Every feed, tracked interest, alert rule, CVE rule, webhook and digest you create is stamped with that customer's id, and quotas are counted per customer, so one busy client does not eat another's allowance. A workspace switcher in the navbar moves you between your own view, any single customer, and a read-only roll-up across all of them.

Offboarding is a soft deactivation. The customer's alert rules, CVE rules and webhooks stop with it, and the record stays in place for your own history.

Feeds, rules and routing per client

Feeds. Keyword and entity feeds per customer, built in the UI or seeded with a keyword list in one API call. Keyword lists can also be synced declaratively, so a feed always matches what your PSA says the client runs.
Alert rules. Cluster and CVE rules scoped to a customer fire only on that customer's entities and thresholds.
Webhooks. JSON, Slack, Teams or Discord per customer, each showing its last-triggered time and failure count. A customer's rule can only route to that customer's webhook, so one client's alert never lands in another client's channel.
Trigger history. Every firing is stored against the customer and queryable over the API.

Digests under their name

Schedule a daily, weekly or monthly digest from any customer feed. It goes out under the customer's name and logo, as a "Threat Digest" for that client, to up to 25 recipients on your email domain or theirs. Test-send it to yourself before switching it on.

For a brief you shape by hand, the weekly executive brief script pulls the week's top clusters into Markdown from the same feed.

Over the API

Two calls put a client on the platform. Business keys carry the mssp:read and mssp:write scopes at 600 requests a minute with no daily budget; every request authenticates with X-API-Key against https://threatcluster.io/api/public/v1.

Create a customer

curl -X POST -H "X-API-Key: $TC_KEY" -H "Content-Type: application/json" \
  "https://threatcluster.io/api/public/v1/mssp/customers" \
  -d '{"name":"Acme Ltd","domain":"acme.com","contact_email":"[email protected]",
       "sector":"Financial Services","country":"GB"}'

The response carries an integer id. That is the mssp_customer_id every other call takes.

Create that customer's feed, with keywords

curl -X POST -H "X-API-Key: $TC_KEY" -H "Content-Type: application/json" \
  "https://threatcluster.io/api/public/v1/mssp/customers/42/feed" \
  -d '{"name":"Acme monitoring","keywords":["Acme","acme.com","Acme Payroll"]}'

Roster sync is GET, POST and PATCH on /mssp/customers; a PATCH with {"is_active": false} offboards a client from your billing system without anyone opening the UI. Scoped reads take ?mssp_customer_id= on /feed, /feeds, /feeds/{id}/entities, /alerts and /darkweb/trends, which picks up the customer's sector on its own. Alert rules and CVE rules are created with the same field.

Dark web, from our own collectors

Ransomware victims, groups, facets, trends and keyword hits come from first-party leak-site collectors and are on the /darkweb/* endpoints, so a client's sector view and the sector ransomware watch script both run on data we gather ourselves.

Company, domain and keyword monitoring is set for your organisation and checked on demand through the keyword-hits endpoint. It is org-level and query-based; it is not a per-customer push alert.

Your team

Business includes an organisation with owner, admin and member roles, invites and domain auto-join. Feeds, alert rules, webhooks and API keys can be shared at the org level, so an analyst who joins on Monday sees the same customers and the same rules as everyone else.

Scripts to start from

Sector ransomware watch: new leak-site victims for a client's sector and country, posted to Slack.
Weekly executive brief: the week's top clusters as a Markdown brief you can send under your own name.
Vendor in the news: which of a client's vendors and products are in incident reporting this week.

Each one is a runnable script with its captured output and credit cost, and each has a .md twin for an agent's context window.

What it costs

There is no separate service-provider plan: it is the Business plan, $199 for the top-level tenant plus $59 per managed customer. Every account starts with a free API key, so you can read the corpus before the call. The full comparison is on the pricing page.

Put your first client on it this week

A customer record, a feed and a scheduled digest take about ten minutes over the API. Tell us how many clients you run and we will set the account up with you.

Talk to us about Business See plans