Threat intelligence for the clients you manage

Each client is a customer record: name, domain, contact email, notes, sector, country and a logo (PNG, JPEG, SVG or WebP, up to 5 MB). Records are managed under Settings or created over the API, and a client never needs to sign up or log in for you to run intelligence on their behalf.

Every feed, tracked interest, alert rule, CVE rule, webhook and digest you create is stamped with that customer's id, and quotas are counted per customer, so one busy client does not eat another's allowance. A workspace switcher in the navbar moves you between your own view, any single customer, and a read-only roll-up across all of them.

Offboarding is a soft deactivation. The customer's alert rules, CVE rules and webhooks stop with it, and the record stays in place for your own history.

• Feeds. Keyword and entity feeds per customer, built in the UI or seeded with a keyword list in one API call. Keyword lists can also be synced declaratively, so a feed always matches what your PSA says the client runs.
• Alert rules. Cluster and CVE rules scoped to a customer fire only on that customer's entities and thresholds.
• Webhooks. JSON, Slack, Teams or Discord per customer, each showing its last-triggered time and failure count. A customer's rule can only route to that customer's webhook, so one client's alert never lands in another client's channel.
• Trigger history. Every firing is stored against the customer and queryable over the API.

Schedule a daily, weekly or monthly digest from any customer feed. It goes out under the customer's name and logo, as a "Threat Digest" for that client, to up to 25 recipients on your email domain or theirs. Test-send it to yourself before switching it on.

For a brief you shape by hand, the weekly executive brief recipe pulls the week's top clusters into Markdown from the same feed.

The base URL is https://threatcluster.io/api/public/v1 and every request authenticates with an X-API-Key header. Business keys carry the mssp:read and mssp:write scopes alongside the other nine, at 600 requests a minute with no daily budget and per-key overrides where a contract needs more. Two calls put a client on the platform.

Create a customer

curl -X POST -H "X-API-Key: $TC_KEY" -H "Content-Type: application/json" \
  "https://threatcluster.io/api/public/v1/mssp/customers" \
  -d '{"name":"Acme Ltd","domain":"acme.com","contact_email":"[email protected]",
       "sector":"Financial Services","country":"GB"}'

The response carries an integer id. That is the mssp_customer_id every other call takes.

Create that customer's feed, with keywords

curl -X POST -H "X-API-Key: $TC_KEY" -H "Content-Type: application/json" \
  "https://threatcluster.io/api/public/v1/mssp/customers/42/feed" \
  -d '{"name":"Acme monitoring","keywords":["Acme","acme.com","Acme Payroll"]}'

Roster sync is GET, POST and PATCH on /mssp/customers; a PATCH with {"is_active": false} offboards a client from your billing system without anyone opening the UI. Scoped reads take ?mssp_customer_id= on /feed, /feeds, /feeds/{id}/entities, /alerts and /darkweb/trends, which picks up the customer's sector on its own. Alert rules and CVE rules are created with the same field.

The rest of the surface is the same as any Business account: MISP feed, STIX 2.1 bundle per threat, IOC export, RSS, the tc CLI, and agent keys with short-lived bearer tokens for CI and automations. The full spec is in the API docs.

Ransomware victims, groups, facets, trends and keyword hits come from first-party leak-site collectors and are on the /darkweb/* endpoints, so a client's sector view and the sector ransomware watch recipe both run on data we gather ourselves.

Company, domain and keyword monitoring is set for your organisation and checked on demand through the keyword-hits endpoint. It is org-level and query-based; it is not a per-customer push alert.

Business includes an organisation with owner, admin and member roles, invites and domain auto-join. Feeds, alert rules, webhooks and API keys can be shared at the org level, so an analyst who joins on Monday sees the same customers and the same rules as everyone else.

• Sector ransomware watch: new leak-site victims for a client's sector and country, posted to Slack.
• Weekly executive brief: the week's top clusters as a Markdown brief you can send under your own name.
• Vendor in the news: which of a client's vendors and products are in incident reporting this week.

Each recipe is a runnable script with its captured output and credit cost, and each has a .md twin for an agent's context window.

Managed-customer scoping is part of the Business plan at $399 a month. It is switched on for your account after a short call and priced by the number of clients you run, so tell us how many you look after. There is no separate service-provider plan.

Business is set up over a short call. Every account starts with a free API key, so you can read the corpus and the docs before that call happens. The full plan comparison is on the pricing page.