Improved
Glossary: worked examples and AI agent security terms
Long-form explanations and worked examples for 16 top terms, plus 14 new terms including an AI agent security category.
Product updates
Changelog
Features, data sources, API changes and fixes shipped to isMalicious, newest first.
Latest releases15 entries
- ImprovedGlossary: worked examples and AI agent security terms
- NewGlossary of threat intelligence terms
- NewMethodology page
- NewProgrammatic CVE intelligence pages
- DataCVE database expanded to 50K+ entries
- APIBulk indicator check: mixed IOC batches in one request
September 2026
April 2026
New
Glossary of threat intelligence terms
A searchable glossary of 50+ terms across threat intelligence, malware, network, vulnerability and API security.
New
Methodology page
Published the 6-factor confidence formula, configured source weights, freshness limits and false-positive handling at /methodology.
New
Programmatic CVE intelligence pages
Pages for high-severity CVEs with CVSS, EPSS, CISA KEV status, SSVC exploitation and correlated IOCs, at /cve/[CVE-ID].
Data
CVE database expanded to 50K+ entries
Daily ingestion from NVD, CISA KEV, GitHub Advisory Database, Exploit-DB, OSV, CERT-FR, MSRC and VulnCheck; EPSS refreshed every 24 hours.
API
Bulk indicator check: mixed IOC batches in one request
The /api-docs/bulk endpoint accepts mixed IP, domain, and URL batches in a single request, up to 500 indicators per request depending on the plan. Responses stream via chunked transfer encoding.
New
Ransomware victim tracker launched
Victim organizations, attack timelines and related infrastructure IOCs per ransomware group, updated hourly from 40+ leak sites.
Improved
Streaming threat feed latency reduced by 40%
A pipeline rewrite cut median streaming latency from 1.2 s to 720 ms; p99 is now under 2.5 s.
March 2026
Data
Ransomware leak-site coverage expanded
Victim posts from more public leak sites via RansomLook and Ransomfeed, each with group, publication time and correlated indicators.
API
STIX 2.1 objects over TAXII 2.1
TAXII 2.1 collections serve STIX 2.1 objects for OpenCTI, MISP and Sentinel. Feeds are included in Pro and Enterprise.
New
NRD (newly registered domain) feed
A daily feed of newly registered domains with age, registrar, nameserver and isMalicious verdict, in CSV and JSON.
Improved
Confidence scoring now factors in source age
Older signals from lower-reliability sources now lose weight over time, reducing false positives from stale community reports.
February 2026
New
DNS history lookup tool
DNS record history for any domain: A, AAAA, MX, NS, TXT and CNAME, timestamped over 3 years.
API
Webhook delivery retry and log
A delivery that fails on a server error or timeout is retried once. Each delivery is logged with its status code in the dashboard.
January 2026
Data
AlienVault OTX and Emerging Threats added to correlation engine
Two sources join the correlation engine, for 17 feeds in total. Source weights are published at /methodology.