Hands-on detection engineering

STIX/TAXII feeds: Pro plan and up

Beginner15 min3 min2026-03-20

Lightweight Reputation Checks vs Full Threat Analysis

Choose GET /check/reputation when you only need vendor-style verdict counts, and reserve GET /check for investigations. Includes curl examples and when to add /check/whois or /check/location.

A clear decision tree for API calls: faster reputation polling for high-volume paths, full /check for triage, and narrow endpoints for geo or WHOIS-only questions.

isMalicious APIcurlPython

Beginner30 min3 min2026-03-18

Automating Malicious IP and Domain Blocklist Downloads

Use GET /blocklist/stats for freshness, then GET /blocklist/download/{filename} to pull plain-text lists into your WAF, DNS firewall, or SOAR— with curl, diff, and cron-friendly patterns.

A scheduled job that downloads the correct blocklist file for your plan, detects changes, and feeds only deltas into downstream controls—aligned with the public HTTP API.

isMalicious APIcurlbashcron

Free: sample list · full lists on paid plans

Beginner25 min3 min2026-03-15

Bulk IOC Triage with the isMalicious Batch API

Turn a CSV or SIEM export into scored verdicts in minutes. Use GET /bulk/check for limits, then POST /bulk/check with mixed domains, IPs, and URLs—curl and Python included.

A repeatable batch pipeline that classifies hundreds of IOCs per run with per-entity malicious flags, confidence, source counts, and categories—without hammering single-entity endpoints.

isMalicious APIcurlPythonCSV

Intermediate60 min4 min2026-03-08

Phishing Domain Detection with Typosquatting Analysis

Build an automated pipeline to detect phishing domains targeting your brand. Uses typosquatting generation, DNS resolution, and isMalicious reputation checks to catch threats before victims do.

An automated daily scan that detects typosquatting domains targeting your brand, with live reputation checking and alerting when a suspicious domain becomes active.

PythonisMalicious APIdnstwistWazuh

Beginner20 min4 min2026-03-05

Blocking Malicious IPs with Firewall Automation

Automatically update firewall blocklists using isMalicious threat data. Covers pfSense, iptables, Palo Alto, and cloud security groups (AWS/GCP/Azure). Zero manual effort after setup.

A cron-driven pipeline that automatically blocks malicious IPs at the network edge, updated every 6 hours from observed threat activity intelligence.

isMalicious APIPythoniptablespfSenseAWS

TAXII feed: Pro plan and up · Free: bulk check

Beginner30 min4 min2026-03-01

Enriching SIEM Alerts with isMalicious Threat Intel

Integrate isMalicious API into Splunk and Elastic to auto-enrich every alert with IP/domain reputation, categories, and risk scores. Includes lookup tables and correlation searches.

Every SIEM alert automatically enriched with threat reputation, category, and confidence score — cutting triage time by up to 60%.

SplunkElastic SIEMisMalicious APIPython

Intermediate45 min6 min2026-02-17

Detecting C2 Beacons with YARA Rules

Build and deploy YARA rules to detect Command & Control beacon traffic in your network. Includes copy-paste rules for Cobalt Strike, Sliver, and Metasploit.

A set of production-ready YARA rules that detect Cobalt Strike, Sliver, and Metasploit C2 beacons, integrated into your SIEM pipeline.

YARASplunkElasticisMalicious API