Client boundaries
API keys belong to an organization. Define the credential and data separation each client needs.
Solutions
MSSP Partners External context for your managed security workflows
Use the API and feeds in your managed SOC. Client boundaries, volumes and redistribution rights are agreed per contract.
No credit card required · Free API key
Capabilities
Key features at a glance.
Branding
Custom branding, domains or delivery formats are scoped per contract, not included in public plans.
Usage and licensing
Quoted on expected volume and the permitted recipients of the data.
Support terms
The response commitments your service needs are written into the contract.
Applications
Use cases to evaluate first.
Managed SOC enrichment
Add source-attributed context to the indicators your analysts already triage.
Client Reporting
Keep returned sources and dates with the findings you report to clients.
FAQ
Frequently asked questions.
Are branding and custom domains included?
Not in public plans. Describe the setup you need; feasibility and price are agreed before you rely on it.
How are clients kept separate?
API credentials are attached to an organization. There is no multi-client console or dedicated infrastructure by default, so define the boundaries each client requires.
How is MSSP usage priced?
Public plans stay as listed. For a quotation, describe the intended usage, client count and delivery model. Volume discounts and dedicated support are agreed explicitly.
Can we redistribute or resell the data?
Not by default: an API subscription grants no redistribution or resale rights. Name the recipients, delivery method and use; the required rights are set in the contract.
Research
Related articles from the research blog.
Blog post
TAXII Threat Feeds: Build a Continuous SIEM Integration
Connect an isMalicious TAXII collection to your SIEM with safe pagination, durable checkpoints, validation, monitoring, and recovery.
Read more
Blog post
STIX/TAXII Threat Feeds: Operational Guide for OpenCTI, MISP, and SIEM Pipelines
How to wire STIX 2.1 and TAXII 2.1 collections into OpenCTI, MISP, or your SIEM — what to poll, how to handle confidence and aging indicators, and where enrichment APIs fit alongside feed ingestion.
Read more
Blog post
IOC Expiration: When to Remove an IP From a Blocklist
Manage IOC expiration with separate DNS, evidence and STIX validity clocks. Review stale IP blocks, process withdrawals and preserve the audit trail.
Read moreTest it with your own indicators.
The free plan includes 50 lookups a month. Check the sources and limits, then connect the API.
No credit card required · Free API key