API Details

IOC Enrichment API

Enrich URLs, domains, IPs, and hashes with threat intelligence, related references, malware associations, adversary links, attack techniques, targeted regions, and affected industries.

IOC EnrichmentThreat ContextSecurity Intelligence

Overview

IoC Enrichment API is a threat intelligence enrichment API that helps answer a deeper question: "What is this indicator connected to?"

Send a URL, domain, IPv4 address, or file hash and get structured enrichment data that helps you understand the context behind the indicator.

Threat context: See related references, tags, malware associations, adversary links, and available intelligence sections. Investigation support: Understand how an indicator may be connected to known campaigns, threat actors, or suspicious activity. Attack mapping: Review related attack IDs or techniques when available. Targeting insight: Identify targeted countries, regions, and affected industries linked to the indicator.

Response Highlights

An IoC Enrichment API response can include enriched threat intelligence details such as related references, tags, malware families, adversaries, attack IDs, targeted countries, affected industries, validation data, and available intelligence sections depending on the submitted indicator.

What can you do with this API?

🧩 Enrich URLs, domains, IPs, and hashes with threat intelligence 🔗 Review related references and intelligence sources 🦠 Identify associated malware families and adversaries 🎯 Map indicators to known attack techniques or attack IDs 🌍 Understand targeted countries, regions, and industries 🛡️ Support SOC triage, threat hunting, and investigation workflows

Documentation

What you get

Every successful request returns OSINT context — adversary attributions, malware families, MITRE ATT&CK techniques, targeted industries / countries, and references — collected from community-curated threat intelligence pulses.

{
  "is_success": true,
  "response_code": 200,
  "message": "Success",
  "data": {
    "search_type": "hash",
    "pulse_detail": {
      "indicator": "44d88612fea8a8f36de82e1278abb02f",
      "type": "md5",
      "adversaries": ["WannaCry Ransomware Group", "APT-C-35 (DoNot)"],
      "malware_families": ["Cobalt strike", "Redline", "Emotet"],
      "attack_ids": ["T1071 - Application Layer Protocol", "T1027 - Obfuscated Files or Information"],
      "tags": ["malware", "cobalt-strike", "phishing"],
      "industries": ["Government", "Financial", "Healthcare"],
      "targeted_countries": ["United States of America", "Spain", "Japan"]
    }
  }
}

IP responses additionally carry geolocation (country_code, country_name, city, asn, latitude, longitude).

Endpoints

Endpoint	Use it for
`GET /url`	Enrich a URL with malware-family / adversary / MITRE / reference context.
`GET /hash`	Enrich a file by MD5 / SHA-1 / SHA-256. Returns hash family attribution, MITRE TTPs, file metadata.
`GET /ip`	Enrich an IPv4 address with adversary, malware family, geolocation, and ASN context.
`GET /domain`	Enrich a domain with malware family / adversary / MITRE / targeted-industry context.

All endpoints take a single query parameter and return the same envelope.