Indicators

IPs, domains, hashes, URLs, and emails — extracted from reports and enriched automatically.

List indicators

GET/indicators

Parameter	Type		Description
type	string	opt	Filter by type: ipv4 / ipv6 / domain / hash / url / email
actor	string	opt	Actor UUID or slug (or comma-separated list). Returns indicators linked to this actor, plus indicators from reports that document only this actor or groups attributed to it.
cluster	string	opt	Cluster UUID or slug (or comma-separated list). Same rules as actor.
tool	string	opt	Tool UUID or slug (or comma-separated list).

Get an indicator

GET/indicators/:id

Full indicator detail including all enrichment data. Accepts UUID or IOC value (e.g. /indicators/1.2.3.4).

Enrichment fields

The /indicators/:id response includes enrichment fields that vary by type:

Type	Fields
ipv4 / ipv6	country_code, asn, asn_org, hosting_provider, abuse_confidence, abuse_reports, abuse_categories, greynoise_classification, greynoise_noise, shodan_ports, shodan_vulns, ip_threatfox_malware, ip_threatfox_confidence, ip_threatfox_first_seen, ip_threatfox_threat_type, ip_vt_detections, ip_vt_total, ip_vt_scan_date
domain	registrar, registration_date, expiry_date, nameservers, resolved_ips, domain_vt_detections, domain_vt_total, urlhaus_urls_count, domain_threatfox_malware
hash	vt_detections, vt_total, file_type, algorithm, mb_malware_family, mb_tags, hash_threatfox_malware, known_good, circl_product
hash (continued)	sha256_value, sha1_value, md5_value, vt_threat_label, vt_threat_category
url	url_vt_detections, url_vt_total, urlhaus_status, urlhaus_malware, url_threatfox_malware, phishtank_valid, final_url
email	email_domain, is_free_provider, is_disposable, mx_records

sha256_value, sha1_value, md5_value — companion hashes populated from VirusTotal (all three returned in a single call) with MalwareBazaar as a fallback source. Whichever forms were not already stored are filled in, so submitting any one hash type will also populate the other two.

vt_threat_label — VirusTotal suggested threat label (e.g. trojan.emotet/nanocore). vt_threat_category — top popular threat category (e.g. trojan). Both are null if VirusTotal has no classification for the file.

Re-enrich an indicator

POST/indicators/:id/enrichAuth required

Queues an indicator for immediate re-enrichment. Use this to refresh stale data after enrichment sources change. Returns immediately — enrichment runs asynchronously.

:id accepts either the indicator UUID or the raw IOC value (e.g. /indicators/1.2.3.4/enrich).

On success, returns 202:

{ "message": "Re-enrichment started" }

Limits:

• 24-hour cooldown per indicator.
• Daily cap per account: 5 re-enrichments for Intel Contributors, 20 for other roles.
• 5 requests per 10 minutes per IP address.

Contributors may only re-enrich indicators from their own submissions — attempts on others' indicators return 403. Exceeding the cooldown or a cap returns 429.

Bulk lookup

POST/indicators/bulk-lookup

Looks up many IOC values at once. Body: { "values": ["1.2.3.4", "example.com", ...] }, up to 500 values. Hashes match any of their SHA-256, SHA-1 or MD5 forms.

Returns { results, total, found, not_found }. Each entry in results is either the matching indicator (type, value, first/last seen, enrichment status, and core enrichment fields) or { value, found: false }.