Indicators
IPs, domains, hashes, URLs, and emails — extracted from reports and enriched automatically.
List indicators
GET/indicators
| Parameter | Type | Description | |
|---|---|---|---|
type | string | opt | Filter by type: ipv4 / ipv6 / domain / hash / url / email |
actor | string | opt | Actor UUID (or comma-separated list). Returns indicators attributed to this actor. |
cluster | string | opt | Cluster UUID (or comma-separated list). |
tool | string | opt | Tool UUID (or comma-separated list). |
Get an indicator
GET/indicators/:id
Full indicator detail including all enrichment data. Accepts UUID or IOC value (e.g.
/indicators/1.2.3.4).Enrichment fields
The /indicators/:id response includes enrichment fields that vary by type:
| Type | Fields |
|---|---|
| ipv4 / ipv6 | country_code, asn, asn_org, hosting_provider, abuse_confidence, abuse_reports, abuse_categories, greynoise_classification, greynoise_noise, shodan_ports, shodan_vulns, threatfox_malware, threatfox_confidence, threatfox_first_seen, threatfox_threat_type, ip_vt_detections, ip_vt_total, ip_vt_scan_date |
| domain | registrar, registration_date, expiry_date, nameservers, resolved_ips, domain_vt_detections, domain_vt_total, urlhaus_urls_count, domain_threatfox_malware |
| hash | vt_detections, vt_total, file_type, algorithm, mb_malware_family, mb_tags, known_good, circl_product |
| hash (continued) | sha256_value, sha1_value, md5_value, vt_threat_label, vt_threat_category |
| url | url_vt_detections, url_vt_total, urlhaus_status, urlhaus_malware, phishtank_valid, final_url |
email_domain, is_free_provider, is_disposable, mx_records |
sha256_value, sha1_value, md5_value — companion hashes populated from VirusTotal (all three returned in a single call) with MalwareBazaar as a fallback source. Whichever forms were not already stored are filled in, so submitting any one hash type will also populate the other two.
vt_threat_label — VirusTotal suggested threat label (e.g. trojan.emotet/nanocore). vt_threat_category — top popular threat category (e.g. trojan). Both are null if VirusTotal has no classification for the file.
Re-enrich an indicator
POST/indicators/:id/enrichAuth required
Queues an indicator for immediate re-enrichment. Use this to refresh stale data after enrichment sources change. Returns immediately — enrichment runs asynchronously.
:id accepts either the indicator UUID or the raw IOC value (e.g. /indicators/1.2.3.4/enrich).
On success, returns 202:
json
{ "message": "Re-enrichment started" }Rate limits:
| Role | Per-indicator cooldown | Daily cap |
|---|---|---|
| contributor | 24 hours | 5 |
| analyst | 24 hours | 20 |
| admin | 24 hours | 20 |
| master | None | Unlimited |
Contributors may only re-enrich indicators from their own submissions — attempts on others' indicators return 403. Exceeding the cooldown or daily cap returns 429.