Threat Intel V2

核心功能：聚合多源公开及专有威胁情报，对IP、域名、文件哈希等IoC进行归一化、关联分析，输出信誉分、威胁等级、关联恶意软件、地理位置等丰富上下文。典型场景：适用于SOC分析师、威胁猎手快速验证可疑对象，助力SOC、MSSP等团队缩短调查时间、提升准确性。输入为指定类型的IoC字符串，输出为结构化JSON格式的详细威胁数据。

krishnakumarmahadevan-cmd

热度 47.59

最近更新 2026-05-11 17:34:32

分类：安全依赖：第三方 API应用场景：数据处理 / 研究 / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add threat-intel-v2

Metadata

name: Threat Intelligence Aggregator
description: Aggregates and analyzes open-source intelligence (OSINT) data from multiple sources to identify threats, validate indicators, and enrich security investigations.

Overview

The Threat Intelligence Aggregator is a security-focused API that collects, normalizes, and correlates open-source intelligence (OSINT) data across public and proprietary threat feeds. It enables security teams to rapidly enrich indicators of compromise (IoCs)—including IP addresses, domains, file hashes, and email addresses—with contextual threat intelligence, reputation scores, and historical breach data.

This tool is essential for SOC analysts, threat hunters, and incident responders who need rapid validation of suspicious artifacts during investigations. By querying a unified aggregation layer rather than consulting dozens of separate feeds, teams reduce investigation time, improve accuracy, and maintain consistent threat scoring across the organization.

The API is ideal for security operations centers (SOCs), managed security service providers (MSSPs), threat intelligence platforms (TIPs), and enterprise security teams building custom detection and response workflows.

Usage

Sample Request

{
  "input": "192.168.1.100"
}

Sample Response

{
  "indicator": "192.168.1.100",
  "indicator_type": "ipv4",
  "reputation_score": 72,
  "threat_level": "high",
  "sources": [
    {
      "name": "AbuseIPDB",
      "reports": 145,
      "last_seen": "2024-01-15T09:32:00Z"
    },
    {
      "name": "Shodan",
      "services": ["SSH", "HTTP"],
      "last_scanned": "2024-01-14T18:20:00Z"
    }
  ],
  "associated_malware": [
    "Emotet",
    "Trickbot"
  ],
  "geolocation": {
    "country": "RU",
    "city": "Moscow",
    "asn": "AS8452"
  },
  "whois_data": {
    "registrar": "RIPE NCC",
    "registered": "2015-03-22"
  },
  "confidence": 0.89,
  "last_updated": "2024-01-15T10:45:00Z"
}

Endpoints

POST /osint-lookup

Description: Performs open-source intelligence lookup on a provided indicator. Aggregates threat data from multiple sources and returns enriched threat intelligence including reputation scores, geolocation, associated malware, and source attribution.

Request Parameters:

Parameter	Type	Required	Description
`input`	string	Yes	The indicator to query. Supports IPv4/IPv6 addresses, fully qualified domain names (FQDNs), email addresses, file hashes (MD5, SHA-1, SHA-256), and URLs.

Response Schema (200 OK):

{
  "indicator": "string",
  "indicator_type": "string",
  "reputation_score": "number",
  "threat_level": "string",
  "sources": [
    {
      "name": "string",
      "reports": "integer",
      "last_seen": "string (ISO 8601)"
    }
  ],
  "associated_malware": ["string"],
  "geolocation": {
    "country": "string",
    "city": "string",
    "asn": "string"
  },
  "whois_data": {
    "registrar": "string",
    "registered": "string"
  },
  "confidence": "number",
  "last_updated": "string (ISO 8601)"
}

Error Response (422 Validation Error):

{
  "detail": [
    {
      "loc": ["body", "input"],
      "msg": "field required",
      "type": "value_error.missing"
    }
  ]
}

Pricing

Plan	Calls/Day	Calls/Month	Price
Free	5	50	Free
Developer	20	500	$39/mo
Professional	200	5,000	$99/mo
Enterprise	100,000	1,000,000	$299/mo

About

ToolWeb.in — 200+ security APIs, CISSP & CISM, platforms: Pay-per-run, API Gateway, MCP Server, OpenClaw, RapidAPI, YouTube.

References

Kong Route: https://api.mkkpro.com/security/threat-intel-v2
API Docs: https://api.mkkpro.com:8011/docs