GET /api/v1/articles/{id} — single article with expansions

Fetching an article by its ID returns the full record including all enrichment expansions computed by the SOC Defenders platform: extracted indicators of compromise, referenced CVEs, attributed threat actors, and mapped MITRE ATT&CK techniques. An AI-generated summary is also included. This endpoint is available on the Free tier.

Endpoint

Method: GET https://socdefenders.ai/api/v1/articles/{id} Authentication: Required — pass your API key in the Authorization header as a Bearer token. Tier: Free.

Path parameters

string

required

The UUID of the article. You can obtain article IDs from the list endpoint at GET /api/v1/articles.

Example request

curl -H "Authorization: Bearer sk_live_YOUR_KEY" \
  "https://socdefenders.ai/api/v1/articles/d0d2789a-cf57-4bfc-aaa5-cf9111a08f1c"

Example response

{
  "id": "d0d2789a-cf57-4bfc-aaa5-cf9111a08f1c",
  "title": "Example Security Article",
  "url": "https://example.com/article",
  "source": "bleepingcomputer.com",
  "published_at": "2024-01-15T10:00:00Z",
  "summary": "AI-generated summary of the article content.",
  "categories": ["vulnerabilities"],
  "severity": "high",
  "tags": ["#vulnerability", "#exploit"],
  "iocs": [
    { "type": "ipv4", "value": "192.0.2.1" },
    { "type": "domain", "value": "evil.example.com" }
  ],
  "cves": ["CVE-2024-1234"],
  "threat_actors": ["APT28"],
  "mitre_techniques": [
    { "id": "T1566", "name": "Phishing" }
  ],
  "points": 3,
  "comment_count": 2
}

Response fields

string

Unique article UUID.

string

Article title as published by the source.

string

Canonical URL of the original article.

string

Domain of the publishing source, for example bleepingcomputer.com or cisa.gov.

string

ISO 8601 timestamp of when the article was published by the source.

string

AI-generated plain-text summary of the article content. Useful for triage without reading the full source.

string[]

Array of category labels, for example ["vulnerabilities", "ransomware"].

string

Assessed severity level: critical, high, medium, or low.

string[]

Array of extracted hashtag-style tags.

object[]

Array of indicators of compromise extracted from the article. Each object contains a type (e.g. ipv4, domain, md5, sha256, url) and a value string.

Show properties

string

IOC type. Possible values: ipv4, ipv6, domain, url, md5, sha1, sha256, email, cve.

string

The raw indicator value, for example an IP address string or domain name.

string[]

Array of CVE identifiers referenced in the article, for example ["CVE-2024-1234"].

string[]

Array of threat actor names attributed to or mentioned in the article, for example ["APT28", "Lazarus Group"].

object[]

Array of MITRE ATT&CK techniques mapped to the article content.

Show properties

string

MITRE ATT&CK technique ID, for example T1566.

string

Human-readable technique name, for example Phishing.

integer

Relevance or engagement score assigned to the article by the platform.

integer

Number of community comments on the article within the SOC Defenders platform.

Overview

IOC Endpoints

Articles Endpoints

TAXII 2.1

IOCs

Statistics

Export Formats

Detection Rules

Lookup

API Keys

TAXII

Articles

GET /api/v1/articles/{id} — single article with expansions

Endpoint

Path parameters

Example request

Example response

Response fields

​Endpoint

​Path parameters

​Example request

​Example response

​Response fields

Endpoint

Path parameters

Example request

Example response

Response fields