curl -H "Authorization: Bearer sk_live_..." \
"https://socdefenders.ai/api/v1/iocs/openioc?since=2026-05-15T00:00:00Z&limit=500" \
-o socdefenders.ioc"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<ioc xmlns=\"http://schemas.mandiant.com/2010/ioc\" id=\"b1c2d3e4-f5a6-7890-abcd-ef1234567890\" last-modified=\"2026-05-17T10:30:00Z\">\n <short_description>SOC Defenders Threat Intelligence Feed</short_description>\n <authored_date>2026-05-17T10:30:00Z</authored_date>\n <authored_by>SOC Defenders</authored_by>\n <criteria>\n <Indicator operator=\"OR\" id=\"indicator-1\">\n <IndicatorItem id=\"item-1\" condition=\"is\">\n <Context document=\"Network\" search=\"Network/DNS\" type=\"mir\"/>\n <Content type=\"string\">c2.example.com</Content>\n </IndicatorItem>\n <IndicatorItem id=\"item-2\" condition=\"is\">\n <Context document=\"FileItem\" search=\"FileItem/Sha256sum\" type=\"mir\"/>\n <Content type=\"string\">e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</Content>\n </IndicatorItem>\n </Indicator>\n </criteria>\n</ioc>"Generates an OpenIOC 1.0 XML document — the format Mandiant introduced and still used by FireEye HX, several EDR products, and some commercial threat intel tools.
<ioc>
<metadata>...</metadata>
<criteria>
<Indicator operator="OR">
<IndicatorItem condition="is"><Context type="mir" search="Network/DNS"/><Content type="string">malicious.com</Content></IndicatorItem>
...
</Indicator>
</criteria>
</ioc>
stix-shifter translate openioc query ...Requires the Pro plan (read:openioc scope).
curl -H "Authorization: Bearer sk_live_..." \
"https://socdefenders.ai/api/v1/iocs/openioc?since=2026-05-15T00:00:00Z&limit=500" \
-o socdefenders.ioc"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<ioc xmlns=\"http://schemas.mandiant.com/2010/ioc\" id=\"b1c2d3e4-f5a6-7890-abcd-ef1234567890\" last-modified=\"2026-05-17T10:30:00Z\">\n <short_description>SOC Defenders Threat Intelligence Feed</short_description>\n <authored_date>2026-05-17T10:30:00Z</authored_date>\n <authored_by>SOC Defenders</authored_by>\n <criteria>\n <Indicator operator=\"OR\" id=\"indicator-1\">\n <IndicatorItem id=\"item-1\" condition=\"is\">\n <Context document=\"Network\" search=\"Network/DNS\" type=\"mir\"/>\n <Content type=\"string\">c2.example.com</Content>\n </IndicatorItem>\n <IndicatorItem id=\"item-2\" condition=\"is\">\n <Context document=\"FileItem\" search=\"FileItem/Sha256sum\" type=\"mir\"/>\n <Content type=\"string\">e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</Content>\n </IndicatorItem>\n </Indicator>\n </criteria>\n</ioc>"Documentation Index
Fetch the complete documentation index at: https://docs.socdefenders.ai/llms.txt
Use this file to discover all available pages before exploring further.
API key in X-API-Key header
Lower time bound (ISO 8601). Clamped to your tier lookback.
"2026-05-15T00:00:00Z"
Max indicators in the document. Tier-capped.
500
OpenIOC 1.0 XML document
The response is of type string.