> ## Documentation Index
> Fetch the complete documentation index at: https://docs.socdefenders.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Export IOCs as Mandiant OpenIOC 1.0 XML

> Generates an [OpenIOC 1.0](https://github.com/mandiant/OpenIOC_1.0) XML document — the format Mandiant introduced and still used by FireEye HX, several EDR products, and some commercial threat intel tools.

## Output structure

```xml
<ioc>
  <metadata>...</metadata>
  <criteria>
    <Indicator operator="OR">
      <IndicatorItem condition="is"><Context type="mir" search="Network/DNS"/><Content type="string">malicious.com</Content></IndicatorItem>
      ...
    </Indicator>
  </criteria>
</ioc>
```

## Import targets

- **Mandiant HX**: Configuration → Indicators → Import OpenIOC
- **FireEye products**: Same UI path
- **Stix-shifter**: `stix-shifter translate openioc query ...`

Requires the **Pro plan** (`read:openioc` scope).



## OpenAPI

````yaml https://socdefenders.ai/api/openapi.json get /api/v1/iocs/openioc
openapi: 3.0.3
info:
  title: SOC Defenders Threat Intelligence API
  description: >-
    # Overview


    The SOC Defenders Threat Intelligence API provides programmatic access to
    aggregated threat intelligence from 30+ cybersecurity sources. Export IOCs
    (Indicators of Compromise) in various formats including JSON, CSV, STIX 2.1,
    MISP, CEF, and OpenIOC.


    ## Authentication


    All API endpoints require authentication using an API key. Include your key
    in one of these ways:


    - **Authorization Header** (recommended): `Authorization: Bearer
    sk_live_xxx`

    - **X-API-Key Header**: `X-API-Key: sk_live_xxx`

    - **Query Parameter**: `?api_key=sk_live_xxx`


    ## Rate Limiting


    Rate limits vary by tier. When limits are exceeded, the API returns a 429
    status code.


    | Tier | Requests/min | Requests/day | Lookback | Formats |

    |------|-------------|--------------|----------|---------|

    | Free | 10 | 1,000 | 1 day | JSON / CSV |

    | Pro ($299/mo) | 1,000 | 1,000,000 | 365 days | All (STIX, TAXII, MISP,
    CEF, OpenIOC, Sigma) |


    Rate limit headers are included in all responses:

    - `X-RateLimit-Limit`: Maximum requests per minute

    - `X-RateLimit-Remaining`: Requests remaining in current window

    - `X-RateLimit-Reset`: Unix timestamp when the limit resets


    ## Error Handling


    All errors follow a consistent format:


    ```json

    {
      "error": {
        "code": "error_code",
        "message": "Human readable message",
        "details": {},
        "request_id": "req_abc123"
      }
    }

    ```


    ## STIX/TAXII Support


    For STIX 2.1 and TAXII 2.1 integration, see the TAXII endpoints section.
    TAXII endpoints are available at `/api/taxii2/`.
  version: 1.0.0
  contact:
    name: SOC Defenders Support
    url: https://socdefenders.ai/contact
    email: support@socdefenders.ai
  license:
    name: Proprietary
    url: https://socdefenders.ai/terms
servers:
  - url: https://socdefenders.ai
    description: Production server
security: []
tags:
  - name: IOCs
    description: Indicators of Compromise endpoints
  - name: Statistics
    description: Feed and IOC statistics
  - name: API Keys
    description: API key management (requires session auth)
  - name: TAXII
    description: TAXII 2.1 threat intelligence sharing endpoints
  - name: Export Formats
    description: Specialized export format endpoints (MISP, CEF, OpenIOC)
  - name: Articles
    description: >-
      Aggregated news articles from 30+ cybersecurity sources, with rich
      filtering and bulk-export support
  - name: Lookup
    description: >-
      Single-IOC enrichment lookup. Auto-detects type, aggregates reporting
      sources, returns AI risk + MITRE techniques + hunting queries. Free-tier
      friendly.
  - name: Detection Rules
    description: >-
      Generate ready-to-deploy SIEM detection rules from recent IOCs. Sigma
      rules ship as multi-document YAML covering network / DNS / proxy /
      process_creation logsources.
paths:
  /api/v1/iocs/openioc:
    get:
      tags:
        - Export Formats
      summary: Export IOCs as Mandiant OpenIOC 1.0 XML
      description: >-
        Generates an [OpenIOC 1.0](https://github.com/mandiant/OpenIOC_1.0) XML
        document — the format Mandiant introduced and still used by FireEye HX,
        several EDR products, and some commercial threat intel tools.


        ## Output structure


        ```xml

        <ioc>
          <metadata>...</metadata>
          <criteria>
            <Indicator operator="OR">
              <IndicatorItem condition="is"><Context type="mir" search="Network/DNS"/><Content type="string">malicious.com</Content></IndicatorItem>
              ...
            </Indicator>
          </criteria>
        </ioc>

        ```


        ## Import targets


        - **Mandiant HX**: Configuration → Indicators → Import OpenIOC

        - **FireEye products**: Same UI path

        - **Stix-shifter**: `stix-shifter translate openioc query ...`


        Requires the **Pro plan** (`read:openioc` scope).
      operationId: exportOpenIOC
      parameters:
        - name: since
          in: query
          description: Lower time bound (ISO 8601). Clamped to your tier lookback.
          schema:
            type: string
            format: date-time
            example: '2026-05-15T00:00:00Z'
        - name: limit
          in: query
          description: Max indicators in the document. Tier-capped.
          schema:
            type: integer
            default: 100
            example: 500
      responses:
        '200':
          description: OpenIOC 1.0 XML document
          content:
            application/xml:
              schema:
                type: string
              example: >-
                <?xml version="1.0" encoding="UTF-8"?>

                <ioc xmlns="http://schemas.mandiant.com/2010/ioc"
                id="b1c2d3e4-f5a6-7890-abcd-ef1234567890"
                last-modified="2026-05-17T10:30:00Z">
                  <short_description>SOC Defenders Threat Intelligence Feed</short_description>
                  <authored_date>2026-05-17T10:30:00Z</authored_date>
                  <authored_by>SOC Defenders</authored_by>
                  <criteria>
                    <Indicator operator="OR" id="indicator-1">
                      <IndicatorItem id="item-1" condition="is">
                        <Context document="Network" search="Network/DNS" type="mir"/>
                        <Content type="string">c2.example.com</Content>
                      </IndicatorItem>
                      <IndicatorItem id="item-2" condition="is">
                        <Context document="FileItem" search="FileItem/Sha256sum" type="mir"/>
                        <Content type="string">e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</Content>
                      </IndicatorItem>
                    </Indicator>
                  </criteria>
                </ioc>
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/RateLimitExceeded'
      security:
        - ApiKeyAuth: []
        - BearerAuth: []
      x-codeSamples:
        - lang: cURL
          label: Export as OpenIOC
          source: |-
            curl -H "Authorization: Bearer sk_live_..." \
              "https://socdefenders.ai/api/v1/iocs/openioc?since=2026-05-15T00:00:00Z&limit=500" \
              -o socdefenders.ioc
components:
  responses:
    Unauthorized:
      description: Authentication required or invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: missing_api_key
              message: >-
                API key is required. Include it in the Authorization header as
                "Bearer sk_live_..."
              request_id: req_abc123
    Forbidden:
      description: Insufficient permissions or scope
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: insufficient_scope
              message: This endpoint requires the "read:stix" scope
              details:
                required_scope: read:stix
                your_scopes:
                  - read:iocs
                upgrade_url: https://socdefenders.ai/export#pricing
              request_id: req_abc123
    RateLimitExceeded:
      description: Rate limit exceeded
      headers:
        Retry-After:
          description: Seconds to wait before retrying
          schema:
            type: integer
        X-RateLimit-Limit:
          description: Rate limit ceiling
          schema:
            type: integer
        X-RateLimit-Remaining:
          description: Remaining requests (will be 0)
          schema:
            type: integer
        X-RateLimit-Reset:
          description: Unix timestamp when limit resets
          schema:
            type: integer
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: rate_limit_exceeded
              message: Rate limit exceeded. Please wait before making more requests.
              details:
                limit: 10
                reset_at: '2024-12-09T10:31:00Z'
                tier: free
                upgrade_url: https://socdefenders.ai/export#pricing
              request_id: req_abc123
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - request_id
          properties:
            code:
              type: string
              description: Error code for programmatic handling
            message:
              type: string
              description: Human-readable error message
            details:
              type: object
              description: Additional error details
            request_id:
              type: string
              description: Unique request identifier for support
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: API key in X-API-Key header
    BearerAuth:
      type: http
      scheme: bearer
      description: 'API key in Authorization header: `Authorization: Bearer sk_live_xxx`'

````