Skip to main content
GET
/
api
/
v1
/
iocs
/
misp
Download a MISP event
curl -H "Authorization: Bearer sk_live_..." \
  "https://socdefenders.ai/api/v1/iocs/misp?since=2026-05-15T00:00:00Z&limit=500" \
  -o socdefenders-misp.json
{
  "Event": {
    "uuid": "00000000-0000-4000-8000-000000000001",
    "info": "SOC Defenders IOCs — 2026-05-15 to 2026-05-17",
    "threat_level_id": "2",
    "analysis": "2",
    "distribution": "3",
    "Attribute": [
      {
        "type": "ip-src",
        "category": "Network activity",
        "value": "192.168.1.1",
        "to_ids": true,
        "comment": "C2 IP from \"New botnet observed beaconing\""
      },
      {
        "type": "domain",
        "category": "Network activity",
        "value": "c2.example.com",
        "to_ids": true,
        "comment": "C2 domain from same campaign"
      },
      {
        "type": "sha256",
        "category": "Payload delivery",
        "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "to_ids": true
      }
    ]
  }
}

Documentation Index

Fetch the complete documentation index at: https://docs.socdefenders.ai/llms.txt

Use this file to discover all available pages before exploring further.

Authorizations

​
X-API-Key
string
header
required

API key in X-API-Key header

Query Parameters

​
type
enum<string>

Filter by IOC type

Available options:
ipv4,
ipv6,
domain,
url,
md5,
sha1,
sha256,
sha512,
email,
cve
Example:

"ipv4"

​
since
string<date-time>

Lower time bound (ISO 8601). Clamped to your tier lookback.

Example:

"2026-05-15T00:00:00Z"

​
limit
integer
default:100

Max attributes in the event. Tier-capped.

Example:

500

Response

MISP event JSON

​
Event
object