GET /api/v1/iocs — list indicators of compromise

The /api/v1/iocs endpoint returns a paginated list of indicators of compromise from the SOC Defenders feed. You can narrow results by IOC type, confidence level, source category, industry sector, and time range. Use the since parameter for delta polling to retrieve only indicators added after a given timestamp — useful for keeping your SIEM or TIP synchronized without re-fetching the full feed.

Request

Method: GET
URL: https://socdefenders.ai/api/v1/iocs
Auth: Required — Authorization: Bearer sk_live_YOUR_KEY
Tier: Free (up to 100 results per request; Pro raises this to 10,000)

Query parameters

string

Filter by IOC type. One of: ipv4, ipv6, domain, url, md5, sha1, sha256, cve, mitre-attack, email.

string

Filter by confidence level. One of: high, medium, low.

string

Filter by source category. Common values: government, commercial, community.

string

Filter by CISA sector name (e.g. energy, healthcare, financial-services).

string

ISO 8601 timestamp. Returns only IOCs added or updated after this time. Use for delta polling (e.g. 2024-01-01T00:00:00Z).

integer

default:"100"

Maximum number of results to return. Free tier: 100. Pro tier: up to 10,000.

integer

default:"0"

Number of results to skip for pagination. Use with limit to page through large result sets.

Example request

curl -H "Authorization: Bearer sk_live_YOUR_KEY" \
  "https://socdefenders.ai/api/v1/iocs?type=ipv4&confidence=high&limit=100"

Response

{
  "meta": { "total": 1523, "limit": 100, "offset": 0 },
  "data": [
    {
      "type": "ipv4",
      "value": "192.168.1.100",
      "confidence": "high",
      "source": {
        "feed_name": "CISA Alerts",
        "category": "government"
      }
    }
  ]
}

Response fields

object

Pagination metadata for the response.

Show properties

integer

Total number of IOCs matching the applied filters, regardless of limit.

integer

The limit value applied to this response.

integer

The offset value applied to this response.

array

Array of IOC objects matching the query.

Show properties

string

IOC type. One of: ipv4, ipv6, domain, url, md5, sha1, sha256, cve, mitre-attack, email.

string

The indicator value (e.g. an IP address, domain name, or file hash).

string

Feed confidence rating for this indicator: high, medium, or low.

string

Name of the source feed that reported this indicator (e.g. CISA Alerts).

string

Category of the source feed (e.g. government, commercial, community).

Error responses

If your API key is missing or invalid, the API returns a 401 Unauthorized response:

{
  "error": {
    "code": "missing_api_key",
    "message": "API key is required. Include it in the Authorization header as \"Bearer sk_live_...\" or in the X-API-Key header.",
    "request_id": "req_..."
  }
}

See Authentication for the full error code reference.

Overview

IOC Endpoints

Articles Endpoints

TAXII 2.1

IOCs

Statistics

Export Formats

Detection Rules

Lookup

API Keys

TAXII

Articles

GET /api/v1/iocs — list indicators of compromise

Request

Query parameters

Example request

Response

Response fields

Error responses

​Request

​Query parameters

​Example request

​Response

​Response fields

​Error responses

Request

Query parameters

Example request

Response

Response fields

Error responses