IOCs

List IOCs (Indicators of Compromise)

The primary IOC export endpoint. Returns indicators of compromise — IPs, domains, URLs, file hashes, email addresses, CVEs, and MITRE ATT&CK technique IDs — extracted from articles and ingested from threat feeds (URLhaus, Feodo Tracker, ThreatFox).

What’s an IOC?

An Indicator of Compromise is a forensic artifact that suggests a system has been compromised. The feed mixes:

Article-extracted IOCs: pulled out of writeups by our extraction pipeline (source.origin: "article")
Feed-sourced IOCs: ingested directly from threat-intel feeds (source.origin: "feed")

Common use cases

1. SIEM block-list ingestion (recent IPs)

GET /api/v1/iocs?type=ipv4&confidence=high&since=2026-05-16T00:00:00Z&format=txt

Returns one IP per line — perfect for piping into a firewall block-list.

2. Hash IOCs for EDR detection

GET /api/v1/iocs?type=sha256&confidence=high&limit=1000

3. APT-tagged IOCs for threat hunting

GET /api/v1/iocs?industry=finance&since=2026-05-01T00:00:00Z&limit=500

4. CSV export for spreadsheet analysis

GET /api/v1/iocs?type=domain&format=csv&limit=1000

Output formats

json (default): structured response with metadata + pagination
csv: 10-column CSV — id, type, value, confidence, first_seen, last_seen, source_article, source_feed, category, tags
txt: bare IOC values one per line — for direct firewall/EDR ingestion

Tier behavior

Tier	Per request	Lookback	Formats
Free	100	1 day	json only
Pro	10,000	365 days	json, csv, txt

Pagination

Standard offset + limit. For walks past ~1k offsets, use the Articles endpoint pattern (cursor) or narrow your time window.

GET

api

iocs

curl -H "Authorization: Bearer sk_live_..." \
  "https://socdefenders.ai/api/v1/iocs?type=ipv4&confidence=high&since=2026-05-16T00:00:00Z&limit=500"

{
  "meta": {
    "total": 1523,
    "limit": 100,
    "offset": 0,
    "generated_at": "2024-12-09T10:30:00Z",
    "feed_version": "1.0",
    "source": "SOC Defenders",
    "filters": {
      "type": "all",
      "category": "all",
      "confidence": "all",
      "since": "2024-12-08T00:00:00Z",
      "until": "2024-12-09T10:30:00Z"
    }
  },
  "data": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "type": "ipv4",
      "value": "192.168.1.1",
      "confidence": "high",
      "first_seen": "2024-12-08T14:30:00Z",
      "last_seen": "2024-12-09T08:15:00Z",
      "source": {
        "article_id": "abc123",
        "article_title": "New APT Campaign Targeting Financial Sector",
        "article_url": "https://socdefenders.ai/item/abc123",
        "feed_name": "Krebs on Security",
        "category": "news"
      },
      "context": "C2 server used in APT28 campaign",
      "tags": [
        "apt28",
        "c2",
        "financial"
      ],
      "mitre_techniques": [
        "T1071",
        "T1059"
      ]
    }
  ],
  "links": {
    "self": "https://socdefenders.ai/api/v1/iocs?limit=100&offset=0",
    "next": "https://socdefenders.ai/api/v1/iocs?limit=100&offset=100"
  }
}

{
  "error": {
    "code": "invalid_parameter",
    "message": "Invalid IOC type: invalid",
    "details": {
      "valid_types": [
        "ipv4",
        "ipv6",
        "domain",
        "url",
        "md5",
        "sha1",
        "sha256"
      ]
    },
    "request_id": "req_abc123"
  }
}

{
  "error": {
    "code": "missing_api_key",
    "message": "API key is required. Include it in the Authorization header as \"Bearer sk_live_...\"",
    "request_id": "req_abc123"
  }
}

{
  "error": {
    "code": "insufficient_scope",
    "message": "This endpoint requires the \"read:stix\" scope",
    "details": {
      "required_scope": "read:stix",
      "your_scopes": [
        "read:iocs"
      ],
      "upgrade_url": "https://socdefenders.ai/export#pricing"
    },
    "request_id": "req_abc123"
  }
}

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded. Please wait before making more requests.",
    "details": {
      "limit": 10,
      "reset_at": "2024-12-09T10:31:00Z",
      "tier": "free",
      "upgrade_url": "https://socdefenders.ai/export#pricing"
    },
    "request_id": "req_abc123"
  }
}

{
  "error": {
    "code": "internal_error",
    "message": "An internal error occurred. Please try again later.",
    "request_id": "req_abc123"
  }
}

Authorizations

X-API-Key

string

header

required

API key in X-API-Key header

Query Parameters

type

enum<string>

Filter by IOC type. Common: ipv4, domain, sha256. Less common: email, cve (use /api/v1/articles?cve_text_search= for CVE search), mitre_attack (technique IDs).

Available options:

ipv4,

ipv6,

domain,

url,

md5,

sha1,

sha256,

sha512,

email,

cve,

mitre_attack

Example:

"ipv4"

Response

Successful response

meta

object

Show child attributes

data

object[]

Show child attributes

links

object

Show child attributes

curl -H "Authorization: Bearer sk_live_..." \
  "https://socdefenders.ai/api/v1/iocs?type=ipv4&confidence=high&since=2026-05-16T00:00:00Z&limit=500"

{
  "meta": {
    "total": 1523,
    "limit": 100,
    "offset": 0,
    "generated_at": "2024-12-09T10:30:00Z",
    "feed_version": "1.0",
    "source": "SOC Defenders",
    "filters": {
      "type": "all",
      "category": "all",
      "confidence": "all",
      "since": "2024-12-08T00:00:00Z",
      "until": "2024-12-09T10:30:00Z"
    }
  },
  "data": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "type": "ipv4",
      "value": "192.168.1.1",
      "confidence": "high",
      "first_seen": "2024-12-08T14:30:00Z",
      "last_seen": "2024-12-09T08:15:00Z",
      "source": {
        "article_id": "abc123",
        "article_title": "New APT Campaign Targeting Financial Sector",
        "article_url": "https://socdefenders.ai/item/abc123",
        "feed_name": "Krebs on Security",
        "category": "news"
      },
      "context": "C2 server used in APT28 campaign",
      "tags": [
        "apt28",
        "c2",
        "financial"
      ],
      "mitre_techniques": [
        "T1071",
        "T1059"
      ]
    }
  ],
  "links": {
    "self": "https://socdefenders.ai/api/v1/iocs?limit=100&offset=0",
    "next": "https://socdefenders.ai/api/v1/iocs?limit=100&offset=100"
  }
}

{
  "error": {
    "code": "invalid_parameter",
    "message": "Invalid IOC type: invalid",
    "details": {
      "valid_types": [
        "ipv4",
        "ipv6",
        "domain",
        "url",
        "md5",
        "sha1",
        "sha256"
      ]
    },
    "request_id": "req_abc123"
  }
}

{
  "error": {
    "code": "missing_api_key",
    "message": "API key is required. Include it in the Authorization header as \"Bearer sk_live_...\"",
    "request_id": "req_abc123"
  }
}

{
  "error": {
    "code": "insufficient_scope",
    "message": "This endpoint requires the \"read:stix\" scope",
    "details": {
      "required_scope": "read:stix",
      "your_scopes": [
        "read:iocs"
      ],
      "upgrade_url": "https://socdefenders.ai/export#pricing"
    },
    "request_id": "req_abc123"
  }
}

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded. Please wait before making more requests.",
    "details": {
      "limit": 10,
      "reset_at": "2024-12-09T10:31:00Z",
      "tier": "free",
      "upgrade_url": "https://socdefenders.ai/export#pricing"
    },
    "request_id": "req_abc123"
  }
}

{
  "error": {
    "code": "internal_error",
    "message": "An internal error occurred. Please try again later.",
    "request_id": "req_abc123"
  }
}

Overview

IOC Endpoints

Articles Endpoints

TAXII 2.1

IOCs

Statistics

Export Formats

Detection Rules

Lookup

API Keys

TAXII

Articles

List IOCs (Indicators of Compromise)

What’s an IOC?

Common use cases

1. SIEM block-list ingestion (recent IPs)

2. Hash IOCs for EDR detection

3. APT-tagged IOCs for threat hunting

4. CSV export for spreadsheet analysis

Output formats

Tier behavior

Pagination

Authorizations

Query Parameters

Response